Create Interactive Tour

Windows Analysis Report
http://ncxili.cn

Overview

General Information

Sample URL:	http://ncxili.cn
Analysis ID:	1379688
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

HTML body with high number of embedded SVGs detected

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5968 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6576 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2028,i,10866297611403954267,9467830860307508843,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6632 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "http://ncxili.cn MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Boot Survival
• Malware Analysis System Evasion

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: http://ncxili.cn/	HTTP Parser: Total embedded SVG size: 1578770
Source: http://ncxili.cn/en	HTTP Parser: Total embedded SVG size: 1578770
Source: http://ncxili.cn/en/gongsijianjie	HTTP Parser: Total embedded SVG size: 1575242

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49760 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49760 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.220.189.216
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.209.36.202
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKAccept-Ranges: bytesCache-Control: max-age=31536000Content-Encoding: gzipContent-Length: 227Content-Type: text/javascriptDate: Tue, 23 Jan 2024 16:37:55 GMTEtag: "4078521116"Expires: Wed, 22 Jan 2025 16:37:55 GMTLast-Modified: Wed, 25 Nov 2015 07:47:55 GMTP3p: CP=" OTI DSP COR IVA OUR IND COM "Server: apacheSet-Cookie: BAIDUID=0F2CB549CC23336D166065FF852C12CF:FG=1; max-age=31536000; expires=Wed, 22-Jan-25 16:37:55 GMT; domain=.baidu.com; path=/; version=1Vary: Accept-EncodingData Raw: 1f 8b 08 00 00 00 00 00 00 03 65 8f c1 6a c3 30 10 44 7f 25 f1 c1 48 d8 5e f5 da 08 61 42 4f b9 16 72 69 14 8a 2a af 6d 41 2c 99 95 1c 43 db fc 7b ed 9a 9e 7a 59 98 81 79 8f dd b7 93 b7 c9 05 cf f8 d7 dd d0 0e 95 60 97 3e a5 f1 7b 3d f1 7a d0 42 8b 8b a9 3e 8f d5 db 53 f5 ac df 35 5c 0b 0d 1f c6 35 93 06 1b 06 2e 3a 57 92 9a 9d 6f c2 0c b7 60 cd 4a 83 9e b0 2d 83 6a 82 9d 06 f4 09 96 88 44 48 d2 b5 6c 8f 90 30 26 46 7c 73 7a 95 09 61 46 07 b1 37 84 1b 7b 45 8b 08 9d 6b 33 19 6a e6 0b 95 d5 a4 b2 02 bd 0d 0d 9e 5f 4f 2f 61 18 83 5f d0 ec 9f 83 97 94 e7 bf 93 fc b6 4c 16 cd e1 af a8 b7 42 ae da a4 3c ce bb d3 60 3a 94 09 22 59 e5 1f 0f b6 3d c2 e5 0f 97 51 90 77 19 01 00 00 Data Ascii: ej0D%H^aBOri*mA,C{zYy`>{=zB>S5\5.:Wo`J-jDHl0&F\|szaF7{Ek3j_O/a_LB<`:"Y=Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKAccept-Ranges: bytesCache-Control: max-age=31536000Content-Encoding: gzipContent-Length: 227Content-Type: text/javascriptDate: Tue, 23 Jan 2024 16:37:55 GMTEtag: "4078521116"Expires: Wed, 22 Jan 2025 16:37:55 GMTLast-Modified: Wed, 25 Nov 2015 07:47:55 GMTP3p: CP=" OTI DSP COR IVA OUR IND COM "Server: apacheSet-Cookie: BAIDUID=0F2CB549CC23336D166065FF852C12CF:FG=1; max-age=31536000; expires=Wed, 22-Jan-25 16:37:55 GMT; domain=.baidu.com; path=/; version=1Vary: Accept-EncodingData Raw: 1f 8b 08 00 00 00 00 00 00 03 65 8f c1 6a c3 30 10 44 7f 25 f1 c1 48 d8 5e f5 da 08 61 42 4f b9 16 72 69 14 8a 2a af 6d 41 2c 99 95 1c 43 db fc 7b ed 9a 9e 7a 59 98 81 79 8f dd b7 93 b7 c9 05 cf f8 d7 dd d0 0e 95 60 97 3e a5 f1 7b 3d f1 7a d0 42 8b 8b a9 3e 8f d5 db 53 f5 ac df 35 5c 0b 0d 1f c6 35 93 06 1b 06 2e 3a 57 92 9a 9d 6f c2 0c b7 60 cd 4a 83 9e b0 2d 83 6a 82 9d 06 f4 09 96 88 44 48 d2 b5 6c 8f 90 30 26 46 7c 73 7a 95 09 61 46 07 b1 37 84 1b 7b 45 8b 08 9d 6b 33 19 6a e6 0b 95 d5 a4 b2 02 bd 0d 0d 9e 5f 4f 2f 61 18 83 5f d0 ec 9f 83 97 94 e7 bf 93 fc b6 4c 16 cd e1 af a8 b7 42 ae da a4 3c ce bb d3 60 3a 94 09 22 59 e5 1f 0f b6 3d c2 e5 0f 97 51 90 77 19 01 00 00 Data Ascii: ej0D%H^aBOri*mA,C{zYy`>{=zB>S5\5.:Wo`J-jDHl0&F\|szaF7{Ek3j_O/a_LB<`:"Y=Qw
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKAccept-Ranges: bytesCache-Control: max-age=31536000Content-Encoding: gzipContent-Length: 227Content-Type: text/javascriptDate: Tue, 23 Jan 2024 16:37:55 GMTEtag: "4078521116"Expires: Wed, 22 Jan 2025 16:37:55 GMTLast-Modified: Wed, 25 Nov 2015 07:47:55 GMTP3p: CP=" OTI DSP COR IVA OUR IND COM "Server: apacheSet-Cookie: BAIDUID=0F2CB549CC23336D166065FF852C12CF:FG=1; max-age=31536000; expires=Wed, 22-Jan-25 16:37:55 GMT; domain=.baidu.com; path=/; version=1Vary: Accept-EncodingData Raw: 1f 8b 08 00 00 00 00 00 00 03 65 8f c1 6a c3 30 10 44 7f 25 f1 c1 48 d8 5e f5 da 08 61 42 4f b9 16 72 69 14 8a 2a af 6d 41 2c 99 95 1c 43 db fc 7b ed 9a 9e 7a 59 98 81 79 8f dd b7 93 b7 c9 05 cf f8 d7 dd d0 0e 95 60 97 3e a5 f1 7b 3d f1 7a d0 42 8b 8b a9 3e 8f d5 db 53 f5 ac df 35 5c 0b 0d 1f c6 35 93 06 1b 06 2e 3a 57 92 9a 9d 6f c2 0c b7 60 cd 4a 83 9e b0 2d 83 6a 82 9d 06 f4 09 96 88 44 48 d2 b5 6c 8f 90 30 26 46 7c 73 7a 95 09 61 46 07 b1 37 84 1b 7b 45 8b 08 9d 6b 33 19 6a e6 0b 95 d5 a4 b2 02 bd 0d 0d 9e 5f 4f 2f 61 18 83 5f d0 ec 9f 83 97 94 e7 bf 93 fc b6 4c 16 cd e1 af a8 b7 42 ae da a4 3c ce bb d3 60 3a 94 09 22 59 e5 1f 0f b6 3d c2 e5 0f 97 51 90 77 19 01 00 00 Data Ascii: ej0D%H^aBOri*mA,C{zYy`>{=zB>S5\5.:Wo`J-jDHl0&F\|szaF7{Ek3j_O/a_LB<`:"Y=Qw

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982817348466.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977830622146.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/bootstrap.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/rangeSlider/ion.rangeSlider.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/font-awesome/4.7.0/css/font-awesome.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/animate.css/ltd_4.1.1/animate.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/Swiper/5.4.5/css/swiper.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/jq.pagination/pagination.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/sliderPro/1.5/css/slider-pro.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visual-editor/lib/marquee.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/layer/3.0.1/skin/default/layer.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visual-editor/css/style.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/bootstrap-datepicker/1.8.0/css/bootstrap-datepicker.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/froala-editor/2.9.0/css/froala_editor.pkgd.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/css/frcss.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/photoswipe/4.1.3/css/default-skin.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/photoswipe/4.1.3/css/photoswipe.min.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977830622146.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982817348466.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/element/element.2.15.14.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/nprogress/nprogress.css?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/jquery/3.1.1/jquery.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/rangeSlider/ion.rangeSlider.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/bootstrap/3.3.7/js/bootstrap.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/jquery_lazyload/1.9.7/jquery.lazyload.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/wow/1.1.2/wow.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/Swiper/5.4.5/js/swiper.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/Swiper/5.4.5/js/swiper.animate1.0.3.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/sliderPro/1.5/js/jquery.sliderPro.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/layer/3.0.1/layer.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/laydate/laydate.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visual-editor/lib/marquee.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/bootstrap-datepicker/1.8.0/js/bootstrap-datepicker.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/jq.pagination/jquery.pagination.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/photoswipe/4.1.3/js/photoswipe.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/photoswipe/4.1.3/js/photoswipe-ui-default.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/plupload/plupload.full.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/DPlayer/hls.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/DPlayer/DPlayer.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/countup.js/1.9.3/countUp.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visual-editor/app/components/icon/iconpark.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visual-editor/app/components/icon/iconfont.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/share/js/euv.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/element/element.2.15.14.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/analyst.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /visual-editor/js/page.min.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/nprogress/nprogress.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/jquery.pjax.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/lib/layer/3.0.1/skin/default/layer.css?v=3.0.11110 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/cdn/laydate/theme/default/laydate.css?v=5.0.9 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/esitrevda.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/iframe-resizer/iframeResizer.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /assets/js/wxim.js?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844646439.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844657579.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844646439.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982247006664.png?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844657579.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111782903362.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/qrcode.jpg?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ring.png?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977827191592.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844644774.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844648379.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844652927.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844656715.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844658491.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844648379.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844652927.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844644774.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111782903362.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977827191592.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/ring.png?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/qrcode.jpg?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16983749738446.jpeg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/animate.css/4.1.1/animate.min.css HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844656715.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844658491.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844653606.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111783827772.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/analyst.png?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/wshare.png?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111783826867.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111784593398.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982225651418.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977880251704.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849498852.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849509498.webp HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982247006664.png?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849505403.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849493133.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849492062.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849494984.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849492103.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849493823.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857736365.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857745097.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857746028.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857743931.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16983749738446.jpeg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111783827772.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977844653606.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/analyst.png?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857742221.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/wshare.png?_v=202401231750 HTTP/1.1Host: static.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111784593398.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfile/image/0/4/10/2017-11/15111783826867.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977880251704.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857757889.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977867306691.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bottomlogo.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849509498.webp HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849498852.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849505403.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849493133.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982225651418.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849492062.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849492103.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849494984.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857736365.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857746028.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977849493823.png?imageView2/1/w/720/h/720 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857745097.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857743931.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977867306691.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/bottomlogo.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857742221.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977857757889.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9051 HTTP/1.1Host: ws.ltd.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: http://ncxili.cnSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: 0NGnGJD90Xu3sTTGr3cTkA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.original.js?_=9872 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977901121633.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977901121633.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /abdr?_o=http%3A%2F%2Fncxili.cn HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_bid=cd260375f7920b2490f35719a602edfed864; ab_sr=1.0.1_OTU3MWZmNThkYWFhNWI5OTZiNWZmN2Q0YjQxOWQzY2E3Yzk1ODliOTBiZjY0NjMzNDZlMTljY2QwM2Y4NjExODBiODY3ODUyN2U4MzQ5NTlkM2JkYjJiNTlkYzk5NzhkYWM4MjNjMmQ3OGE5MzU0MDI0NzE4OTY5MTE3YjQxMzVmOTYwMjk0MzBkYzIzM2QyMzg3Zjc2MDBlZTkzOGExMw==; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22l%2F7l%2BP7GUfW4az063AvzuSWGtOX%2FWNFMsnJ0FAkAqfSsfdaK9ZFSy%2FxfxH51KVdxsIdujjFWTQQuC86FKrcl6ImCOrRalHrC0s1JPnwxL1%2BC4Xznx57tjuCBWv9aBmWg7tStMib4KivDJdayqKmjx5yo7Y2bnnWMHbF5e37aXCXQsq3uWlyucqOLRjBioRaRRCabbo%2B9EFqW2AWDXkpMLgLQtKfRfPpnQ7PMvLiV8pgRy5gNKKtnTEtxPH6Q5fSW3bTK8CnmeI0D2zzBLmWYTPfLm1NGPjjK9avVruVd%2FGZWybjt9hDGjNsP5RWDw1XK2OZLA49c0HmfcLW0MgbXBb3AZEltwPaEY%2FwQsz18i49lwOEU9s%2F%2B5nHIGCH7gLRd%2FNXZ3ztKiQ666jdDyufMuNMbAQ1pkwXAdy8%2FmVAfzgsoEY%2BNTdwv4V4z5g0RNgf5CLoN3CUtYcsTFMgJ9tytXR5Ki2%2BDLnsVw%2FrMn6pPXYhYS9cNYBNNT2Ox99y9SGCm8KRqfhc6HsIJuKxdag4KkaYs8jezH81q0mR4weKSU5CPREspPs8IyOhoxQnPHZ1ebK2a6sZg7s7GLDCHutPfeTx3QZ%2BuH27BEuBDlUrZPQYBOs63Th%2FOMBL7MA8yCjVL%2BAf8dexE1mw22LUc53CgUA%3D%3D%22%2C%22key_id%22%3A%22abb45258103e49aa%22%2C%22enc%22%3A2%7D&_=0.8577743671215925 HTTP/1.1Host: miao.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_bid=cd260375f7920b2490f35719a602edfed864; ab_sr=1.0.1_OTU3MWZmNThkYWFhNWI5OTZiNWZmN2Q0YjQxOWQzY2E3Yzk1ODliOTBiZjY0NjMzNDZlMTljY2QwM2Y4NjExODBiODY3ODUyN2U4MzQ5NTlkM2JkYjJiNTlkYzk5NzhkYWM4MjNjMmQ3OGE5MzU0MDI0NzE4OTY5MTE3YjQxMzVmOTYwMjk0MzBkYzIzM2QyMzg3Zjc2MDBlZTkzOGExMw==; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22l%2F7l%2BP7GUfW4az063AvzuSWGtOX%2FWNFMsnJ0FAkAqfSsfdaK9ZFSy%2FxfxH51KVdxsIdujjFWTQQuC86FKrcl6ImCOrRalHrC0s1JPnwxL1%2BC4Xznx57tjuCBWv9aBmWg7tStMib4KivDJdayqKmjx5yo7Y2bnnWMHbF5e37aXCXQsq3uWlyucqOLRjBioRaRRCabbo%2B9EFqW2AWDXkpMLgLQtKfRfPpnQ7PMvLiV8pgRy5gNKKtnTEtxPH6Q5fSW3bTK8CnmeI0D2zzBLmWYTPfLm1NGPjjK9avVruVd%2FGZWybjt9hDGjNsP5RWDw1XK2OZLA49c0HmfcLW0MgbXBb3AZEltwPaEY%2FwQsz18i49lwOEU9s%2F%2B5nHIGCH7gLRd%2FNXZ3ztKiQ666jdDyufMuNMbAQ1pkwXAdy8%2FmVAfzgsoEY%2BNTdwv4V4z5g0RNgf5CLoN3CUtYcsTFMgJ9tytXR5Ki2%2BDLnsVw%2FrMn6pPXYhYS9cNYBNNT2Ox99y9SGCm8KRqfhc6HsIJuKxdag4KkaYs8jezH81q0mR4weKSU5CPREspPs8IyOhoxQnPHZ1ebK2a6sZg7s7GLDCHutPfeTx3QZ%2BuH27BEuBDlUrZPQYBOs63Th%2FOMBL7MA8yCjVL%2BAf8dexE1mw22LUc53CgUA%3D%3D%22%2C%22key_id%22%3A%22abb45258103e49aa%22%2C%22enc%22%3A2%7D&_=0.8577743671215925 HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_bid=cd260375f7920b2490f35719a602edfed864; ab_sr=1.0.1_OTU3MWZmNThkYWFhNWI5OTZiNWZmN2Q0YjQxOWQzY2E3Yzk1ODliOTBiZjY0NjMzNDZlMTljY2QwM2Y4NjExODBiODY3ODUyN2U4MzQ5NTlkM2JkYjJiNTlkYzk5NzhkYWM4MjNjMmQ3OGE5MzU0MDI0NzE4OTY5MTE3YjQxMzVmOTYwMjk0MzBkYzIzM2QyMzg3Zjc2MDBlZTkzOGExMw==; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_sr=1.0.1_OTU3MWZmNThkYWFhNWI5OTZiNWZmN2Q0YjQxOWQzY2E3Yzk1ODliOTBiZjY0NjMzNDZlMTljY2QwM2Y4NjExODBiODY3ODUyN2U4MzQ5NTlkM2JkYjJiNTlkYzk5NzhkYWM4MjNjMmQ3OGE5MzU0MDI0NzE4OTY5MTE3YjQxMzVmOTYwMjk0MzBkYzIzM2QyMzg3Zjc2MDBlZTkzOGExMw==
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.original.js?_=9872 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_sr=1.0.1_OTU3MWZmNThkYWFhNWI5OTZiNWZmN2Q0YjQxOWQzY2E3Yzk1ODliOTBiZjY0NjMzNDZlMTljY2QwM2Y4NjExODBiODY3ODUyN2U4MzQ5NTlkM2JkYjJiNTlkYzk5NzhkYWM4MjNjMmQ3OGE5MzU0MDI0NzE4OTY5MTE3YjQxMzVmOTYwMjk0MzBkYzIzM2QyMzg3Zjc2MDBlZTkzOGExMw==If-None-Match: "65af570f-1bbf5"If-Modified-Since: Tue, 23 Jan 2024 06:05:03 GMT
Source: global traffic	HTTP traffic detected: GET /abdr?_o=http%3A%2F%2Fncxili.cn HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864; ab_bid=260375f7920b2490f35719a602edfed86531; ab_sr=1.0.1_MmZiNTYwNjgyNDc4YTNlYjVkYzMwNzQxNGZjOGVjOTAwYzQ2MzJkMTI4ZDE3MDBjZWRlNThkMTNjZWI4ZTlhMThhZWFkNjFlOGRiYTNlYTM3MWQ4MjhhMzQ0MDNjMjdlMmZhNTg0ZTUyOGVlYzNlOTU0MzkxOTkzYTAyYjMzYmY2MWQ0NmMxOTg1NDNhNzgyMjQyZGU4ODQ2MDAwNjFmOA==
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22l%2F7l%2BP7GUfW4az063AvzuSWGtOX%2FWNFMsnJ0FAkAqfSsfdaK9ZFSy%2FxfxH51KVdxsIdujjFWTQQuC86FKrcl6ImCOrRalHrC0s1JPnwxL18BHtCzt4HaHBgYV53VdHTj%2F22DrMJo5%2BOjRG7u2l8F1XI8VPCoW4wsJSTi1zu7xRC1XWCvn8jjrvOehfcyI9AQ%2FhCPcsn%2FoQQca%2BoazoL%2Fmwhscw%2BPlMrHrKrMlCJ6UK%2Bt9nmeH28bt%2B4NXnnVQSHtG%2BVYd0l5JpllwoN9DAan5AtGlmwFRvJLLPOVqO7YSKJL8Y0dujqme7%2Fnx2X4OoBkL3WoIztqNznJ%2Feo7thcYbpMr7O2r%2FhDa2INlPmDyLp4VuB%2Fvnyitg%2Fo%2Fc%2F7gnvqG42YlUC%2Bj1ACTy7KLZruM6qZZhkY8koQZe9cj%2BvGJJomyYe8sq6DoZHdEiaVZmzjwwaF4cdK7J7eKre1CKNZ1pWIhJihxmcIEh%2FLjY%2FlwIiWwIa3PwMhiSyZsRt3fFuY%2F5cQuPvP7qFAbvP6kHRuAqjqKkabb2IqUDoDOjnsw8Q2UXkadV0OmaH65U3xpiKnOabsxnkD9xMNLEDak%2F9BCRh8NqNk2sagC%2BLpGvc9tWu4%3D%22%2C%22key_id%22%3A%22abb45258103e49aa%22%2C%22enc%22%3A2%7D&_=0.45612722676938544 HTTP/1.1Host: miao.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864; ab_bid=260375f7920b2490f35719a602edfed86531; ab_sr=1.0.1_MmZiNTYwNjgyNDc4YTNlYjVkYzMwNzQxNGZjOGVjOTAwYzQ2MzJkMTI4ZDE3MDBjZWRlNThkMTNjZWI4ZTlhMThhZWFkNjFlOGRiYTNlYTM3MWQ4MjhhMzQ0MDNjMjdlMmZhNTg0ZTUyOGVlYzNlOTU0MzkxOTkzYTAyYjMzYmY2MWQ0NmMxOTg1NDNhNzgyMjQyZGU4ODQ2MDAwNjFmOA==
Source: global traffic	HTTP traffic detected: GET /9051 HTTP/1.1Host: ws.ltd.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: http://ncxili.cnSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: QWZK3sf57HoghX8HrQn1Tg==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977858731371.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874879549.jpg?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874879172.jpg?imageMogr2/thumbnail/720x/crop/!720x539a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874873863.jpg?imageMogr2/thumbnail/720x/crop/!720x540a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874875055.jpg?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874873687.jpg?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /9051 HTTP/1.1Host: ws.ltd.comConnection: UpgradePragma: no-cacheCache-Control: no-cacheUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Upgrade: websocketOrigin: http://ncxili.cnSec-WebSocket-Version: 13Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Sec-WebSocket-Key: 1MEiM564Asiuk8nylKNDHA==Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874871717.jpg?imageMogr2/thumbnail/720x/crop/!720x480a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874876443.jpg?imageMogr2/thumbnail/720x/crop/!720x718a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874874013.jpg?imageView2/1/w/720/h/960 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982240797436.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22l%2F7l%2BP7GUfW4az063AvzuSWGtOX%2FWNFMsnJ0FAkAqfSsfdaK9ZFSy%2FxfxH51KVdxsIdujjFWTQQuC86FKrcl6ImCOrRalHrC0s1JPnwxL18BHtCzt4HaHBgYV53VdHTj%2F22DrMJo5%2BOjRG7u2l8F1XI8VPCoW4wsJSTi1zu7xRC1XWCvn8jjrvOehfcyI9AQ%2FhCPcsn%2FoQQca%2BoazoL%2Fmwhscw%2BPlMrHrKrMlCJ6UK%2Bt9nmeH28bt%2B4NXnnVQSHtG%2BVYd0l5JpllwoN9DAan5AtGlmwFRvJLLPOVqO7YSKJL8Y0dujqme7%2Fnx2X4OoBkL3WoIztqNznJ%2Feo7thcYbpMr7O2r%2FhDa2INlPmDyLp4VuB%2Fvnyitg%2Fo%2Fc%2F7gnvqG42YlUC%2Bj1ACTy7KLZruM6qZZhkY8koQZe9cj%2BvGJJomyYe8sq6DoZHdEiaVZmzjwwaF4cdK7J7eKre1CKNZ1pWIhJihxmcIEh%2FLjY%2FlwIiWwIa3PwMhiSyZsRt3fFuY%2F5cQuPvP7qFAbvP6kHRuAqjqKkabb2IqUDoDOjnsw8Q2UXkadV0OmaH65U3xpiKnOabsxnkD9xMNLEDak%2F9BCRh8NqNk2sagC%2BLpGvc9tWu4%3D%22%2C%22key_id%22%3A%22abb45258103e49aa%22%2C%22enc%22%3A2%7D&_=0.45612722676938544 HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864; ab_bid=260375f7920b2490f35719a602edfed86531; ab_sr=1.0.1_MmZiNTYwNjgyNDc4YTNlYjVkYzMwNzQxNGZjOGVjOTAwYzQ2MzJkMTI4ZDE3MDBjZWRlNThkMTNjZWI4ZTlhMThhZWFkNjFlOGRiYTNlYTM3MWQ4MjhhMzQ0MDNjMjdlMmZhNTg0ZTUyOGVlYzNlOTU0MzkxOTkzYTAyYjMzYmY2MWQ0NmMxOTg1NDNhNzgyMjQyZGU4ODQ2MDAwNjFmOA==
Source: global traffic	HTTP traffic detected: GET /assets/lib/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0 HTTP/1.1Host: static.ltdcdn.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: http://ncxili.cnsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://static.ltdcdn.com/assets/lib/font-awesome/4.7.0/css/font-awesome.min.css?_v=202401231750Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874873863.jpg?imageMogr2/thumbnail/720x/crop/!720x540a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874879172.jpg?imageMogr2/thumbnail/720x/crop/!720x539a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874873687.jpg?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874879549.jpg?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977858731371.png HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874875055.jpg?imageView2/1/w/720/h/540 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_sr=1.0.1_MmZiNTYwNjgyNDc4YTNlYjVkYzMwNzQxNGZjOGVjOTAwYzQ2MzJkMTI4ZDE3MDBjZWRlNThkMTNjZWI4ZTlhMThhZWFkNjFlOGRiYTNlYTM3MWQ4MjhhMzQ0MDNjMjdlMmZhNTg0ZTUyOGVlYzNlOTU0MzkxOTkzYTAyYjMzYmY2MWQ0NmMxOTg1NDNhNzgyMjQyZGU4ODQ2MDAwNjFmOA==
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874874013.jpg?imageView2/1/w/720/h/960 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874876443.jpg?imageMogr2/thumbnail/720x/crop/!720x718a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16982240797436.jpg HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploadfilev2/image/0/515/525/2023-10/16977874871717.jpg?imageMogr2/thumbnail/720x/crop/!720x480a0a0 HTTP/1.1Host: uploadfile.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.original.js?_=9872 HTTP/1.1Host: dlswbr.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_sr=1.0.1_MmZiNTYwNjgyNDc4YTNlYjVkYzMwNzQxNGZjOGVjOTAwYzQ2MzJkMTI4ZDE3MDBjZWRlNThkMTNjZWI4ZTlhMThhZWFkNjFlOGRiYTNlYTM3MWQ4MjhhMzQ0MDNjMjdlMmZhNTg0ZTUyOGVlYzNlOTU0MzkxOTkzYTAyYjMzYmY2MWQ0NmMxOTg1NDNhNzgyMjQyZGU4ODQ2MDAwNjFmOA==If-None-Match: "65af570f-1bbf5"If-Modified-Since: Tue, 23 Jan 2024 06:05:03 GMT
Source: global traffic	HTTP traffic detected: GET /tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000062012771D2 HTTP/1.1Host: clients1.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /abdr?_o=http%3A%2F%2Fncxili.cn HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864; ab_bid=0375f7920b2490f35719a602edfed865318a; ab_sr=1.0.1_NDk4ZjIxODlhNjM1MjYwODU1NzBjMjBiYzg0MDM4MmQ0YmFiNTE3MGI1ZmIwZGVjMWY2MGUwOGI0OGVhZjZhNDhiNDMyZjliOTViMWNhZDY5MGU4ZmVhODQ5ZjA0YzAzYWViMTVhNjU1NjI4NzlhYTA1OTMxODU2MGJmMmNkZTFlY2Y5YWUwOTJjYmM4Yjk2ZjMwOGY3Mzk5MzVkMTU5Zg==
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22l%2F7l%2BP7GUfW4az063AvzuSWGtOX%2FWNFMsnJ0FAkAqfSsfdaK9ZFSy%2FxfxH51KVdxsIdujjFWTQQuC86FKrcl6ImCOrRalHrC0s1JPnwxL1%2BExB8cBSy%2FiWXergNwzPCUDQ9sKPX00oWZcmMVIUY2UWT61devnew%2F8KWnLMuSz5vpiHdXR3orP0yo%2FivkHNLfIWUI4xDKvOfjvHwOOjAUwRtNz%2BpM2hH6afGPMhR9%2BOrVKBiAtJSRfdzhwTS6eStWGQIGdwJJlZuCqytmbFCtsjZYgOlenjDm8ExlwFn%2FzGBU16aVPySLhxYQnqAuYCLHdRdiFeL8iPM1D3XKDz3LkBWDVJWd5j7OXYhVPO%2BkCQbJfSocEKtduMRABIYs%2FjsBaGao9xVPv%2F9c0Fk%2BBArwJqvdMpAn0jQZtxq7OXi5H8GUKPvvCqmIfsY%2BZyukPhp%2BZQ4VAsQ7ME3lQrpn7qrTOE%2F8gk3E9z3ljjR4LtZAw8c27%2BEcsJ6HYeizKWh7CGJyIRERPaVSxljIMKwjbHgTQznLwnH5hUl%2FvN6f0bg5leDZKvFV4vzQMxEQ96vln6CVB8hwaU0xx4tnDhQ7KLypWA%3D%3D%22%2C%22key_id%22%3A%22abb45258103e49aa%22%2C%22enc%22%3A2%7D&_=0.35762146323625466 HTTP/1.1Host: miao.baidu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: http://ncxili.cn/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864; ab_bid=0375f7920b2490f35719a602edfed865318a; ab_sr=1.0.1_NDk4ZjIxODlhNjM1MjYwODU1NzBjMjBiYzg0MDM4MmQ0YmFiNTE3MGI1ZmIwZGVjMWY2MGUwOGI0OGVhZjZhNDhiNDMyZjliOTViMWNhZDY5MGU4ZmVhODQ5ZjA0YzAzYWViMTVhNjU1NjI4NzlhYTA1OTMxODU2MGJmMmNkZTFlY2Y5YWUwOTJjYmM4Yjk2ZjMwOGY3Mzk5MzVkMTU5Zg==
Source: global traffic	HTTP traffic detected: GET /abdr?data=%7B%22data%22%3A%22l%2F7l%2BP7GUfW4az063AvzuSWGtOX%2FWNFMsnJ0FAkAqfSsfdaK9ZFSy%2FxfxH51KVdxsIdujjFWTQQuC86FKrcl6ImCOrRalHrC0s1JPnwxL1%2BExB8cBSy%2FiWXergNwzPCUDQ9sKPX00oWZcmMVIUY2UWT61devnew%2F8KWnLMuSz5vpiHdXR3orP0yo%2FivkHNLfIWUI4xDKvOfjvHwOOjAUwRtNz%2BpM2hH6afGPMhR9%2BOrVKBiAtJSRfdzhwTS6eStWGQIGdwJJlZuCqytmbFCtsjZYgOlenjDm8ExlwFn%2FzGBU16aVPySLhxYQnqAuYCLHdRdiFeL8iPM1D3XKDz3LkBWDVJWd5j7OXYhVPO%2BkCQbJfSocEKtduMRABIYs%2FjsBaGao9xVPv%2F9c0Fk%2BBArwJqvdMpAn0jQZtxq7OXi5H8GUKPvvCqmIfsY%2BZyukPhp%2BZQ4VAsQ7ME3lQrpn7qrTOE%2F8gk3E9z3ljjR4LtZAw8c27%2BEcsJ6HYeizKWh7CGJyIRERPaVSxljIMKwjbHgTQznLwnH5hUl%2FvN6f0bg5leDZKvFV4vzQMxEQ96vln6CVB8hwaU0xx4tnDhQ7KLypWA%3D%3D%22%2C%22key_id%22%3A%22abb45258103e49aa%22%2C%22enc%22%3A2%7D&_=0.35762146323625466 HTTP/1.1Host: miao.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: ab_jid=cd260375f7920b2490f35719a602edfed864; ab_jid_BFESS=cd260375f7920b2490f35719a602edfed864; ab_bid=0375f7920b2490f35719a602edfed865318a; ab_sr=1.0.1_NDk4ZjIxODlhNjM1MjYwODU1NzBjMjBiYzg0MDM4MmQ0YmFiNTE3MGI1ZmIwZGVjMWY2MGUwOGI0OGVhZjZhNDhiNDMyZjliOTViMWNhZDY5MGU4ZmVhODQ5ZjA0YzAzYWViMTVhNjU1NjI4NzlhYTA1OTMxODU2MGJmMmNkZTFlY2Y5YWUwOTJjYmM4Yjk2ZjMwOGY3Mzk5MzVkMTU5Zg==
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: ncxili.cnConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t/font_925836_jkocxsylryr.css HTTP/1.1Host: at.alicdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /open/js/jweixin-1.4.0.js HTTP/1.1Host: res.wx.qq.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api?v=1.0&type=webgl&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getscript?type=webgl&v=1.0&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&services=&t=20240116115527 HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /res/webgl/10/bmap.css HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/css,/;q=0.1Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/ HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /shop/frontend/home/getQywxCs HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /shop/user/me/getProfile HTTP/1.1Host: ncxili.cnConnection: keep-aliveAccept: /lang: enGw-Shop-User-Token: nullX-Requested-With: XMLHttpRequestltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2F HTTP/1.1Host: ncxili.cnConnection: keep-aliveAccept: /lang: enGw-Shop-User-Token: nullX-Requested-With: XMLHttpRequestltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /?qt=verify&v=gl&type=webgl&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&callback=BMapGL.bmapVerifyCbk HTTP/1.1Host: api.map.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/ HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /shop/frontend/home/getQywxCs HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /shop/user/me/getProfile HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2F HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2F&wi=3&ui=0&st=1706027865872&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217374587246&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /push.js HTTP/1.1Host: push.zhanzhang.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2F&wi=3&ui=0&st=1706027865872&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217374587246&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/ HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en HTTP/1.1Host: ncxili.cnConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/enAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen HTTP/1.1Host: ncxili.cnConnection: keep-aliveAccept: /lang: enGw-Shop-User-Token: nullX-Requested-With: XMLHttpRequestltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://ncxili.cn/enAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /shop/frontend/home/getQywxCs HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/enAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /shop/user/me/getProfile HTTP/1.1Host: ncxili.cnConnection: keep-aliveAccept: /lang: enGw-Shop-User-Token: nullX-Requested-With: XMLHttpRequestltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://ncxili.cn/enAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/en HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shop/frontend/home/getQywxCs HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /shop/user/me/getProfile HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/en HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /en/gongsijianjie HTTP/1.1Host: ncxili.cnConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, liData Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en/gongsijianjie HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/en/gongsijianjieAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie HTTP/1.1Host: ncxili.cnConnection: keep-aliveAccept: /lang: enGw-Shop-User-Token: nullX-Requested-With: XMLHttpRequestltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://ncxili.cn/en/gongsijianjieAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /shop/frontend/home/getQywxCs HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/en/gongsijianjieAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /shop/user/me/getProfile HTTP/1.1Host: ncxili.cnConnection: keep-aliveAccept: /lang: enGw-Shop-User-Token: nullX-Requested-With: XMLHttpRequestltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Referer: http://ncxili.cn/en/gongsijianjieAccept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl HTTP/1.1Host: dlswbr.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie&wi=3&ui=0&st=1706027910743&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217383074328&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/en/gongsijianjie HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Referer: http://ncxili.cn/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shop/frontend/home/getQywxCs HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /shop/user/me/getProfile HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en/gongsijianjie HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie&wi=3&ui=0&st=1706027910743&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217383074328&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/Data Raw: Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie HTTP/1.1Host: ncxili.cnConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Source: global traffic	HTTP traffic detected: GET /s.gif?l=http://ncxili.cn/en/gongsijianjie HTTP/1.1Host: api.share.baidu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie&wi=3&ui=0&st=1706027910743&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217383074328&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1Host: api.ltdcdn.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/Data Raw: Data Ascii:

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: chromecache_377.2.dr	String found in binary or memory: http://api.map.baidu.com/getscript?type=webgl&v=1.0&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&services=&t=
Source: chromecache_208.2.dr	String found in binary or memory: http://api.map.baidu.com/marker?location=
Source: chromecache_377.2.dr	String found in binary or memory: http://api.map.baidu.com/res/webgl/10/bmap.css
Source: chromecache_359.2.dr, chromecache_220.2.dr	String found in binary or memory: http://bqworks.com/
Source: chromecache_359.2.dr, chromecache_220.2.dr	String found in binary or memory: http://bqworks.com/slider-pro/
Source: chromecache_252.2.dr	String found in binary or memory: http://fontawesome.io
Source: chromecache_252.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: chromecache_245.2.dr, chromecache_371.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_213.2.dr	String found in binary or memory: http://ionden.com/a/plugins/ion.rangeSlider/en.html
Source: chromecache_213.2.dr	String found in binary or memory: http://ionden.com/a/plugins/licence-en.html
Source: chromecache_281.2.dr	String found in binary or memory: http://layer.layui.com/
Source: chromecache_208.2.dr	String found in binary or memory: http://maps.apple.com/?sll=
Source: chromecache_250.2.dr	String found in binary or memory: http://masscode.ru
Source: chromecache_250.2.dr	String found in binary or memory: http://masscode.ru/index.php/k2/item/44-limarquee
Source: chromecache_213.2.dr	String found in binary or memory: http://my.opera.com/emoller/blog/2011/12/20/requestanimationframe-for-smart-er-animating
Source: chromecache_230.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: chromecache_213.2.dr	String found in binary or memory: http://paulirish.com/2011/requestanimationframe-for-smart-animating/
Source: chromecache_272.2.dr, chromecache_192.2.dr	String found in binary or memory: http://photoswipe.com
Source: chromecache_336.2.dr	String found in binary or memory: http://ricostacruz.com/nprogress
Source: chromecache_254.2.dr	String found in binary or memory: http://stackoverflow.com/a/28210364/1070244
Source: chromecache_217.2.dr, chromecache_345.2.dr	String found in binary or memory: http://swiperjs.com
Source: chromecache_268.2.dr, chromecache_368.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0)
Source: chromecache_234.2.dr, chromecache_241.2.dr	String found in binary or memory: http://www.layui.com/laydate/
Source: chromecache_254.2.dr	String found in binary or memory: http://www.matts411.com/post/internet-explorer-9-oninput/
Source: chromecache_230.2.dr	String found in binary or memory: https://animate.style/
Source: chromecache_307.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=93506
Source: chromecache_210.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css
Source: chromecache_372.2.dr, chromecache_216.2.dr	String found in binary or memory: https://dlswbr.baidu.com/heicha/mw/abclite-
Source: chromecache_254.2.dr	String found in binary or memory: https://flow.org/blog/2017/05/07/Strict-Function-Call-Arity/).
Source: chromecache_347.2.dr, chromecache_275.2.dr	String found in binary or memory: https://froala.com/wysiwyg-editor/terms/
Source: chromecache_213.2.dr	String found in binary or memory: https://github.com/IonDen
Source: chromecache_213.2.dr	String found in binary or memory: https://github.com/IonDen/ion.rangeSlider
Source: chromecache_261.2.dr	String found in binary or memory: https://github.com/Maxiaoxiang/jQuery-plugins
Source: chromecache_306.2.dr	String found in binary or memory: https://github.com/davidjbradshaw/iframe-resizer
Source: chromecache_307.2.dr	String found in binary or memory: https://github.com/defunkt/jquery-pjax
Source: chromecache_254.2.dr	String found in binary or memory: https://github.com/facebook/flow/issues/285
Source: chromecache_254.2.dr	String found in binary or memory: https://github.com/paldepind/snabbdom/blob/master/LICENSE
Source: chromecache_245.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_268.2.dr, chromecache_368.2.dr	String found in binary or memory: https://github.com/uxsolutions/bootstrap-datepicker)
Source: chromecache_254.2.dr	String found in binary or memory: https://github.com/vuejs/vue-devtools
Source: chromecache_254.2.dr	String found in binary or memory: https://github.com/vuejs/vue/pull/7730
Source: chromecache_254.2.dr	String found in binary or memory: https://github.com/vuejs/vuex/issues/1505
Source: chromecache_254.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/dom.html#phrasing-content
Source: chromecache_254.2.dr	String found in binary or memory: https://html.spec.whatwg.org/multipage/indices.html#elements-3
Source: chromecache_315.2.dr	String found in binary or memory: https://static.xcx.gw66.vip/uploadfile/image/0/0/0/2022-03/16461192801861.png
Source: chromecache_254.2.dr	String found in binary or memory: https://vuejs.org/guide/deployment.html
Source: chromecache_254.2.dr	String found in binary or memory: https://vuejs.org/guide/list.html#key
Source: chromecache_254.2.dr	String found in binary or memory: https://vuejs.org/v2/api/#data
Source: chromecache_254.2.dr	String found in binary or memory: https://vuejs.org/v2/guide/components.html#data-Must-Be-a-Function
Source: chromecache_254.2.dr	String found in binary or memory: https://vuejs.org/v2/guide/reactivity.html#Declaring-Reactive-Properties.
Source: chromecache_315.2.dr	String found in binary or memory: https://wei.ltd.com
Source: chromecache_347.2.dr, chromecache_275.2.dr	String found in binary or memory: https://www.froala.com/wysiwyg-editor)

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49901 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 49902 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49933
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49925 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49919
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49902
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 443

Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.220.189.216:443 -> 192.168.2.5:49717 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_5968_491955458

Jump to behavior

Source: classification engine

Classification label: clean2.win@18/196@81/24

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2028,i,10866297611403954267,9467830860307508843,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "http://ncxili.cn
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=2028,i,10866297611403954267,9467830860307508843,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Source: chromecache_199.2.dr

Binary or memory string: VMcii

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Ingress Tool Transfer			Data Destruction	Virtual Private Server	Employee Names

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://ncxili.cn	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://static.ltdcdn.com/assets/js/nprogress/nprogress.css?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/photoswipe/4.1.3/js/photoswipe.min.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/Swiper/5.4.5/css/swiper.min.css?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/element/element.2.15.14.css?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfile/image/0/4/10/2017-11/15111784593398.jpg	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/jquery/3.1.1/jquery.min.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0	0%	Avira URL Cloud	safe
https://ws.ltd.com/9051	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/js/jquery.pjax.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/images/analyst.png?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/plupload/plupload.full.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/wow/1.1.2/wow.min.js?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfile/image/0/4/10/2017-11/15111783826867.jpg	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874879549.jpg?imageView2/1/w/720/h/540	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849509498.webp	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16982247006664.png?imageView2/1/w/720/h/540	0%	Avira URL Cloud	safe
about:blank	0%	Avira URL Cloud	safe
http://api.ltdcdn.com/analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d	0%	Avira URL Cloud	safe
http://ncxili.cn/gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/froala-editor/2.9.0/css/froala_editor.pkgd.min.css?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/visual-editor/lib/marquee.css?_v=202401231750	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/rangeSlider/ion.rangeSlider.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/photoswipe/4.1.3/css/default-skin.min.css?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/bootstrap-datepicker/1.8.0/css/bootstrap-datepicker.css?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849493823.png?imageView2/1/w/720/h/720	0%	Avira URL Cloud	safe
http://masscode.ru/index.php/k2/item/44-limarquee	0%	Avira URL Cloud	safe
http://api.ltdcdn.com/analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2F&wi=3&ui=0&st=1706027865872&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217374587246&gmac=7fa17943-d776-4431-b8d5-09df72778f1d	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/images/qrcode.jpg?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849498852.png?imageView2/1/w/720/h/720	0%	Avira URL Cloud	safe
http://ncxili.cn/shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/js/esitrevda.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/bootstrap-datepicker/1.8.0/js/bootstrap-datepicker.js?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844653606.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/bootstrap/3.3.7/js/bootstrap.min.js?_v=202401231750	0%	Avira URL Cloud	safe
http://ncxili.cn/shop/user/me/getProfile	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849505403.png?imageView2/1/w/720/h/720	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/layer/3.0.1/skin/default/layer.min.css?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16982225651418.jpg	0%	Avira URL Cloud	safe
http://ncxili.cn/gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/css/bootstrap.min.css?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/images/wshare.png?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977830622146.png	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/Swiper/5.4.5/js/swiper.animate1.0.3.min.js?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844656715.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874873863.jpg?imageMogr2/thumbnail/720x/crop/!720x540a0a0	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977857742221.png	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874874013.jpg?imageView2/1/w/720/h/960	0%	Avira URL Cloud	safe
https://static.xcx.gw66.vip/uploadfile/image/0/0/0/2022-03/16461192801861.png	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/share/js/euv.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/jq.pagination/jquery.pagination.js?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/countup.js/1.9.3/countUp.min.js?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977867306691.jpg	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844644774.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	0%	Avira URL Cloud	safe
http://masscode.ru	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/css/frcss.css?_v=202401231750	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/lib/layer/3.0.1/skin/default/layer.css?v=3.0.11110	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977880251704.png	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfile/image/0/4/10/2017-11/15111782903362.jpg	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844646439.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	0%	Avira URL Cloud	safe
https://static.ltdcdn.com/assets/cdn/laydate/laydate.js?_v=202401231750	0%	Avira URL Cloud	safe
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874879172.jpg?imageMogr2/thumbnail/720x/crop/!720x539a0a0	0%	Avira URL Cloud	safe
http://ncxili.cn/gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2F	0%	Avira URL Cloud	safe
http://ricostacruz.com/nprogress	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
share.n.shifen.com	182.61.244.229	true	false	unknown
at.alicdn.com.danuoyi.alicdn.com	47.246.22.253	true	false	high
usa.guanwang.cc	47.88.12.58	true	false	unknown
api.share.n.shifen.com	112.34.113.148	true	false	unknown
api.map.n.shifen.com	103.235.46.245	true	false	unknown
accounts.google.com	142.250.105.84	true	false	high
qiniuglobalweb.sni.channel.w.alikunlun.com	47.246.22.175	true	false	unknown
u888.v.baishan-cloud.net	156.251.65.33	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
opencdnsslv6.jomodns.com	171.214.23.35	true	false	unknown
api.ltdcdn.com	47.114.108.219	true	false	unknown
jxt2rgi0.ovslegodl.sched.ovscdns.com	128.14.246.120	true	false	unknown
cdnjs.cloudflare.com	104.17.25.14	true	false	high
anti-bot.n.shifen.com	153.3.237.19	true	false	unknown
www.google.com	142.250.105.103	true	false	high
clients.l.google.com	108.177.122.113	true	false	high
aliltd.guanwang.cc	47.97.122.100	true	false	unknown
clients1.google.com	unknown	unknown	false	high
ncxili.cn	unknown	unknown	false	unknown
at.alicdn.com	unknown	unknown	false	high
dlswbr.baidu.com	unknown	unknown	false	high
push.zhanzhang.baidu.com	unknown	unknown	false	high
res.wx.qq.com	unknown	unknown	false	high
stun.services.mozilla1.com	unknown	unknown	false	unknown
api.share.baidu.com	unknown	unknown	false	high
clients2.google.com	unknown	unknown	false	high
api.map.baidu.com	unknown	unknown	false	high
uploadfile.ltdcdn.com	unknown	unknown	false	unknown
static.ltdcdn.com	unknown	unknown	false	unknown
miao.baidu.com	unknown	unknown	false	high
ws.ltd.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://static.ltdcdn.com/assets/cdn/element/element.2.15.14.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/cdn/photoswipe/4.1.3/js/photoswipe.min.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/font-awesome/4.7.0/fonts/fontawesome-webfont.woff2?v=4.7.0	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/js/nprogress/nprogress.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/Swiper/5.4.5/css/swiper.min.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://ws.ltd.com/9051	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/images/analyst.png?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfile/image/0/4/10/2017-11/15111784593398.jpg	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/api?v=1.0&type=webgl&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y	false		high
https://static.ltdcdn.com/assets/js/jquery.pjax.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/jquery/3.1.1/jquery.min.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849509498.webp	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfile/image/0/4/10/2017-11/15111783826867.jpg	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/wow/1.1.2/wow.min.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/cdn/plupload/plupload.full.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16982247006664.png?imageView2/1/w/720/h/540	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874879549.jpg?imageView2/1/w/720/h/540	false	Avira URL Cloud: safe	unknown
http://api.ltdcdn.com/analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d	false	Avira URL Cloud: safe	unknown
about:blank	false	Avira URL Cloud: safe	low
https://static.ltdcdn.com/assets/cdn/froala-editor/2.9.0/css/froala_editor.pkgd.min.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
http://ncxili.cn/gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/cdn/photoswipe/4.1.3/css/default-skin.min.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849493823.png?imageView2/1/w/720/h/720	false	Avira URL Cloud: safe	unknown
https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl	false		high
https://static.ltdcdn.com/visual-editor/lib/marquee.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/bootstrap-datepicker/1.8.0/css/bootstrap-datepicker.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
http://api.share.baidu.com/s.gif?l=http://ncxili.cn/en/gongsijianjie	false		high
https://static.ltdcdn.com/assets/cdn/rangeSlider/ion.rangeSlider.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/getscript?type=webgl&v=1.0&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&services=&t=20240116115527	false		high
http://api.ltdcdn.com/analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2F&wi=3&ui=0&st=1706027865872&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217374587246&gmac=7fa17943-d776-4431-b8d5-09df72778f1d	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/images/qrcode.jpg?_v=202401231750	false	Avira URL Cloud: safe	unknown
http://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl	false		high
http://at.alicdn.com/t/font_925836_jkocxsylryr.css	false		high
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849498852.png?imageView2/1/w/720/h/720	false	Avira URL Cloud: safe	unknown
http://ncxili.cn/shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/js/esitrevda.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/layer/3.0.1/skin/default/layer.min.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844653606.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977849505403.png?imageView2/1/w/720/h/720	false	Avira URL Cloud: safe	unknown
http://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl	false		high
https://static.ltdcdn.com/assets/lib/bootstrap-datepicker/1.8.0/js/bootstrap-datepicker.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
http://ncxili.cn/shop/user/me/getProfile	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/bootstrap/3.3.7/js/bootstrap.min.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16982225651418.jpg	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/animate.css/4.1.1/animate.min.css	false		high
https://static.ltdcdn.com/images/wshare.png?_v=202401231750	false	Avira URL Cloud: safe	unknown
http://api.share.baidu.com/s.gif?l=http://ncxili.cn/en	false		high
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977830622146.png	false	Avira URL Cloud: safe	unknown
http://ncxili.cn/en/gongsijianjie	false		unknown
https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl	false		high
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844656715.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	false	Avira URL Cloud: safe	unknown
http://api.map.baidu.com/res/webgl/10/bmap.css	false		high
http://ncxili.cn/gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/Swiper/5.4.5/js/swiper.animate1.0.3.min.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/css/bootstrap.min.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874873863.jpg?imageMogr2/thumbnail/720x/crop/!720x540a0a0	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977857742221.png	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874874013.jpg?imageView2/1/w/720/h/960	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/share/js/euv.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/cdn/jq.pagination/jquery.pagination.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/cdn/countup.js/1.9.3/countUp.min.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977867306691.jpg	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/css/frcss.css?_v=202401231750	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844644774.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/lib/layer/3.0.1/skin/default/layer.css?v=3.0.11110	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977880251704.png	false	Avira URL Cloud: safe	unknown
https://clients1.google.com/tools/pso/ping?as=chrome&brand=ONGR&pid=&hl=en&events=C1I,C2I,C7I,C1S,C7S&rep=2&rlz=C1:,C2:,C7:&id=000000000000000000000000000000000000000062012771D2	false		high
https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl	false		high
https://uploadfile.ltdcdn.com/uploadfile/image/0/4/10/2017-11/15111782903362.jpg	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977844646439.jpg?imageMogr2/thumbnail/720x/crop/!720x451a0a0	false	Avira URL Cloud: safe	unknown
https://static.ltdcdn.com/assets/cdn/laydate/laydate.js?_v=202401231750	false	Avira URL Cloud: safe	unknown
http://ncxili.cn/gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2F	false	Avira URL Cloud: safe	unknown
https://uploadfile.ltdcdn.com/uploadfilev2/image/0/515/525/2023-10/16977874879172.jpg?imageMogr2/thumbnail/720x/crop/!720x539a0a0	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/vuejs/vuex/issues/1505	chromecache_254.2.dr	false		high
http://fontawesome.io	chromecache_252.2.dr	false		high
http://www.layui.com/laydate/	chromecache_234.2.dr, chromecache_241.2.dr	false		high
https://github.com/IonDen/ion.rangeSlider	chromecache_213.2.dr	false		high
http://photoswipe.com	chromecache_272.2.dr, chromecache_192.2.dr	false		high
https://vuejs.org/guide/list.html#key	chromecache_254.2.dr	false		high
http://paulirish.com/2011/requestanimationframe-for-smart-animating/	chromecache_213.2.dr	false		high
https://html.spec.whatwg.org/multipage/indices.html#elements-3	chromecache_254.2.dr	false		high
https://www.froala.com/wysiwyg-editor)	chromecache_347.2.dr, chromecache_275.2.dr	false		high
http://api.map.baidu.com/getscript?type=webgl&v=1.0&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&services=&t=	chromecache_377.2.dr	false		high
http://stackoverflow.com/a/28210364/1070244	chromecache_254.2.dr	false		high
https://vuejs.org/guide/deployment.html	chromecache_254.2.dr	false		high
https://vuejs.org/v2/api/#data	chromecache_254.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0)	chromecache_268.2.dr, chromecache_368.2.dr	false		high
http://masscode.ru/index.php/k2/item/44-limarquee	chromecache_250.2.dr	false	Avira URL Cloud: safe	unknown
http://getbootstrap.com)	chromecache_245.2.dr, chromecache_371.2.dr	false	Avira URL Cloud: safe	low
http://api.map.baidu.com/marker?location=	chromecache_208.2.dr	false		high
https://html.spec.whatwg.org/multipage/dom.html#phrasing-content	chromecache_254.2.dr	false		high
http://my.opera.com/emoller/blog/2011/12/20/requestanimationframe-for-smart-er-animating	chromecache_213.2.dr	false		high
http://ionden.com/a/plugins/licence-en.html	chromecache_213.2.dr	false		high
https://github.com/vuejs/vue/pull/7730	chromecache_254.2.dr	false		high
https://github.com/vuejs/vue-devtools	chromecache_254.2.dr	false		high
https://static.xcx.gw66.vip/uploadfile/image/0/0/0/2022-03/16461192801861.png	chromecache_315.2.dr	false	Avira URL Cloud: safe	unknown
http://masscode.ru	chromecache_250.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_245.2.dr	false		high
https://froala.com/wysiwyg-editor/terms/	chromecache_347.2.dr, chromecache_275.2.dr	false		high
http://ricostacruz.com/nprogress	chromecache_336.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
47.246.22.174	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
47.88.12.58	usa.guanwang.cc	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
47.246.22.253	at.alicdn.com.danuoyi.alicdn.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
47.246.22.175	qiniuglobalweb.sni.channel.w.alikunlun.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
142.250.105.84	accounts.google.com	United States	15169	GOOGLEUS	false
14.215.182.161	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
112.34.113.148	api.share.n.shifen.com	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
39.156.68.163	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
47.114.108.219	api.ltdcdn.com	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
113.219.161.35	unknown	China	63838	CT-HUNAN-HENGYANG-IDCHengyangCN	false
156.251.65.31	unknown	Seychelles	26484	IKGUL-26484US	false
103.235.46.245	api.map.n.shifen.com	Hong Kong	55967	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
108.177.122.113	clients.l.google.com	United States	15169	GOOGLEUS	false
153.3.237.19	anti-bot.n.shifen.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
163.177.18.92	unknown	China	136958	UNICOM-GUANGZHOU-IDCChinaUnicomGuangdongIPnetworkCN	false
128.14.246.120	jxt2rgi0.ovslegodl.sched.ovscdns.com	United States	135377	UHGL-AS-APUCloudHKHoldingsGroupLimitedHK	false
142.250.105.103	www.google.com	United States	15169	GOOGLEUS	false
47.97.122.100	aliltd.guanwang.cc	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
182.61.244.229	share.n.shifen.com	China	38365	BAIDUBeijingBaiduNetcomScienceandTechnologyCoLtd	false
171.214.23.35	opencdnsslv6.jomodns.com	China	139220	CHINANET-SICHUAN-CHUANXI-IDCSichuanChuanxnIDCCN	false
64.233.176.102	unknown	United States	15169	GOOGLEUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	39.0.0 Ruby
Analysis ID:	1379688
Start date and time:	2024-01-23 17:36:29 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://ncxili.cn
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@18/196@81/24
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: http://ncxili.cn/en Browse: http://ncxili.cn/en/gongsijianjie

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 108.177.122.94, 34.104.35.123, 20.12.23.50, 192.229.211.108, 96.7.245.17, 96.7.245.97, 13.95.31.18, 96.7.245.64, 52.165.164.15, 172.253.124.94, 72.21.81.240
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, wu.azureedge.net, download.windowsupdate.com.edgesuite.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, update.googleapis.com, hlb.apr-52dd2-0.edgecastdns.net, glb.sls.prod.dcat.dsp.trafficmanager.net
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
VT rate limit hit for: http://ncxili.cn

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 23 15:37:19 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978152375963794
Encrypted:	false
SSDEEP:	48:8DwdmTCuSHiNZidAKZdA19ehwiZUklqeh9y+3:8FDbpey
MD5:	B5FB34ED8CCEC014835B2469A36F46ED
SHA1:	4BBC3D5EA4160B031D23A72DA871CD71F79D9DF2
SHA-256:	270249C533DE167B98539AD9C97A4C6F73B28FE056AE25748186742BFC787D7D
SHA-512:	3A1FCD54B14E50B7A633F40A0C4F3DDB0EC0423FB3FCC7C771C925DFE87D9944CCCB7337F8A65152DA59CBCD7753522F139E4890C757A08046E7E8D835C1A2EF
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......n.N..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I7X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V7X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V7X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V7X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V7X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q'.b.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 23, 2024 17:37:17.054328918 CET	192.168.2.5	1.1.1.1	0xac2b	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:17.054621935 CET	192.168.2.5	1.1.1.1	0x15eb	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:17.055078983 CET	192.168.2.5	1.1.1.1	0xfed6	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:17.055280924 CET	192.168.2.5	1.1.1.1	0x3409	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:19.262351036 CET	192.168.2.5	1.1.1.1	0x68c2	Standard query (0)	ncxili.cn	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:19.263139009 CET	192.168.2.5	1.1.1.1	0x6a11	Standard query (0)	ncxili.cn	65	IN (0x0001)	false
Jan 23, 2024 17:37:20.290534019 CET	192.168.2.5	1.1.1.1	0x68f5	Standard query (0)	ncxili.cn	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:21.077117920 CET	192.168.2.5	1.1.1.1	0xe11	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:21.078747988 CET	192.168.2.5	1.1.1.1	0xadb4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:26.192266941 CET	192.168.2.5	1.1.1.1	0xd585	Standard query (0)	static.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:26.193654060 CET	192.168.2.5	1.1.1.1	0x7e56	Standard query (0)	static.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:26.206795931 CET	192.168.2.5	1.1.1.1	0x9605	Standard query (0)	at.alicdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:26.211355925 CET	192.168.2.5	1.1.1.1	0x1aab	Standard query (0)	at.alicdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:26.222378016 CET	192.168.2.5	1.1.1.1	0x44c	Standard query (0)	api.map.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:26.223788977 CET	192.168.2.5	1.1.1.1	0x125	Standard query (0)	api.map.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:26.234419107 CET	192.168.2.5	1.1.1.1	0xb5b7	Standard query (0)	res.wx.qq.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:26.236402035 CET	192.168.2.5	1.1.1.1	0x9d05	Standard query (0)	res.wx.qq.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:26.248212099 CET	192.168.2.5	1.1.1.1	0xe5ec	Standard query (0)	uploadfile.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:26.248905897 CET	192.168.2.5	1.1.1.1	0x744	Standard query (0)	uploadfile.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:27.205024004 CET	192.168.2.5	1.1.1.1	0xbc09	Standard query (0)	static.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:27.205492973 CET	192.168.2.5	1.1.1.1	0xf916	Standard query (0)	static.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:27.271872044 CET	192.168.2.5	1.1.1.1	0x8e66	Standard query (0)	uploadfile.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:27.273040056 CET	192.168.2.5	1.1.1.1	0x5bab	Standard query (0)	uploadfile.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:29.631983042 CET	192.168.2.5	1.1.1.1	0xc3cb	Standard query (0)	static.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:30.187005997 CET	192.168.2.5	1.1.1.1	0x5765	Standard query (0)	uploadfile.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:30.187724113 CET	192.168.2.5	1.1.1.1	0x7b50	Standard query (0)	uploadfile.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:31.727116108 CET	192.168.2.5	1.1.1.1	0x48d6	Standard query (0)	uploadfile.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:31.730894089 CET	192.168.2.5	1.1.1.1	0xa91a	Standard query (0)	uploadfile.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:46.608519077 CET	192.168.2.5	1.1.1.1	0xa55e	Standard query (0)	ws.ltd.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:46.608730078 CET	192.168.2.5	1.1.1.1	0x9145	Standard query (0)	ws.ltd.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:46.962948084 CET	192.168.2.5	1.1.1.1	0x62d8	Standard query (0)	static.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:46.963284016 CET	192.168.2.5	1.1.1.1	0xe6f6	Standard query (0)	static.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:48.340993881 CET	192.168.2.5	1.1.1.1	0x160e	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:48.341360092 CET	192.168.2.5	1.1.1.1	0x62ed	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:48.525544882 CET	192.168.2.5	1.1.1.1	0xbbb4	Standard query (0)	ncxili.cn	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:48.526154995 CET	192.168.2.5	1.1.1.1	0xcce9	Standard query (0)	ncxili.cn	65	IN (0x0001)	false
Jan 23, 2024 17:37:48.544749022 CET	192.168.2.5	1.1.1.1	0xb57d	Standard query (0)	ws.ltd.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:48.545007944 CET	192.168.2.5	1.1.1.1	0x5c41	Standard query (0)	ws.ltd.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:49.847678900 CET	192.168.2.5	1.1.1.1	0xded	Standard query (0)	dlswbr.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:49.849910975 CET	192.168.2.5	1.1.1.1	0xa5ba	Standard query (0)	dlswbr.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:50.216022015 CET	192.168.2.5	1.1.1.1	0xfe93	Standard query (0)	api.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:50.216824055 CET	192.168.2.5	1.1.1.1	0x3ac8	Standard query (0)	api.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:52.077913046 CET	192.168.2.5	1.1.1.1	0x633	Standard query (0)	push.zhanzhang.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:52.077981949 CET	192.168.2.5	1.1.1.1	0x7642	Standard query (0)	push.zhanzhang.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:52.153033018 CET	192.168.2.5	1.1.1.1	0x7849	Standard query (0)	api.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:52.153940916 CET	192.168.2.5	1.1.1.1	0xa13	Standard query (0)	api.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:54.134730101 CET	192.168.2.5	1.1.1.1	0x9df0	Standard query (0)	push.zhanzhang.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:54.135107994 CET	192.168.2.5	1.1.1.1	0x879f	Standard query (0)	push.zhanzhang.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:54.322118998 CET	192.168.2.5	1.1.1.1	0xcce2	Standard query (0)	dlswbr.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:54.323870897 CET	192.168.2.5	1.1.1.1	0x71f5	Standard query (0)	dlswbr.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:55.808690071 CET	192.168.2.5	1.1.1.1	0x4782	Standard query (0)	api.share.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:55.809104919 CET	192.168.2.5	1.1.1.1	0x5184	Standard query (0)	api.share.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:55.842946053 CET	192.168.2.5	1.1.1.1	0x5196	Standard query (0)	api.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:55.843651056 CET	192.168.2.5	1.1.1.1	0xefb4	Standard query (0)	api.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:37:57.658216953 CET	192.168.2.5	1.1.1.1	0x8675	Standard query (0)	api.share.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:37:57.658524990 CET	192.168.2.5	1.1.1.1	0x96e5	Standard query (0)	api.share.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:38:02.823765993 CET	192.168.2.5	1.1.1.1	0x18ba	Standard query (0)	miao.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:02.824027061 CET	192.168.2.5	1.1.1.1	0x1f26	Standard query (0)	miao.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:38:02.859374046 CET	192.168.2.5	1.1.1.1	0x368f	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:02.860277891 CET	192.168.2.5	1.1.1.1	0x7e95	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Jan 23, 2024 17:38:02.980467081 CET	192.168.2.5	1.1.1.1	0x9d7c	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Jan 23, 2024 17:38:02.998011112 CET	192.168.2.5	1.1.1.1	0x9140	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:06.714612007 CET	192.168.2.5	1.1.1.1	0x379f	Standard query (0)	miao.baidu.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:06.715370893 CET	192.168.2.5	1.1.1.1	0x1062	Standard query (0)	miao.baidu.com	65	IN (0x0001)	false
Jan 23, 2024 17:38:18.089989901 CET	192.168.2.5	1.1.1.1	0x5daf	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:24.282686949 CET	192.168.2.5	1.1.1.1	0xbe33	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:24.285499096 CET	192.168.2.5	1.1.1.1	0x28e7	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Jan 23, 2024 17:38:24.415510893 CET	192.168.2.5	1.1.1.1	0xa86f	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:24.419095039 CET	192.168.2.5	1.1.1.1	0xc0c8	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Jan 23, 2024 17:38:31.003335953 CET	192.168.2.5	1.1.1.1	0x2d97	Standard query (0)	uploadfile.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:31.007422924 CET	192.168.2.5	1.1.1.1	0xf043	Standard query (0)	uploadfile.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:38:34.723370075 CET	192.168.2.5	1.1.1.1	0x92e9	Standard query (0)	static.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:34.723683119 CET	192.168.2.5	1.1.1.1	0x829b	Standard query (0)	static.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:38:35.959079027 CET	192.168.2.5	1.1.1.1	0x9d35	Standard query (0)	uploadfile.ltdcdn.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:35.959435940 CET	192.168.2.5	1.1.1.1	0xe980	Standard query (0)	uploadfile.ltdcdn.com	65	IN (0x0001)	false
Jan 23, 2024 17:38:44.029789925 CET	192.168.2.5	1.1.1.1	0xde1b	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:44.030621052 CET	192.168.2.5	1.1.1.1	0x5e8b	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Jan 23, 2024 17:38:44.150140047 CET	192.168.2.5	1.1.1.1	0x4a00	Standard query (0)	stun.services.mozilla1.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:44.151077986 CET	192.168.2.5	1.1.1.1	0x86a	Standard query (0)	stun.services.mozilla1.com	28	IN (0x0001)	false
Jan 23, 2024 17:38:46.051599026 CET	192.168.2.5	1.1.1.1	0xf75f	Standard query (0)	clients1.google.com	A (IP address)	IN (0x0001)	false
Jan 23, 2024 17:38:46.052380085 CET	192.168.2.5	1.1.1.1	0xf5a5	Standard query (0)	clients1.google.com	65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:20.894172907 CET	424	OUT	GET / HTTP/1.1 Host: ncxili.cn Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:25.589230061 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:37:25 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Content-Encoding: gzip Data Raw: 34 30 30 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 79 7b 1b c7 95 37 fa f7 d5 a7 68 43 8a 01 da 6c 00 8d 95 80 44 69 1c 59 4e 9c f1 1a c9 93 cc 48 1a a6 09 34 c8 96 40 34 8c 45 14 4d e9 7d ec 24 8a a5 d8 8e 9c c4 8e 1d db 49 2c 4f 9c 78 92 58 b2 27 89 37 79 79 9e 7b 3f ca 2b 90 d4 5f f3 15 ee ef 54 55 77 57 f5 02 82 14 a8 15 b4 45 02 dd b5 9e 3a 75 ea d4 59 f7 dd f7 f0 93 07 8f fc fb 53 87 b4 c5 de 52 73 ff ae 7d f4 47 6b 9a ad 85 d9 84 d5 4a 68 75 b3 67 ea de 57 7a 6f 99 f5 fd bb 34 fc ec 5b b2 7a a6 56 5b 34 3b 5d ab 37 9b e8 f7 1a fa 4c 42 bc ea d9 bd a6 b5 ff 09 b3 85 d7 ad 05 ed 87 76 d3 d6 be 63 76 96 ac 56 4f 7b b4 55 ef 77 7b 1d db 6c 6a 07 9d f4 b4 f6 58 af be 2f c3 2b 48 ed b6 cc 25 6b 36 51 b7 ba b5 8e dd ee d9 0e c6 52 73 5a 3d 34 30 9b 18 b9 dd b4 b6 6c 76 35 ab db 33 e7 9b 76 77 d1 aa 6b 76 4b cb 65 8d 92 66 b6 f0 b9 ab 35 9d 9a d9 e3 8f bd 46 0f da bd 95 69 ed 7b 36 06 7e da d6 9e ea 38 a7 ec 56 cd 4a 6b 4f 38 cb da b2 dd 5b d4 4c ad 67 99 4b 9a d3 d0 8a d9 ac 66 2d b5 9b ce 8a 65 75 a7 b5 65 4b 33 3b 16 c6 b9 b4 64 f7 a8 d9 9e a3 b5 a9 7e dd 06 10 16 ed 85 45 fd d9 be d9 44 fb 5a ad e9 f4 16 e9 29 8a 2c 59 56 4f 73 fa 1d ad 06 b8 38 4b 56 a7 7b ff ee 6c be b2 57 6b 59 56 bd 9b 76 61 ca c0 cd c1 72 d2 5a 59 76 3a f5 6e 04 4c a6 09 d6 d3 02 d6 d3 3e ac a7 0f 3a d3 d3 d3 80 b5 d2 1c 46 d7 b6 3a bd 95 d9 84 b3 50 65 6b 10 d1 e4 a6 cb 17 df a4 bd 64 2e c8 4d 2e f6 7a ed 6e 35 93 e9 03 66 66 bd 61 37 ad 74 b3 57 af d5 5b 69 00 4d 7a 7a 2a 97 61 55 33 d9 4c d1 28 66 8a b9 62 26 97 cd e5 75 23 9b 31 4a 95 72 b9 92 35 8c 9c 51 ca e7 d3 ed d6 82 e8 de c7 49 65 56 13 14 f2 50 88 41 a8 69 b7 4e 6a 1d ab 39 9b e8 2e 3a 9d 5e ad df d3 6c ec ac 84 b6 d8 b1 1a b3 89 9d 5e 21 7f 95 38 2a 9f b2 ad e5 36 c6 91 60 7b df ff f1 36 fb b2 5d ef 2d ce d6 ad 53 76 cd d2 d9 97 69 bb 65 f7 40 3e f4 6e cd 6c 5a b3 c6 b4 b6 84 27 4b fd 25 f7 41 3a 8b 47 e6 69 f9 d1 b4 d6 ef 5a 1d 56 00 b4 c0 9a 6d 39 a2 16 9a e9 db 21 0c 22 28 e8 d6 b3 7d fb d4 6c e2 87 fa 33 0f e9 07 9d a5 b6 d9 b3 51 55 da 20 8f 1e 9a 3d 54 5f b0 a6 6b 8b 1d 6c db 59 43 6a 26 00 ea 9a d9 72 5a 36 3a 97 c1 8c 7d d0 aa 9d c6 76 4d d7 5a 19 79 08 d2 12 f5 56 9a 16 08 97 d5 0b ae 0f 68 5a cf ae c9 bb a7 d6 ed 66 e6 1d a7 07 da 6a b6 d3 00 49 1a 4f 0e cc 9d 9a c5 ce 29 64 8d 5c de 28 17 b3 ee 56 8d ec 42 5a 02 15 19 c2 9d 99 5d 10 fd 6e 06 3b 37 d3 01 a1 b4 0e 37 ed ba d5 c9 80 4e a7 a5 ef b1 a3 c8 88 73 62 4c c3 68 da f3 99 06 4e 07 dd Data Ascii: 400ay{7hClDiYNH4@4EM}$I,OxX'7yy{?+_TUwWE:uYSRs}GkJhugWzo4[zV[4;]7LBvcvVO{Uw{ljX/+H%k6QRsZ=40lv53vwkvKef5Fi{6~8VJkO8[LgKf-eueK3;d~EDZ),YVOs8KV{lWkYVvarZYv:nL>:F:Pekd.M.zn5ffa7tW[iMzzaU3L(fb&u#1Jr5QIeVPAiNj9.:^l^!86`{6]-Svie@>nlZ'K%A:GiZVm9!"(}l3QU =T_klYCj&rZ6:}vMZyVhZfjIO)d\(VBZ]n;77NsbLhN
Jan 23, 2024 17:37:25.589344025 CET	1286	IN	Data Raw: 5c b6 ba 58 8a 4c 21 5d 4e 67 33 04 11 f9 71 ec 70 70 ae dd a7 eb ca de d8 02 e0 05 2c 68 10 26 f0 10 07 0a 41 3e 93 4f 17 d3 39 ef 49 ec 7a 68 ba 3e 96 ee 69 29 e4 ee 0b 69 23 6d 8c d8 bd bb ed 64 e2 e0 03 60 7b 68 21 8f 05 34 7e 6e c4 f1 ec e2 Data Ascii: \XL!]Ng3qpp,h&A>O9Izh>i)i#md`{h!4~n<@$bHT,VJ^qeB0r="x66#7e[\|Kp8M?@[.=!/g!49SwMsOgv+Sf/n"<d^3
Jan 23, 2024 17:37:25.589381933 CET	1286	IN	Data Raw: b0 35 b2 d9 6f 45 c3 36 fc c6 9b 2f 5e 05 5a 73 da 66 0d 6a 62 f4 92 9e 51 9b 1b 02 5c 1f 85 aa da ee 19 f6 13 0d c6 f9 8e b3 0c 6d d8 1d 08 8c f2 c8 c0 18 b6 1f 09 21 14 60 29 f0 97 b1 46 81 94 bd b4 10 c0 3c 48 b9 21 e8 d7 19 92 18 45 65 23 c8 Data Ascii: 5oE6/^ZsfjbQ\m!`)F<H!Ee#Qlwft`wVtzf-`]aa<aUrBK$A;(b/R&bE/yGmm{{>-KohNRDRME#]kK{l@"a\>2$%
Jan 23, 2024 17:37:25.589420080 CET	1286	IN	Data Raw: 3c 91 3e a7 da 72 7a a9 a3 92 a7 dc 73 8b 89 e3 53 11 4f f5 5a 0b 2f dc bb c9 7e cd ac 36 ec 4e b7 a7 3b 0d 9d 54 6d 0a 14 18 77 56 b7 3b 18 04 53 e7 40 64 0f b2 7a 0a ce 61 d2 56 f1 c7 a1 28 98 22 ba de de 80 00 16 79 65 5c 7e 86 2b 40 02 0c 17 Data Ascii: <>rzsSOZ/~6N;TmwV;S@dzaV("ye\~+@7n+23WCRH_3`LE0>E(AP=!'0O&[#n>aNerKQ`RY]:a\ dQWkaAKA:mf(i_&Y,UQ_E
Jan 23, 2024 17:37:25.589459896 CET	1286	IN	Data Raw: a3 55 0b ae fb 68 b5 42 ab 1d 5f cd dd 5d 49 46 40 0e 23 b8 41 bf 9b 9c 4e 32 ab df e4 54 a8 1e dd 89 d3 dc 0a 3a d3 cf b0 3a 07 3a 10 7b d3 75 79 96 f8 05 16 d8 c5 2d 24 55 f7 4f 73 0d ce 98 30 9c ef 2e 68 f7 df 8f 80 37 e4 7a 84 2f 0c de f8 2b Data Ascii: UhB_]IF@#AN2T:::{uy-$UOs0.h7z/+w)VYNoUYD0)zGmO=N+dr:<^3e,2(w=)o(om\|6ywo>\|uWkoczp
Jan 23, 2024 17:37:25.589498997 CET	1286	IN	Data Raw: a8 26 77 d3 5d 33 e9 8f 9e be c2 69 02 cf b0 46 e4 c3 ab cf 2f e8 35 b3 53 e7 f2 3b 3c df e7 7d 62 4a 65 51 4a 90 57 dd 67 9d a8 25 c6 6f 8a 86 d2 8c 0a 50 cb 7b 45 0b 49 ae 96 0e b4 e0 cf 88 5a e0 3a 1b 84 52 71 fd 6d e7 18 86 68 0f fa ad ec 17 Data Ascii: &w]3iF/5S;<}bJeQJWg%oP{EIZ:RqmhW$IiG`>jCfQUqV5;CV8_5-L?:6d0kVHkD5;6rGj=w7T8])RP)"o9b<2HC,sL
Jan 23, 2024 17:37:25.589534998 CET	1286	IN	Data Raw: 24 91 e0 77 91 28 cd 9b 9c 27 f6 24 47 0b 7a c3 8d f9 82 42 bc ed f6 f5 10 44 a3 3d ed 19 24 ac 0c 8a 59 11 8c 7d c1 69 2d 74 ed 13 60 7f 4f d8 56 62 bf 5b 76 bc 23 80 a5 29 c5 93 8e 1e 01 19 ff b6 ed d6 73 88 8c 88 9c 9f ad 03 b0 1d 87 fb ca 5c Data Ascii: $w('$GzBD=$Y}i-t`OVb[v#)s\.Qe+FsLYSvn3B"\b;Ni/@AEO\ZXjxrleobO5/AV!!WRhW>k]X`brhx6W
Jan 23, 2024 17:37:25.589574099 CET	1286	IN	Data Raw: 3d e4 ae 68 f5 91 dc 0b 81 8f b1 65 a7 a1 f4 47 a2 59 6c f7 05 4b 73 1a 50 e7 77 4e d9 88 65 89 78 d4 b5 66 9f 72 df 69 68 14 ae fa 2c e7 50 1d 79 0b 9a 4e 9b 9a 99 46 6a a0 1e 42 6c 21 a1 b7 79 92 1a d2 ba e6 52 1b 29 cd fc 7c ef 88 cd 06 6b 02 Data Ascii: =heGYlKsPwNexfrih,PyNFjBl!yR)\|kd[aYkk4]n=U{BCg{\JfK-r{>^^{/^rqN(Ay&[^s_rgwU=nl1)a5W B(Mnp!xq'9U2[u%O
Jan 23, 2024 17:37:25.589611053 CET	1286	IN	Data Raw: 5b 60 7f 05 1b 91 ab b0 34 b8 43 ea 20 09 96 58 b0 11 cc 8f 44 54 9f cd 82 f7 c4 6a ff 23 25 9a b2 d5 51 d6 95 0f 17 48 b2 12 8d 03 62 b6 2e a6 6c 56 4e 4a 7e ae c2 49 20 35 42 bc b2 50 83 0c 50 9c eb 94 59 9f e8 ea 2a ae c9 ed 1a d9 c8 51 07 12 Data Ascii: [`4C XDTj#%QHb.lVNJ~I 5BPPYQAK9XbYA;^\)NOY8[o%."O(q<%#xb'tY&sf[Y&^8)&H0Bt+uj7-Pbt.\|B{S_
Jan 23, 2024 17:37:25.589648962 CET	1286	IN	Data Raw: f7 1c 39 74 6b 20 3d 91 88 36 dc d4 dc 0f 7a bb a6 1b b9 88 00 97 14 d3 65 1e f1 0b ba 96 4e 65 bd 50 2a 22 3c 42 b1 22 87 52 89 8c d6 3c be c8 c6 e4 09 48 07 b2 51 c9 96 f3 85 3b 20 b2 71 3e 2e b2 31 a3 14 65 bd 8c 90 eb 4a c4 4f 96 7c f7 76 4d Data Ascii: 9tk =6zeNeP"<B"R<HQ; q>.1eJO\|vM$tD6W)D(tN{F5U&Qo .Pu0V F&IYumG_zkxC,ohustXr~iEK cus4>)KC mf)ZzoCEdEJ
Jan 23, 2024 17:37:25.777112961 CET	1286	IN	Data Raw: bc 63 c9 d7 90 e9 dc ce e4 6b a8 70 59 da 28 d1 14 ad 48 fb e6 8e 21 68 10 60 cd 64 73 45 a3 9c 65 09 dd 36 b7 12 d9 01 7d 84 c7 f6 33 ea 5a 29 c2 7f 0d 36 ba 92 bf 66 0f e1 17 8c 02 5d 4d c5 2d d5 57 47 14 64 92 c5 98 b2 f1 72 5c b7 e8 96 3a ef Data Ascii: ckpY(H!h`dsEe6}3Z)6f]M-WGdr\:4Lxw^?t-xx^hr_%Y@-zr.%jU,5[2;N?Vm&zsRRcfr]W;MJJ.[\|Are>(+K'tjjo^sa2n}C!Zx,D
Jan 23, 2024 17:37:46.628175020 CET	461	OUT	GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/ HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:48.011873960 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:47 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:37:47 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 35 65 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 6d 69 64 64 6c 65 22 3a 7b 7d 2c 22 74 6f 70 22 3a 7b 7d 2c 22 62 6f 74 22 3a 7b 7d 2c 22 6c 65 66 74 22 3a 7b 7d 2c 22 72 69 67 68 74 22 3a 7b 7d 2c 22 6d 79 5f 63 65 6e 74 65 72 22 3a 7b 7d 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 5e{"code":0,"msg":"","data":{"middle":{},"top":{},"bot":{},"left":{},"right":{},"my_center":{}}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:26.472595930 CET	338	OUT	GET /t/font_925836_jkocxsylryr.css HTTP/1.1 Host: at.alicdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:26.599627972 CET	1286	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Date: Mon, 25 Dec 2023 02:49:51 GMT Vary: Accept-Encoding Vary: Accept-Encoding x-oss-request-id: 6588EDCF1F32A83931DF886A Vary: Origin ETag: W/"53BC62BFACB178C7B797ACCDDB92C85A" Last-Modified: Sat, 25 Dec 2021 05:13:35 GMT x-oss-object-type: Normal x-oss-hash-crc64ecma: 2243372200706035571 x-oss-storage-class: Standard Cache-Control: max-age=63072000 Content-MD5: U7xiv6yxeMe3l6zN25LIWg== x-oss-server-time: 77 Ali-Swift-Global-Savetime: 1703472591 Via: cache4.l2us1[0,0,200-0,H], cache37.l2us1[1,0], cache5.us13[0,0,200-0,H], cache1.us13[3,0] Age: 2555255 X-Cache: HIT TCP_MEM_HIT dirn:9:46357284 X-Swift-SaveTime: Tue, 26 Dec 2023 14:25:05 GMT X-Swift-CacheTime: 62943886 Access-Control-Allow-Origin: * Timing-Allow-Origin: * EagleId: 2ff6169517060278465372882e Content-Encoding: gzip Data Raw: 61 37 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ac 57 c9 ae e3 c8 b1 dd d7 57 e8 b5 17 e5 b6 ea 16 c5 51 64 15 1a 7e 49 8a a2 48 4a a4 38 0f 30 60 70 9e e7 99 0d ff bb a1 db 53 01 8d 32 bc 70 2e 02 91 99 27 4e 1c 72 93 71 3e fc 7f dc d4 e3 5b ec 05 d1 e1 e7 5f d3 2a 2b b7 2f 87 1f b2 a0 a9 5f 27 3f 7c fd 70 38 0c 7d f0 e5 30 f5 e5 5f 3f 42 90 37 7e f6 ca 2c 08 eb cf 41 53 41 23 f4 02 fd 93 42 70 12 25 fe 99 17 4d b0 0e 5b d9 6f fd e7 a8 19 ff 3e fe 04 e3 18 8a c0 27 14 a1 70 02 fb f8 e3 d7 03 f4 b7 03 cf 52 7f 83 fe 77 ac 7f c9 a2 38 5b 3f fe 78 88 9b be f2 c6 bf 7e 8c 2a 3f 0a c3 28 7c 6b da a8 1e b7 36 fa f8 e3 a7 5f fa 12 6f 3c 4b 1e de 9b bf f7 0d bd d1 fb e2 b5 6d 99 05 de 98 35 35 b4 be bd ff 85 a5 89 e3 af 41 ea f5 43 34 fe 34 8d f1 1b f9 d5 f7 86 88 c0 3e 85 27 8a 53 13 40 83 f7 95 39 00 0c ef d9 45 05 00 28 e0 3f 2c fa 66 c0 26 f3 4a 5e 01 5c 1e ef e9 f0 24 f6 b3 41 e9 f7 9d 07 00 b0 e4 eb ea 45 05 ae 0e 99 b3 99 ed 20 70 1a bc f6 ce 3b 07 f4 0a 68 fe b8 7a 58 58 fb b7 b2 02 00 bc d3 d1 b7 57 Data Ascii: a7fWWQd~IHJ80`pS2p.'Nrq>[_+/_'?\|p8}0_?B7~,ASA#Bp%M[o>'pRw8[?x~?(\|k6_o<Km55AC44>'S@9E(?,f&J^\$AE p;hzXXW
Jan 23, 2024 17:37:26.599646091 CET	1286	IN	Data Raw: bd eb 5c 45 ed a2 57 69 e9 58 2f 31 ee e9 75 77 5f 5e fd 1c dd 69 99 c9 e3 d2 d2 51 00 a0 bb 77 b1 ef d4 02 88 23 80 a5 8d 6f ab 18 00 80 7b c1 01 78 a5 20 b8 bd 22 b7 ce 0e c2 02 00 fc f7 a2 57 06 68 70 bd 01 17 f3 ad 2b f6 22 a1 a7 f7 a2 f8 15 Data Ascii: \EWiX/1uw_^iQw#o{x "Whp+"xz_'K;0WY}Q/@_k@F;82Sq,s(l=<KFA"=-.E\7c5.qvrgR334\uLmcFadX.#H
Jan 23, 2024 17:37:26.611927032 CET	1090	IN	Data Raw: 0a d9 61 d1 0b 7b e9 6a cc 39 f7 04 3e 50 1d e7 76 74 2b 78 d4 1f a4 82 6e 00 0b 09 4a 41 54 ac 10 a8 c8 d6 51 e9 41 ae db cc 0f 8b 86 77 95 04 01 31 8a 73 e1 6a d9 4f a1 39 a2 41 56 07 5b 61 60 53 2f 9b da f1 6a dd 0b b1 4b 4e 57 f8 78 bd fa 27 Data Ascii: a{j9>Pvt+xnJATQAw1sjO9AV[a`S/jKNWx'uo~7;io+2n$djk{9PPt5G $\|P)^#!Nt}`+oh5tB].Ri=FnEdfD\J NEx@
Jan 23, 2024 17:38:11.625513077 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:26.626972914 CET	318	OUT	GET /open/js/jweixin-1.4.0.js HTTP/1.1 Host: res.wx.qq.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:26.747203112 CET	549	IN	HTTP/1.1 200 OK Last-Modified: Tue, 28 Nov 2023 07:30:00 GMT Server: nginx/1.8.1 Date: Tue, 28 Nov 2023 07:30:21 GMT Expires: Wed, 27 Nov 2024 07:30:21 GMT Content-Type: application/x-javascript X-Verify-Code: 7d1d1dc209ee37d05ae3329fdbbf5ca5 Strict-Transport-Security: max-age=3600 X-Daa-Tunnel: hop_count=1 Cache-Control: must-revalidate, max-age=31536000 Content-Length: 12548 Accept-Ranges: bytes X-NWS-LOG-UUID: 6525353694668683964 Connection: keep-alive X-Cache-Lookup: Cache Hit Access-Control-Allow-Origin: * Vary: Origin
Jan 23, 2024 17:37:26.747951984 CET	1286	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 29 7b 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 26 28 64 65 66 69 6e 65 2e 61 6d 64 7c 7c 64 65 66 69 6e 65 2e 63 6d 64 29 3f 64 65 66 69 6e 65 28 66 75 6e 63 74 69 6f 6e Data Ascii: !function(e,n){"function"==typeof define&&(define.amd\|\|define.cmd)?define(function(){return n(e)}):n(e,!0)}(this,function(r,e){var a,c,n,i,t,s,d,o,l,u,p,f,m,g,h,S,I,y,v,_,k,w;if(!r.jWeixin)return a={config:"preVerifyJSAPI",onMenuShareTimeline:
Jan 23, 2024 17:37:26.747967005 CET	1286	IN	Data Raw: 42 28 29 2c 69 6e 69 74 45 6e 64 54 69 6d 65 3a 30 2c 70 72 65 56 65 72 69 66 79 53 74 61 72 74 54 69 6d 65 3a 30 2c 70 72 65 56 65 72 69 66 79 45 6e 64 54 69 6d 65 3a 30 7d 2c 67 3d 7b 76 65 72 73 69 6f 6e 3a 31 2c 61 70 70 49 64 3a 22 22 2c 69 Data Ascii: B(),initEndTime:0,preVerifyStartTime:0,preVerifyEndTime:0},g={version:1,appId:"",initTime:0,preVerifyTime:0,networkType:"",isPreVerifyOk:1,systemType:u?1:l?2:-1,clientVersion:p,url:encodeURIComponent(location.href)},h={},S={_completes:[]},I={s
Jan 23, 2024 17:37:26.747980118 CET	1286	IN	Data Raw: 76 6f 6b 65 7c 7c 28 5f 2e 69 6e 76 6f 6b 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 6e 2c 69 29 7b 72 2e 57 65 69 78 69 6e 4a 53 42 72 69 64 67 65 26 26 57 65 69 78 69 6e 4a 53 42 72 69 64 67 65 2e 69 6e 76 6f 6b 65 28 65 2c 50 28 6e 29 2c 69 29 7d Data Ascii: voke\|\|(_.invoke=function(e,n,i){r.WeixinJSBridge&&WeixinJSBridge.invoke(e,P(n),i)},_.on=function(e,n){r.WeixinJSBridge&&WeixinJSBridge.on(e,n)})},ready:function(e){(0!=I.state\|\|(S._completes.push(e),!o&&h.debug))&&e()},error:function(e){p<"6.0
Jan 23, 2024 17:37:26.747991085 CET	1286	IN	Data Raw: 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 7d 2c 65 29 7d 7d 2c 65 29 7d 2c 6f 6e 4d 65 6e 75 53 68 61 72 65 57 65 69 62 6f 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 4d 28 61 2e 6f 6e 4d 65 6e 75 53 68 61 72 65 57 65 69 62 6f 2c 7b 63 6f 6d 70 6c 65 74 Data Ascii: location.href},e)}},e)},onMenuShareWeibo:function(e){M(a.onMenuShareWeibo,{complete:function(){T("shareWeiboApp",{title:e.title\|\|i,desc:e.desc\|\|"",img_url:e.imgUrl\|\|"",link:e.link\|\|location.href},e)}},e)},onMenuShareQZone:function(e){M(a.onMen
Jan 23, 2024 17:37:26.748032093 CET	1286	IN	Data Raw: 6c 6f 63 61 6c 49 64 2c 69 73 53 68 6f 77 50 72 6f 67 72 65 73 73 54 69 70 73 3a 30 3d 3d 65 2e 69 73 53 68 6f 77 50 72 6f 67 72 65 73 73 54 69 70 73 3f 30 3a 31 7d 2c 65 29 7d 2c 63 68 6f 6f 73 65 49 6d 61 67 65 3a 66 75 6e 63 74 69 6f 6e 28 65 Data Ascii: localId,isShowProgressTips:0==e.isShowProgressTips?0:1},e)},chooseImage:function(e){T("chooseImage",{scene:"1\|2",count:e.count\|\|9,sizeType:e.sizeType\|\|["original","compressed"],sourceType:e.sourceType\|\|["album","camera"]},(e._complete=function
Jan 23, 2024 17:37:26.748106003 CET	1286	IN	Data Raw: 70 65 6e 4c 6f 63 61 74 69 6f 6e 22 2c 7b 6c 61 74 69 74 75 64 65 3a 65 2e 6c 61 74 69 74 75 64 65 2c 6c 6f 6e 67 69 74 75 64 65 3a 65 2e 6c 6f 6e 67 69 74 75 64 65 2c 6e 61 6d 65 3a 65 2e 6e 61 6d 65 7c 7c 22 22 2c 61 64 64 72 65 73 73 3a 65 2e Data Ascii: penLocation",{latitude:e.latitude,longitude:e.longitude,name:e.name\|\|"",address:e.address\|\|"",scale:e.scale\|\|28,infoUrl:e.infoUrl\|\|""},e)},hideOptionMenu:function(e){T("hideOptionMenu",{},e)},showOptionMenu:function(e){T("showOptionMenu",{},e)
Jan 23, 2024 17:37:26.748120070 CET	1286	IN	Data Raw: 28 61 2e 6f 70 65 6e 50 72 6f 64 75 63 74 53 70 65 63 69 66 69 63 56 69 65 77 2c 7b 70 69 64 3a 65 2e 70 72 6f 64 75 63 74 49 64 2c 76 69 65 77 5f 74 79 70 65 3a 65 2e 76 69 65 77 54 79 70 65 7c 7c 30 2c 65 78 74 5f 69 6e 66 6f 3a 65 2e 65 78 74 Data Ascii: (a.openProductSpecificView,{pid:e.productId,view_type:e.viewType\|\|0,ext_info:e.extInfo},e)},addCard:function(e){for(var n=e.cardList,i=[],t=0,o=n.length;t<o;++t){var r=n[t],r={card_id:r.cardId,card_ext:r.cardExt};i.push(r)}T(a.addCard,{card_li
Jan 23, 2024 17:37:26.748159885 CET	1286	IN	Data Raw: 63 68 42 65 61 63 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 54 28 61 2e 73 74 6f 70 53 65 61 72 63 68 42 65 61 63 6f 6e 73 2c 7b 7d 2c 65 29 7d 2c 6f 6e 53 65 61 72 63 68 42 65 61 63 6f 6e 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 4d 28 61 Data Ascii: chBeacons:function(e){T(a.stopSearchBeacons,{},e)},onSearchBeacons:function(e){M(a.onSearchBeacons,e)},openEnterpriseChat:function(e){T("openEnterpriseChat",{useridlist:e.userIds,chatname:e.groupName},e)},launchMiniProgram:function(e){T("launc
Jan 23, 2024 17:37:26.748173952 CET	1286	IN	Data Raw: 47 22 21 3d 74 26 26 22 56 49 44 45 4f 22 21 3d 74 26 26 22 41 55 44 49 4f 22 21 3d 74 26 26 22 53 4f 55 52 43 45 22 21 3d 74 29 7c 7c 2d 31 21 3d 69 2e 69 6e 64 65 78 4f 66 28 22 77 78 6c 6f 63 61 6c 72 65 73 6f 75 72 63 65 3a 2f 2f 22 29 26 26 Data Ascii: G"!=t&&"VIDEO"!=t&&"AUDIO"!=t&&"SOURCE"!=t)\|\|-1!=i.indexOf("wxlocalresource://")&&(e.preventDefault(),e.stopPropagation(),(t=n["wx-id"])\|\|(t=k++,n["wx-id"]=t),w[t]\|\|(w[t]=!0,wx.ready(function(){wx.getLocalImgData({localId:i,success:function(e)
Jan 23, 2024 17:37:26.748277903 CET	974	IN	Data Raw: 69 3d 6e 2e 73 75 62 73 74 72 69 6e 67 28 74 2b 31 29 29 3f 22 6f 6b 22 3a 69 29 3f 22 66 61 69 6c 22 3a 69 29 2e 69 6e 64 65 78 4f 66 28 22 66 61 69 6c 65 64 5f 22 29 3f 69 2e 73 75 62 73 74 72 69 6e 67 28 37 29 3a 69 29 2e 69 6e 64 65 78 4f 66 Data Ascii: i=n.substring(t+1))?"ok":i)?"fail":i).indexOf("failed_")?i.substring(7):i).indexOf("fail_")?i.substring(5):i).replace(/_/g," ")).toLowerCase())&&"no permission to execute"!=i\|\|(i="permission denied"),""==(i="config"==e&&"function not exist"==i

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:26.710928917 CET	354	OUT	GET /api?v=1.0&type=webgl&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:27.075562954 CET	1140	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 364 Content-Type: text/javascript;charset=utf-8 Date: Tue, 23 Jan 2024 16:37:26 GMT Expires: Wed, 24 Jan 2024 16:37:26 GMT Http_x_bd_logid: 2246876294 Http_x_bd_logid64: 2246876542528716554 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=C63FFC692644D5E5673CD5F63B1C8501:FG=1; expires=Wed, 22-Jan-25 16:37:26 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=0015B8E8006491CCA2F8C21B3677EC33:FG=1; expires=Wed, 22-Jan-25 16:37:26 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 22468762943831354378012400 Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 47 4c 5f 6c 6f 61 64 53 63 72 69 70 74 54 69 6d 65 20 3d 20 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 70 69 2e 6d 61 70 2e 62 61 69 64 75 2e 63 6f 6d 2f 67 65 74 73 63 72 69 70 74 3f 74 79 70 65 3d 77 65 62 67 6c 26 76 3d 31 2e 30 26 61 6b 3d 44 4c 51 31 36 44 38 77 43 41 48 63 58 30 4d 30 41 57 64 37 45 36 74 6b 6c 6d 44 48 50 6a 38 59 26 73 65 72 76 69 63 65 73 3d 26 74 3d 32 30 32 34 30 31 31 36 31 31 35 35 32 37 22 3e 3c 2f 73 63 72 69 70 74 3e 27 29 3b 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 70 69 2e 6d 61 70 2e 62 61 69 64 75 2e 63 6f 6d 2f 72 65 73 2f 77 65 62 67 6c 2f 31 30 2f 62 6d 61 70 2e 63 73 73 22 2f 3e 27 29 3b 7d 29 28 29 3b Data Ascii: (function(){ window.BMapGL_loadScriptTime = (new Date).getTime(); document.write('<script type="text/javascript" src="http://api.map.baidu.com/getscript?type=webgl&v=1.0&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&services=&t=20240116115527"></script>');document.write('<link rel="stylesheet" type="text/css" href="http://api.map.baidu.com/res/webgl/10/bmap.css"/>');})();
Jan 23, 2024 17:37:27.276850939 CET	1140	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Length: 364 Content-Type: text/javascript;charset=utf-8 Date: Tue, 23 Jan 2024 16:37:26 GMT Expires: Wed, 24 Jan 2024 16:37:26 GMT Http_x_bd_logid: 2246876294 Http_x_bd_logid64: 2246876542528716554 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=C63FFC692644D5E5673CD5F63B1C8501:FG=1; expires=Wed, 22-Jan-25 16:37:26 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=0015B8E8006491CCA2F8C21B3677EC33:FG=1; expires=Wed, 22-Jan-25 16:37:26 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 22468762943831354378012400 Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 20 77 69 6e 64 6f 77 2e 42 4d 61 70 47 4c 5f 6c 6f 61 64 53 63 72 69 70 74 54 69 6d 65 20 3d 20 28 6e 65 77 20 44 61 74 65 29 2e 67 65 74 54 69 6d 65 28 29 3b 20 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 73 72 63 3d 22 68 74 74 70 3a 2f 2f 61 70 69 2e 6d 61 70 2e 62 61 69 64 75 2e 63 6f 6d 2f 67 65 74 73 63 72 69 70 74 3f 74 79 70 65 3d 77 65 62 67 6c 26 76 3d 31 2e 30 26 61 6b 3d 44 4c 51 31 36 44 38 77 43 41 48 63 58 30 4d 30 41 57 64 37 45 36 74 6b 6c 6d 44 48 50 6a 38 59 26 73 65 72 76 69 63 65 73 3d 26 74 3d 32 30 32 34 30 31 31 36 31 31 35 35 32 37 22 3e 3c 2f 73 63 72 69 70 74 3e 27 29 3b 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 27 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 61 70 69 2e 6d 61 70 2e 62 61 69 64 75 2e 63 6f 6d 2f 72 65 73 2f 77 65 62 67 6c 2f 31 30 2f 62 6d 61 70 2e 63 73 73 22 2f 3e 27 29 3b 7d 29 28 29 3b Data Ascii: (function(){ window.BMapGL_loadScriptTime = (new Date).getTime(); document.write('<script type="text/javascript" src="http://api.map.baidu.com/getscript?type=webgl&v=1.0&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&services=&t=20240116115527"></script>');document.write('<link rel="stylesheet" type="text/css" href="http://api.map.baidu.com/res/webgl/10/bmap.css"/>');})();
Jan 23, 2024 17:37:37.371540070 CET	475	OUT	GET /getscript?type=webgl&v=1.0&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&services=&t=20240116115527 HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:37.726763964 CET	830	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/javascript;charset=utf-8 Date: Tue, 23 Jan 2024 16:37:37 GMT Expires: Wed, 24 Jan 2024 16:37:37 GMT Http_x_bd_logid: 2257545664 Http_x_bd_logid64: 2257545100227779338 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=905E45547B255B6A92808A37F90F8EF1:FG=1; expires=Wed, 22-Jan-25 16:37:37 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=E349D22F2DBB9C0D57D1B0D3319B0693:FG=1; expires=Wed, 22-Jan-25 16:37:37 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 22575456643781153802012400 Vary: Accept-Encoding Transfer-Encoding: chunked
Jan 23, 2024 17:37:37.726922035 CET	1280	IN	Data Raw: 38 30 63 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd fb 73 e3 48 93 20 f6 fb fe 15 6a c6 b7 5a 80 04 29 82 2f 89 54 a3 75 6a 49 33 a3 f9 ba 5b 3d 92 e6 d1 23 6b 15 10 59 14 31 4d 02 1c 00 d4 63 5a dc f0 9d cf 11 f6 45 6c f8 2e e2 fc c3 de ee f9 19 Data Ascii: 80csH jZ)/TujI3[=#kY1McZEl.;[G>xf(sx"UuvzWgw_"/JUMn,jhV)LzRi^?R{K7*<q_dKJZ
Jan 23, 2024 17:37:38.049071074 CET	1280	IN	Data Raw: a2 57 0a c5 30 14 d1 a8 64 ed ef 9e ee 5e bc 38 da dd 3f d8 ef 95 40 f6 74 c7 81 3b 28 59 a7 5f 7c fd f2 79 12 1f 8f 66 93 cb 0b 4c 81 89 6a 9d 1c 9c 5e bc 3e fa a6 57 82 d9 71 31 0d ae 4b 16 84 2e f6 be d8 7d f5 39 66 86 98 8b fe c8 f5 af 30 af Data Ascii: W0d^8?@t;(Y_\|yfLj^>Wq1K.}9f0rq*z!\|OA0IK~EOBK(/4?Zhx:e<G_}qqr{\|fQSM{q^?oG_?}TF.2G}s w0HS^g
Jan 23, 2024 17:37:38.049084902 CET	1280	IN	Data Raw: 4c 83 05 b5 e4 39 cb 33 7b 7d 9d f9 ca 13 27 4d 3c b3 cf 77 f4 40 0f 16 3d 7f 19 85 c7 a9 f9 2a 44 1e 24 56 e3 41 02 74 2f d4 05 40 78 dc 8d 61 30 2e 67 a0 f6 84 96 38 0b 75 13 9e 85 b3 62 16 82 d6 1b 9f 60 67 8b cc 33 72 02 d3 fc 99 4c a1 9a 01 Data Ascii: L93{}'M<w@=*D$VAt/@xa0.g8ub`g3rLeEK9v7@g>F$<d@-;sUSyT+J!/6,q6goAd=mxul_ ,knOU?y8{n4e6>:2iI@
Jan 23, 2024 17:37:38.049099922 CET	1280	IN	Data Raw: 14 9c c1 0a f4 2e ba d3 29 a8 03 b2 8b 56 60 5a c8 32 01 f5 13 2f 12 ba 41 1a 27 46 da 7f 9d 37 80 3e 24 70 03 2d 27 3c 0b 13 95 17 e1 d0 b0 40 83 50 9d d0 95 0a 34 8a a0 dc 03 4a 58 4d f0 de c4 19 d9 bf ce d7 5e 63 ee 35 da b0 a8 95 cc 39 ce 64 Data Ascii: .)V`Z2/A'F7>$p-'<@P4JXM^c59dFj]36$Yx~6,DW;zk%4K46L\w(.{u#$h_a{E1mL(+3X+w*uwdL&/vTS>YFQ`64.
Jan 23, 2024 17:37:38.371160030 CET	1280	IN	Data Raw: 63 b2 b8 85 b5 57 f2 13 62 b5 25 4e ab 41 46 ed 24 5f bd c6 66 bd 9a 2f c8 2b 61 58 a3 5f 8e a2 c5 b0 5b 7f 0a 12 60 b5 5b 7f 16 ec d4 7b 01 a4 64 d6 c5 b0 b6 af 05 31 15 57 48 88 85 1f 10 1c 29 08 b1 b4 44 02 96 e0 07 fb ae d6 48 0d ca d7 32 6e Data Ascii: cWb%NAF$_f/+aX_[`[{d1WH)DH2n'9P]M${X.tFu8CmOEvO,B:B'hD:)%Hv_-PE@;@*L.c5O#3+1?^2vKHU^N]Z{:IH$c
Jan 23, 2024 17:37:38.371175051 CET	1280	IN	Data Raw: 6d bb dd 68 2e 82 61 33 18 8d 3a 80 d9 80 81 ef 2e 02 b2 45 70 c0 84 87 15 a9 d9 ee 2e c2 41 18 47 fe 07 cb 27 10 4e 6b 11 8c 8e 84 a2 dd 41 d6 02 5c ae 00 90 26 41 62 c3 3c b0 db 76 a7 55 00 48 8b 47 a6 d5 86 9e d4 37 eb 05 80 d8 12 23 b0 c6 36 Data Ascii: mh.a3:.Ep.AG'NkA\&Ab<vUHG7#6l`EP&gk.e4a\m_GY!CBJ=D]\|NQN:J[-8[&;WC%z(B] ,i3-y?3Tk5}n3@sfm{!8,h,xBPB
Jan 23, 2024 17:37:38.371217012 CET	1280	IN	Data Raw: 24 e7 c1 45 38 d1 8e c3 ec 48 37 47 dc c8 0b c6 d7 e8 9f d8 2b 16 7c d0 cd 63 3b ce 10 80 53 78 1e 95 f7 06 63 e7 c1 8b 31 74 db 31 fa 48 b2 6d 37 3e 0b ce 99 d7 45 7c f7 4d ea 2b a9 ef 24 63 7d f3 a8 36 00 51 7a 47 18 33 b3 97 ef c4 4c 52 09 9e Data Ascii: $E8H7G+\|c;Sxc1t1Hm7>E\|M+$c}6QzG3LRu>ALFK()F7n,G,WTJKo-!VF"JX~D$TkwQ~=>7`z7uUggn_Qk07X3^5%\
Jan 23, 2024 17:37:38.419954062 CET	1280	IN	Data Raw: b8 79 2e 0f a7 40 bd 07 3e 08 89 22 52 9e bb 69 fb a7 9a 6a 58 93 8b 14 39 c2 01 63 17 f2 b4 9c 5a 63 f8 d0 cc 1a a1 c1 d2 73 3b 9a 1b e9 2e 99 31 b3 cd 3a 67 aa 6f a5 30 08 e2 d2 1c 58 5f c2 74 0f 08 48 09 2a 6a 0c b1 81 57 6d 24 15 ee a9 6b 52 Data Ascii: y.@>"RijX9cZcs;.1:go0X_tH*jWm$kR8"Lr8GMPH0tiOSM1JE!B@)v M_dJ<C&Pxv'YI 9{-oZ&&DNrun ;2R3Zk^_`o(]O
Jan 23, 2024 17:37:38.419970036 CET	1280	IN	Data Raw: 38 77 de cd 53 02 29 52 85 b4 7b 38 e2 0d 28 2a 61 35 cb e9 37 1e d4 b2 d2 fd 7d 72 66 f9 6c 1c d0 56 7f 1c bc 56 6d 61 a7 35 e4 8d 62 ad 15 3e 22 ec 45 f4 4b d7 8f d0 d7 f3 d9 70 28 50 91 f8 c6 13 37 06 32 fa 27 46 e6 26 49 dc 8a c6 34 ad de 7e Data Ascii: 8wS)R{8(*a57}rflVVma5b>"EKp(P72'F&I4~:)h;K72JRT%G4Xlc@F"ilRx5Z?AHCi)\@QN\2^}a=3jBAt/0B[mf2o$Tyizme"ZQtc1
Jan 23, 2024 17:37:38.693283081 CET	1280	IN	Data Raw: bc 90 50 2d 16 42 60 8a cc 0e 7a 45 72 bd 14 ea aa f4 eb d8 b1 45 b5 63 4d 62 a7 94 bc b4 9b be f9 ab eb d0 3b 7a a0 47 7f ad 2b 75 d7 2f 1d 99 4c 0d 97 77 e9 ad b5 08 d1 24 36 1a 09 97 9f c4 4f 1c bd 2a 7a 4f 09 f8 77 1d 6f fd 39 a7 3b fa d2 65 Data Ascii: P-B`zErEcMb;zG+u/Lw$6O*zOwo9;e"} ,ixrS)XVorird9_7^XoDGw G8S~9tVPwIDY^u\|]?=D%eBwo
Jan 23, 2024 17:37:49.828003883 CET	390	OUT	GET /?qt=verify&v=gl&type=webgl&ak=DLQ16D8wCAHcX0M0AWd7E6tklmDHPj8Y&callback=BMapGL.bmapVerifyCbk HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:50.210057020 CET	843	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Type: application/javascript;charset=utf-8 Date: Tue, 23 Jan 2024 16:37:50 GMT Expires: Wed, 24 Jan 2024 16:37:50 GMT Http_x_bd_logid: 2270025013 Http_x_bd_logid64: 2270025662392105738 Http_x_bd_product: map Http_x_bd_subsys: apimap P3p: CP=" OTI DSP COR IVA OUR IND COM " P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=29C2C5B37FF38B33F0BABF728F1BDAD7:FG=1; expires=Wed, 22-Jan-25 16:37:50 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Set-Cookie: BAIDUID=93EDD2C4731F58ED28CCBD2F8A9E5FB5:FG=1; expires=Wed, 22-Jan-25 16:37:50 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Tracecode: 22700250130362390282012400 Content-Length: 61 Data Raw: 2f 2a 2a 2f 42 4d 61 70 47 4c 2e 62 6d 61 70 56 65 72 69 66 79 43 62 6b 20 26 26 20 42 4d 61 70 47 4c 2e 62 6d 61 70 56 65 72 69 66 79 43 62 6b 28 7b 22 65 72 72 6f 72 22 3a 30 7d 29 Data Ascii: /**/BMapGL.bmapVerifyCbk && BMapGL.bmapVerifyCbk({"error":0})

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:37.371752024 CET	334	OUT	GET /res/webgl/10/bmap.css HTTP/1.1 Host: api.map.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:37.711378098 CET	1280	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/css Date: Tue, 23 Jan 2024 16:37:37 GMT Etag: W/"65a0d02e-674f" Expires: Wed, 24 Jan 2024 16:37:37 GMT Http_x_bd_logid: 2257545944 Http_x_bd_logid64: 2257545502646811658 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Fri, 12 Jan 2024 05:37:50 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=D7444707494B32DD140FA655FE5BADAC:FG=1; expires=Wed, 22-Jan-25 16:37:37 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 38 63 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 3d 89 72 e2 3c 93 af e2 9d a9 af 6a e6 4b 20 be 39 52 7f ed 72 26 e4 0e 24 24 a1 b6 8a 32 b6 00 07 5f b1 cd 15 6a 9e 64 5f 65 df 69 5f 61 25 d9 06 d9 96 31 99 c9 3f f3 4d 2a 04 90 d4 dd ea 6e 75 b7 5a 2d 4f 71 64 2a 4e 41 b5 2d 5f d1 2d e0 32 a3 b9 ef db d6 66 64 bb 1a 70 0b ae a2 e9 73 af ca 9e fe 28 d6 af 15 67 68 2a de 6c 33 52 d4 d9 c4 b5 e7 96 56 f5 5d c5 f2 1c c5 05 96 cf cc 5d e3 db c9 c9 12 20 80 6c 71 a4 e9 e6 a4 a8 da e6 89 6e 2a 13 70 a2 38 fa c9 c8 50 ac 59 71 a2 8f bf 47 f0 2c db 53 5d 00 ac 8d a6 7b 8e a1 ac ab 96 6d 81 a8 31 24 45 9d bb 9e ed 56 1d 5b b7 7c e0 46 8d 9e af 5d 3b 0d df 35 18 4d 5f 6c 1c db d3 7d dd b6 aa ca c8 b3 8d b9 0f 62 dd 06 b6 6d 6e 7c db a9 8a 92 b3 3a b5 17 c0 1d 1b f6 b2 3a d5 35 0d 58 a9 9e 4c 0c fb 52 d7 fc 69 95 97 e1 c0 29 d0 27 53 bf ca 8b f0 bd 01 c6 7e 55 60 29 e0 76 dc 29 e0 99 57 f3 f9 e2 f9 8a a5 29 ae c6 17 1d 6b f2 9d 84 e0 02 07 28 3e e4 4a f8 ee f4 bd a0 5b 1a 58 55 39 76 3f dd 43 0b 2c a1 10 57 05 6f aa 68 90 38 ce 59 31 3c fc 45 7f dd c9 48 f9 c6 1e e3 9f 22 27 7d 3f 4d 70 98 32 65 f9 d0 29 ab b6 01 21 7d 6d b7 db 1f 22 b5 3a d6 5d cf 2f a8 53 dd d0 22 dd 1b d9 b0 d5 c4 94 43 99 ea 1a f3 55 55 d5 7c 50 4c 51 8f a4 c6 b1 bb 29 e0 f7 48 07 ca d1 54 d0 9b 83 85 b5 b4 8d b1 a9 58 48 54 be ae 9e c0 af 4c db 0a 44 e8 61 19 c2 fe 88 9c 94 04 b7 9a c9 32 87 f0 61 8a 78 8b a7 40 83 51 e0 e1 2c 0e 81 c3 14 ed b9 ff 4f e4 42 81 3b 70 06 11 27 d0 3c a8 80 84 10 d0 7f 99 40 d3 15 c6 b6 8c 35 13 18 13 06 ae a6 6f 05 48 fd 4c f7 0b a6 6e 15 34 b0 d0 55 50 70 f4 15 30 a0 49 83 e3 ab fc f7 e3 6f a8 c9 05 d8 5e 20 88 bc e6 38 ab f4 d7 5c 05 36 e8 df 37 07 e9 dd a7 73 92 5f a5 78 e9 e9 ef a0 2a a2 d9 63 69 1e a8 0b 7f 82 b2 24 69 1d ba 56 c3 95 f1 7f ff fb 3f a9 89 dc 66 48 9e 65 e0 32 10 13 33 7f 58 3b 80 63 88 2f 7a d0 62 00 f7 38 d1 85 cf ef 22 7c 10 0a 22 35 d9 81 25 3b dc 29 Data Ascii: 8c2=r<jK 9Rr&$$2_jd_ei_a%1?MnuZ-OqdNA-_-2fdps(ghl3RV]] lqnp8PYqG,S]{m1$EV[\|F];5M_l}bmn\|::5XLRi)'S~U`)v)W)k(>J[XU9v?C,Woh8Y1<EH"'}?Mp2e)!}m":]/S"CUU\|PLQ)HTXHTLDa2ax@Q,OB;p'<@5oHLn4UPp0Io^ 8\67s_x*ci$iV?fHe23X;c/zb8"\|"5%;)
Jan 23, 2024 17:37:37.711405039 CET	1280	IN	Data Raw: d6 f1 3e 4a 29 ed 42 4e bb 98 68 a7 ba 4f 3a 35 34 72 b9 bc 0e 62 5e 07 81 a1 b9 5b 36 45 8a 98 66 2e ee 59 e0 24 79 27 d1 86 ee af af 74 cf 47 ee 7d 33 86 a1 49 a0 59 1c 4f ef c2 28 1b 1f ac 7c b8 cc 55 1b af 6e 0b f3 e1 3f 74 d3 b1 5d e8 5a 7d Data Ascii: >J)BNhO:54rb^[6Ef.Y$y'tG}3IYO(\|Un?t]Z}?9mdE^?eN#=}iwWQCDP!we!L\|Nz#YD&sE{:P$*@A9h%"$-oXDd
Jan 23, 2024 17:37:37.711417913 CET	337	IN	Data Raw: 67 49 60 5b ea 84 1d b8 d2 a1 e0 36 58 1f e2 df 63 0a dd 70 67 93 c6 1f 0c 49 cd 33 24 25 18 97 6a 45 7a 93 8e 48 88 c5 4a 30 38 5c e5 1a 18 2b 73 c3 4f 9b 43 0c 27 4c be 20 44 0c 7e 61 19 24 f7 e3 e4 67 fc 3e d1 be fb 98 a4 b1 a8 29 ee 8c 5c 62 Data Ascii: gI`[6XcpgI3$%jEzHJ08\+sOC'L D~a$g>)\b $}1&z4Iy!IDh)VCD`m7c9E:H7ww60;W5hDq=}r>odq~2HdL?]53cmMA
Jan 23, 2024 17:37:37.711429119 CET	1280	IN	Data Raw: 66 35 31 0d 0a 6a a0 9b bf 86 30 dc ec 64 0a 31 07 66 c0 ec 63 82 e9 db f7 c8 77 d3 a3 86 28 07 9b 15 4e d8 ce f5 67 d5 5b fc dc 52 a7 2d 53 b8 9f b6 23 73 cb 95 b6 ca 21 91 e9 b6 dd aa 8d 87 bc fb c9 85 90 a1 18 56 43 96 4b 84 b2 0c a2 95 09 f6 Data Ascii: f51j0d1fcw(Ng[R-S#s!VCK6\|WO%"wkR:8YJ.&HRF0]C^5uo@e6j#@RJv6%9 C [8MeIDH{~paO\|g9P^(gI[l
Jan 23, 2024 17:37:37.711441994 CET	1280	IN	Data Raw: 09 f2 91 7d d9 6a 6a 0f a5 5b de 55 1e af ad 16 67 ea 57 e0 75 f0 78 ed b6 9a e0 ed b6 d2 1c f4 af 1f 3a e5 be 71 2f be 34 a4 a7 5b b3 fe d4 3f 77 26 dd 8b e7 46 a7 6b 4b 2f 6d c3 5e 88 6f cf 86 0e 0c c9 6e 3c ca b6 bc 38 f2 1a 83 f5 d9 ab 6b 9c Data Ascii: }jj[UgWux:q/4[?w&FkK/m^on<8kFnnM^%+s\_n=O{O}hK?v=\|C/Nv5_+5xIZ]j}~{Pk(FMX\?g+c_t;L&rpa
Jan 23, 2024 17:37:37.711455107 CET	1280	IN	Data Raw: af 3f 79 45 4b f5 52 bd 51 a7 00 ff c9 05 cd fe fa 82 96 b1 1d e3 2b a5 43 c4 b2 6f e1 ae f7 ae db ed bd b3 44 e7 cf 59 bf 82 9c bb 7e 19 5a b8 be 8f c4 d5 c7 a3 88 d5 6f 0d 22 56 7f dc 9d af 7e 3a 86 5f fd e9 b5 8e 6e 81 c5 d7 fa ea df e9 bd 57 Data Ascii: ?yEKRQ+CoDY~Zo"V~:_nW~C@,#.0\|{W+UA%N>G>RWon1Y]o1"x:oyV8q1IH/d\|wC]NeU.bc1>)qN
Jan 23, 2024 17:37:37.711466074 CET	88	IN	Data Raw: 82 38 a4 34 bb ff 5b 42 ca be b8 9e 52 3a 29 73 a1 0a 5b 57 ce 1d a4 97 01 09 59 fb 82 c4 de 2c 49 bf a2 bb 08 32 f8 f8 14 d8 3d 26 ed 23 e4 6f 29 38 60 97 b8 b5 8f 9a 0b d1 7d c8 40 f2 e5 8f 1a c8 3c c2 03 1a e8 ae 58 24 0c c2 ff 03 22 0a 10 db Data Ascii: 84[BR:)s[WY,I2=&#o)8`}@<X$"Og
Jan 23, 2024 17:37:37.711477041 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Jan 23, 2024 17:37:37.913218975 CET	1280	IN	HTTP/1.1 200 OK Cache-Control: max-age=86400 Connection: keep-alive Content-Encoding: gzip Content-Type: text/css Date: Tue, 23 Jan 2024 16:37:37 GMT Etag: W/"65a0d02e-674f" Expires: Wed, 24 Jan 2024 16:37:37 GMT Http_x_bd_logid: 2257545944 Http_x_bd_logid64: 2257545502646811658 Http_x_bd_product: map Http_x_bd_subsys: apimap Last-Modified: Fri, 12 Jan 2024 05:37:50 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=D7444707494B32DD140FA655FE5BADAC:FG=1; expires=Wed, 22-Jan-25 16:37:37 GMT; max-age=31536000; path=/; domain=.baidu.com; version=1 Vary: Accept-Encoding Transfer-Encoding: chunked Data Raw: 38 63 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 3d 89 72 e2 3c 93 af e2 9d a9 af 6a e6 4b 20 be 39 52 7f ed 72 26 e4 0e 24 24 a1 b6 8a 32 b6 00 07 5f b1 cd 15 6a 9e 64 5f 65 df 69 5f 61 25 d9 06 d9 96 31 99 c9 3f f3 4d 2a 04 90 d4 dd ea 6e 75 b7 5a 2d 4f 71 64 2a 4e 41 b5 2d 5f d1 2d e0 32 a3 b9 ef db d6 66 64 bb 1a 70 0b ae a2 e9 73 af ca 9e fe 28 d6 af 15 67 68 2a de 6c 33 52 d4 d9 c4 b5 e7 96 56 f5 5d c5 f2 1c c5 05 96 cf cc 5d e3 db c9 c9 12 20 80 6c 71 a4 e9 e6 a4 a8 da e6 89 6e 2a 13 70 a2 38 fa c9 c8 50 ac 59 71 a2 8f bf 47 f0 2c db 53 5d 00 ac 8d a6 7b 8e a1 ac ab 96 6d 81 a8 31 24 45 9d bb 9e ed 56 1d 5b b7 7c e0 46 8d 9e af 5d 3b 0d df 35 18 4d 5f 6c 1c db d3 7d dd b6 aa ca c8 b3 8d b9 0f 62 dd 06 b6 6d 6e 7c db a9 8a 92 b3 3a b5 17 c0 1d 1b f6 b2 3a d5 35 0d 58 a9 9e 4c 0c fb 52 d7 fc 69 95 97 e1 c0 29 d0 27 53 bf ca 8b f0 bd 01 c6 7e 55 60 29 e0 76 dc 29 e0 99 57 f3 f9 e2 f9 8a a5 29 ae c6 17 1d 6b f2 9d 84 e0 02 07 28 3e e4 4a f8 ee f4 bd a0 5b 1a 58 55 39 76 3f dd 43 0b 2c a1 10 57 05 6f aa 68 90 38 ce 59 31 3c fc 45 7f dd c9 48 f9 c6 1e e3 9f 22 27 7d 3f 4d 70 98 32 65 f9 d0 29 ab b6 01 21 7d 6d b7 db 1f 22 b5 3a d6 5d cf 2f a8 53 dd d0 22 dd 1b d9 b0 d5 c4 94 43 99 ea 1a f3 55 55 d5 7c 50 4c 51 8f a4 c6 b1 bb 29 e0 f7 48 07 ca d1 54 d0 9b 83 85 b5 b4 8d b1 a9 58 48 54 be ae 9e c0 af 4c db 0a 44 e8 61 19 c2 fe 88 9c 94 04 b7 9a c9 32 87 f0 61 8a 78 8b a7 40 83 51 e0 e1 2c 0e 81 c3 14 ed b9 ff 4f e4 42 81 3b 70 06 11 27 d0 3c a8 80 84 10 d0 7f 99 40 d3 15 c6 b6 8c 35 13 18 13 06 ae a6 6f 05 48 fd 4c f7 0b a6 6e 15 34 b0 d0 55 50 70 f4 15 30 a0 49 83 e3 ab fc f7 e3 6f a8 c9 05 d8 5e 20 88 bc e6 38 ab f4 d7 5c 05 36 e8 df 37 07 e9 dd a7 73 92 5f a5 78 e9 e9 ef a0 2a a2 d9 63 69 1e a8 0b 7f 82 b2 24 69 1d ba 56 c3 95 f1 7f ff fb 3f a9 89 dc 66 48 9e 65 e0 32 10 13 33 7f 58 3b 80 63 88 2f 7a d0 62 00 f7 38 d1 85 cf ef 22 7c 10 0a 22 35 d9 81 25 3b dc 29 Data Ascii: 8c2=r<jK 9Rr&$$2_jd_ei_a%1?MnuZ-OqdNA-_-2fdps(ghl3RV]] lqnp8PYqG,S]{m1$EV[\|F];5M_l}bmn\|::5XLRi)'S~U`)v)W)k(>J[XU9v?C,Woh8Y1<EH"'}?Mp2e)!}m":]/S"CUU\|PLQ)HTXHTLDa2ax@Q,OB;p'<@5oHLn4UPp0Io^ 8\67s_x*ci$iV?fHe23X;c/zb8"\|"5%;)
Jan 23, 2024 17:37:38.033593893 CET	88	IN	Data Raw: 82 38 a4 34 bb ff 5b 42 ca be b8 9e 52 3a 29 73 a1 0a 5b 57 ce 1d a4 97 01 09 59 fb 82 c4 de 2c 49 bf a2 bb 08 32 f8 f8 14 d8 3d 26 ed 23 e4 6f 29 38 60 97 b8 b5 8f 9a 0b d1 7d c8 40 f2 e5 8f 1a c8 3c c2 03 1a e8 ae 58 24 0c c2 ff 03 22 0a 10 db Data Ascii: 84[BR:)s[WY,I2=&#o)8`}@<X$"Og
Jan 23, 2024 17:37:38.033610106 CET	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:46.630943060 CET	427	OUT	GET /shop/frontend/home/getQywxCs HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:48.097714901 CET	1039	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:48 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Access-Control-Allow-Origin: * Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:37:48 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 32 33 66 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 31 30 35 35 2c 22 77 65 62 73 69 74 65 5f 69 64 22 3a 35 31 35 35 32 35 2c 22 73 74 61 74 75 73 22 3a 31 2c 22 73 74 79 6c 65 22 3a 32 2c 22 74 65 78 74 5f 69 6e 66 6f 22 3a 22 57 65 43 68 61 74 20 73 63 61 6e 6e 69 6e 67 20 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 22 2c 22 63 73 5f 6c 69 6e 6b 22 3a 22 22 2c 22 68 6f 74 5f 6c 69 6e 65 22 3a 22 31 35 38 37 30 36 34 38 31 35 31 22 2c 22 6f 6e 6c 69 6e 65 5f 6c 69 6e 6b 22 3a 22 22 2c 22 71 72 63 6f 64 65 22 3a 30 2c 22 63 6f 6c 6f 72 22 3a 22 23 33 33 33 33 33 33 22 2c 22 71 79 77 78 5f 71 72 63 6f 64 65 22 3a 7b 22 69 64 22 3a 31 34 39 36 35 30 32 33 2c 22 77 69 64 74 68 22 3a 34 33 30 2c 22 68 65 69 67 68 74 22 3a 34 33 30 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 22 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 3f 69 6d 61 67 65 56 69 65 77 32 5c 2f 31 5c 2f 77 5c 2f 33 36 30 5c 2f 68 5c 2f 33 36 30 22 7d 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 30 20 31 36 3a 31 35 3a 34 30 22 2c 22 75 70 64 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 37 20 31 30 3a 34 39 3a 33 35 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f{"code":0,"msg":"","data":{"id":1055,"website_id":515525,"status":1,"style":2,"text_info":"WeChat scanning consultation","cs_link":"","hot_line":"15870648151","online_link":"","qrcode":0,"color":"#333333","qywx_qrcode":{"id":14965023,"width":430,"height":430,"url":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg","thumbnail":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg?imageView2\/1\/w\/360\/h\/360"},"created_at":"2023-10-20 16:15:40","updated_at":"2023-10-27 10:49:35"}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:46.815393925 CET	523	OUT	GET /shop/user/me/getProfile HTTP/1.1 Host: ncxili.cn Connection: keep-alive Accept: / lang: en Gw-Shop-User-Token: null X-Requested-With: XMLHttpRequest ltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:48.266450882 CET	592	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:48 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:37:48 GMT; Max-Age=7200; path=/; HttpOnly Set-Cookie: shop_user_token=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 33 38 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 31 2c 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 73 67 22 3a 22 50 6c 65 61 73 65 20 6c 6f 67 20 69 6e 22 2c 22 64 61 74 61 22 3a 22 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 38{"code":1001,"status":0,"msg":"Please log in","data":""}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:47.012135029 CET	545	OUT	GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2F HTTP/1.1 Host: ncxili.cn Connection: keep-alive Accept: / lang: en Gw-Shop-User-Token: null X-Requested-With: XMLHttpRequest ltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:48.478451967 CET	334	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:48 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Nginx-Cache: MISS Data Raw: 32 63 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 30 31 2c 22 6d 73 67 22 3a 22 6e 6f 20 63 6f 6e 66 69 67 22 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c{"code":10001,"msg":"no config","data":null}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:50.101032972 CET	433	OUT	GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/ HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:51.620074987 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:51 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:37:51 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 35 65 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 6d 69 64 64 6c 65 22 3a 7b 7d 2c 22 74 6f 70 22 3a 7b 7d 2c 22 62 6f 74 22 3a 7b 7d 2c 22 6c 65 66 74 22 3a 7b 7d 2c 22 72 69 67 68 74 22 3a 7b 7d 2c 22 6d 79 5f 63 65 6e 74 65 72 22 3a 7b 7d 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 5e{"code":0,"msg":"","data":{"middle":{},"top":{},"bot":{},"left":{},"right":{},"my_center":{}}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:50.104038954 CET	399	OUT	GET /shop/frontend/home/getQywxCs HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:51.567389011 CET	1039	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:51 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Access-Control-Allow-Origin: * Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:37:51 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 32 33 66 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 31 30 35 35 2c 22 77 65 62 73 69 74 65 5f 69 64 22 3a 35 31 35 35 32 35 2c 22 73 74 61 74 75 73 22 3a 31 2c 22 73 74 79 6c 65 22 3a 32 2c 22 74 65 78 74 5f 69 6e 66 6f 22 3a 22 57 65 43 68 61 74 20 73 63 61 6e 6e 69 6e 67 20 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 22 2c 22 63 73 5f 6c 69 6e 6b 22 3a 22 22 2c 22 68 6f 74 5f 6c 69 6e 65 22 3a 22 31 35 38 37 30 36 34 38 31 35 31 22 2c 22 6f 6e 6c 69 6e 65 5f 6c 69 6e 6b 22 3a 22 22 2c 22 71 72 63 6f 64 65 22 3a 30 2c 22 63 6f 6c 6f 72 22 3a 22 23 33 33 33 33 33 33 22 2c 22 71 79 77 78 5f 71 72 63 6f 64 65 22 3a 7b 22 69 64 22 3a 31 34 39 36 35 30 32 33 2c 22 77 69 64 74 68 22 3a 34 33 30 2c 22 68 65 69 67 68 74 22 3a 34 33 30 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 22 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 3f 69 6d 61 67 65 56 69 65 77 32 5c 2f 31 5c 2f 77 5c 2f 33 36 30 5c 2f 68 5c 2f 33 36 30 22 7d 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 30 20 31 36 3a 31 35 3a 34 30 22 2c 22 75 70 64 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 37 20 31 30 3a 34 39 3a 33 35 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f{"code":0,"msg":"","data":{"id":1055,"website_id":515525,"status":1,"style":2,"text_info":"WeChat scanning consultation","cs_link":"","hot_line":"15870648151","online_link":"","qrcode":0,"color":"#333333","qywx_qrcode":{"id":14965023,"width":430,"height":430,"url":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg","thumbnail":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg?imageView2\/1\/w\/360\/h\/360"},"created_at":"2023-10-20 16:15:40","updated_at":"2023-10-27 10:49:35"}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:50.105223894 CET	394	OUT	GET /shop/user/me/getProfile HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:51.585061073 CET	492	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:51 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:37:51 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 33 64 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 31 2c 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 73 67 22 3a 22 5c 75 38 62 66 37 5c 75 37 36 37 62 5c 75 35 66 35 35 22 2c 22 64 61 74 61 22 3a 22 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3d{"code":1001,"status":0,"msg":"\u8bf7\u767b\u5f55","data":""}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:50.105534077 CET	416	OUT	GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2F HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d
Jan 23, 2024 17:37:50.289340973 CET	333	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:37:50 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Nginx-Cache: HIT Data Raw: 32 63 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 30 31 2c 22 6d 73 67 22 3a 22 6e 6f 20 63 6f 6e 66 69 67 22 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c{"code":10001,"msg":"no config","data":null}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:51.956806898 CET	346	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:52.698487043 CET	346	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:53.098711014 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:37:52 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:37:53.302262068 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:37:52 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:37:53.511482954 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:37:52 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027865763&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:38:18.809767008 CET	346	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:19.197851896 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:38:19 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:38:19.398540974 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:38:19 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:38:19.606842995 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:38:19 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:38:19.814670086 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:38:19 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027894770&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:38:34.710355043 CET	346	OUT	GET /heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl HTTP/1.1 Host: dlswbr.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:35.084898949 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:38:34 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:38:35.287564039 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:38:34 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>
Jan 23, 2024 17:38:35.494570971 CET	475	IN	HTTP/1.1 302 Moved Temporarily Server: JSP3/2.0.14 Date: Tue, 23 Jan 2024 16:38:34 GMT Content-Type: text/html Content-Length: 144 Connection: keep-alive Location: https://dlswbr.baidu.com/heicha/mw/abclite-2063-s.js?_t=1706027910438&v=gl X-Cache-Status: MISS Access-Control-Allow-Origin: * Cache-Control: max-age=7200 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 4a 53 50 33 2f 32 2e 30 2e 31 34 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>JSP3/2.0.14</center></body></html>

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:54.782213926 CET	745	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2F&wi=3&ui=0&st=1706027865872&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217374587246&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:55.195619106 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:37:55 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:37:55 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:18.809915066 CET	746	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:19.206151962 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:19 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:19 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:19.969350100 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:19 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:19 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:21.087374926 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:19 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:19 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:23.319183111 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:19 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:19 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:34.714459896 CET	763	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie&wi=3&ui=0&st=1706027910743&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217383074328&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:35.097982883 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:34 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:34 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:35.861177921 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:34 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:34 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:40.335172892 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:34 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:34 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:55.186779022 CET	312	OUT	GET /push.js HTTP/1.1 Host: push.zhanzhang.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:55.609966040 CET	752	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Encoding: gzip Content-Length: 227 Content-Type: text/javascript Date: Tue, 23 Jan 2024 16:37:55 GMT Etag: "4078521116" Expires: Wed, 22 Jan 2025 16:37:55 GMT Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=0F2CB549CC23336D166065FF852C12CF:FG=1; max-age=31536000; expires=Wed, 22-Jan-25 16:37:55 GMT; domain=.baidu.com; path=/; version=1 Vary: Accept-Encoding Data Raw: 1f 8b 08 00 00 00 00 00 00 03 65 8f c1 6a c3 30 10 44 7f 25 f1 c1 48 d8 5e f5 da 08 61 42 4f b9 16 72 69 14 8a 2a af 6d 41 2c 99 95 1c 43 db fc 7b ed 9a 9e 7a 59 98 81 79 8f dd b7 93 b7 c9 05 cf f8 d7 dd d0 0e 95 60 97 3e a5 f1 7b 3d f1 7a d0 42 8b 8b a9 3e 8f d5 db 53 f5 ac df 35 5c 0b 0d 1f c6 35 93 06 1b 06 2e 3a 57 92 9a 9d 6f c2 0c b7 60 cd 4a 83 9e b0 2d 83 6a 82 9d 06 f4 09 96 88 44 48 d2 b5 6c 8f 90 30 26 46 7c 73 7a 95 09 61 46 07 b1 37 84 1b 7b 45 8b 08 9d 6b 33 19 6a e6 0b 95 d5 a4 b2 02 bd 0d 0d 9e 5f 4f 2f 61 18 83 5f d0 ec 9f 83 97 94 e7 bf 93 fc b6 4c 16 cd e1 af a8 b7 42 ae da a4 3c ce bb d3 60 3a 94 09 22 59 e5 1f 0f b6 3d c2 e5 0f 97 51 90 77 19 01 00 00 Data Ascii: ej0D%H^aBOri*mA,C{zYy`>{=zB>S5\5.:Wo`J-jDHl0&F\|szaF7{Ek3j_O/a_LB<`:"Y=Qw
Jan 23, 2024 17:37:55.814615011 CET	752	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Encoding: gzip Content-Length: 227 Content-Type: text/javascript Date: Tue, 23 Jan 2024 16:37:55 GMT Etag: "4078521116" Expires: Wed, 22 Jan 2025 16:37:55 GMT Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=0F2CB549CC23336D166065FF852C12CF:FG=1; max-age=31536000; expires=Wed, 22-Jan-25 16:37:55 GMT; domain=.baidu.com; path=/; version=1 Vary: Accept-Encoding Data Raw: 1f 8b 08 00 00 00 00 00 00 03 65 8f c1 6a c3 30 10 44 7f 25 f1 c1 48 d8 5e f5 da 08 61 42 4f b9 16 72 69 14 8a 2a af 6d 41 2c 99 95 1c 43 db fc 7b ed 9a 9e 7a 59 98 81 79 8f dd b7 93 b7 c9 05 cf f8 d7 dd d0 0e 95 60 97 3e a5 f1 7b 3d f1 7a d0 42 8b 8b a9 3e 8f d5 db 53 f5 ac df 35 5c 0b 0d 1f c6 35 93 06 1b 06 2e 3a 57 92 9a 9d 6f c2 0c b7 60 cd 4a 83 9e b0 2d 83 6a 82 9d 06 f4 09 96 88 44 48 d2 b5 6c 8f 90 30 26 46 7c 73 7a 95 09 61 46 07 b1 37 84 1b 7b 45 8b 08 9d 6b 33 19 6a e6 0b 95 d5 a4 b2 02 bd 0d 0d 9e 5f 4f 2f 61 18 83 5f d0 ec 9f 83 97 94 e7 bf 93 fc b6 4c 16 cd e1 af a8 b7 42 ae da a4 3c ce bb d3 60 3a 94 09 22 59 e5 1f 0f b6 3d c2 e5 0f 97 51 90 77 19 01 00 00 Data Ascii: ej0D%H^aBOri*mA,C{zYy`>{=zB>S5\5.:Wo`J-jDHl0&F\|szaF7{Ek3j_O/a_LB<`:"Y=Qw
Jan 23, 2024 17:37:56.022573948 CET	752	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=31536000 Content-Encoding: gzip Content-Length: 227 Content-Type: text/javascript Date: Tue, 23 Jan 2024 16:37:55 GMT Etag: "4078521116" Expires: Wed, 22 Jan 2025 16:37:55 GMT Last-Modified: Wed, 25 Nov 2015 07:47:55 GMT P3p: CP=" OTI DSP COR IVA OUR IND COM " Server: apache Set-Cookie: BAIDUID=0F2CB549CC23336D166065FF852C12CF:FG=1; max-age=31536000; expires=Wed, 22-Jan-25 16:37:55 GMT; domain=.baidu.com; path=/; version=1 Vary: Accept-Encoding Data Raw: 1f 8b 08 00 00 00 00 00 00 03 65 8f c1 6a c3 30 10 44 7f 25 f1 c1 48 d8 5e f5 da 08 61 42 4f b9 16 72 69 14 8a 2a af 6d 41 2c 99 95 1c 43 db fc 7b ed 9a 9e 7a 59 98 81 79 8f dd b7 93 b7 c9 05 cf f8 d7 dd d0 0e 95 60 97 3e a5 f1 7b 3d f1 7a d0 42 8b 8b a9 3e 8f d5 db 53 f5 ac df 35 5c 0b 0d 1f c6 35 93 06 1b 06 2e 3a 57 92 9a 9d 6f c2 0c b7 60 cd 4a 83 9e b0 2d 83 6a 82 9d 06 f4 09 96 88 44 48 d2 b5 6c 8f 90 30 26 46 7c 73 7a 95 09 61 46 07 b1 37 84 1b 7b 45 8b 08 9d 6b 33 19 6a e6 0b 95 d5 a4 b2 02 bd 0d 0d 9e 5f 4f 2f 61 18 83 5f d0 ec 9f 83 97 94 e7 bf 93 fc b6 4c 16 cd e1 af a8 b7 42 ae da a4 3c ce bb d3 60 3a 94 09 22 59 e5 1f 0f b6 3d c2 e5 0f 97 51 90 77 19 01 00 00 Data Ascii: ej0D%H^aBOri*mA,C{zYy`>{=zB>S5\5.:Wo`J-jDHl0&F\|szaF7{Ek3j_O/a_LB<`:"Y=Qw

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:56.394597054 CET	386	OUT	GET /s.gif?l=http://ncxili.cn/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:57.252036095 CET	386	OUT	GET /s.gif?l=http://ncxili.cn/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:57.652906895 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:37:57 GMT
Jan 23, 2024 17:37:57.860527992 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:37:57 GMT
Jan 23, 2024 17:37:58.067392111 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:37:57 GMT
Jan 23, 2024 17:38:19.011545897 CET	388	OUT	GET /s.gif?l=http://ncxili.cn/en HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:19.408449888 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:19 GMT
Jan 23, 2024 17:38:19.619564056 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:19 GMT
Jan 23, 2024 17:38:34.791300058 CET	402	OUT	GET /s.gif?l=http://ncxili.cn/en/gongsijianjie HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://ncxili.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:35.193197966 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:35 GMT
Jan 23, 2024 17:38:35.403471947 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:35 GMT

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:37:58.489912033 CET	656	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2F&wi=3&ui=0&st=1706027865872&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217374587246&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:37:58.970818043 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:37:58 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:37:58 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:19.292087078 CET	657	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:20.274760962 CET	657	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:21.437371969 CET	657	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:23.751204014 CET	657	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:28.381306887 CET	536	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen&wi=3&ui=0&st=1706027895084&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=2024021738158480&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, li Data Raw: Data Ascii:
Jan 23, 2024 17:38:28.884896994 CET	121	OUT	Data Raw: 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 Data Ascii: e Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:30.053914070 CET	121	OUT	Data Raw: 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f 64 69 6e 67 3a 20 67 7a 69 70 2c 20 64 65 66 6c 61 Data Ascii: e Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:30.513930082 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:30 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:30 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0
Jan 23, 2024 17:38:35.992379904 CET	536	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie&wi=3&ui=0&st=1706027910743&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217383074328&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ Data Raw: Data Ascii:
Jan 23, 2024 17:38:39.471014977 CET	536	OUT	GET /analyst?r=&sw=1280&sh=1024&h=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie&wi=3&ui=0&st=1706027910743&t=&os=win10&si=515525&b=Chrome&bv=117.0.0.0&s=&sv=&sk=%7B%7D&se=%E6%97%A0&sek=%E6%97%A0&ua=mozilla%2F5.0%20(windows%20nt%2010.0%3B%20win64%3B%20x64)%20applewebkit%2F537.36%20(khtml%2C%20like%20gecko)%20chrome%2F117.0.0.0%20safari%2F537.36&dt=pc&uq=20240217383074328&gmac=7fa17943-d776-4431-b8d5-09df72778f1d HTTP/1.1 Host: api.ltdcdn.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/ Data Raw: Data Ascii:
Jan 23, 2024 17:38:39.871488094 CET	138	OUT	Data Raw: 33 37 2e 33 36 20 28 4b 48 54 4d 4c 2c 20 6c 69 6b 65 20 47 65 63 6b 6f 29 20 43 68 72 6f 6d 65 2f 31 31 37 2e 30 2e 30 2e 30 20 53 61 66 61 72 69 2f 35 33 37 2e 33 36 0d 0a 41 63 63 65 70 74 3a 20 2a 2f 2a 0d 0a 41 63 63 65 70 74 2d 45 6e 63 6f Data Ascii: 37.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:40.263580084 CET	399	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Content-Type: image/gif Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: public Date: Tue, 23 Jan 2024 16:38:40 GMT Pragma: no-cache Last-Modified: Tue, 23 Jan 2024 16:38:40 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Encoding: gzip Data Raw: 33 38 0d 0a 1f 8b 08 00 00 00 00 00 00 03 73 f7 74 b3 b0 4c 64 64 60 64 68 60 64 00 82 ff ff ff 2b fe 64 01 32 19 19 74 40 7c 90 0c 03 13 93 0f 23 83 35 00 cf 0e 1c 9c 2b 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 38stLdd`dh`d+d2t@\|#5+0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:00.200834990 CET	297	OUT	GET /s.gif?l=http://ncxili.cn/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:01.109992027 CET	297	OUT	GET /s.gif?l=http://ncxili.cn/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:02.517165899 CET	297	OUT	GET /s.gif?l=http://ncxili.cn/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:05.334209919 CET	297	OUT	GET /s.gif?l=http://ncxili.cn/ HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:50.797612906 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:09.628619909 CET	801	OUT	GET /en HTTP/1.1 Host: ncxili.cn Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:14.014648914 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:13 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Content-Encoding: gzip Data Raw: 34 30 30 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 7b 7f 1b d5 b5 3f fc f7 93 57 31 28 29 92 c1 23 69 74 97 12 87 43 43 68 e9 e1 da 84 d3 9e 93 e4 b8 63 69 64 4f 22 6b 84 2e 71 8c 93 df 07 da 52 48 81 86 b6 50 28 d0 16 38 a5 e5 b4 25 81 d3 96 5b b8 7c 3e cf f3 52 7e 91 ed fc 75 de c2 f3 5d 7b ef 99 d9 7b 2e b2 ec c8 b9 ca 10 5b 9a d9 d7 b5 d7 5e 7b ed 75 3d 70 d7 03 8f 1d 3a fa ef 8f 1f d6 96 fa cb ad 83 7b 0e d0 1f ad 65 b6 17 e7 12 56 3b a1 35 cc be a9 7b 5f e9 bd 65 36 0e ee d1 f0 73 60 d9 ea 9b 5a 7d c9 ec f6 ac fe 5c 62 d0 6f ea 95 84 78 d5 b7 fb 2d eb e0 a3 66 1b af db 8b da 0f ed 96 ad 7d c7 ec 2e 5b ed be f6 50 bb 31 e8 f5 bb b6 d9 d2 0e 39 e9 59 ed e1 7e e3 40 86 57 90 da 6d 9b cb d6 5c a2 61 f5 ea 5d bb d3 b7 1d 8c a5 ee b4 fb 68 60 2e 31 76 bb 69 6d c5 ec 69 56 af 6f 2e b4 ec de 92 d5 d0 ec b6 96 cb 1a 25 cd 6c e3 73 4f 6b 39 75 b3 cf 1f 7b 8d 1e b2 fb ab b3 da f7 6c 0c fc 8c ad 3d de 75 4e db ed ba 95 d6 1e 75 56 b4 15 bb bf a4 99 5a df 32 97 35 a7 a9 15 b3 59 cd 5a ee b4 9c 55 cb ea cd 6a 2b 96 66 76 2d 8c 73 79 d9 ee 53 b3 7d 47 eb 50 fd 86 0d 20 2c d9 8b 4b fa 53 03 b3 85 f6 b5 7a cb e9 2f d1 53 14 59 b6 ac be e6 0c ba 5a 1d 70 71 96 ad 6e ef ee bd d9 7c 75 bf d6 b6 ac 46 2f ed c2 94 81 9b 83 e5 94 b5 ba e2 74 1b bd 08 98 cc 12 ac 67 05 ac 67 7d 58 cf 1e 72 66 67 67 01 6b a5 39 8c ae 63 75 fb ab 73 09 67 b1 c6 d6 20 a2 c9 2d 97 2f be 49 7b d9 5c 94 9b 5c ea f7 3b bd 5a 26 33 00 cc cc 46 d3 6e 59 e9 56 bf 51 6f b4 d3 00 9a f4 f4 74 2e c3 aa 66 b2 99 a2 51 cc 14 73 c5 4c 2e 9b cb eb 46 36 63 94 aa e5 72 35 6b 18 39 a3 94 cf a7 3b ed 45 d1 bd 8f 93 ca ac a6 28 e4 a1 10 83 50 cb 6e 9f d2 ba 56 6b 2e d1 5b 72 ba fd fa a0 af d9 d8 59 09 6d a9 6b 35 e7 12 bb bd 42 fe 2a 71 54 3e 6d 5b 2b 1d 8c 23 c1 f6 be ff e3 6d f6 15 bb d1 5f 9a 6b 58 a7 ed ba a5 b3 2f b3 76 db ee 83 7c e8 bd ba d9 b2 e6 8c 59 6d 19 4f 96 07 cb ee 83 74 16 8f cc 33 f2 a3 59 6d d0 b3 ba ac 00 68 81 35 d7 76 44 2d 34 33 b0 43 18 44 50 d0 ad a7 06 f6 e9 b9 c4 0f f5 27 ef d7 0f 39 cb 1d b3 6f a3 aa b4 41 1e 3a 3c 77 b8 b1 68 cd d6 97 ba d8 b6 73 86 d4 4c 00 d4 75 b3 ed b4 6d 74 2e 83 19 fb a0 5d 3f 83 ed 9a ae b7 33 f2 10 a4 25 ea af b6 2c 10 2e ab 1f 5c 1f d0 b4 be 5d 97 77 4f bd d7 cb 2c 38 4e 1f b4 d5 ec a4 01 92 34 9e dc 37 7f 7a 0e 3b a7 90 35 72 79 a3 5c cc ba 5b 35 b2 0b 69 09 54 64 08 77 66 f6 40 f4 7b 19 ec dc 4c 17 84 d2 3a d2 b2 1b 56 37 03 3a 9d 96 be c7 8e 22 23 ce 89 09 0d a3 65 2f 64 9a 38 1d 74 73 Data Ascii: 400a{?W1()#itCChcidO"k.qRHP(8%[\|>R~u]{{.[^{u=p:{eV;5{_e6s`Z}\box-f}.[P19Y~@Wm\a]h`.1vimiVo.%lsOk9u{l=uNuVZ25YZUj+fv-syS}GP ,KSz/SYZpqn\|uF/tgg}Xrfggk9cusg -/I{\\;Z&3FnYVQot.fQsL.F6cr5k9;E(PnVk.[rYmk5B*qT>m[+#m_kX/v\|YmOt3Ymh5vD-43CDP'9oA:<whsLumt.]?3%,.\]wO,8N47z;5ry\[5iTdwf@{L:V7:"#e/d8ts
Jan 23, 2024 17:38:14.014667034 CET	1286	IN	Data Raw: c5 ea 61 29 32 85 74 39 9d cd 10 44 e4 c7 b1 c3 c1 b9 76 97 ae 2b 7b 63 1b 80 17 b0 a0 41 98 c0 43 1c 28 04 f9 4c 3e 5d 4c e7 bc 27 b1 eb a1 e9 fa 44 ba a7 a5 90 bb 2f a4 8d b4 31 66 f7 ee b6 93 89 83 0f 80 9d a1 85 3c 16 d0 f8 f9 31 c7 b3 87 f3 Data Ascii: a)2t9Dv+{cAC(L>]L'D/1f<1 QXI+qd)"C{Lpt\N;mE-:{X5mc{ktanlvXl#HLU,v>NLjV.f8F0(z':1ip.7gk+V
Jan 23, 2024 17:38:14.014681101 CET	1286	IN	Data Raw: 6b 64 b3 df 8a 86 6d f8 8d 37 5f bc 0a b4 e6 74 cc 3a d4 c4 e8 25 5d 51 9b 1b 01 5c 1f 85 6a da de 0a fb 89 06 e3 42 d7 59 81 36 ec 16 04 46 79 6c 60 8c da 8f 84 10 0a b0 14 f8 cb 58 a3 40 ca 5e 5e 0c 60 1e a4 dc 10 f4 eb 0c 49 8c a2 b2 11 e4 56 Data Ascii: kdm7_t:%]Q\jBY6Fyl`X@^^`IV({\|`p:^kw`T}3.a\9f}cd mbTR["6v`bBT7#ij4b'aE)H"poat&[egc=KA 0.Z
Jan 23, 2024 17:38:14.014693975 CET	1286	IN	Data Raw: 91 3e a7 d6 76 fa a9 63 92 a7 dc d3 4b 89 13 33 11 4f f5 7a 1b 2f dc bb c9 41 cd ac 35 ed 6e af af 3b 4d 9d 54 6d 0a 14 18 77 d6 b0 bb 18 04 53 e7 40 64 0f b2 7a 1a ce 61 d2 56 f1 c7 a1 28 98 22 ba de d9 80 00 16 79 65 5c 7e 86 2b 40 02 0c 17 e1 Data Ascii: >vcK3Oz/A5n;MTmwS@dzaV("ye\~+@7n+22WCRH_3`LE60>E(AP=!'0O&#n9iNerKQ`RY]:`\ dQWgaAKA:R)J*tH${}W
Jan 23, 2024 17:38:14.014806032 CET	1286	IN	Data Raw: 57 2d b8 ee e3 d5 0a ad 76 7c 35 77 77 25 19 01 39 82 e0 06 83 5e 72 36 c9 ac 7e 93 33 a1 7a 74 27 4e 73 2b e8 cc 20 c3 ea dc d7 85 d8 9b ae cb 73 c4 2f b0 c0 2e 6e 21 a9 ba 7f 9a 6b 70 c6 84 e1 7c 6f 51 bb fb 6e 04 bc 21 d7 23 7c 61 f0 c6 5f b9 Data Ascii: W-v\|5ww%9^r6~3zt'Ns+ s/.n!kp\|oQn!#\|a_Kluhux"rIct?bhhR>vd\w)3X`AA3Ky[F&`7o?=0{7/}3_+/[X>g_}s
Jan 23, 2024 17:38:14.014818907 CET	1286	IN	Data Raw: 6b c9 bd 74 d7 4c fa a3 a7 af 70 9a c0 33 ac 11 f9 f0 ea 0b 8b 7a dd ec 36 b8 fc 0e cf 0f 78 9f 98 52 59 94 12 e4 55 f7 59 27 6a 89 f1 9b a2 a1 34 a3 02 d4 f2 7e d1 42 92 ab a5 03 2d f8 33 a2 16 b8 ce 06 a1 54 5c 7f db 79 86 21 da bd 7e 2b 07 45 Data Ascii: ktLp3z6xRYUY'j4~B-3T\y!~+E{IRZs!rT5?fN-N(ll.-`rxA=O<5uU7AdQMN(xZE/NWKr\UU:Ecqc^-GGPi\|%3]1i
Jan 23, 2024 17:38:14.014832020 CET	1286	IN	Data Raw: 48 f0 bb 48 94 e6 4d ce 13 7b 92 a3 05 bd e1 c6 7c 41 21 de 4e fb ba 1f a2 d1 be f6 24 12 56 06 c5 ac 08 c6 be e8 b4 17 7b f6 49 b0 bf 27 6d 2b 71 d0 2d 3b d9 11 c0 d2 94 e2 49 47 8f 80 8c 7f 3b 76 fb 69 44 46 44 ce cf f6 7d b0 1d 87 fb ca 7c 2e Data Ascii: HHM{\|A!N$V{I'm+q-;IG;viDFD}\|.J(9ld9nMxiCkPJk:58h\|6isWZ-?"5[=v[X3pcP6UpUr9'n2\|g731X(7=2
Jan 23, 2024 17:38:14.014842987 CET	1286	IN	Data Raw: 5d d1 1e 20 b9 17 02 1f 63 cb ce 42 e9 8f 44 b3 d8 ee 8b 96 e6 34 a1 ce ef 9e b6 11 cb 12 f1 a8 eb ad 01 e5 be d3 d0 28 5c f5 59 ce a1 06 f2 16 b4 9c 0e 35 33 8b d4 40 7d 84 d8 42 42 6f f3 14 35 a4 f5 cc e5 0e 52 9a f9 f9 de 11 9b 0d d6 04 ca 83 Data Ascii: ] cBD4(\Y53@}BBo5R1`'F)2?{ix`iwn[z#-?-}g7sWx^9JX/f;qz3L!cd3S#kpMBPB+eVserj.#/
Jan 23, 2024 17:38:14.014853954 CET	1286	IN	Data Raw: f6 57 b0 11 b9 0a 4b 83 3b a2 0e 92 60 89 05 1b c3 fc 48 44 f5 d9 2a 78 4f ac f6 3f 52 a2 29 5b 1d 65 5d f9 70 81 24 2b d1 38 20 66 eb 62 ca 56 e5 a4 e4 e7 2a 9c 04 52 23 c4 2b 0b 35 c8 00 c5 b9 4e 99 f5 89 ae ae e2 9a dc ae 91 8d 1c 75 20 71 18 Data Ascii: WK;`HDxO?R)[e]p$+8 fbVR#+5Nu q!~h,T85SJ,zP"L)SB+8?Wr0Dfq.Pm2FfxRX"ULBbwOLtS]@r-rBbIu~Y
Jan 23, 2024 17:38:14.014864922 CET	1286	IN	Data Raw: e4 d0 ad 81 f4 44 22 da 70 4b 73 3f e8 9d ba 6e e4 22 02 5c 52 4c 97 05 c4 2f e8 59 3a 95 f5 42 a9 88 f0 08 c5 aa 1c 4a 25 32 5a f3 e4 22 1b 93 27 20 1d c8 46 35 5b ce 17 6e 81 c8 c6 f9 b8 c8 c6 8c 52 94 f5 32 42 ae 2b 11 3f 59 f2 dd 9b 35 91 d0 Data Ascii: D"pKs?n"\RL/Y:BJ%2Z"' F5[nR2B+?Y5xT^9x,TF5SOVhLt'P`*X!`@L6PI?Xm&?4K`Ai]da9}@RW2K
Jan 23, 2024 17:38:14.199404955 CET	1286	IN	Data Raw: 35 62 3a 37 33 f9 1a 29 5c 96 36 4a 34 45 2b d2 be b9 65 08 1a 04 58 95 6c ae 68 94 b3 2c a1 db d6 56 22 bb a0 8f f0 d8 7e 46 5d ab 45 f8 af c1 46 57 f2 d7 ec 23 fc 82 51 a0 ab a9 b8 a5 fa ea 88 82 4c b2 18 53 36 59 8e eb 06 dd 52 17 9c 56 83 3b Data Ascii: 5b:73)\6J4E+eXlh,V"~F]EFW#QLS6YRV;A0AmiC@.]5x9d3EXODMf\|f Z u._Vp,LwuqSXez1/(Tee:Nvr.LF6o8{5b;
Jan 23, 2024 17:38:17.260807037 CET	731	OUT	GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/en Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:18.710071087 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:18 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 35 65 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 6d 69 64 64 6c 65 22 3a 7b 7d 2c 22 74 6f 70 22 3a 7b 7d 2c 22 62 6f 74 22 3a 7b 7d 2c 22 6c 65 66 74 22 3a 7b 7d 2c 22 72 69 67 68 74 22 3a 7b 7d 2c 22 6d 79 5f 63 65 6e 74 65 72 22 3a 7b 7d 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 5e{"code":0,"msg":"","data":{"middle":{},"top":{},"bot":{},"left":{},"right":{},"my_center":{}}}0
Jan 23, 2024 17:38:32.121563911 CET	805	OUT	GET /shop/user/me/getProfile HTTP/1.1 Host: ncxili.cn Connection: keep-alive Accept: / lang: en Gw-Shop-User-Token: null X-Requested-With: XMLHttpRequest ltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://ncxili.cn/en/gongsijianjie Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:33.614860058 CET	592	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:33 GMT; Max-Age=7200; path=/; HttpOnly Set-Cookie: shop_user_token=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 33 38 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 31 2c 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 73 67 22 3a 22 50 6c 65 61 73 65 20 6c 6f 67 20 69 6e 22 2c 22 64 61 74 61 22 3a 22 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 38{"code":1001,"status":0,"msg":"Please log in","data":""}0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://ncxili.cn

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Chrome Cache Entry: 193

Chrome Cache Entry: 194

Chrome Cache Entry: 195

Chrome Cache Entry: 196

Chrome Cache Entry: 197

Chrome Cache Entry: 198

Chrome Cache Entry: 199

Chrome Cache Entry: 200

Chrome Cache Entry: 201

Chrome Cache Entry: 202

Chrome Cache Entry: 203

Chrome Cache Entry: 204

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Windows Analysis Report
http://ncxili.cn

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:17.260945082 CET	815	OUT	GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen HTTP/1.1 Host: ncxili.cn Connection: keep-alive Accept: / lang: en Gw-Shop-User-Token: null X-Requested-With: XMLHttpRequest ltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://ncxili.cn/en Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:18.775008917 CET	334	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Nginx-Cache: MISS Data Raw: 32 63 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 30 31 2c 22 6d 73 67 22 3a 22 6e 6f 20 63 6f 6e 66 69 67 22 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c{"code":10001,"msg":"no config","data":null}0
Jan 23, 2024 17:38:32.117186069 CET	709	OUT	GET /shop/frontend/home/getQywxCs HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/en/gongsijianjie Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:33.619118929 CET	1039	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Access-Control-Allow-Origin: * Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:33 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 32 33 66 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 31 30 35 35 2c 22 77 65 62 73 69 74 65 5f 69 64 22 3a 35 31 35 35 32 35 2c 22 73 74 61 74 75 73 22 3a 31 2c 22 73 74 79 6c 65 22 3a 32 2c 22 74 65 78 74 5f 69 6e 66 6f 22 3a 22 57 65 43 68 61 74 20 73 63 61 6e 6e 69 6e 67 20 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 22 2c 22 63 73 5f 6c 69 6e 6b 22 3a 22 22 2c 22 68 6f 74 5f 6c 69 6e 65 22 3a 22 31 35 38 37 30 36 34 38 31 35 31 22 2c 22 6f 6e 6c 69 6e 65 5f 6c 69 6e 6b 22 3a 22 22 2c 22 71 72 63 6f 64 65 22 3a 30 2c 22 63 6f 6c 6f 72 22 3a 22 23 33 33 33 33 33 33 22 2c 22 71 79 77 78 5f 71 72 63 6f 64 65 22 3a 7b 22 69 64 22 3a 31 34 39 36 35 30 32 33 2c 22 77 69 64 74 68 22 3a 34 33 30 2c 22 68 65 69 67 68 74 22 3a 34 33 30 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 22 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 3f 69 6d 61 67 65 56 69 65 77 32 5c 2f 31 5c 2f 77 5c 2f 33 36 30 5c 2f 68 5c 2f 33 36 30 22 7d 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 30 20 31 36 3a 31 35 3a 34 30 22 2c 22 75 70 64 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 37 20 31 30 3a 34 39 3a 33 35 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f{"code":0,"msg":"","data":{"id":1055,"website_id":515525,"status":1,"style":2,"text_info":"WeChat scanning consultation","cs_link":"","hot_line":"15870648151","online_link":"","qrcode":0,"color":"#333333","qywx_qrcode":{"id":14965023,"width":430,"height":430,"url":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg","thumbnail":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg?imageView2\/1\/w\/360\/h\/360"},"created_at":"2023-10-20 16:15:40","updated_at":"2023-10-27 10:49:35"}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:17.515038013 CET	695	OUT	GET /shop/frontend/home/getQywxCs HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/en Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:18.967390060 CET	1039	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Access-Control-Allow-Origin: * Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:18 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 32 33 66 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 31 30 35 35 2c 22 77 65 62 73 69 74 65 5f 69 64 22 3a 35 31 35 35 32 35 2c 22 73 74 61 74 75 73 22 3a 31 2c 22 73 74 79 6c 65 22 3a 32 2c 22 74 65 78 74 5f 69 6e 66 6f 22 3a 22 57 65 43 68 61 74 20 73 63 61 6e 6e 69 6e 67 20 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 22 2c 22 63 73 5f 6c 69 6e 6b 22 3a 22 22 2c 22 68 6f 74 5f 6c 69 6e 65 22 3a 22 31 35 38 37 30 36 34 38 31 35 31 22 2c 22 6f 6e 6c 69 6e 65 5f 6c 69 6e 6b 22 3a 22 22 2c 22 71 72 63 6f 64 65 22 3a 30 2c 22 63 6f 6c 6f 72 22 3a 22 23 33 33 33 33 33 33 22 2c 22 71 79 77 78 5f 71 72 63 6f 64 65 22 3a 7b 22 69 64 22 3a 31 34 39 36 35 30 32 33 2c 22 77 69 64 74 68 22 3a 34 33 30 2c 22 68 65 69 67 68 74 22 3a 34 33 30 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 22 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 3f 69 6d 61 67 65 56 69 65 77 32 5c 2f 31 5c 2f 77 5c 2f 33 36 30 5c 2f 68 5c 2f 33 36 30 22 7d 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 30 20 31 36 3a 31 35 3a 34 30 22 2c 22 75 70 64 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 37 20 31 30 3a 34 39 3a 33 35 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f{"code":0,"msg":"","data":{"id":1055,"website_id":515525,"status":1,"style":2,"text_info":"WeChat scanning consultation","cs_link":"","hot_line":"15870648151","online_link":"","qrcode":0,"color":"#333333","qywx_qrcode":{"id":14965023,"width":430,"height":430,"url":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg","thumbnail":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg?imageView2\/1\/w\/360\/h\/360"},"created_at":"2023-10-20 16:15:40","updated_at":"2023-10-27 10:49:35"}}0
Jan 23, 2024 17:38:32.115818977 CET	845	OUT	GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie HTTP/1.1 Host: ncxili.cn Connection: keep-alive Accept: / lang: en Gw-Shop-User-Token: null X-Requested-With: XMLHttpRequest ltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://ncxili.cn/en/gongsijianjie Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:33.549024105 CET	334	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Nginx-Cache: MISS Data Raw: 32 63 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 30 31 2c 22 6d 73 67 22 3a 22 6e 6f 20 63 6f 6e 66 69 67 22 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c{"code":10001,"msg":"no config","data":null}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:17.515080929 CET	791	OUT	GET /shop/user/me/getProfile HTTP/1.1 Host: ncxili.cn Connection: keep-alive Accept: / lang: en Gw-Shop-User-Token: null X-Requested-With: XMLHttpRequest ltd-token: ltd-website-id: User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Referer: http://ncxili.cn/en Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:18.992424011 CET	592	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:18 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:18 GMT; Max-Age=7200; path=/; HttpOnly Set-Cookie: shop_user_token=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; Max-Age=0; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 33 38 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 31 2c 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 73 67 22 3a 22 50 6c 65 61 73 65 20 6c 6f 67 20 69 6e 22 2c 22 64 61 74 61 22 3a 22 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 38{"code":1001,"status":0,"msg":"Please log in","data":""}0
Jan 23, 2024 17:38:25.662067890 CET	815	OUT	GET /en/gongsijianjie HTTP/1.1 Host: ncxili.cn Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D
Jan 23, 2024 17:38:29.889956951 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:29 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Content-Encoding: gzip Data Raw: 35 65 64 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ed bd 7b 9f 14 d5 b5 3f fc f7 c3 ab 28 1b 62 f7 e8 f4 fd de 30 10 83 98 98 78 07 4f 72 0e 70 26 d5 dd d5 33 05 dd 5d 6d 77 35 c3 70 f9 7d 30 09 0a 51 83 49 34 78 4b 14 4f 4c 38 31 82 1e 8d 22 88 7e 3e cf f3 52 7e f4 cc f0 d7 79 0b cf 77 ed bd ab 6a ef ba f4 f4 0c 03 82 ce 28 33 dd 55 fb ba f6 da 6b af bd ae 3b ee 7b f8 c9 dd fb fe fd a9 3d da bc dd 69 ef dc b2 83 fe 68 6d bd 3b 37 13 33 ba 31 ad a9 db 7a d2 fd 4a ef 0d bd b9 73 8b 86 9f 1d 1d c3 d6 b5 c6 bc de 1f 18 f6 4c 6c 68 b7 92 95 98 78 65 9b 76 db d8 f9 84 de c5 eb ee 9c f6 0b b3 6d 6a 3f d6 fb 1d a3 6b 6b 8f 76 9b c3 81 dd 37 f5 b6 b6 db 4a 4d 6b 8f d9 cd 1d 69 5e 41 6a b7 ab 77 8c 99 58 d3 18 34 fa 66 cf 36 2d 8c a5 61 75 6d 34 30 13 9b b8 dd 94 b6 a0 0f 34 63 60 eb f5 b6 39 98 37 9a 9a d9 d5 72 99 6c 49 d3 bb f8 3c d0 da 56 43 b7 f9 63 b7 d1 dd a6 bd 38 ad fd d4 c4 c0 8f 9a da 53 7d eb 88 d9 6d 18 29 ed 09 6b 41 5b 30 ed 79 4d d7 6c 43 ef 68 56 4b 2b 66 32 9a d1 e9 b5 ad 45 c3 18 4c 6b 0b 86 a6 f7 0d 8c b3 d3 31 6d 6a d6 b6 b4 1e d5 6f 9a 00 c2 bc 39 37 9f 7c 6e a8 b7 d1 be d6 68 5b f6 3c 3d 45 91 8e 61 d8 9a 35 ec 6b 0d c0 c5 ea 18 fd c1 fd 5b 33 f9 ea 76 ad 6b 18 cd 41 ca 81 29 03 37 07 cb 61 63 71 c1 ea 37 07 21 30 99 26 58 4f 0b 58 4f 7b b0 9e de 6d 4d 4f 4f 03 d6 4a 73 18 5d cf e8 db 8b 33 31 6b ae c6 d6 20 a4 c9 55 97 2f ba 49 b3 a3 cf c9 4d ce db 76 6f 50 4b a7 87 80 99 de 6c 99 6d 23 d5 b6 9b 8d 66 37 05 a0 49 4f 8f e4 d2 ac 6a 3a 93 2e 66 8b e9 62 ae 98 ce 65 72 f9 64 36 93 ce 96 aa e5 72 35 93 cd e6 b2 a5 7c 3e d5 eb ce 89 ee 3d 9c 54 66 b5 89 42 2e 0a 31 08 b5 cd ee 61 ad 6f b4 67 62 83 79 ab 6f 37 86 b6 66 62 67 c5 b4 f9 be d1 9a 89 dd ee 15 f2 56 89 a3 f2 11 d3 58 e8 61 1c 31 b6 f7 bd 1f 77 b3 2f 98 4d 7b 7e a6 69 1c 31 1b 46 92 7d 99 36 bb a6 0d f2 91 1c 34 f4 b6 31 93 9d d6 3a 78 d2 19 76 9c 07 a9 0c 1e e9 47 e5 47 d3 da 70 60 f4 59 01 d0 02 63 a6 6b 89 5a 68 66 68 06 30 88 a0 90 34 9e 1b 9a 47 66 62 bf 48 3e fb 50 72 b7 d5 e9 e9 b6 89 aa d2 06 79 74 cf cc 9e e6 9c 31 dd 98 ef 63 db ce 64 e5 66 24 30 db 8b 6d 03 c4 c7 b0 fd 30 06 5d b2 cd 86 bc 03 1a 83 41 ba 6e 59 36 e8 a3 de 4b 61 5a 29 3c d9 35 7b 64 06 d8 5f c8 64 73 f9 6c b9 98 71 b6 5b 68 17 12 18 d5 05 0d 76 a6 0f 40 b8 07 69 ec be 74 1f c4 ce d8 db 36 9b 46 3f 0d 5a 9b 92 be 47 8e 22 2d 68 fd 06 0d a3 6d d6 d3 2d 50 f8 a4 be 60 0c 00 ce 74 21 55 4e 65 d2 04 11 f9 71 e4 70 70 36 dd 97 4c 2a f8 bd 06 c0 0b 58 d0 Data Ascii: 5ed4{?(b0xOrp&3]mw5p}0QI4xKOL81"~>R~ywj(3Uk;{=ihm;731zJsLlhxevmj?kkv7JMki^AjwX4f6-aum404c`97rlI<VCc8S}m)kA[0yMlChVK+f2ELk1mjo97\|nh[<=Ea5k[3vkA)7acq7!0&XOXO{mMOOJs]31k U/IMvoPKlm#f7IOj:.fberd6r5\|>=TfB.1aogbyo7fbgVXa1w/M{~i1F}641:xvGGp`YckZhfh04GfbH>Pryt1cdf$0m0]AnY6KaZ)<5{d_dslq[hv@it6F?ZG"-hm-P`t!UNeqpp6L*X
Jan 23, 2024 17:38:29.889991045 CET	1286	IN	Data Raw: 20 74 e0 12 0e 05 82 7c 3a 9f 2a a6 72 ee 93 c8 f5 d0 92 c9 0d e9 9e 96 42 ee be 90 ca a6 b2 13 76 ef 6c 1d 79 83 7b 00 58 1f 5a c8 63 01 9d 9e 9d 70 3c 5b f8 39 1e 8a 18 3e 32 13 89 95 b4 12 7b 17 4c 9c 4e e9 62 aa 90 2a 32 44 18 b0 07 91 28 00 Data Ascii: t\|:rBvly{XZcp<[9>2{LNb2D(i=sfq7?`[G:L=Ih7}F]#IhO;z6Bm2@an-};2kciB<Nu;hlFfb%_=tj,}`8=;`8f
Jan 23, 2024 17:38:29.890002966 CET	1286	IN	Data Raw: 0a d5 b4 ad 15 f6 13 0e c6 7a df 5a 80 46 eb 1e 04 46 79 62 60 8c db 8f 84 10 0a b0 14 f8 cb 58 a3 40 ca ec cc f9 30 0f 52 6e 08 fa 93 0c 49 b2 45 65 23 c8 ad 34 c1 51 ac ba dd b7 e6 f3 79 df 66 e1 74 60 6b a3 d1 d0 ee 33 c1 a8 f4 6d 3d 8a 16 b0 Data Ascii: zZFFyb`X@0RnIEe#4Qyft`k3m=.0abp\rBK&I<vPy;R$b[[E/yGulv7vOK45h'TS; "c9JA 0.XW7s8nmZ&5rL:K?%8
Jan 23, 2024 17:38:29.890016079 CET	1286	IN	Data Raw: 7f 60 27 ad 56 92 54 6d 0a 14 18 77 d6 34 fb 18 04 53 e7 40 64 0f b2 7a 04 0e 5e d2 56 f1 c6 a1 28 98 42 ba 5e df 80 00 16 79 65 1c 7e 86 2b 40 7c 0c 17 e1 37 fd 90 6e 2b e5 30 d3 fe b5 d1 76 32 1a a3 ac 57 a8 90 43 e2 52 48 98 11 81 04 d4 9f 8f Data Ascii: `'VTmw4S@dz^V(B^ye~+@\|7n+0v2WCRH3`.LE_.s0>(~PL>v6T> [-f~4d:a.!Z.EIeI=I$[J$Z1&hJQPQG Y6id*lOX!9
Jan 23, 2024 17:38:29.890031099 CET	1286	IN	Data Raw: a6 59 9d 5d 7d c8 b1 e9 fe 3b 43 fc 02 8b b6 e2 14 92 aa 7b a7 b9 06 ef 4a 58 c2 0f e6 b4 fb ef 47 14 1a f2 25 c2 17 06 6f fc 95 bb 14 2b cf 56 c7 6d ea a4 b7 8c 46 bf 8f 1b 8a bb 88 f8 aa 2c 22 47 98 04 3d f6 6a 8b 4f 27 f9 23 f6 87 86 b6 2d e1 Data Ascii: Y]};C{JXG%o+VmF,"G=jO'#-S)7{8>.lbn3ep,(mw(\|?Vy\uO\hO~j^rANy_ mjp8S'Mq'00Twtz_
Jan 23, 2024 17:38:29.890044928 CET	1286	IN	Data Raw: 9d a8 25 c6 6f 8a 86 52 8c 0a 50 cb db 45 0b 71 ae 67 f6 b5 e0 cd 88 5a e0 3a 1b c4 46 71 1c 68 67 19 86 68 0f 7a ad ec 14 ed c9 57 24 49 69 e5 ac 87 6f 3e 12 c2 12 a8 c6 cf 85 3c 64 03 76 c7 61 55 bc 71 d6 34 ef 98 11 3b c9 45 56 b6 38 be 5f e3 Data Ascii: %oRPEqgZ:FqhghzW$Iio><dvaUq4;EV8_5hL?&sMNfI./y[#DJ!ZI\ BTT)\5_9S85DrxdA>K&Ec x -fJP.*dva@J0s2
Jan 23, 2024 17:38:29.890055895 CET	1286	IN	Data Raw: 9c d5 9d 1b 98 87 c0 fe 1e 32 8d d8 4e a7 ec c6 8e 00 96 a6 14 20 3a 7c 04 64 fc db 33 bb c7 10 ea 10 89 38 bb bb 60 3b 0e f7 95 d9 5c 9e fc 05 cb d9 42 2e 53 9d c9 96 b3 99 42 fe 7e 8e 69 78 3b e3 bc bd df 45 20 7a 2a 61 13 01 de 6c 99 d0 ed 66 Data Ascii: 2N :\|d38`;\B.SB~ix;E z*alf)dPP$5hc4%l=\|=fb;fkD.{~\a^Yof-B3_T^}S7]wY(Z=2SwU+kF~wF
Jan 23, 2024 17:38:29.890068054 CET	1286	IN	Data Raw: 70 d5 67 49 84 9a 48 44 d0 b6 7a d4 cc 34 72 fd d8 08 b1 85 0c dd fa 61 6a 48 1b e8 9d 1e 72 94 79 09 dc 11 9b 0d d6 04 ca 83 e7 c8 aa c5 5e 64 99 15 b0 13 59 a3 14 6b 0b a9 1c 1b 83 14 5d 80 be 7d 1a aa 60 f7 26 0d 9d d1 be 3f 34 34 e2 12 4e 34 Data Ascii: pgIHDz4rajHry^dYk]}`&?44N4W2[[n^Vn;:we^wWGXrZ2,]N-%?+J^?zsBaU`(\|eY/DjT(WY(y\A~k/Ztfr&)_F.
Jan 23, 2024 17:38:29.890079021 CET	1286	IN	Data Raw: 33 47 89 6a 47 21 c7 9d dc 1b 46 a3 54 87 3f 81 14 66 50 85 12 0d 33 12 52 df fa bc 10 c6 4e 5c d7 d6 34 0f 85 1f 63 33 54 96 77 e9 e5 b3 37 ff 70 49 59 db 53 67 6f 5c f9 68 e5 d7 2f 2f bd 79 f9 8e 2e 72 f8 1a d7 71 1b b1 ba ea 02 bb b9 15 44 88 Data Ascii: 3GjG!FT?fP3RN\4c3Tw7pIYSgo\h//y.rqD\|~:4F ,<hZ #XP"g`?K^s< ,4`(OS~-OMFxq'7:}7!8z_"z.m` IrWv
Jan 23, 2024 17:38:29.890091896 CET	1286	IN	Data Raw: 9a b2 dd 9d 5c dc 4d f7 99 a2 a4 d8 c9 79 43 87 23 0d 65 f1 34 eb 50 8f cc 21 d7 a6 df dd 26 49 a6 cd 28 e1 75 34 98 b7 16 42 ba 39 e9 45 85 75 7a f7 2d ed e8 f4 a7 37 cf 7f c4 1d 4f 02 93 ba 43 8b da 37 06 86 9d c4 06 bb ad cb e9 f5 32 f1 42 7a Data Ascii: \MyC#e4P!&I(u4B9Euz-7OC72Bz+wr@Ix\|?rF*:,.c#QmuXpito`2r?A7E.]y!&!DO882XzlKld<''5OF"r_QNN:H{N:z{ALEm9]h
Jan 23, 2024 17:38:30.074443102 CET	1286	IN	Data Raw: 11 17 dd 17 83 7f d8 35 9f 1b 52 80 74 37 5c 3b 9b 37 2f 65 1e 63 ea 15 15 d8 88 94 6e 74 07 43 e4 01 b0 e7 75 5b 63 70 77 1a 45 74 77 44 49 ef 1e b2 16 11 28 7e 80 ca 03 ca 6e 6a 51 d0 74 79 a2 c6 51 7c 45 e8 7a 64 1d 70 c1 3a 51 e4 fa 55 b1 fc Data Ascii: 5Rt7\;7/ecntCu[cpwEtwDI(~njQtyQ\|Ezdp:QUf79$(Fc~5p5~Q_wy%i@wa#]^w_6M=$fBxfG!wy;xeC[{s-A+q$jEGty$AJrl
Jan 23, 2024 17:38:32.106039047 CET	759	OUT	GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en/gongsijianjie HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://ncxili.cn/en/gongsijianjie Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:33.568276882 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:33 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:33 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 35 65 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 6d 69 64 64 6c 65 22 3a 7b 7d 2c 22 74 6f 70 22 3a 7b 7d 2c 22 62 6f 74 22 3a 7b 7d 2c 22 6c 65 66 74 22 3a 7b 7d 2c 22 72 69 67 68 74 22 3a 7b 7d 2c 22 6d 79 5f 63 65 6e 74 65 72 22 3a 7b 7d 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 5e{"code":0,"msg":"","data":{"middle":{},"top":{},"bot":{},"left":{},"right":{},"my_center":{}}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:19.001836061 CET	701	OUT	GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:20.446801901 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:20 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 35 65 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 6d 69 64 64 6c 65 22 3a 7b 7d 2c 22 74 6f 70 22 3a 7b 7d 2c 22 62 6f 74 22 3a 7b 7d 2c 22 6c 65 66 74 22 3a 7b 7d 2c 22 72 69 67 68 74 22 3a 7b 7d 2c 22 6d 79 5f 63 65 6e 74 65 72 22 3a 7b 7d 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 5e{"code":0,"msg":"","data":{"middle":{},"top":{},"bot":{},"left":{},"right":{},"my_center":{}}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:19.189287901 CET	684	OUT	GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:19.373800039 CET	333	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:19 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Nginx-Cache: HIT Data Raw: 32 63 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 30 31 2c 22 6d 73 67 22 3a 22 6e 6f 20 63 6f 6e 66 69 67 22 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c{"code":10001,"msg":"no config","data":null}0
Jan 23, 2024 17:38:35.597398043 CET	715	OUT	GET /shop/frontend/getEsitrevment?terminal=1&page=http://ncxili.cn/en/gongsijianjie HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:37.114537001 CET	525	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:37 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:37 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 35 65 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 6d 69 64 64 6c 65 22 3a 7b 7d 2c 22 74 6f 70 22 3a 7b 7d 2c 22 62 6f 74 22 3a 7b 7d 2c 22 6c 65 66 74 22 3a 7b 7d 2c 22 72 69 67 68 74 22 3a 7b 7d 2c 22 6d 79 5f 63 65 6e 74 65 72 22 3a 7b 7d 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 5e{"code":0,"msg":"","data":{"middle":{},"top":{},"bot":{},"left":{},"right":{},"my_center":{}}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:19.316417933 CET	665	OUT	GET /shop/frontend/home/getQywxCs HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:20.785365105 CET	1039	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Access-Control-Allow-Origin: * Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:20 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 32 33 66 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 31 30 35 35 2c 22 77 65 62 73 69 74 65 5f 69 64 22 3a 35 31 35 35 32 35 2c 22 73 74 61 74 75 73 22 3a 31 2c 22 73 74 79 6c 65 22 3a 32 2c 22 74 65 78 74 5f 69 6e 66 6f 22 3a 22 57 65 43 68 61 74 20 73 63 61 6e 6e 69 6e 67 20 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 22 2c 22 63 73 5f 6c 69 6e 6b 22 3a 22 22 2c 22 68 6f 74 5f 6c 69 6e 65 22 3a 22 31 35 38 37 30 36 34 38 31 35 31 22 2c 22 6f 6e 6c 69 6e 65 5f 6c 69 6e 6b 22 3a 22 22 2c 22 71 72 63 6f 64 65 22 3a 30 2c 22 63 6f 6c 6f 72 22 3a 22 23 33 33 33 33 33 33 22 2c 22 71 79 77 78 5f 71 72 63 6f 64 65 22 3a 7b 22 69 64 22 3a 31 34 39 36 35 30 32 33 2c 22 77 69 64 74 68 22 3a 34 33 30 2c 22 68 65 69 67 68 74 22 3a 34 33 30 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 22 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 3f 69 6d 61 67 65 56 69 65 77 32 5c 2f 31 5c 2f 77 5c 2f 33 36 30 5c 2f 68 5c 2f 33 36 30 22 7d 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 30 20 31 36 3a 31 35 3a 34 30 22 2c 22 75 70 64 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 37 20 31 30 3a 34 39 3a 33 35 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f{"code":0,"msg":"","data":{"id":1055,"website_id":515525,"status":1,"style":2,"text_info":"WeChat scanning consultation","cs_link":"","hot_line":"15870648151","online_link":"","qrcode":0,"color":"#333333","qywx_qrcode":{"id":14965023,"width":430,"height":430,"url":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg","thumbnail":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg?imageView2\/1\/w\/360\/h\/360"},"created_at":"2023-10-20 16:15:40","updated_at":"2023-10-27 10:49:35"}}0
Jan 23, 2024 17:38:35.595717907 CET	665	OUT	GET /shop/frontend/home/getQywxCs HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:37.068505049 CET	1039	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:36 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Access-Control-Allow-Origin: * Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:36 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 32 33 66 0d 0a 7b 22 63 6f 64 65 22 3a 30 2c 22 6d 73 67 22 3a 22 22 2c 22 64 61 74 61 22 3a 7b 22 69 64 22 3a 31 30 35 35 2c 22 77 65 62 73 69 74 65 5f 69 64 22 3a 35 31 35 35 32 35 2c 22 73 74 61 74 75 73 22 3a 31 2c 22 73 74 79 6c 65 22 3a 32 2c 22 74 65 78 74 5f 69 6e 66 6f 22 3a 22 57 65 43 68 61 74 20 73 63 61 6e 6e 69 6e 67 20 63 6f 6e 73 75 6c 74 61 74 69 6f 6e 22 2c 22 63 73 5f 6c 69 6e 6b 22 3a 22 22 2c 22 68 6f 74 5f 6c 69 6e 65 22 3a 22 31 35 38 37 30 36 34 38 31 35 31 22 2c 22 6f 6e 6c 69 6e 65 5f 6c 69 6e 6b 22 3a 22 22 2c 22 71 72 63 6f 64 65 22 3a 30 2c 22 63 6f 6c 6f 72 22 3a 22 23 33 33 33 33 33 33 22 2c 22 71 79 77 78 5f 71 72 63 6f 64 65 22 3a 7b 22 69 64 22 3a 31 34 39 36 35 30 32 33 2c 22 77 69 64 74 68 22 3a 34 33 30 2c 22 68 65 69 67 68 74 22 3a 34 33 30 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 22 2c 22 74 68 75 6d 62 6e 61 69 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 2e 6c 74 64 63 64 6e 2e 63 6f 6d 5c 2f 75 70 6c 6f 61 64 66 69 6c 65 76 32 5c 2f 69 6d 61 67 65 5c 2f 30 5c 2f 35 31 35 5c 2f 35 32 35 5c 2f 32 30 32 33 2d 31 30 5c 2f 31 36 39 38 33 37 34 39 37 33 38 34 34 36 2e 6a 70 65 67 3f 69 6d 61 67 65 56 69 65 77 32 5c 2f 31 5c 2f 77 5c 2f 33 36 30 5c 2f 68 5c 2f 33 36 30 22 7d 2c 22 63 72 65 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 30 20 31 36 3a 31 35 3a 34 30 22 2c 22 75 70 64 61 74 65 64 5f 61 74 22 3a 22 32 30 32 33 2d 31 30 2d 32 37 20 31 30 3a 34 39 3a 33 35 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 23f{"code":0,"msg":"","data":{"id":1055,"website_id":515525,"status":1,"style":2,"text_info":"WeChat scanning consultation","cs_link":"","hot_line":"15870648151","online_link":"","qrcode":0,"color":"#333333","qywx_qrcode":{"id":14965023,"width":430,"height":430,"url":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg","thumbnail":"https:\/\/uploadfile.ltdcdn.com\/uploadfilev2\/image\/0\/515\/525\/2023-10\/16983749738446.jpeg?imageView2\/1\/w\/360\/h\/360"},"created_at":"2023-10-20 16:15:40","updated_at":"2023-10-27 10:49:35"}}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:19.335707903 CET	660	OUT	GET /shop/user/me/getProfile HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9aNTTM2MY/4HwIJ8gdNEKoo%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gW-yBsbdcewBd1UxsRn7trabVo3rmQiKHLZj2PZKeYqFUe7OVk99Hnf8yMQwlVTbDyfZuikga_hgZ7ePzCqpbMndBCoPxzwaa553dHqf7-MorWHerkXKZ5u8xp9EcvUgJ4dbVbatlHqA_3X2plKfPqYfBkVC6CKT6B-422D3B3G8
Jan 23, 2024 17:38:20.742146015 CET	492	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:20 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:20 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 33 64 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 31 2c 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 73 67 22 3a 22 5c 75 38 62 66 37 5c 75 37 36 37 62 5c 75 35 66 35 35 22 2c 22 64 61 74 61 22 3a 22 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3d{"code":1001,"status":0,"msg":"\u8bf7\u767b\u5f55","data":""}0
Jan 23, 2024 17:38:35.596693993 CET	660	OUT	GET /shop/user/me/getProfile HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:36.999361992 CET	492	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:36 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Set-Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; expires=Tue, 23-Jan-2024 18:38:36 GMT; Max-Age=7200; path=/; HttpOnly Nginx-Cache: MISS Data Raw: 33 64 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 31 2c 22 73 74 61 74 75 73 22 3a 30 2c 22 6d 73 67 22 3a 22 5c 75 38 62 66 37 5c 75 37 36 37 62 5c 75 35 66 35 35 22 2c 22 64 61 74 61 22 3a 22 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3d{"code":1001,"status":0,"msg":"\u8bf7\u767b\u5f55","data":""}0

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:21.066538095 CET	299	OUT	GET /s.gif?l=http://ncxili.cn/en HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:21.437500000 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:21 GMT
Jan 23, 2024 17:38:21.636964083 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:21 GMT
Jan 23, 2024 17:38:21.836812019 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:21 GMT
Jan 23, 2024 17:38:36.147393942 CET	313	OUT	GET /s.gif?l=http://ncxili.cn/en/gongsijianjie HTTP/1.1 Host: api.share.baidu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 23, 2024 17:38:36.504544020 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:36 GMT
Jan 23, 2024 17:38:36.704171896 CET	116	IN	HTTP/1.1 200 OK Content-Length: 0 Content-Type: text/plain; charset=utf-8 Date: Tue, 23 Jan 2024 16:38:36 GMT

Timestamp	Bytes transferred	Direction	Data
Jan 23, 2024 17:38:36.140811920 CET	700	OUT	GET /gzh/self/jsInfo?url=http%3A%2F%2Fncxili.cn%2Fen%2Fgongsijianjie HTTP/1.1 Host: ncxili.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: laravel_session=c01aefbfc8b2c2803282eb023d2381556be8eb39; gmac=7fa17943-d776-4431-b8d5-09df72778f1d; SECKEY_ABVK=wSthY6ocPihUvLQVm9Wc9Q9Ot5aA4XK7N3DLYMCF7lc%3D; BMAP_SECKEY=VNI7J94bhYC9U003sP79gdEa1KT8RMq1j5tMhpY3UlnBreUwFz_ecfccNNVGGcxR8RPJmgBRRhB1rFs-E1ey61D1bMWrdN9odT9KoAKWDPaLqViCs3kyHdHjYRSDqyjIsjs-LwnV2hcpgSJugwTBvmU1N2d6gwYdS-WV4DZoy6gc9Fie9YJY3MmPTrRc-QfL
Jan 23, 2024 17:38:36.325738907 CET	333	IN	HTTP/1.1 200 OK Server: nginx/1.16.1 Date: Tue, 23 Jan 2024 16:38:36 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.1.18 Cache-Control: private, must-revalidate pragma: no-cache expires: -1 Nginx-Cache: HIT Data Raw: 32 63 0d 0a 7b 22 63 6f 64 65 22 3a 31 30 30 30 31 2c 22 6d 73 67 22 3a 22 6e 6f 20 63 6f 6e 66 69 67 22 2c 22 64 61 74 61 22 3a 6e 75 6c 6c 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2c{"code":10001,"msg":"no config","data":null}0

Timestamp	Bytes transferred	Direction	Data
2024-01-23 16:37:17 UTC	680	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4
2024-01-23 16:37:17 UTC	1	OUT	Data Raw: 20 Data Ascii:
2024-01-23 16:37:17 UTC	1627	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 23 Jan 2024 16:37:17 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Gp0c89MQMVzfzH2FcVyFtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factor=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factor, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-01-23 16:37:17 UTC	23	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2024-01-23 16:37:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0