Edit tour

Windows Analysis Report
http://vrqvtg91272.cn/

Overview

General Information

Sample URL:	http://vrqvtg91272.cn/
Analysis ID:	1447552
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 6464 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3440 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1992,i,9087482692117002457,13901402769184823247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 4524 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://vrqvtg91272.cn/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /report/v4?s=XN5d5gefi8oCRf%2FNb%2BepQaDeaHFaVQLDKEhO6t9NFLMY%2BeI0ygRM9vFa8RcEJFKT1D3peCm6tJ5EWmrVZwk5YBu%2FiHS9epNlxCT2jS6EU8ACwHFiYh19%2Fzaexce3akKzf%2Fpt5Ck%3D HTTP/1.1Host: a.nel.cloudflare.comConnection: keep-aliveContent-Length: 443Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.211.8.90:443 -> 192.168.2.5:49727 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.211.8.90
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: vrqvtg91272.cn
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: hm.baidu.com
Source: global traffic	DNS traffic detected: DNS query: pcdown91.telegrarndown936.com
Source: global traffic	DNS traffic detected: DNS query: www.telegremapp.me
Source: global traffic	DNS traffic detected: DNS query: js.users.51.la
Source: global traffic	DNS traffic detected: DNS query: ia.51.la
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: www.telegermapp.ink
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 25 May 2024 22:24:18 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 25 May 2024 22:24:36 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 25 May 2024 22:24:50 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 25 May 2024 22:24:59 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 25 May 2024 22:25:10 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Sat, 25 May 2024 22:25:17 GMTContent-Type: text/htmlContent-Length: 548Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: chromecache_249.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: chromecache_249.2.dr	String found in binary or memory: http://getbootstrap.com/customize/?id=92d2ac1b31978642b6b6)
Source: chromecache_272.2.dr	String found in binary or memory: http://tongji.baidu.com/hm-web/welcome/ico
Source: chromecache_419.2.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: chromecache_272.2.dr	String found in binary or memory: https://fclog.baidu.com/log/ocpcagl?type=behavior&emd=euc
Source: chromecache_461.2.dr	String found in binary or memory: https://gearvpn.com/vpn-for-china/
Source: chromecache_249.2.dr	String found in binary or memory: https://gist.github.com/92d2ac1b31978642b6b6
Source: chromecache_249.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: chromecache_272.2.dr	String found in binary or memory: https://goutong.baidu.com/site/
Source: chromecache_494.2.dr, chromecache_281.2.dr, chromecache_333.2.dr, chromecache_328.2.dr, chromecache_260.2.dr, chromecache_481.2.dr	String found in binary or memory: https://hm.baidu.com/hm.js?f5af99a9e60f46adaabec28642c97c28
Source: chromecache_272.2.dr	String found in binary or memory: https://hmcdn.baidu.com/static
Source: chromecache_272.2.dr	String found in binary or memory: https://hmcdn.baidu.com/static/tongji/plugins/
Source: chromecache_315.2.dr	String found in binary or memory: https://js.users.51.la/21568093.js
Source: chromecache_259.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard.png)
Source: chromecache_259.2.dr	String found in binary or memory: https://osx.telegram.org/updates/site/artboard_2x.png);
Source: chromecache_332.2.dr	String found in binary or memory: https://pcdown91.telegrarndown936.com/tz.js
Source: chromecache_289.2.dr	String found in binary or memory: https://telegram.org/
Source: chromecache_289.2.dr	String found in binary or memory: https://twitter.com/intent/tweet?text=
Source: chromecache_435.2.dr	String found in binary or memory: https://www.telegremapp.me

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 57273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57256
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 57264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 57276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57259
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57266
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57267
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57264
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57260
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57271 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57276
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57278
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 57266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57271
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 57257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57280
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 57260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 57275 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 57256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 57278 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57267 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1992,i,9087482692117002457,13901402769184823247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://vrqvtg91272.cn/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1992,i,9087482692117002457,13901402769184823247,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
http://vrqvtg91272.cn/	16%	Virustotal		Browse
http://vrqvtg91272.cn/	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Link
bg.microsoft.map.fastly.net	0%	Virustotal	Browse
fp2e7a.wpc.phicdn.net	0%	Virustotal	Browse
vrqvtg91272.cn	16%	Virustotal	Browse
a.nel.cloudflare.com	0%	Virustotal	Browse
google.com	1%	Virustotal	Browse
js.users.51.la.w.cdngslb.com	0%	Virustotal	Browse
hm.e.shifen.com	0%	Virustotal	Browse
zcmcm.v.trpcdn.net	0%	Virustotal	Browse
hm.baidu.com	0%	Virustotal	Browse
www.google.com	0%	Virustotal	Browse
js.users.51.la	4%	Virustotal	Browse
ia.51.la	2%	Virustotal	Browse

Source	Detection	Scanner	Label	Link
https://twitter.com/intent/tweet?text=	0%	URL Reputation	safe
https://www.telegremapp.me/img/download_windows.jpg	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp820/picture/1637864147832485.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp220/js/output.min.js	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp220/picture/logotg.png	0%	Avira URL Cloud	safe
https://osx.telegram.org/updates/site/artboard.png)	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/1637863872179908.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp820/css/bootstrap.min.css	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp820/picture/shaps2.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp820/picture/user-interact3.png	0%	Avira URL Cloud	safe
https://osx.telegram.org/updates/site/artboard.png)	0%	Virustotal		Browse
http://vrqvtg91272.cn/static/temp820/picture/1637863593133725.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp720/css/magnific-popup.css	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp720/picture/shaps2.png	0%	Avira URL Cloud	safe
https://www.telegremapp.me/img/t_logo.svg	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp620/picture/footer-bg.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/shaps1.png	0%	Avira URL Cloud	safe
https://www.telegremapp.me/js/jquery-2.1.3.min.js	0%	Avira URL Cloud	safe
http://ia.51.la/go1?id=21568093&rt=1716675889458&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=0&vd=3&ce=1&cd=24&ds=&ing=3&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252Findex.html%2523blog&pu=	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/1637863734520890.png	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp820/css/style.css	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp120/picture/logotg.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp820/js/jquery-3.3.1.min.js	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/user-interact3.png	0%	Avira URL Cloud	safe
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1716675854&rnd=1198851487&si=f5af99a9e60f46adaabec28642c97c28&v=1.3.0&lv=2&sn=52110&r=0&ww=1280&u=http%3A%2F%2Fvrqvtg91272.cn%2Fsoft%2F08%2F&tt=%E7%BA%B8%E9%A3%9E%E6%9C%BA%E7%94%A8%E4%BB%80%E4%B9%88%E5%8A%A0%E9%80%9F%E5%99%A8%E5%A5%BD%E7%94%A8-%E6%9C%80%E6%96%B0%E7%89%88%2FAPP%2F%E4%B8%8B%E8%BD%BD%20-%20TG%E7%BA%B8%E9%A3%9E%E6%9C%BA(Telegram)%E5%AE%98%E6%96%B9%E7%89%88%E4%B8%8B%E8%BD%BD-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%AD%E6%96%87%E7%89%88%E4%B8%8B%E8%BD%BD%E5%AE%98%E7%BD%912024%E6%9C%80%E6%96%B0%E7%89%88	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/footer-bg.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp720/picture/shaps5.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/logotg.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp720/picture/1637864237157646.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp720/picture/1637863593133725.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp620/css/owl.carousel.min.css	0%	Avira URL Cloud	safe
https://www.telegremapp.me/img/picture/911807f65dfb4f8f20.jpg	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/1637863995405821.png	0%	Avira URL Cloud	safe
https://hmcdn.baidu.com/static/tongji/plugins/	0%	Avira URL Cloud	safe
https://www.telegremapp.me/img/SiteAndroid.jpg?2	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp720/picture/1637864147832485.png	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/css/magnific-popup.css	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp220/js/scripts.js	0%	Avira URL Cloud	safe
http://vrqvtg91272.cn/static/temp420/picture/1637864390903159.png	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	0%, Virustotal, Browse	unknown
a.nel.cloudflare.com	35.190.80.1	true	false	0%, Virustotal, Browse	unknown
google.com	142.250.186.46	true	false	1%, Virustotal, Browse	unknown
vrqvtg91272.cn	156.235.169.237	true	false	16%, Virustotal, Browse	unknown
js.users.51.la.w.cdngslb.com	163.181.92.243	true	false	0%, Virustotal, Browse	unknown
zcmcm.v.trpcdn.net	185.23.181.23	true	false	0%, Virustotal, Browse	unknown
pcdown91.telegrarndown936.com	38.34.166.72	true	false		unknown
www.google.com	142.250.184.196	true	false	0%, Virustotal, Browse	unknown
hm.e.shifen.com	183.240.98.228	true	false	0%, Virustotal, Browse	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	0%, Virustotal, Browse	unknown
www.telegremapp.me	104.21.38.129	true	false		unknown
www.telegermapp.ink	unknown	unknown	false		unknown
hm.baidu.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
ia.51.la	unknown	unknown	false	2%, Virustotal, Browse	unknown
js.users.51.la	unknown	unknown	false	4%, Virustotal, Browse	unknown

Name	Malicious	Antivirus Detection	Reputation
https://www.telegremapp.me/img/download_windows.jpg	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/1637864147832485.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/js/output.min.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/picture/logotg.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/1637863872179908.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/shaps2.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/user-interact3.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/1637863593133725.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/css/magnific-popup.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp620/picture/footer-bg.png	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/img/t_logo.svg	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/picture/shaps2.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/shaps1.png	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/js/jquery-2.1.3.min.js	false	Avira URL Cloud: safe	unknown
http://ia.51.la/go1?id=21568093&rt=1716675889458&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=0&vd=3&ce=1&cd=24&ds=&ing=3&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252Findex.html%2523blog&pu=	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/1637863734520890.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/css/style.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp120/picture/logotg.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/js/jquery-3.3.1.min.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/user-interact3.png	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.gif?cc=1&ck=1&cl=24-bit&ds=1280x1024&vl=907&et=0&ja=0&ln=en-us&lo=0&lt=1716675854&rnd=1198851487&si=f5af99a9e60f46adaabec28642c97c28&v=1.3.0&lv=2&sn=52110&r=0&ww=1280&u=http%3A%2F%2Fvrqvtg91272.cn%2Fsoft%2F08%2F&tt=%E7%BA%B8%E9%A3%9E%E6%9C%BA%E7%94%A8%E4%BB%80%E4%B9%88%E5%8A%A0%E9%80%9F%E5%99%A8%E5%A5%BD%E7%94%A8-%E6%9C%80%E6%96%B0%E7%89%88%2FAPP%2F%E4%B8%8B%E8%BD%BD%20-%20TG%E7%BA%B8%E9%A3%9E%E6%9C%BA(Telegram)%E5%AE%98%E6%96%B9%E7%89%88%E4%B8%8B%E8%BD%BD-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%AD%E6%96%87%E7%89%88%E4%B8%8B%E8%BD%BD%E5%AE%98%E7%BD%912024%E6%9C%80%E6%96%B0%E7%89%88	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/footer-bg.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/picture/shaps5.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/logotg.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/index.html#features	false		unknown
http://vrqvtg91272.cn/static/temp720/picture/1637864237157646.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/picture/1637863593133725.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp620/css/owl.carousel.min.css	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/img/picture/911807f65dfb4f8f20.jpg	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/1637863995405821.png	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/img/SiteAndroid.jpg?2	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/picture/1637864147832485.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/css/magnific-popup.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/js/scripts.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/1637864390903159.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/shaps5.png	false	Avira URL Cloud: safe	unknown
https://hm.baidu.com/hm.js?f5af99a9e60f46adaabec28642c97c28	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/js/scripts.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/ajax2.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp120/css/font-awesome.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/picture/1637862988996122.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/Telegram-an.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/1637863995405821.png	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/img/SiteLogos.png	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/js/language.js?0.1259567342506962	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/css/magnific-popup.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp120/css/magnific-popup.css	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/css/responsive.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/shaps4.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/1637863446965509.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/tj.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp620/picture/Telegram-an.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/css/owl.carousel.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp620/css/astyle.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/shaps6.png	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/img/vp-m.jpg	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp120/font/fontawesome-webfont.woff2	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/img/t_main_Android_demo.mp4	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/1637864237157646.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/css/font-awesome.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/font/fontawesome-webfont.woff2	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/font/fontawesome-webfont.woff2	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/shaps1.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp620/font/fontawesome-webfont.woff2	false	Avira URL Cloud: safe	unknown
https://www.telegremapp.me/	false		unknown
http://vrqvtg91272.cn/static/temp720/picture/shaps3.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/picture/Telegram-an.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/logotg.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/css/magnific-popup.css	false	Avira URL Cloud: safe	unknown
http://ia.51.la/go1?id=21568093&rt=1716675910898&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=0&vd=5&ce=1&cd=24&ds=&ing=5&ekc=&sid=1716675855892&tt=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E6%259B%25B4%25E6%2596%25B0-%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588%252FAPP%252F%25E4%25B8%258B%25E8%25BD%25BD%2520-%2520TG%25E4%25B8%25AD%25E6%2596%2587%25E7%25BD%2591&kw=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E6%259B%25B4%25E6%2596%25B0&cu=http%253A%252F%252Fvrqvtg91272.cn%252Fsoft%252F99003.html&pu=	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp620/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/css/astyle.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/css/owl.carousel.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/js/output.min.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/css/font-awesome.min.css	false	Avira URL Cloud: safe	unknown
http://ia.51.la/go1?id=21568093&rt=1716675876130&rl=1280*1024&lang=en-US&ct=unknow&pf=1&ins=0&vd=2&ce=1&cd=24&ds=&ing=2&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252Findex.html%2523features&pu=	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp620/picture/telegram-android.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/download.html	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/favicon.ico	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp420/js/output.min.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/picture/1637863446965509.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/js/output.min.js	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp720/picture/user-interact2.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp120/css/bootstrap.min.css	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp120/picture/telegram-android.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp220/picture/Telegram-an.png	false	Avira URL Cloud: safe	unknown
http://vrqvtg91272.cn/static/temp820/picture/1637863446965509.png	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://osx.telegram.org/updates/site/artboard.png)	chromecache_259.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://getbootstrap.com)	chromecache_249.2.dr	false	Avira URL Cloud: safe	unknown
https://hmcdn.baidu.com/static/tongji/plugins/	chromecache_272.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/twbs/bootstrap/blob/master/LICENSE)	chromecache_249.2.dr	false	Avira URL Cloud: safe	unknown
https://osx.telegram.org/updates/site/artboard_2x.png);	chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://twitter.com/intent/tweet?text=	chromecache_289.2.dr	false	URL Reputation: safe	unknown
https://gist.github.com/92d2ac1b31978642b6b6	chromecache_249.2.dr	false	Avira URL Cloud: safe	unknown
https://hmcdn.baidu.com/static	chromecache_272.2.dr	false	Avira URL Cloud: safe	unknown
https://telegram.org/	chromecache_289.2.dr	false	Avira URL Cloud: safe	unknown
http://tongji.baidu.com/hm-web/welcome/ico	chromecache_272.2.dr	false	Avira URL Cloud: safe	unknown
https://goutong.baidu.com/site/	chromecache_272.2.dr	false	Avira URL Cloud: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
163.181.92.225	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
111.45.3.198	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
163.181.92.243	js.users.51.la.w.cdngslb.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
185.23.181.23	zcmcm.v.trpcdn.net	Turkey	138915	KAOPU-HKKaopuCloudHKLimitedHK	false
156.235.169.237	vrqvtg91272.cn	Seychelles	134548	DXTL-HKDXTLTseungKwanOServiceHK	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.21.38.129	www.telegremapp.me	United States	13335	CLOUDFLARENETUS	false
183.240.98.228	hm.e.shifen.com	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
38.34.166.72	pcdown91.telegrarndown936.com	United States	174	COGENT-174US	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1447552
Start date and time:	2024-05-26 00:23:19 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://vrqvtg91272.cn/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.win@31/498@44/13
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: http://vrqvtg91272.cn/index.html#features Browse: http://vrqvtg91272.cn/index.html#blog Browse: http://vrqvtg91272.cn/soft/08/ Browse: http://vrqvtg91272.cn/download.html Browse: http://vrqvtg91272.cn/soft/99003.html Browse: http://vrqvtg91272.cn/soft/67552.html

Input	Output
URL: http://vrqvtg91272.cn/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login', 'Sign In', or similar submit button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/ Model: gpt-4o	```json { "riskscore": 0, "reasons": "The provided JavaScript code is a typical implementation of a tracking script from Baidu Analytics. It does not exhibit any malicious behavior such as data exfiltration, credential stealing, or unauthorized access. The long hexadecimal string in the URL is a tracking identifier and is considered no risk." }
var _hmt = _hmt \|\| []; (function() { var hm = document.createElement('script'); hm.src = 'https://hm.baidu.com/hm.js?f5af99a9e60f46adaabec28642c97c28'; var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(hm, s); })();
URL: http://vrqvtg91272.cn/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No submit button for the form is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/ Model: gpt-4o	```json { "riskscore": 2, "reasons": "The script dynamically loads an external JavaScript file based on the protocol (HTTP or HTTPS). While this behavior is not inherently malicious, it can potentially be used to load malicious scripts. The domains used (bdstatic.com and zhanzhang.baidu.com) are associated with Baidu, a legitimate search engine, which reduces the risk. However, caution is advised as external scripts can change over time." }
(function(){ var bp = document.createElement(script); var curProtocol = window.location.protocol.split(:)[0]; if (curProtocol === https) { bp.src = https://zz.bdstatic.com/linksubmit/push.js; } else { bp.src = http://push.zhanzhang.baidu.com/push.js; } var s = document.getElementsByTagName(script)[0]; s.parentNode.insertBefore(bp, s); })();
URL: http://vrqvtg91272.cn/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No input fields for username or password are present in the text.", "No submit button or link is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No input fields for username or password are present in the text.", "No submit button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No submit button for the form is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No submit button for the form is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: https://www.telegremapp.me/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/index.html#features Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/index.html#features Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No submit button for the form is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/index.html#blog Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/index.html#blog Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No submit button for the form is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/soft/08/ Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/soft/99003.html Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No form fields for username or password are present in the text.", "No 'Login' or 'Submit' button is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN
URL: http://vrqvtg91272.cn/soft/67552.html Model: Perplexity: mixtral-8x7b-instruct	{ "loginform": false, "reasons": [ "No input fields for username or password are present in the text.", "No submit button or link is present in the text." ] }
Telegram Telegram a new era of messaging IWI Telegram for Android Telegram Windows fikEY_PN

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat May 25 21:24:08 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9802365348743307
Encrypted:	false
SSDEEP:	48:8ud6TGqaHLidAKZdA19ehwiZUklqehgy+3:8zHy/y
MD5:	DED7B0611964495DE4445CC7C3BE65B2
SHA1:	1217D13316A0183DE2D2073D53ADA0EB5A81698F
SHA-256:	A78148BF74A0A47E7EF0678524D1FF8F3E48DEA86590A29E9FCC9F7534E60805
SHA-512:	BC7F18B4D78A2061303091105B7DECEE6DEE41A65B2DF84471F6588E4DEA3DE29EC40A277C853F1C17F93613CE3CBB3C4597061F083B143C076635E053B188B8
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....w.B...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I.X......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........O\.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 26, 2024 00:24:09.179388046 CEST	192.168.2.5	1.1.1.1	0x2f2e	Standard query (0)	vrqvtg91272.cn	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:09.179487944 CEST	192.168.2.5	1.1.1.1	0xb75	Standard query (0)	vrqvtg91272.cn	65	IN (0x0001)	false
May 26, 2024 00:24:11.354556084 CEST	192.168.2.5	1.1.1.1	0xc37	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:11.355324984 CEST	192.168.2.5	1.1.1.1	0x5ce7	Standard query (0)	www.google.com	65	IN (0x0001)	false
May 26, 2024 00:24:12.057502031 CEST	192.168.2.5	1.1.1.1	0xb005	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.058018923 CEST	192.168.2.5	1.1.1.1	0xf461	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
May 26, 2024 00:24:12.077023983 CEST	192.168.2.5	1.1.1.1	0x9d40	Standard query (0)	vrqvtg91272.cn	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.078748941 CEST	192.168.2.5	1.1.1.1	0xfb07	Standard query (0)	vrqvtg91272.cn	65	IN (0x0001)	false
May 26, 2024 00:24:12.732741117 CEST	192.168.2.5	1.1.1.1	0xd6d8	Standard query (0)	pcdown91.telegrarndown936.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.733262062 CEST	192.168.2.5	1.1.1.1	0x3ce7	Standard query (0)	pcdown91.telegrarndown936.com	65	IN (0x0001)	false
May 26, 2024 00:24:14.382843018 CEST	192.168.2.5	1.1.1.1	0x7306	Standard query (0)	www.telegremapp.me	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:14.383584023 CEST	192.168.2.5	1.1.1.1	0xfae5	Standard query (0)	www.telegremapp.me	65	IN (0x0001)	false
May 26, 2024 00:24:15.047555923 CEST	192.168.2.5	1.1.1.1	0xb1ea	Standard query (0)	js.users.51.la	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.047941923 CEST	192.168.2.5	1.1.1.1	0x8539	Standard query (0)	js.users.51.la	65	IN (0x0001)	false
May 26, 2024 00:24:16.798136950 CEST	192.168.2.5	1.1.1.1	0x40c5	Standard query (0)	www.telegremapp.me	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:16.798240900 CEST	192.168.2.5	1.1.1.1	0x5cfa	Standard query (0)	www.telegremapp.me	65	IN (0x0001)	false
May 26, 2024 00:24:18.183367014 CEST	192.168.2.5	1.1.1.1	0x220c	Standard query (0)	ia.51.la	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:18.183641911 CEST	192.168.2.5	1.1.1.1	0x9bc7	Standard query (0)	ia.51.la	65	IN (0x0001)	false
May 26, 2024 00:24:20.734786987 CEST	192.168.2.5	1.1.1.1	0xce9a	Standard query (0)	ia.51.la	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:20.735229015 CEST	192.168.2.5	1.1.1.1	0xd381	Standard query (0)	ia.51.la	65	IN (0x0001)	false
May 26, 2024 00:24:22.264671087 CEST	192.168.2.5	1.1.1.1	0xb57a	Standard query (0)	a.nel.cloudflare.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.264990091 CEST	192.168.2.5	1.1.1.1	0x8655	Standard query (0)	a.nel.cloudflare.com	65	IN (0x0001)	false
May 26, 2024 00:24:22.724113941 CEST	192.168.2.5	1.1.1.1	0xa107	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.724524021 CEST	192.168.2.5	1.1.1.1	0xe420	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
May 26, 2024 00:24:22.728878975 CEST	192.168.2.5	1.1.1.1	0x73f6	Standard query (0)	ia.51.la	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.729053020 CEST	192.168.2.5	1.1.1.1	0x9547	Standard query (0)	ia.51.la	65	IN (0x0001)	false
May 26, 2024 00:25:04.428093910 CEST	192.168.2.5	1.1.1.1	0x2904	Standard query (0)	www.telegermapp.ink	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.428884983 CEST	192.168.2.5	1.1.1.1	0xf064	Standard query (0)	www.telegermapp.ink	65	IN (0x0001)	false
May 26, 2024 00:25:04.455605030 CEST	192.168.2.5	1.1.1.1	0x4899	Standard query (0)	www.telegermapp.ink	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.476141930 CEST	192.168.2.5	1.1.1.1	0xa0b9	Standard query (0)	www.telegermapp.ink	65	IN (0x0001)	false
May 26, 2024 00:25:04.497299910 CEST	192.168.2.5	1.1.1.1	0x9cec	Standard query (0)	www.telegermapp.ink	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.621478081 CEST	192.168.2.5	8.8.8.8	0xd53c	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.622005939 CEST	192.168.2.5	1.1.1.1	0xe2b7	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:05.644974947 CEST	192.168.2.5	1.1.1.1	0xafdf	Standard query (0)	www.telegermapp.ink	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:05.645189047 CEST	192.168.2.5	1.1.1.1	0x2890	Standard query (0)	www.telegermapp.ink	65	IN (0x0001)	false
May 26, 2024 00:25:05.684211016 CEST	192.168.2.5	1.1.1.1	0xc656	Standard query (0)	www.telegermapp.ink	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:05.690121889 CEST	192.168.2.5	1.1.1.1	0xdf2f	Standard query (0)	www.telegermapp.ink	65	IN (0x0001)	false
May 26, 2024 00:25:15.707371950 CEST	192.168.2.5	1.1.1.1	0x86f4	Standard query (0)	js.users.51.la	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:15.707705975 CEST	192.168.2.5	1.1.1.1	0x4e2	Standard query (0)	js.users.51.la	65	IN (0x0001)	false
May 26, 2024 00:25:15.708097935 CEST	192.168.2.5	1.1.1.1	0xae2d	Standard query (0)	pcdown91.telegrarndown936.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:15.708097935 CEST	192.168.2.5	1.1.1.1	0xc8c1	Standard query (0)	pcdown91.telegrarndown936.com	65	IN (0x0001)	false
May 26, 2024 00:25:17.362339973 CEST	192.168.2.5	1.1.1.1	0x7515	Standard query (0)	hm.baidu.com	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:17.362731934 CEST	192.168.2.5	1.1.1.1	0xa86b	Standard query (0)	hm.baidu.com	65	IN (0x0001)	false
May 26, 2024 00:25:20.912170887 CEST	192.168.2.5	1.1.1.1	0xe081	Standard query (0)	www.telegermapp.ink	A (IP address)	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 26, 2024 00:24:09.696928024 CEST	1.1.1.1	192.168.2.5	0x2f2e	No error (0)	vrqvtg91272.cn		156.235.169.237	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:11.370939970 CEST	1.1.1.1	192.168.2.5	0xc37	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:11.396111012 CEST	1.1.1.1	192.168.2.5	0x5ce7	No error (0)	www.google.com			65	IN (0x0001)	false
May 26, 2024 00:24:12.107455015 CEST	1.1.1.1	192.168.2.5	0xb005	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:12.107455015 CEST	1.1.1.1	192.168.2.5	0xb005	No error (0)	hm.e.shifen.com		183.240.98.228	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.107455015 CEST	1.1.1.1	192.168.2.5	0xb005	No error (0)	hm.e.shifen.com		14.215.183.79	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.107455015 CEST	1.1.1.1	192.168.2.5	0xb005	No error (0)	hm.e.shifen.com		111.45.11.83	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.107455015 CEST	1.1.1.1	192.168.2.5	0xb005	No error (0)	hm.e.shifen.com		111.45.3.198	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.107455015 CEST	1.1.1.1	192.168.2.5	0xb005	No error (0)	hm.e.shifen.com		14.215.182.140	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.107502937 CEST	1.1.1.1	192.168.2.5	0xf461	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:12.750060081 CEST	1.1.1.1	192.168.2.5	0xd6d8	No error (0)	pcdown91.telegrarndown936.com		38.34.166.72	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:12.775278091 CEST	1.1.1.1	192.168.2.5	0x9d40	No error (0)	vrqvtg91272.cn		156.235.169.237	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:13.370711088 CEST	1.1.1.1	192.168.2.5	0xb75	Server failure (2)	vrqvtg91272.cn	none	none	65	IN (0x0001)	false
May 26, 2024 00:24:14.483458042 CEST	1.1.1.1	192.168.2.5	0x7306	No error (0)	www.telegremapp.me		104.21.38.129	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:14.483458042 CEST	1.1.1.1	192.168.2.5	0x7306	No error (0)	www.telegremapp.me		172.67.222.240	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:14.483472109 CEST	1.1.1.1	192.168.2.5	0xfae5	No error (0)	www.telegremapp.me			65	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la	js.users.51.la.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.243	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.245	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.246	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.249	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.250	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.225	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.226	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.119415998 CEST	1.1.1.1	192.168.2.5	0xb1ea	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.241	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:15.332000017 CEST	1.1.1.1	192.168.2.5	0x8539	No error (0)	js.users.51.la	js.users.51.la.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:16.216052055 CEST	1.1.1.1	192.168.2.5	0xfb07	Server failure (2)	vrqvtg91272.cn	none	none	65	IN (0x0001)	false
May 26, 2024 00:24:16.817233086 CEST	1.1.1.1	192.168.2.5	0x5cfa	No error (0)	www.telegremapp.me			65	IN (0x0001)	false
May 26, 2024 00:24:16.817243099 CEST	1.1.1.1	192.168.2.5	0x40c5	No error (0)	www.telegremapp.me		104.21.38.129	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:16.817243099 CEST	1.1.1.1	192.168.2.5	0x40c5	No error (0)	www.telegremapp.me		172.67.222.240	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:18.280595064 CEST	1.1.1.1	192.168.2.5	0x220c	No error (0)	ia.51.la	ia.51.la.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:18.280595064 CEST	1.1.1.1	192.168.2.5	0x220c	No error (0)	ia.51.la.trpcdn.net	zcmcm.v.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:18.280595064 CEST	1.1.1.1	192.168.2.5	0x220c	No error (0)	zcmcm.v.trpcdn.net		185.23.181.23	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:18.280595064 CEST	1.1.1.1	192.168.2.5	0x220c	No error (0)	zcmcm.v.trpcdn.net		154.85.69.254	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:18.280606031 CEST	1.1.1.1	192.168.2.5	0x9bc7	No error (0)	ia.51.la	ia.51.la.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:18.280606031 CEST	1.1.1.1	192.168.2.5	0x9bc7	No error (0)	ia.51.la.trpcdn.net	zcmcm.v.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:20.783143997 CEST	1.1.1.1	192.168.2.5	0xce9a	No error (0)	ia.51.la	ia.51.la.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:20.783143997 CEST	1.1.1.1	192.168.2.5	0xce9a	No error (0)	ia.51.la.trpcdn.net	zcmcm.v.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:20.783143997 CEST	1.1.1.1	192.168.2.5	0xce9a	No error (0)	zcmcm.v.trpcdn.net		154.85.69.254	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:20.783143997 CEST	1.1.1.1	192.168.2.5	0xce9a	No error (0)	zcmcm.v.trpcdn.net		185.23.181.23	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:20.783157110 CEST	1.1.1.1	192.168.2.5	0xd381	No error (0)	ia.51.la	ia.51.la.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:20.783157110 CEST	1.1.1.1	192.168.2.5	0xd381	No error (0)	ia.51.la.trpcdn.net	zcmcm.v.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:22.272219896 CEST	1.1.1.1	192.168.2.5	0xb57a	No error (0)	a.nel.cloudflare.com		35.190.80.1	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.776388884 CEST	1.1.1.1	192.168.2.5	0xa107	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:22.776388884 CEST	1.1.1.1	192.168.2.5	0xa107	No error (0)	hm.e.shifen.com		111.45.3.198	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.776388884 CEST	1.1.1.1	192.168.2.5	0xa107	No error (0)	hm.e.shifen.com		14.215.183.79	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.776388884 CEST	1.1.1.1	192.168.2.5	0xa107	No error (0)	hm.e.shifen.com		14.215.182.140	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.776388884 CEST	1.1.1.1	192.168.2.5	0xa107	No error (0)	hm.e.shifen.com		111.45.11.83	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.776388884 CEST	1.1.1.1	192.168.2.5	0xa107	No error (0)	hm.e.shifen.com		183.240.98.228	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.776418924 CEST	1.1.1.1	192.168.2.5	0x73f6	No error (0)	ia.51.la	ia.51.la.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:22.776418924 CEST	1.1.1.1	192.168.2.5	0x73f6	No error (0)	ia.51.la.trpcdn.net	zcmcm.v.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:22.776418924 CEST	1.1.1.1	192.168.2.5	0x73f6	No error (0)	zcmcm.v.trpcdn.net		185.23.181.23	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.776418924 CEST	1.1.1.1	192.168.2.5	0x73f6	No error (0)	zcmcm.v.trpcdn.net		154.85.69.254	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:22.987607002 CEST	1.1.1.1	192.168.2.5	0xe420	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:23.231319904 CEST	1.1.1.1	192.168.2.5	0x9547	No error (0)	ia.51.la	ia.51.la.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:23.231319904 CEST	1.1.1.1	192.168.2.5	0x9547	No error (0)	ia.51.la.trpcdn.net	zcmcm.v.trpcdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:23.686079025 CEST	1.1.1.1	192.168.2.5	0x8a5f	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:23.686079025 CEST	1.1.1.1	192.168.2.5	0x8a5f	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
May 26, 2024 00:24:24.528599024 CEST	1.1.1.1	192.168.2.5	0x9fdd	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:24:24.528599024 CEST	1.1.1.1	192.168.2.5	0x9fdd	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.450704098 CEST	1.1.1.1	192.168.2.5	0x2904	Server failure (2)	www.telegermapp.ink	none	none	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.473586082 CEST	1.1.1.1	192.168.2.5	0xf064	Server failure (2)	www.telegermapp.ink	none	none	65	IN (0x0001)	false
May 26, 2024 00:25:04.496303082 CEST	1.1.1.1	192.168.2.5	0x4899	Server failure (2)	www.telegermapp.ink	none	none	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.515022039 CEST	1.1.1.1	192.168.2.5	0xa0b9	Server failure (2)	www.telegermapp.ink	none	none	65	IN (0x0001)	false
May 26, 2024 00:25:04.543740034 CEST	1.1.1.1	192.168.2.5	0x9cec	Server failure (2)	www.telegermapp.ink	none	none	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.628030062 CEST	8.8.8.8	192.168.2.5	0xd53c	No error (0)	google.com		142.250.186.46	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:04.675291061 CEST	1.1.1.1	192.168.2.5	0xe2b7	No error (0)	google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:05.657480955 CEST	1.1.1.1	192.168.2.5	0xafdf	Server failure (2)	www.telegermapp.ink	none	none	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:05.689673901 CEST	1.1.1.1	192.168.2.5	0x2890	Server failure (2)	www.telegermapp.ink	none	none	65	IN (0x0001)	false
May 26, 2024 00:25:05.694464922 CEST	1.1.1.1	192.168.2.5	0xc656	Server failure (2)	www.telegermapp.ink	none	none	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:05.748130083 CEST	1.1.1.1	192.168.2.5	0xdf2f	Server failure (2)	www.telegermapp.ink	none	none	65	IN (0x0001)	false
May 26, 2024 00:25:15.781903028 CEST	1.1.1.1	192.168.2.5	0x4e2	No error (0)	js.users.51.la	js.users.51.la.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:25:15.803364992 CEST	1.1.1.1	192.168.2.5	0xae2d	No error (0)	pcdown91.telegrarndown936.com		38.34.166.72	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la	js.users.51.la.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.225	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.241	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.250	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.226	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.249	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.243	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.245	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:16.014708996 CEST	1.1.1.1	192.168.2.5	0x86f4	No error (0)	js.users.51.la.w.cdngslb.com		163.181.92.246	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:17.434165955 CEST	1.1.1.1	192.168.2.5	0x7515	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:25:17.434165955 CEST	1.1.1.1	192.168.2.5	0x7515	No error (0)	hm.e.shifen.com		111.45.3.198	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:17.434165955 CEST	1.1.1.1	192.168.2.5	0x7515	No error (0)	hm.e.shifen.com		14.215.183.79	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:17.434165955 CEST	1.1.1.1	192.168.2.5	0x7515	No error (0)	hm.e.shifen.com		183.240.98.228	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:17.434165955 CEST	1.1.1.1	192.168.2.5	0x7515	No error (0)	hm.e.shifen.com		111.45.11.83	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:17.434165955 CEST	1.1.1.1	192.168.2.5	0x7515	No error (0)	hm.e.shifen.com		14.215.182.140	A (IP address)	IN (0x0001)	false
May 26, 2024 00:25:17.434180021 CEST	1.1.1.1	192.168.2.5	0xa86b	No error (0)	hm.baidu.com	hm.e.shifen.com		CNAME (Canonical name)	IN (0x0001)	false
May 26, 2024 00:25:20.929617882 CEST	1.1.1.1	192.168.2.5	0xe081	Server failure (2)	www.telegermapp.ink	none	none	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
May 26, 2024 00:24:12.892579079 CEST	300	OUT	GET /static/temp820/picture/shaps3.png HTTP/1.1 Host: vrqvtg91272.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:24:13.782665014 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:13 GMT Content-Type: image/png Content-Length: 1150 Last-Modified: Thu, 12 Oct 2023 13:52:22 GMT Connection: keep-alive ETag: "6527fa16-47e" Expires: Mon, 24 Jun 2024 22:24:13 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 23 00 00 00 23 08 03 00 00 00 29 07 43 6b 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 01 6b 50 4c 54 45 00 00 00 00 00 00 69 69 69 d1 d1 d1 cf cf cf 95 95 95 d1 d1 d1 00 00 00 cf cf cf af af af d1 d1 d1 d1 d1 d1 00 00 00 cf cf cf d1 d1 d1 c1 c1 c1 d1 d1 d1 b8 b8 b8 d1 d1 d1 cc cc cc 00 00 00 cb cb cb 69 69 69 c3 c3 c3 ca ca ca d0 d0 d0 d0 d0 d0 7d 7d 7d 00 00 00 70 70 70 d0 d0 d0 ba ba ba ca ca ca cf cf cf cf cf cf d0 d0 d0 d1 d1 d1 c9 c9 c9 00 00 00 c8 c8 c8 cf cf cf cf cf cf cf cf cf cc cc cc 2f 2f 2f 1a 1a 1a ca ca ca cf cf cf d0 d0 d0 cf cf cf 7d 7d 7d cf cf cf ca ca ca b0 b0 b0 00 00 00 c6 c6 c6 d0 d0 d0 8b 8b 8b d0 d0 d0 d1 d1 d1 c7 c7 c7 c7 c7 c7 d1 d1 d1 00 00 00 8b 8b 8b d0 d0 d0 c3 c3 c3 c2 c2 c2 95 95 95 d0 d0 d0 bd bd bd bd bd bd d1 d1 d1 d0 d0 d0 a2 a2 a2 d0 d0 d0 9e 9e 9e 94 94 94 d0 d0 d0 [TRUNCATED] Data Ascii: PNGIHDR##)CkgAMAa cHRMz&u0`:pQ<kPLTEiiiiii}}}ppp///}}}ooo999FFFTC~wtRNSTo)"\|t-_6fc[Q OVRJG?<BCUt3]`mqL$%srxibKGDHpHYs~IDAT8}[0[QT\*G- jTEYE\|}4mwt3tbYi]wV,Q hl8h$D>hnA+ZS&.qjAH{.hM{zqz=]+T.nxw3>E-ZoKjrD#@al\>r#`tDSLL\|ZQ1=P{!ug0/CAFq7pQ#K0/{,iL
May 26, 2024 00:24:13.787455082 CEST	218	IN	Data Raw: 35 d5 32 2b 08 4d ae b7 58 c9 65 56 51 a6 b7 6b ef d6 68 7d 8f d5 2c 23 14 b3 8e 8a bf b1 b9 85 ed 0f 1f fd 4f 58 57 8c c8 32 15 7c fe f2 95 3f ef b7 ef 3f 50 49 31 9c 8c 7a 97 5e 19 3f 81 d2 ce af 9d 12 b0 8b 32 21 11 c3 07 66 0a 0a 81 bd fd 03 Data Ascii: 52+MXeVQkh},#OXW2\|??PI1z^?2!f*`r,GG8LR?~'MbO'(p5XrDg1da~z=7.QPJXUPFUj!4U7PW8CIENDB`
May 26, 2024 00:24:15.737859964 CEST	423	OUT	GET /static/temp820/picture/1637864237157646.png HTTP/1.1 Host: vrqvtg91272.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_f5af99a9e60f46adaabec28642c97c28=1716675854; Hm_lpvt_f5af99a9e60f46adaabec28642c97c28=1716675854
May 26, 2024 00:24:16.062566996 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:15 GMT Content-Type: image/png Content-Length: 16232 Last-Modified: Thu, 12 Oct 2023 13:52:24 GMT Connection: keep-alive ETag: "6527fa18-3f68" Expires: Mon, 24 Jun 2024 22:24:15 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 04 67 41 4d 41 00 00 b1 8e 7c fb 51 93 00 00 00 20 63 48 52 4d 00 00 7a 25 00 00 80 83 00 00 f9 ff 00 00 80 e9 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 6f 92 5f c5 46 00 00 3e de 49 44 41 54 78 da 62 fc ff ff 3f c3 28 18 05 c4 02 80 00 62 1a 0d 82 51 40 0a 00 08 a0 d1 04 33 0a 48 02 00 01 34 9a 60 46 01 49 00 20 80 58 28 d1 bc a1 b3 78 b8 86 0b 37 10 9b 00 b1 0e 10 6b 02 b1 3c 10 4b 02 31 2f 10 33 02 31 a8 e1 f7 19 88 df 00 f1 33 20 3e 03 c4 3b 80 f8 3e 54 6e 50 81 80 f2 5e aa 99 05 10 40 2c a3 79 06 0e 38 81 d8 0e 88 bd 81 d8 19 88 b5 48 d0 9b 08 c4 df 80 f8 34 10 af 03 e2 15 40 fc 6a 38 06 12 40 00 8d 26 18 08 30 00 e2 99 40 6c 06 e2 fc fb f7 8f e1 ef df bf 0c c8 3d 48 10 9b 99 99 19 52 bc fc fb 0b 56 f3 1f 5a 98 30 31 32 31 30 31 b3 70 31 31 33 d9 33 32 32 d9 03 85 72 80 b8 00 88 b7 0d b7 80 02 08 40 2e dd dc 20 08 44 51 14 [TRUNCATED] Data Ascii: PNGIHDRA>pHYsgAMA\|Q cHRMz%u0`:o_F>IDATxb?(bQ@3H4`FI X(x7k<K1/313 >;>TnP^@,y8H4@j8@&0@l=HRVZ012101p113322r@. DQ>_`BbvbBtoE8px9EDR9G<S7nkOw6"9QVY&Wyzv4L(,?0?`c`W``\@/p9`%D9 Fjann %)N< /,'^10qK&`hmi pngnKPITqzHL0@jAXD2K#S/{moU7]@$.bgorHJ0B@<AP$$$VF_XKliT1K?fa!6`[hWfS`qR\FSPDIwujoJ}}}y99aH_}\|c!3+O`Il3%5@`@:fQUQa'
May 26, 2024 00:24:16.062577963 CEST	224	IN	Data Raw: 22 23 01 01 13 c8 ff df bf 18 fe bc bc cf f0 ff e7 57 86 bf 40 f1 ff 7f 7e 33 58 78 06 31 88 c8 c8 03 ab a7 6f a0 52 2a 1c a8 81 75 28 06 24 40 00 8d 94 04 d3 0e cc d9 e2 a0 c4 22 25 25 05 2e 5d c8 2b 55 88 0d 55 26 70 95 f5 f7 35 b0 a4 f9 f6 81 Data Ascii: "#W@~3Xx1oR*u($@"%%.]+UU&p5,D3 FB&pPbvA!PbPovff`63J}&@c%Q[`/<0j;pRJ
May 26, 2024 00:24:16.062586069 CEST	1236	IN	Data Raw: 7f 7f ff 91 01 aa 28 1a 6a 01 0a 10 40 c3 3d c1 80 66 47 99 40 25 8a 92 b2 32 b8 67 f4 07 d8 e0 a5 2b 00 26 1a 50 03 f8 df e7 77 e0 ae f8 bf 1f 3f 18 84 81 89 06 d8 35 03 c9 86 32 40 26 36 c1 23 ca b4 c2 d4 04 00 01 34 9c bb d5 8e 40 ec 0f aa 7a Data Ascii: (j@=fG@%2g+&Pw?52@&6#4@z@^###]ece` 3KE5`h8'8PT(8FoPs`)kFaYv`FQKR//}E'KB5h&4A"z}L
May 26, 2024 00:24:16.063366890 CEST	1236	IN	Data Raw: a5 0f 0c 40 fb 80 0d f5 21 91 60 00 02 68 38 b6 61 fe fd 05 c6 02 1f b0 d7 c3 05 cc e9 7f 3e 7c 64 f8 0e ec b5 fc 7f f3 9e 41 43 5a 82 81 83 15 b1 6e a9 ac ac 8c e1 c0 81 03 0c 11 11 e0 b5 55 0c 4a 0a d2 0c 32 c0 52 09 ef 04 25 68 04 97 8d 83 e1 Data Ascii: @!`h8a>\|dACZnUJ2R%hex?f`g'4'\KPPd0BP\<oF0F<!bC=da-p5R}rn.R~9
May 26, 2024 00:24:16.063380003 CEST	1236	IN	Data Raw: c8 ae ed c4 f0 ee eb 2f d0 b9 32 20 47 00 53 1e c3 cb a1 10 b8 00 01 34 5c 57 dc 5d 63 84 ee 97 fe 02 2c f6 b9 b9 b9 71 26 18 d0 46 7a d0 68 ed d7 cb bb 18 be df 3a c6 f0 e7 fd 73 60 0d f3 8a e1 ff af 2f c0 84 03 5a 98 fd 0f 9c 04 39 c4 19 18 c4 Data Ascii: /2 GS4\W]c,q&Fzh:s`/Z98fA[]kq"OPa}ef`x[?U{`cy9"}}A\#08=8Wal,3ZmX~>q".lA& <buL30_T#"hXd
May 26, 2024 00:24:16.063389063 CEST	1236	IN	Data Raw: 20 ea 21 04 2c 85 80 91 0d ec d1 30 80 a6 80 40 8b c7 91 e7 9a a0 69 02 5c 1d 31 21 37 76 a1 d5 d3 7f 60 a2 7c fd 87 e1 db 83 af 0c 1f 80 dd ea af 37 be 30 b0 72 fc 67 e0 64 fe cb f0 52 c0 90 e1 b5 b0 fe 54 de 2f 0f ee d1 63 3b a0 02 15 cd 02 08 Data Ascii: !,0@i\1!7v`\|70rgdRT/c;`@X{,fA<9:lc~*l,&1h\|QRw\|Vi~2\|]T+0S.97"_12%5r+@:
May 26, 2024 00:24:16.064142942 CEST	1236	IN	Data Raw: 7c ff 46 df 7d cd a0 63 3d 58 e1 33 e5 e0 d2 45 62 a8 26 18 80 00 1a 8c 09 06 74 4e 4a 27 88 01 2a 0d 74 74 74 18 38 38 38 e0 a5 0b ac 94 f8 81 d8 06 0b 6a 9f 5c 23 c2 5c 3e 68 6a a3 ec 48 32 52 1b 2c a0 c3 a5 81 09 9b 1d e8 07 a4 2a 54 7e a8 26 Data Ascii: \|F}c=X3Eb&tNJ'ttt888j\#\>hjH2R,T~&th4VFF\|eOCAW`)"~H(`\<vJ@-q>t.(>v [e@l)GiPM04@LSUo@C5A#<e
May 26, 2024 00:24:16.064153910 CEST	552	IN	Data Raw: 0c 68 84 33 09 d6 76 91 91 95 25 b0 ed 03 69 2c 06 d8 4e 79 ff f6 2d c3 63 e8 e0 1d a8 3a e2 e7 e5 25 65 07 c1 c0 02 60 1b 06 74 6e ef df d7 8f c0 3b 11 40 ee 07 6d 96 34 72 f6 65 b0 77 f7 61 e0 60 63 81 8d 15 45 02 55 9f 03 62 4b cc 3e 12 23 c3 Data Ascii: h3v%i,Ny-c:%e`tn;@m4rewa`cEUbK>#_H0~D&\|=#`bo7o^TLlpY4_Z^\|E'0K`B4@@Wal&!+L^z@lSm
May 26, 2024 00:24:16.065726995 CEST	1236	IN	Data Raw: 30 08 08 c8 30 58 f3 70 33 dc fc fc 8f e1 fd 7f 71 20 16 0b fe fd 9f b5 f9 ff 7f a6 4a 17 ce b5 0c ac 0c bf 06 64 5a 00 04 00 02 88 c2 8b ce 99 48 c8 5b a0 4a f7 bf 1d a8 28 fd c9 c0 cd c0 cf c1 c8 c0 7c 73 06 03 c3 b3 a3 0c 0c df 9e 02 03 f3 27 Data Ascii: 00Xp3q JdZH[J(\|s'8Ae`!/E1(=`AR24aZW' ._}b,m8Yv'pN{ (\|kg.Q$;w>jlWW5
May 26, 2024 00:24:16.065737963 CEST	1236	IN	Data Raw: 54 04 46 0e e8 e8 7e 50 8f 09 d8 7e 60 ba d4 c1 c0 f8 f1 3a 64 1c 84 aa 89 06 68 16 0b 0f b0 61 7b 93 81 e9 e6 1c c8 40 1c 48 ec db 5b 86 7f d6 35 0c 7f 22 8f 33 fc 51 04 16 b0 3f bf 41 ce f8 a5 c8 af c0 76 de 57 24 bf 82 32 46 00 30 d3 e9 b3 43 Data Ascii: TF~P~`:dha{@H[5"3Q?AvW$2F0C2[dL0D>_ucrB8mLdn>,"/uB.#34li}{u"FPlZ0@c*1p@#$"biZ%
May 26, 2024 00:24:16.275656939 CEST	423	OUT	GET /static/temp820/picture/1637863593133725.png HTTP/1.1 Host: vrqvtg91272.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_f5af99a9e60f46adaabec28642c97c28=1716675854; Hm_lpvt_f5af99a9e60f46adaabec28642c97c28=1716675854
May 26, 2024 00:24:16.598906994 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:16 GMT Content-Type: image/png Content-Length: 18138 Last-Modified: Thu, 12 Oct 2023 13:52:24 GMT Connection: keep-alive ETag: "6527fa18-46da" Expires: Mon, 24 Jun 2024 22:24:16 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 04 67 41 4d 41 00 00 b1 8e 7c fb 51 93 00 00 00 20 63 48 52 4d 00 00 7a 25 00 00 80 83 00 00 f9 ff 00 00 80 e9 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 6f 92 5f c5 46 00 00 46 50 49 44 41 54 78 da 62 fc ff ff 3f c3 28 18 05 c4 02 80 00 62 1a 0d 82 51 40 0a 00 08 a0 d1 04 33 0a 48 02 00 01 34 9a 60 46 01 49 00 20 80 46 13 cc 28 20 09 00 04 d0 68 82 19 05 24 01 80 00 1a 4d 30 a3 80 24 00 10 40 a3 09 66 14 90 04 00 02 68 34 c1 8c 02 92 00 40 00 b1 90 a2 b8 b0 93 7b 24 84 89 2e 10 57 01 f1 5a 20 5e 33 c4 dc ee 05 c4 09 40 dc 0c c4 97 09 29 ee 2f ff 4a b2 05 00 01 34 5a c2 60 02 3f 20 8e 00 e2 55 40 9c 32 84 dc 6d 0f c4 cb 81 38 14 94 b7 69 65 09 40 00 b1 8c a6 0f 0c f0 18 4a 33 02 f1 2c 20 fe 05 c4 8b c8 30 87 1d 88 f9 80 58 00 88 39 a1 62 a0 79 98 ef 40 0c ca da 9f 80 f8 27 10 ff a1 82 9b cd a0 09 9c 0f 6a c7 0e 5a 05 0e 40 00 8d [TRUNCATED] Data Ascii: PNGIHDRA>pHYsgAMA\|Q cHRMz%u0`:o_FFPIDATxb?(bQ@3H4`FI F( h$M0$@fh4@{$.WZ ^3@)/J4Z`? U@2m8ie@J3, 0X9by@'jZ@&Lt89?FE,+4K13#%@k(K ~M=u@,BM@&L/bq @NXT"&rp2BcddTb& ffff`dbpN^h{)j @7!@!P]@\8N(l,<\l\l`1ff&hb&Nvv3}gf13120I211MU-VA2@KCXbFZ@1a(b(0*XXxEx@ ^DDd?}h+W/hbL< CK;Pb[q#@%a94r@0pr0p)J +LoXX 7 /`i~{w(s
May 26, 2024 00:24:22.699546099 CEST	554	OUT	GET /static/temp820/picture/footer-bg.png HTTP/1.1 Host: vrqvtg91272.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_f5af99a9e60f46adaabec28642c97c28=1716675854; Hm_lpvt_f5af99a9e60f46adaabec28642c97c28=1716675854; __tins__21568093=%7B%22sid%22%3A%201716675855892%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201716677655892%7D; __51cke__=; __51laig__=1
May 26, 2024 00:24:23.023607969 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:22 GMT Content-Type: image/png Content-Length: 9284 Last-Modified: Thu, 12 Oct 2023 13:52:22 GMT Connection: keep-alive ETag: "6527fa16-2444" Expires: Mon, 24 Jun 2024 22:24:22 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 07 66 00 00 02 0d 08 06 00 00 00 e5 48 1f 51 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 00 00 00 00 00 f9 43 bb 7f 00 00 00 09 70 48 59 73 00 00 0b 12 00 00 0b 12 01 d2 dd 7e fc 00 00 23 a8 49 44 41 54 78 da ed dd 79 97 14 75 b6 ef e1 af 88 a4 99 88 c2 51 71 02 45 bb 8f ed 51 7b 3a f7 fd bf 82 7b fa dc d6 76 d6 76 c2 a1 6d 07 26 8d 30 10 f0 fe 11 19 46 16 14 08 58 9b 5f 0d cf b3 56 ac 88 cc 2c 8a 5d f4 5a ac 96 cf da 11 f7 05 00 00 80 7b ae ef 86 a3 49 8e ac 5f 1e 4a f2 c8 c6 c7 9b 9f dd 9f e4 e1 db fc ec a1 24 0f ac af 0f 27 39 76 9b 9f 1d 5b bf 77 bd 87 d7 bf c7 76 8e 27 b9 6f 9b f7 ef 5b 7f 76 a7 96 49 1e dc 81 3f da ed 5c 4b 72 e1 2e 7f ed 8f 49 fa 5b 7c fe 53 92 ef b7 79 ff 72 92 1f b6 79 ff 62 92 ab 1b af 7f 58 7f ed 64 48 d2 6d bc be ba fe 35 9b ce 5d f7 fa 52 92 2b db 7c bf 6e [TRUNCATED] Data Ascii: PNGIHDRfHQgAMAa cHRMz&u0`:pQ<bKGDCpHYs~#IDATxyuQqEQ{:{vvm&0FX_V,]Z{I_J$'9v[wv'o[vI?\Kr.I[\|SyrybXdHm5]R+\|n96v`wadd:?9.3/?Sf#h6Grc\|Jl}f=\|;MD9G=9[w<8Ou:O{nn\|RMi\-irz35aVS=>/LOd:=5}Tbxv)Nn}>c12F3mOk,}7L3cu9N{`gL3Gs?^_=Zgeuee!vq5{_1^kp{>cq>_~r@wMG8_9v/fqzYd\|&l~dc:_>s68rJ1=)Nu\|j=?p3Fsq2
May 26, 2024 00:24:24.057193041 CEST	529	OUT	GET /favicon.ico HTTP/1.1 Host: vrqvtg91272.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_f5af99a9e60f46adaabec28642c97c28=1716675854; Hm_lpvt_f5af99a9e60f46adaabec28642c97c28=1716675854; __tins__21568093=%7B%22sid%22%3A%201716675855892%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201716677655892%7D; __51cke__=; __51laig__=1
May 26, 2024 00:24:24.376718998 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:24 GMT Content-Type: image/x-icon Content-Length: 15086 Last-Modified: Sat, 02 Mar 2024 09:35:13 GMT Connection: keep-alive ETag: "65e2f2d1-3aee" Accept-Ranges: bytes Data Raw: 00 00 01 00 03 00 30 30 00 00 01 00 20 00 a8 25 00 00 36 00 00 00 20 20 00 00 01 00 20 00 a8 10 00 00 de 25 00 00 10 10 00 00 01 00 20 00 68 04 00 00 86 36 00 00 28 00 00 00 30 00 00 00 60 00 00 00 01 00 20 00 00 00 00 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da 9e 22 0d d9 9e 22 36 d9 9e 22 6f d9 9e 22 a4 d9 9e 22 cd d9 9e 22 e7 d9 9e 22 f7 d9 9e 22 fe d9 9e 22 fe d9 9e 22 f7 d9 9e 22 e7 d9 9e 22 cd d9 9e 22 a4 d9 9e 22 6f d9 9e 22 36 da 9e 23 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: 00 %6 % h6(0` $""6"o"""""""""""o"6###("s"""""""""""""""""s#(###-#######################-###}#########################}##:########################
May 26, 2024 00:24:35.093213081 CEST	561	OUT	GET /static/temp720/picture/1637863446965509.png HTTP/1.1 Host: vrqvtg91272.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_f5af99a9e60f46adaabec28642c97c28=1716675854; __tins__21568093=%7B%22sid%22%3A%201716675855892%2C%20%22vd%22%3A%201%2C%20%22expires%22%3A%201716677655892%7D; __51cke__=; __51laig__=1; Hm_lpvt_f5af99a9e60f46adaabec28642c97c28=1716675873
May 26, 2024 00:24:35.409564972 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:35 GMT Content-Type: image/png Content-Length: 13564 Last-Modified: Thu, 12 Oct 2023 13:52:24 GMT Connection: keep-alive ETag: "6527fa18-34fc" Expires: Mon, 24 Jun 2024 22:24:35 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 04 67 41 4d 41 00 00 b1 8e 7c fb 51 93 00 00 00 20 63 48 52 4d 00 00 7a 25 00 00 80 83 00 00 f9 ff 00 00 80 e9 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 6f 92 5f c5 46 00 00 34 72 49 44 41 54 78 da 62 fc ff ff 3f c3 28 18 05 c4 02 80 00 62 1a 0d 82 51 40 0a 00 08 a0 d1 04 33 0a 48 02 00 01 34 9a 60 46 01 49 00 20 80 46 13 cc 28 20 09 00 04 d0 68 82 19 05 24 01 80 00 62 21 46 11 07 07 fb 48 0a 13 46 20 16 01 62 65 20 d6 00 62 1d 20 96 80 8a 09 03 31 2f 10 b3 01 31 2c 50 7e 00 f1 4f 20 fe 04 c4 2f 80 f8 39 10 df 01 e2 e3 40 7c 1e 88 bf 0f 16 8f fd f8 f1 93 62 33 00 02 88 65 88 46 2a 0f 14 ff 83 46 d4 0f 2a 98 a9 07 c4 5e 40 ec 09 c4 9a 40 2c f4 9f 81 81 f9 ff bf ff 0c ff fe fd 63 00 0d 3f fc 03 0d 41 e0 1a 86 60 64 64 60 62 02 61 26 06 26 20 9b 91 91 f1 2f 50 f4 1e 10 1f 01 e2 e5 40 bc 7b 38 e4 26 80 00 62 24 66 1c 66 90 94 30 2a [TRUNCATED] Data Ascii: PNGIHDRA>pHYsgAMA\|Q cHRMz%u0`:o_F4rIDATxb?(bQ@3H4`FI F( h$b!FHF be b 1/1,P~O /9@\|b3eFF^@@,c?A`dd`ba&& /P@{8&b$ff0@@7k]-N0os(~A!&(\|17 _Z@?77;3333(z\|0\|#FVDC@] QMZTgp]<ME(!E)P\&0'r& 565cP9/HWC%YhnR8> ^-g4D`?\w>oSU0B\c`N0@cd%5x^y;Oof_Bs8~320i*1XhKf> 48JPu? X###R@%8u2=yl'_3?m(&f",t~pp<3\|?Wp6i\|bJWFE0P
May 26, 2024 00:24:51.190097094 CEST	561	OUT	GET /static/temp420/picture/1637863995405821.png HTTP/1.1 Host: vrqvtg91272.cn Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: Hm_lvt_f5af99a9e60f46adaabec28642c97c28=1716675854; __51cke__=; Hm_lpvt_f5af99a9e60f46adaabec28642c97c28=1716675889; __tins__21568093=%7B%22sid%22%3A%201716675855892%2C%20%22vd%22%3A%203%2C%20%22expires%22%3A%201716677689458%7D; __51laig__=3
May 26, 2024 00:24:51.567670107 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:51 GMT Content-Type: image/png Content-Length: 21476 Last-Modified: Thu, 12 Oct 2023 13:52:24 GMT Connection: keep-alive ETag: "6527fa18-53e4" Expires: Mon, 24 Jun 2024 22:24:51 GMT Cache-Control: max-age=2592000 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 8c 00 00 00 8c 08 06 00 00 00 ae c0 41 3e 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 04 67 41 4d 41 00 00 b1 8e 7c fb 51 93 00 00 00 20 63 48 52 4d 00 00 7a 25 00 00 80 83 00 00 f9 ff 00 00 80 e9 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 6f 92 5f c5 46 00 00 53 5a 49 44 41 54 78 da 62 fc ff ff 3f c3 28 18 05 c4 02 80 00 62 1a 0d 82 51 40 0a 00 08 a0 d1 04 33 0a 48 02 00 01 34 9a 60 46 01 49 00 20 80 46 13 cc 28 20 09 00 04 10 0b 21 05 bf 27 8a 8f 86 d2 40 45 0e 30 3b 7f f8 c1 c0 60 35 f9 2f c3 cb cf 0c 0c ac cc 14 19 97 0e c4 46 50 1a 2b 78 f9 e6 0d 41 43 00 02 68 b4 84 19 c4 e0 cf 3f 06 06 41 5e 06 86 78 13 26 86 6f bf 29 36 ce 14 88 3d 81 98 9d 12 43 00 02 68 34 c1 0c fa 54 c3 c0 90 6c c6 c8 20 c5 c7 c0 f0 f3 0f 45 26 7d 07 e2 0f a0 4a 83 12 43 00 02 88 65 04 46 01 17 10 4b 02 31 a8 ae 15 01 62 60 54 30 f0 42 69 6e 20 e6 04 62 66 b4 80 fe 04 c4 5f a0 7c 46 20 be 09 c4 4f 80 f8 2d 10 bf 83 44 2b 6d c0 ef bf 0c [TRUNCATED] Data Ascii: PNGIHDRA>pHYsgAMA\|Q cHRMz%u0`:o_FSZIDATxb?(bQ@3H4`FI F( !'@E0;`5/FP+xACh?A^x&o)6=Ch4Tl E&}JCeFK1b`T0Bin bf_\|F O-D+m@M`b]4lHQ3x=4(x8X`)(aAs7 x& n6b[`t8=N*.Xj~m@<S^f`I0D j@u@V@@X@VX8j% ^uxad.@c"WkUJ &FF.f&.2&FN`#NP0~lG\|+#L1" >x?&L$P@+IPA_JJ FB\|kk"E6&F&AF!VF^P"a_`>aHf<=^;?CUVX'{ j. .H(!% fdgb`&iv ,^jast,?^`6bFIlN;q&NVM

Timestamp	Bytes transferred	Direction	Data
May 26, 2024 00:24:20.778198957 CEST	867	OUT	GET /go1?id=21568093&rt=1716675855892&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252F&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:24:21.834984064 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:21 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1
May 26, 2024 00:24:36.971868038 CEST	890	OUT	GET /go1?id=21568093&rt=1716675876130&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=2&ce=1&cd=24&ds=&ing=2&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252Findex.html%2523features&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:24:37.511641026 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:37 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1
May 26, 2024 00:24:51.229816914 CEST	886	OUT	GET /go1?id=21568093&rt=1716675889458&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=3&ce=1&cd=24&ds=&ing=3&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252Findex.html%2523blog&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:24:51.793755054 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:51 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1
May 26, 2024 00:25:00.530900002 CEST	1313	OUT	GET /go1?id=21568093&rt=1716675900015&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=4&ce=1&cd=24&ds=&ing=4&ekc=&sid=1716675855892&tt=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E7%2594%25A8%25E4%25BB%2580%25E4%25B9%2588%25E5%258A%25A0%25E9%2580%259F%25E5%2599%25A8%25E5%25A5%25BD%25E7%2594%25A8-%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588%252FAPP%252F%25E4%25B8%258B%25E8%25BD%25BD%2520-%2520TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E7%2594%25A8%25E4%25BB%2580%25E4%25B9%2588%25E5%258A%25A0%25E9%2580%259F%25E5%2599%25A8%25E5%25A5%25BD%25E7%2594%25A8&cu=http%253A%252F%252Fvrqvtg91272.cn%252Fsoft%252F08%252F&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:25:00.913005114 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:25:00 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1
May 26, 2024 00:25:11.423311949 CEST	851	OUT	GET /go1?id=21568093&rt=1716675910898&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=5&ce=1&cd=24&ds=&ing=5&ekc=&sid=1716675855892&tt=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E6%259B%25B4%25E6%2596%25B0-%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588%252FAPP%252F%25E4%25B8%258B%25E8%25BD%25BD%2520-%2520TG%25E4%25B8%25AD%25E6%2596%2587%25E7%25BD%2591&kw=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E6%259B%25B4%25E6%2596%25B0&cu=http%253A%252F%252Fvrqvtg91272.cn%252Fsoft%252F99003.html&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:25:11.651268005 CEST	484	IN	HTTP/1.1 502 Bad Gateway Date: Sat, 25 May 2024 22:25:11 GMT Content-Type: text/html Content-Length: 244 Connection: keep-alive Server: web cache Expires: Sat, 25 May 2024 22:25:11 GMT X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 5a 45 52 4f 20 53 49 5a 45 20 4f 42 4a 45 43 54 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 45 52 52 4f 52 3a 20 5a 45 52 4f 20 53 49 5a 45 20 4f 42 4a 45 43 54 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 53 61 74 2c 20 32 35 20 4d 61 79 20 32 30 32 34 20 32 32 3a 32 35 3a 31 31 20 47 4d 54 20 28 74 61 69 6b 6f 6f 2f 42 43 32 35 5f 44 45 2d 46 72 61 6e 6b 66 75 72 74 2d 46 72 61 6e 6b 66 75 72 74 2d 37 2d 63 61 63 68 65 2d 31 29 3c 2f 63 65 6e 74 65 72 3e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 20 77 65 62 20 63 61 63 68 65 20 2d 2d 3e 0a Data Ascii: <html><head><title>ERROR: ZERO SIZE OBJECT</title></head><body><center><h1>ERROR: ZERO SIZE OBJECT</h1></center><hr><center>Sat, 25 May 2024 22:25:11 GMT (taikoo/BC25_DE-Frankfurt-Frankfurt-7-cache-1)</center></BODY></HTML>... web cache -->

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://vrqvtg91272.cn/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 243

Chrome Cache Entry: 244

Chrome Cache Entry: 245

Chrome Cache Entry: 246

Chrome Cache Entry: 247

Chrome Cache Entry: 248

Chrome Cache Entry: 249

Chrome Cache Entry: 250

Chrome Cache Entry: 251

Chrome Cache Entry: 252

Chrome Cache Entry: 253

Chrome Cache Entry: 254

Chrome Cache Entry: 255

Chrome Cache Entry: 256

Chrome Cache Entry: 257

Chrome Cache Entry: 258

Chrome Cache Entry: 259

Chrome Cache Entry: 260

Chrome Cache Entry: 261

Chrome Cache Entry: 262

Chrome Cache Entry: 263

Windows Analysis Report
http://vrqvtg91272.cn/

Timestamp	Bytes transferred	Direction	Data
May 26, 2024 00:24:22.833797932 CEST	773	OUT	GET /go1?id=21568093&rt=1716675855892&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=1&vd=1&ce=1&cd=24&ds=&ing=1&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252F&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:24:23.563373089 CEST	484	IN	HTTP/1.1 502 Bad Gateway Date: Sat, 25 May 2024 22:24:23 GMT Content-Type: text/html Content-Length: 244 Connection: keep-alive Server: web cache Expires: Sat, 25 May 2024 22:24:23 GMT X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 45 52 52 4f 52 3a 20 5a 45 52 4f 20 53 49 5a 45 20 4f 42 4a 45 43 54 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 45 52 52 4f 52 3a 20 5a 45 52 4f 20 53 49 5a 45 20 4f 42 4a 45 43 54 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 3c 68 72 3e 0a 3c 63 65 6e 74 65 72 3e 53 61 74 2c 20 32 35 20 4d 61 79 20 32 30 32 34 20 32 32 3a 32 34 3a 32 33 20 47 4d 54 20 28 74 61 69 6b 6f 6f 2f 42 43 32 35 5f 44 45 2d 46 72 61 6e 6b 66 75 72 74 2d 46 72 61 6e 6b 66 75 72 74 2d 37 2d 63 61 63 68 65 2d 31 29 3c 2f 63 65 6e 74 65 72 3e 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0a 3c 21 2d 2d 20 77 65 62 20 63 61 63 68 65 20 2d 2d 3e 0a Data Ascii: <html><head><title>ERROR: ZERO SIZE OBJECT</title></head><body><center><h1>ERROR: ZERO SIZE OBJECT</h1></center><hr><center>Sat, 25 May 2024 22:24:23 GMT (taikoo/BC25_DE-Frankfurt-Frankfurt-7-cache-1)</center></BODY></HTML>... web cache -->
May 26, 2024 00:24:37.808371067 CEST	796	OUT	GET /go1?id=21568093&rt=1716675876130&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=2&ce=1&cd=24&ds=&ing=2&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252Findex.html%2523features&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:24:38.203275919 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:38 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1
May 26, 2024 00:24:55.010606050 CEST	792	OUT	GET /go1?id=21568093&rt=1716675889458&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=3&ce=1&cd=24&ds=&ing=3&ekc=&sid=1716675855892&tt=TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=&cu=http%253A%252F%252Fvrqvtg91272.cn%252Findex.html%2523blog&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:24:55.386130095 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:55 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1
May 26, 2024 00:25:00.920104027 CEST	1219	OUT	GET /go1?id=21568093&rt=1716675900015&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=4&ce=1&cd=24&ds=&ing=4&ekc=&sid=1716675855892&tt=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E7%2594%25A8%25E4%25BB%2580%25E4%25B9%2588%25E5%258A%25A0%25E9%2580%259F%25E5%2599%25A8%25E5%25A5%25BD%25E7%2594%25A8-%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588%252FAPP%252F%25E4%25B8%258B%25E8%25BD%25BD%2520-%2520TG%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA(Telegram)%25E5%25AE%2598%25E6%2596%25B9%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD-%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E4%25B8%25AD%25E6%2596%2587%25E7%2589%2588%25E4%25B8%258B%25E8%25BD%25BD%25E5%25AE%2598%25E7%25BD%25912024%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588&kw=%25E7%25BA%25B8%25E9%25A3%259E%25E6%259C%25BA%25E7%2594%25A8%25E4%25BB%2580%25E4%25B9%2588%25E5%258A%25A0%25E9%2580%259F%25E5%2599%25A8%25E5%25A5%25BD%25E7%2594%25A8&cu=http%253A%252F%252Fvrqvtg91272.cn%252Fsoft%252F08%252F&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:25:01.346625090 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:25:01 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1
May 26, 2024 00:25:20.249926090 CEST	911	OUT	GET /go1?id=21568093&rt=1716675918804&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=6&ce=1&cd=24&ds=&ing=6&ekc=&sid=1716675855892&tt=tg%25E9%25A3%259E%25E6%259C%25BA%25E4%25BC%259A%25E5%2591%2598%25E5%2592%258C%25E9%25A3%259E%25E6%259C%25BA%25E9%25AB%2598%25E7%25BA%25A7%25E7%2589%2588-%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588%252FAPP%252F%25E4%25B8%258B%25E8%25BD%25BD%2520-%2520TG%25E4%25B8%25AD%25E6%2596%2587%25E7%25BD%2591&kw=tg%25E9%25A3%259E%25E6%259C%25BA%25E4%25BC%259A%25E5%2591%2598%25E5%2592%258C%25E9%25A3%259E%25E6%259C%25BA%25E9%25AB%2598%25E7%25BA%25A7%25E7%2589%2588&cu=http%253A%252F%252Fvrqvtg91272.cn%252Fsoft%252F67552.html&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: /* Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:25:20.626808882 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:25:20 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1

Timestamp	Bytes transferred	Direction	Data
May 26, 2024 00:25:19.403650999 CEST	1005	OUT	GET /go1?id=21568093&rt=1716675918804&rl=12801024&lang=en-US&ct=unknow&pf=1&ins=0&vd=6&ce=1&cd=24&ds=&ing=6&ekc=&sid=1716675855892&tt=tg%25E9%25A3%259E%25E6%259C%25BA%25E4%25BC%259A%25E5%2591%2598%25E5%2592%258C%25E9%25A3%259E%25E6%259C%25BA%25E9%25AB%2598%25E7%25BA%25A7%25E7%2589%2588-%25E6%259C%2580%25E6%2596%25B0%25E7%2589%2588%252FAPP%252F%25E4%25B8%258B%25E8%25BD%25BD%2520-%2520TG%25E4%25B8%25AD%25E6%2596%2587%25E7%25BD%2591&kw=tg%25E9%25A3%259E%25E6%259C%25BA%25E4%25BC%259A%25E5%2591%2598%25E5%2592%258C%25E9%25A3%259E%25E6%259C%25BA%25E9%25AB%2598%25E7%25BA%25A7%25E7%2589%2588&cu=http%253A%252F%252Fvrqvtg91272.cn%252Fsoft%252F67552.html&pu= HTTP/1.1 Host: ia.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
May 26, 2024 00:25:20.246531010 CEST	145	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:25:20 GMT Content-Length: 0 Connection: keep-alive X-Ser: BC25_DE-Frankfurt-Frankfurt-7-cache-1

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:12 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-25 22:24:12 UTC	466	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=63936 Date: Sat, 25 May 2024 22:24:12 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:13 UTC	547	OUT	GET /hm.js?f5af99a9e60f46adaabec28642c97c28 HTTP/1.1 Host: hm.baidu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 22:24:14 UTC	615	IN	HTTP/1.1 200 OK Cache-Control: max-age=0, must-revalidate Content-Length: 29911 Content-Type: application/javascript Date: Sat, 25 May 2024 22:24:13 GMT Etag: 3b39dbff09412e478e9e13bb675903f5 P3p: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Server: apache Set-Cookie: HMACCOUNT=DEA794E6063B6136; Path=/; Domain=hm.baidu.com; Expires=Sun, 18 Jan 2038 00:00:00 GMT Set-Cookie: HMACCOUNT_BFESS=DEA794E6063B6136; Path=/; Domain=hm.baidu.com; Expires=Mon, 18 Jan 2038 00:00:00 GMT; Secure; SameSite=None Strict-Transport-Security: max-age=172800 Connection: close
2024-05-25 22:24:14 UTC	564	IN	Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 68 3d 7b 7d 2c 6d 74 3d 7b 7d 2c 63 3d 7b 69 64 3a 22 66 35 61 66 39 39 61 39 65 36 30 66 34 36 61 64 61 61 62 65 63 32 38 36 34 32 63 39 37 63 32 38 22 2c 64 6d 3a 5b 22 74 65 6c 65 67 72 61 6d 78 69 61 7a 61 69 2e 63 6f 6d 22 2c 22 74 65 6c 65 67 72 61 6d 74 69 6d 65 2e 63 6f 6d 22 2c 22 74 65 6c 65 67 72 61 6d 73 74 2e 63 6f 6d 22 2c 22 74 65 6c 65 67 72 61 6d 73 6f 66 74 73 2e 63 6f 6d 22 2c 22 74 65 6c 65 67 72 61 6d 73 67 2e 63 6f 6d 22 2c 22 74 65 6c 65 67 72 61 6d 6f 70 65 6e 2e 63 6f 22 2c 22 74 65 6c 65 67 72 61 6d 69 6d 2e 63 6f 22 2c 22 74 65 6c 65 67 72 61 6d 69 6d 2e 63 63 22 5d 2c 6a 73 3a 22 74 6f 6e 67 6a 69 2e 62 61 69 64 75 2e 63 6f 6d 2f 68 6d 2d 77 65 62 2f 6a 73 2f 22 2c 65 74 72 6b 3a Data Ascii: (function(){var h={},mt={},c={id:"f5af99a9e60f46adaabec28642c97c28",dm:["telegramxiazai.com","telegramtime.com","telegramst.com","telegramsofts.com","telegramsg.com","telegramopen.co","telegramim.co","telegramim.cc"],js:"tongji.baidu.com/hm-web/js/",etrk:
2024-05-25 22:24:14 UTC	449	IN	Data Raw: 28 62 2e 70 61 74 68 3f 22 3b 20 70 61 74 68 3d 22 2b 62 2e 70 61 74 68 3a 22 22 29 2b 28 6b 3f 22 3b 20 65 78 70 69 72 65 73 3d 22 2b 6b 2e 74 6f 47 4d 54 53 74 72 69 6e 67 28 29 3a 22 22 29 2b 28 62 2e 64 63 3f 22 3b 20 73 65 63 75 72 65 22 3a 22 22 29 7d 3b 6d 74 2e 63 6f 6f 6b 69 65 2e 67 65 74 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 28 65 3d 52 65 67 45 78 70 28 22 28 5e 7c 20 29 22 2b 65 2b 22 3d 28 5b 5e 3b 5d 2a 29 28 3b 7c 24 29 22 29 2e 65 78 65 63 28 64 6f 63 75 6d 65 6e 74 2e 63 6f 6f 6b 69 65 29 29 3f 65 5b 32 5d 3a 75 7d 3b 0a 6d 74 2e 63 6f 6f 6b 69 65 2e 72 62 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 61 29 7b 74 72 79 7b 76 61 72 20 62 3d 22 48 6d 5f 63 6b 5f 22 2b 20 2b 6e 65 77 20 44 61 74 65 3b 6d 74 2e 63 6f 6f 6b 69 65 2e Data Ascii: (b.path?"; path="+b.path:"")+(k?"; expires="+k.toGMTString():"")+(b.dc?"; secure":"")};mt.cookie.get=function(e){return(e=RegExp("(^\| )"+e+"=([^;]*)(;\|$)").exec(document.cookie))?e[2]:u};mt.cookie.rb=function(e,a){try{var b="Hm_ck_"+ +new Date;mt.cookie.
2024-05-25 22:24:14 UTC	3537	IN	Data Raw: 6e 74 4c 69 73 74 65 6e 65 72 3f 65 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 61 2c 62 2c 6b 7c 7c 78 29 3a 65 2e 61 74 74 61 63 68 45 76 65 6e 74 26 26 65 2e 61 74 74 61 63 68 45 76 65 6e 74 28 22 6f 6e 22 2b 61 2c 66 75 6e 63 74 69 6f 6e 28 64 29 7b 62 2e 63 61 6c 6c 28 65 2c 64 29 7d 29 7d 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 65 3d 6d 74 2e 65 76 65 6e 74 3b 6d 74 2e 6c 61 6e 67 3d 7b 7d 3b 6d 74 2e 6c 61 6e 67 2e 69 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 22 5b 6f 62 6a 65 63 74 20 22 2b 62 2b 22 5d 22 3d 3d 3d 7b 7d 2e 74 6f 53 74 72 69 6e 67 2e 63 61 6c 6c 28 61 29 7d 3b 6d 74 2e 6c 61 6e 67 2e 6a 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6d 74 2e 6c 61 6e 67 2e 69 28 61 2c 22 46 Data Ascii: ntListener?e.addEventListener(a,b,k\|\|x):e.attachEvent&&e.attachEvent("on"+a,function(d){b.call(e,d)})};(function(){var e=mt.event;mt.lang={};mt.lang.i=function(a,b){return"[object "+b+"]"==={}.toString.call(a)};mt.lang.j=function(a){return mt.lang.i(a,"F
2024-05-25 22:24:14 UTC	4716	IN	Data Raw: 3b 0a 6d 74 2e 64 2e 66 61 3d 66 75 6e 63 74 69 6f 6e 28 62 2c 61 29 7b 76 61 72 20 64 3d 5b 5d 2c 66 3d 5b 5d 3b 69 66 28 21 62 29 72 65 74 75 72 6e 20 66 3b 66 6f 72 28 3b 62 2e 70 61 72 65 6e 74 4e 6f 64 65 21 3d 75 3b 29 7b 66 6f 72 28 76 61 72 20 67 3d 30 2c 6c 3d 30 2c 65 3d 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 2c 70 3d 30 3b 70 3c 65 3b 70 2b 2b 29 7b 76 61 72 20 6e 3d 62 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 70 5d 3b 69 66 28 6e 2e 6e 6f 64 65 4e 61 6d 65 3d 3d 3d 62 2e 6e 6f 64 65 4e 61 6d 65 26 26 28 67 2b 2b 2c 6e 3d 3d 3d 62 26 26 28 6c 3d 67 29 2c 30 3c 6c 26 26 31 3c 67 29 29 62 72 65 61 6b 7d 69 66 28 28 65 3d 22 22 21 3d 3d 62 2e 69 64 29 26 26 61 29 7b 64 Data Ascii: ;mt.d.fa=function(b,a){var d=[],f=[];if(!b)return f;for(;b.parentNode!=u;){for(var g=0,l=0,e=b.parentNode.childNodes.length,p=0;p<e;p++){var n=b.parentNode.childNodes[p];if(n.nodeName===b.nodeName&&(g++,n===b&&(l=g),0<l&&1<g))break}if((e=""!==b.id)&&a){d
2024-05-25 22:24:14 UTC	4779	IN	Data Raw: 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 2b 28 66 25 31 36 29 2e 74 6f 53 74 72 69 6e 67 28 31 36 29 7d 29 29 3b 72 65 74 75 72 6e 27 22 27 2b 61 2b 27 22 27 7d 66 75 6e 63 74 69 6f 6e 20 61 28 61 29 7b 72 65 74 75 72 6e 20 31 30 3e 61 3f 22 30 22 2b 61 3a 61 7d 76 61 72 20 62 3d 7b 22 5c 62 22 3a 22 5c 5c 62 22 2c 22 5c 74 22 3a 22 5c 5c 74 22 2c 22 5c 6e 22 3a 22 5c 5c 6e 22 2c 22 5c 66 22 3a 22 5c 5c 66 22 2c 22 5c 72 22 3a 22 5c 5c 72 22 2c 27 22 27 3a 27 5c 5c 22 27 2c 22 5c 5c 22 3a 22 5c 5c 5c 5c 22 7d 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 73 77 69 74 63 68 28 74 79 70 65 6f 66 20 62 29 7b 63 61 73 65 20 22 75 6e 64 65 66 69 6e 65 64 22 3a 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 3b 63 61 73 65 20 22 6e 75 6d 62 65 Data Ascii: ).toString(16)+(f%16).toString(16)}));return'"'+a+'"'}function a(a){return 10>a?"0"+a:a}var b={"\b":"\\b","\t":"\\t","\n":"\\n","\f":"\\f","\r":"\\r",'"':'\\"',"\\":"\\\\"};return function(b){switch(typeof b){case "undefined":return"undefined";case "numbe
2024-05-25 22:24:14 UTC	7074	IN	Data Raw: 61 74 68 22 2c 63 6f 6e 74 65 6e 74 3a 22 64 61 74 61 2d 68 6d 2d 63 6f 6e 74 65 6e 74 22 2c 68 63 3a 22 64 61 74 61 2d 68 6d 2d 74 61 67 22 2c 6c 69 6e 6b 3a 22 64 61 74 61 2d 68 6d 2d 6c 69 6e 6b 22 7d 2c 52 62 3a 22 64 61 74 61 2d 68 6d 2d 65 6e 61 62 6c 65 64 22 2c 51 62 3a 22 64 61 74 61 2d 68 6d 2d 64 69 73 61 62 6c 65 64 22 2c 78 62 3a 22 68 74 74 70 73 3a 2f 2f 68 6d 63 64 6e 2e 62 61 69 64 75 2e 63 6f 6d 2f 73 74 61 74 69 63 2f 74 6f 6e 67 6a 69 2f 70 6c 75 67 69 6e 73 2f 22 2c 6e 61 3a 5b 22 55 72 6c 43 68 61 6e 67 65 54 72 61 63 6b 65 72 22 5d 2c 4e 62 3a 7b 24 62 3a 30 2c 69 63 3a 31 2c 58 62 3a 32 7d 2c 59 62 3a 22 68 74 74 70 73 3a 2f 2f 66 63 6c 6f 67 2e 62 61 69 64 75 2e 63 6f 6d 2f 6c 6f 67 2f 6f 63 70 63 61 67 6c 3f 74 79 70 65 3d 62 65 Data Ascii: ath",content:"data-hm-content",hc:"data-hm-tag",link:"data-hm-link"},Rb:"data-hm-enabled",Qb:"data-hm-disabled",xb:"https://hmcdn.baidu.com/static/tongji/plugins/",na:["UrlChangeTracker"],Nb:{$b:0,ic:1,Xb:2},Yb:"https://fclog.baidu.com/log/ocpcagl?type=be
2024-05-25 22:24:14 UTC	1614	IN	Data Raw: 49 43 6f 6d 70 6f 6e 65 6e 74 28 67 29 5d 2e 6a 6f 69 6e 28 22 22 29 2c 64 29 7d 7d 2c 46 62 3a 66 75 6e 63 74 69 6f 6e 28 62 29 7b 69 66 28 65 2e 69 28 62 2c 22 53 74 72 69 6e 67 22 29 7c 7c 65 2e 69 28 62 2c 22 4e 75 6d 62 65 72 22 29 29 77 69 6e 64 6f 77 2e 5f 64 78 74 3d 77 69 6e 64 6f 77 2e 5f 64 78 74 7c 7c 5b 5d 2c 77 69 6e 64 6f 77 2e 5f 64 78 74 2e 70 75 73 68 28 5b 22 5f 73 65 74 55 73 65 72 49 64 22 2c 62 5d 29 7d 7d 3b 72 65 74 75 72 6e 20 68 2e 46 61 3d 64 7d 29 28 29 3b 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 61 29 7b 66 6f 72 28 76 61 72 20 64 20 69 6e 20 61 29 69 66 28 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 64 29 29 7b 76 61 72 20 66 3d 61 5b 64 5d 3b 62 2e 4a 28 66 29 7c Data Ascii: IComponent(g)].join(""),d)}},Fb:function(b){if(e.i(b,"String")\|\|e.i(b,"Number"))window._dxt=window._dxt\|\|[],window._dxt.push(["_setUserId",b])}};return h.Fa=d})();(function(){function e(a){for(var d in a)if({}.hasOwnProperty.call(a,d)){var f=a[d];b.J(f)\|
2024-05-25 22:24:14 UTC	7178	IN	Data Raw: 2e 62 2e 61 2e 73 75 3d 68 2e 62 2e 61 2e 75 7c 7c 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 29 2c 68 2e 62 2e 61 2e 75 3d 66 2e 70 72 6f 74 6f 63 6f 6c 2b 22 2f 2f 22 2b 64 6f 63 75 6d 65 6e 74 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 2b 0a 62 5b 31 5d 2c 68 2e 62 2e 6d 28 29 2c 68 2e 62 2e 73 62 3d 2b 6e 65 77 20 44 61 74 65 29 7d 2c 5f 74 72 61 63 6b 45 76 65 6e 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 32 3c 61 2e 6c 65 6e 67 74 68 26 26 28 6e 2e 68 7c 3d 38 2c 68 2e 62 2e 61 2e 65 74 3d 34 2c 68 2e 62 2e 61 2e 65 70 3d 62 2e 6e 28 61 5b 31 5d 29 2b 22 2a 22 2b 62 2e 6e 28 61 5b 32 5d 29 2b 28 61 5b 33 5d 3f 22 2a 22 2b 62 2e 6e 28 61 5b 33 5d 29 3a 22 22 29 2b 28 61 5b 34 5d 3f 22 2a 22 2b 62 2e 6e 28 61 5b 34 5d 29 3a 22 22 Data Ascii: .b.a.su=h.b.a.u\|\|document.location.href),h.b.a.u=f.protocol+"//"+document.location.host+b[1],h.b.m(),h.b.sb=+new Date)},_trackEvent:function(a){2<a.length&&(n.h\|=8,h.b.a.et=4,h.b.a.ep=b.n(a[1])+""+b.n(a[2])+(a[3]?""+b.n(a[3]):"")+(a[4]?"*"+b.n(a[4]):""

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:13 UTC	619	OUT	GET /tz.js HTTP/1.1 Host: pcdown91.telegrarndown936.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 22:24:14 UTC	354	IN	HTTP/1.1 200 OK Server: nginx Date: Sat, 25 May 2024 22:24:13 GMT Content-Type: application/javascript Content-Length: 402 Last-Modified: Thu, 25 Apr 2024 06:08:19 GMT Connection: close ETag: "6629f353-192" Expires: Sun, 26 May 2024 10:24:13 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-05-25 22:24:14 UTC	402	IN	Data Raw: 76 61 72 20 69 66 72 61 6d 65 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 27 69 66 72 61 6d 65 27 29 3b 0a 69 66 72 61 6d 65 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 27 73 72 63 27 2c 20 27 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 6c 65 67 72 65 6d 61 70 70 2e 6d 65 27 29 3b 0a 69 66 72 61 6d 65 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 20 3d 20 27 70 6f 73 69 74 69 6f 6e 3a 66 69 78 65 64 3b 62 6f 72 64 65 72 3a 20 30 70 78 3b 74 6f 70 3a 30 3b 6c 65 66 74 3a 30 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 30 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 6d 61 78 2d 68 65 69 67 68 74 3a 6e 6f 6e 65 3b 27 3b 0a 64 6f 63 75 6d 65 6e 74 Data Ascii: var iframe = document.createElement('iframe');iframe.setAttribute('src', 'https://www.telegremapp.me');iframe.style.cssText = 'position:fixed;border: 0px;top:0;left:0;z-index:10000;width:100%;height:100%;background-color:#fff;max-height:none;';document

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:13 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-05-25 22:24:14 UTC	534	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=63848 Date: Sat, 25 May 2024 22:24:13 GMT Content-Length: 55 Connection: close X-CID: 2
2024-05-25 22:24:14 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:15 UTC	678	OUT	GET / HTTP/1.1 Host: www.telegremapp.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: iframe Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 22:24:15 UTC	675	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:15 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: close Last-Modified: Wed, 09 Nov 2022 07:17:38 GMT Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6aXfm0f6nt85BhunlcII3m0bL2IU45YQiWIXh85Wky2peWJOo%2FfkH5uUd3jCeBgcNP3cw0wHmHoAhycw9Isx3hl29tZ0DbN%2BD2LMyMjCASpsSTRrO3K5lfqIllaT1OIRy41qpdA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8898ef426d1372b1-EWR alt-svc: h3=":443"; ma=86400
2024-05-25 22:24:15 UTC	694	IN	Data Raw: 32 61 63 36 0d 0a 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0d 0a 20 20 20 20 3c 74 69 74 6c 65 3e 3c 2f 74 69 74 6c 65 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 0d 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0d 0a 20 20 20 20 3c Data Ascii: 2ac6<!DOCTYPE html><html class=""><head> <meta charset="utf-8"> <title></title><meta name="keywords" content=""><meta name="description" content=""> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <
2024-05-25 22:24:15 UTC	1369	IN	Data Raw: 61 20 6e 61 6d 65 3d 22 74 65 6c 65 67 72 61 6d 3a 63 68 61 6e 6e 65 6c 22 20 63 6f 6e 74 65 6e 74 3d 22 40 74 65 6c 65 67 72 61 6d 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 73 76 67 2b 78 6d 6c 22 20 68 72 65 66 3d 22 2f 69 6d 67 2f 77 65 62 73 69 74 65 5f 69 63 6f 6e 2e 73 76 67 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0d 0a 20 20 20 20 3c 6c 69 6e 6b 20 68 72 65 66 3d 22 2f 63 73 73 2f 62 6f 6f 74 73 74 72 61 70 2e 6d 69 6e 2e 63 73 73 22 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 3e 0d 0a 20 20 Data Ascii: a name="telegram:channel" content="@telegram"> <link rel="icon" type="image/svg+xml" href="/img/website_icon.svg"> <link rel="alternate icon" href="/favicon.ico" type="image/x-icon"> <link href="/css/bootstrap.min.css" rel="stylesheet">
2024-05-25 22:24:15 UTC	1369	IN	Data Raw: 38 22 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 6c 6f 67 6f 22 3e 0d 0a 09 09 09 09 09 3c 69 6d 61 67 65 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 6c 6f 67 6f 22 20 78 6c 69 6e 6b 3a 68 72 65 66 3d 22 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 73 76 67 3f 31 22 20 73 72 63 3d 22 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 20 73 72 63 73 65 74 3d 22 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 5f 32 78 2e 70 6e 67 3f 31 20 32 78 2c 20 2f 69 6d 67 2f 74 5f 6c 6f 67 6f 2e 70 6e 67 22 20 61 6c 74 3d 22 54 65 6c 65 67 72 61 6d 20 6c 6f 67 6f 22 20 77 69 64 74 68 3d 22 31 32 38 22 20 68 65 69 67 68 74 3d 22 31 32 38 22 3e 3c 2f 69 6d 61 67 65 3e 0d 0a 09 09 09 09 09 3c 2f 73 76 67 3e 0d 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f Data Ascii: 8" class="tl_main_logo"><image class="tl_main_logo" xlink:href="/img/t_logo.svg?1" src="/img/t_logo.png" srcset="/img/t_logo_2x.png?1 2x, /img/t_logo.png" alt="Telegram logo" width="128" height="128"></image></svg><div class="tl_main_
2024-05-25 22:24:15 UTC	1369	IN	Data Raw: 69 6e 5f 64 6f 77 6e 6c 6f 61 64 5f 69 6d 61 67 65 5f 5f 61 6e 64 72 6f 69 64 22 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 27 2f 69 6d 67 2f 64 6f 77 6e 6c 6f 61 64 5f 77 69 6e 64 6f 77 73 2e 6a 70 67 27 29 20 6e 6f 2d 72 65 70 65 61 74 3b 22 3e 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 2f 61 3e 0d 0a 09 09 09 09 0d 0a 09 09 09 09 3c 21 2d 2d 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 64 6f 77 6e 6c 6f 61 64 2d 76 70 6e 22 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 20 61 75 74 6f 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 31 31 31 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 64 61 65 63 66 64 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 3b 62 6f 72 64 65 72 2d 72 61 Data Ascii: in_download_image__android" style="background:url('/img/download_windows.jpg') no-repeat;"></div></a>... <div class="download-vpn" style="margin:0 auto;font-size:14px;color:#111;line-height:30px;background:#daecfd;padding:15px;border-ra
2024-05-25 22:24:15 UTC	1369	IN	Data Raw: 6e 74 61 67 65 5f 31 5f 74 69 74 6c 65 22 3e 3c 2f 68 33 3e 0d 0a 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 6c 65 61 64 22 20 69 64 3d 22 69 64 5f 61 64 76 61 6e 74 61 67 65 5f 31 5f 74 65 78 74 22 3e 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 63 65 6c 6c 22 3e 0d 0a 09 09 09 09 09 09 09 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 77 72 61 70 22 3e 0d 0a 09 09 09 09 09 09 09 3c 70 69 63 74 75 72 65 20 63 6c 61 73 73 3d 22 64 65 76 5f 70 61 67 65 5f 74 67 73 74 69 63 6b 65 72 20 74 6c 5f 6d 61 69 6e 5f 63 Data Ascii: ntage_1_title"></h3><div class="tl_main_card_lead" id="id_advantage_1_text"></div></div></div><div class="tl_main_card_cell"> <div class="tl_main_card_wrap"><picture class="dev_page_tgsticker tl_main_c
2024-05-25 22:24:15 UTC	1369	IN	Data Raw: 5f 6d 61 69 6e 5f 63 61 72 64 5f 63 65 6c 6c 22 3e 0d 0a 09 09 09 09 09 09 09 20 20 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 77 72 61 70 22 3e 0d 0a 09 09 09 09 09 09 09 3c 70 69 63 74 75 72 65 20 63 6c 61 73 73 3d 22 64 65 76 5f 70 61 67 65 5f 74 67 73 74 69 63 6b 65 72 20 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 61 6e 69 6d 61 74 65 64 20 6a 73 2d 74 67 73 74 69 63 6b 65 72 5f 69 6d 61 67 65 22 3e 0d 0a 09 09 09 09 09 09 09 09 20 20 3c 64 69 76 3e 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 20 20 3c 73 6f 75 72 63 65 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 74 67 73 74 69 63 6b 65 72 22 20 73 72 63 73 65 74 3d 22 2f 66 69 6c 65 2f 34 36 34 30 30 31 34 39 33 2f 32 2f 68 56 36 75 50 63 61 48 6b 5f Data Ascii: _main_card_cell"> <div class="tl_main_card_wrap"><picture class="dev_page_tgsticker tl_main_card_animated js-tgsticker_image"> <div></div> <source type="application/x-tgsticker" srcset="/file/464001493/2/hV6uPcaHk_
2024-05-25 22:24:15 UTC	1369	IN	Data Raw: 0d 0a 09 09 09 09 09 09 09 09 20 20 3c 64 69 76 3e 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 09 09 09 09 20 20 3c 73 6f 75 72 63 65 20 74 79 70 65 3d 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 78 2d 74 67 73 74 69 63 6b 65 72 22 20 73 72 63 73 65 74 3d 22 2f 66 69 6c 65 2f 34 36 34 30 30 31 38 38 30 2f 32 2f 56 47 54 4c 42 4e 33 51 75 59 4d 2e 31 30 39 35 39 2f 38 39 34 30 38 33 38 65 37 64 64 64 63 37 38 37 64 38 22 3e 0d 0a 09 09 09 09 09 09 09 09 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2f 70 69 63 74 75 72 65 2f 66 65 62 31 65 31 36 31 62 31 64 33 36 30 38 36 31 33 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 09 09 09 20 20 3c 63 61 6e 76 61 73 20 77 69 64 74 68 3d 22 32 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 3e 3c 2f 63 61 6e 76 61 73 3e 0d 0a 09 09 Data Ascii: <div></div> <source type="application/x-tgsticker" srcset="/file/464001880/2/VGTLBN3QuYM.10959/8940838e7dddc787d8"> <img src="/img/picture/feb1e161b1d3608613.jpg"> <canvas width="200" height="200"></canvas>
2024-05-25 22:24:15 UTC	1369	IN	Data Raw: 09 09 09 09 09 20 20 3c 69 6d 67 20 73 72 63 3d 22 2f 69 6d 67 2f 70 69 63 74 75 72 65 2f 66 33 63 65 63 36 63 34 35 31 64 30 32 33 63 31 30 39 2e 6a 70 67 22 3e 0d 0a 09 09 09 09 09 09 09 09 20 20 3c 63 61 6e 76 61 73 20 77 69 64 74 68 3d 22 32 30 30 22 20 68 65 69 67 68 74 3d 22 32 30 30 22 3e 3c 2f 63 61 6e 76 61 73 3e 0d 0a 09 09 09 09 09 09 09 09 3c 2f 70 69 63 74 75 72 65 3e 0d 0a 09 09 09 09 09 09 09 09 3c 68 33 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 68 65 61 64 65 72 22 20 69 64 3d 22 69 64 5f 61 64 76 61 6e 74 61 67 65 5f 38 5f 74 69 74 6c 65 22 3e 3c 2f 68 33 3e 0d 0a 09 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 74 6c 5f 6d 61 69 6e 5f 63 61 72 64 5f 6c 65 61 64 22 20 69 64 3d 22 69 64 5f 61 64 76 61 6e 74 Data Ascii: <img src="/img/picture/f3cec6c451d023c109.jpg"> <canvas width="200" height="200"></canvas></picture><h3 class="tl_main_card_header" id="id_advantage_8_title"></h3><div class="tl_main_card_lead" id="id_advant
2024-05-25 22:24:15 UTC	681	IN	Data Raw: 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 09 09 0d 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 63 6f 6c 75 6d 6e 73 5f 77 72 61 70 20 66 6f 6f 74 65 72 5f 6d 6f 62 69 6c 65 22 3e 0d 0a 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 5f 63 6f 6c 75 6d 6e 22 3e 0d 0a 09 09 09 09 3c 68 35 3e 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 32 32 20 54 65 6c 65 67 72 61 6d 20 49 6e 63 2e 3c 2f 68 35 3e 0d 0a 09 09 09 3c 2f 64 69 76 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 64 69 76 3e 0d 0a 09 3c 2f 64 69 76 3e 0d 0a 3c 2f 64 69 76 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 73 72 63 3d 22 2f 6a 73 2f 6a 71 75 65 72 79 2d 32 2e 31 2e 33 2e 6d 69 6e 2e 6a 73 22 3e 3c 2f 73 63 72 69 70 74 3e 0d 0a 3c 73 63 72 69 70 74 3e 0d 0a 64 6f 63 Data Ascii: </div><div class="footer_columns_wrap footer_mobile"><div class="footer_column"><h5>Copyright 2022 Telegram Inc.</h5></div> </div></div></div><script src="/js/jquery-2.1.3.min.js"></script><script>doc
2024-05-25 22:24:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:15 UTC	610	OUT	GET /21568093.js HTTP/1.1 Host: js.users.51.la Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: http://vrqvtg91272.cn/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 22:24:16 UTC	635	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Date: Sat, 25 May 2024 22:24:16 GMT Access-Control-Allow-Headers: Content-Type Access-Control-Allow-Origin: * Cache-Control: no-store Access-Control-Allow-Credentials: true Ali-Swift-Global-Savetime: 1716675856 Via: cache16.l2de2[165,165,200-0,M], cache12.l2de2[166,0], ens-cache1.de5[167,167,200-0,M], ens-cache6.de5[168,0] X-Cache: MISS TCP_MISS dirn:-2:-2 X-Swift-SaveTime: Sat, 25 May 2024 22:24:16 GMT X-Swift-CacheTime: 0 Timing-Allow-Origin: * EagleId: a3b55c9a17166758560795554e
2024-05-25 22:24:16 UTC	4906	IN	Data Raw: 31 33 32 32 0d 0a 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 63 6f 6e 66 69 67 20 3d 20 7b 69 74 76 3a 20 31 38 30 30 30 30 30 2c 75 72 6c 31 3a 27 2f 2f 69 61 2e 35 31 2e 6c 61 2f 67 6f 31 3f 69 64 3d 32 31 35 36 38 30 39 33 27 2c 65 6b 63 3a 27 27 7d 3b 21 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 72 29 7b 69 66 28 6e 5b 72 5d 29 72 65 74 75 72 6e 20 6e 5b 72 5d 2e 65 78 70 6f 72 74 73 3b 76 61 72 20 6f 3d 6e 5b 72 5d 3d 7b 65 78 70 6f 72 74 73 3a 7b 7d 2c 69 64 3a 72 2c 6c 6f 61 64 65 64 3a 21 31 7d 3b 72 65 74 75 72 6e 20 65 5b 72 5d 2e 63 61 6c 6c 28 6f 2e 65 78 70 6f 72 74 73 2c 6f 2c 6f 2e 65 78 70 6f 72 74 73 2c 74 29 2c 6f 2e 6c 6f 61 64 65 64 3d 21 30 2c 6f 2e 65 78 70 6f 72 74 73 7d 76 61 72 20 6e 3d 7b 7d 3b 72 Data Ascii: 1322(function(){var config = {itv: 1800000,url1:'//ia.51.la/go1?id=21568093',ekc:''};!function(e){function t(r){if(n[r])return n[r].exports;var o=n[r]={exports:{},id:r,loaded:!1};return e[r].call(o.exports,o,o.exports,t),o.loaded=!0,o.exports}var n={};r
2024-05-25 22:24:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:16 UTC	556	OUT	GET /css/bootstrap.min.css HTTP/1.1 Host: www.telegremapp.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telegremapp.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 22:24:16 UTC	787	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:16 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Sat, 26 Feb 2022 14:06:22 GMT Vary: Accept-Encoding ETag: W/"621a33de-a61b" Expires: Sun, 26 May 2024 00:12:34 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 CF-Cache-Status: HIT Age: 36702 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3%2FVi4c4e8mn%2FrEW23j1ZWMCmVBrb3byNgUljMg%2BHDtij6PouSTj7tZuEi5%2FaHK05z%2BVMvWOmXmm4kRG0sPHQzec4i8E1kNI%2BxermcfU1NGuiadP2%2FcuGLAq7VbVJaAd7rNiYJ4I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8898ef47e80241d2-EWR alt-svc: h3=":443"; ma=86400
2024-05-25 22:24:16 UTC	582	IN	Data Raw: 37 63 39 65 0d 0a 2f 2a 21 0a 20 2a 20 42 6f 6f 74 73 74 72 61 70 20 76 33 2e 32 2e 30 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 29 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d 32 30 31 34 20 54 77 69 74 74 65 72 2c 20 49 6e 63 2e 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 4d 49 54 20 28 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 74 77 62 73 2f 62 6f 6f 74 73 74 72 61 70 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 4c 49 43 45 4e 53 45 29 0a 20 2a 2f 0a 0a 2f 2a 21 0a 20 2a 20 47 65 6e 65 72 61 74 65 64 20 75 73 69 6e 67 20 74 68 65 20 42 6f 6f 74 73 74 72 61 70 20 43 75 73 74 6f 6d 69 7a 65 72 20 28 68 74 74 70 3a 2f 2f 67 65 74 62 6f 6f 74 73 74 72 61 70 2e 63 6f 6d 2f 63 75 73 74 6f 6d Data Ascii: 7c9e/! Bootstrap v3.2.0 (http://getbootstrap.com) * Copyright 2011-2014 Twitter, Inc. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE) //! * Generated using the Bootstrap Customizer (http://getbootstrap.com/custom
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 72 6f 75 70 2c 6d 61 69 6e 2c 6e 61 76 2c 73 65 63 74 69 6f 6e 2c 73 75 6d 6d 61 72 79 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 61 75 64 69 6f 2c 63 61 6e 76 61 73 2c 70 72 6f 67 72 65 73 73 2c 76 69 64 65 6f 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 61 73 65 6c 69 6e 65 7d 61 75 64 69 6f 3a 6e 6f 74 28 5b 63 6f 6e 74 72 6f 6c 73 5d 29 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 68 65 69 67 68 74 3a 30 7d 5b 68 69 64 64 65 6e 5d 2c 74 65 6d 70 6c 61 74 65 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 61 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 61 3a 61 63 74 69 76 65 2c 61 3a 68 6f 76 65 72 7b 6f 75 74 6c 69 6e 65 3a 30 7d 61 62 62 72 5b 74 69 74 6c 65 5d Data Ascii: roup,main,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background:transparent}a:active,a:hover{outline:0}abbr[title]
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 63 6f 6e 74 65 6e 74 2d 62 6f 78 7d 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 63 61 6e 63 65 6c 2d 62 75 74 74 6f 6e 2c 69 6e 70 75 74 5b 74 79 70 65 3d 22 73 65 61 72 63 68 22 5d 3a 3a 2d 77 65 62 6b 69 74 2d 73 65 61 72 63 68 2d 64 65 63 6f 72 61 74 69 6f 6e 7b 2d 77 65 62 6b 69 74 2d 61 70 70 65 61 72 61 6e 63 65 3a 6e 6f 6e 65 7d 66 69 65 6c 64 73 65 74 7b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 63 30 63 30 63 30 3b 6d 61 72 67 69 6e 3a 30 20 32 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: -box-sizing:content-box;-webkit-box-sizing:content-box;box-sizing:content-box}input[type="search"]::-webkit-search-cancel-button,input[type="search"]::-webkit-search-decoration{-webkit-appearance:none}fieldset{border:1px solid #c0c0c0;margin:0 2px;padding
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 2d 6f 2d 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 74 72 61 6e 73 69 74 69 6f 6e 3a 61 6c 6c 20 2e 32 73 20 65 61 73 65 2d 69 6e 2d 6f 75 74 3b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 30 30 25 20 5c 39 3b 6d 61 78 2d 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 61 75 74 6f 7d 2e 69 6d 67 2d 63 69 72 63 6c 65 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 30 25 7d 68 72 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 31 37 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 37 70 78 3b 62 6f 72 64 65 72 3a 30 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 7d 2e 73 72 2d 6f 6e 6c 79 7b 70 6f 73 Data Ascii: ease-in-out;-o-transition:all .2s ease-in-out;transition:all .2s ease-in-out;display:inline-block;width:100% \9;max-width:100%;height:auto}.img-circle{border-radius:50%}hr{margin-top:17px;margin-bottom:17px;border:0;border-top:1px solid #eee}.sr-only{pos
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 78 7d 68 36 2c 2e 68 36 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 31 70 78 7d 70 7b 6d 61 72 67 69 6e 3a 30 20 30 20 38 2e 35 70 78 7d 2e 6c 65 61 64 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 37 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 33 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 33 30 30 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 34 7d 40 6d 65 64 69 61 20 28 6d 69 6e 2d 77 69 64 74 68 3a 37 36 38 70 78 29 7b 2e 6c 65 61 64 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 7d 7d 73 6d 61 6c 6c 2c 2e 73 6d 61 6c 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 39 31 25 7d 63 69 74 65 7b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 7d 6d 61 72 6b 2c 2e 6d 61 72 6b 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 63 66 38 65 33 3b 70 61 64 64 69 6e 67 Data Ascii: x}h6,.h6{font-size:11px}p{margin:0 0 8.5px}.lead{margin-bottom:17px;font-size:13px;font-weight:300;line-height:1.4}@media (min-width:768px){.lead{font-size:18px}}small,.small{font-size:91%}cite{font-style:normal}mark,.mark{background-color:#fcf8e3;padding
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 6e 2d 74 6f 70 3a 30 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 38 2e 35 70 78 7d 75 6c 20 75 6c 2c 6f 6c 20 75 6c 2c 75 6c 20 6f 6c 2c 6f 6c 20 6f 6c 7b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 30 7d 2e 6c 69 73 74 2d 75 6e 73 74 79 6c 65 64 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 6c 69 73 74 2d 69 6e 6c 69 6e 65 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 30 3b 6c 69 73 74 2d 73 74 79 6c 65 3a 6e 6f 6e 65 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 2d 35 70 78 7d 2e 6c 69 73 74 2d 69 6e 6c 69 6e 65 3e 6c 69 7b 64 69 73 70 6c 61 79 3a 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 35 70 78 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 35 70 78 7d 64 6c 7b 6d 61 72 67 69 Data Ascii: n-top:0;margin-bottom:8.5px}ul ul,ol ul,ul ol,ol ol{margin-bottom:0}.list-unstyled{padding-left:0;list-style:none}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-left:5px;padding-right:5px}dl{margi
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 6f 74 65 2e 70 75 6c 6c 2d 72 69 67 68 74 20 2e 73 6d 61 6c 6c 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 27 27 7d 2e 62 6c 6f 63 6b 71 75 6f 74 65 2d 72 65 76 65 72 73 65 20 66 6f 6f 74 65 72 3a 61 66 74 65 72 2c 62 6c 6f 63 6b 71 75 6f 74 65 2e 70 75 6c 6c 2d 72 69 67 68 74 20 66 6f 6f 74 65 72 3a 61 66 74 65 72 2c 2e 62 6c 6f 63 6b 71 75 6f 74 65 2d 72 65 76 65 72 73 65 20 73 6d 61 6c 6c 3a 61 66 74 65 72 2c 62 6c 6f 63 6b 71 75 6f 74 65 2e 70 75 6c 6c 2d 72 69 67 68 74 20 73 6d 61 6c 6c 3a 61 66 74 65 72 2c 2e 62 6c 6f 63 6b 71 75 6f 74 65 2d 72 65 76 65 72 73 65 20 2e 73 6d 61 6c 6c 3a 61 66 74 65 72 2c 62 6c 6f 63 6b 71 75 6f 74 65 2e 70 75 6c 6c 2d 72 69 67 68 74 20 2e 73 6d 61 6c 6c 3a 61 66 74 65 72 7b 63 6f 6e 74 65 6e 74 3a 27 5c 30 30 41 Data Ascii: ote.pull-right .small:before{content:''}.blockquote-reverse footer:after,blockquote.pull-right footer:after,.blockquote-reverse small:after,blockquote.pull-right small:after,.blockquote-reverse .small:after,blockquote.pull-right .small:after{content:'\00A
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 70 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 31 70 78 20 73 6f 6c 69 64 20 23 65 65 65 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 7b 76 65 72 74 69 63 61 6c 2d 61 6c 69 67 6e 3a 62 6f 74 74 6f 6d 3b 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 32 70 78 20 73 6f 6c 69 64 20 23 65 65 65 7d 2e 74 61 62 6c 65 3e 63 61 70 74 69 6f 6e 2b 74 68 65 61 64 3e 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 74 68 2c 2e 74 61 62 6c 65 3e 63 6f 6c 67 72 6f 75 70 2b 74 68 65 61 64 3e 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 68 65 61 64 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 3e 74 68 2c 2e 74 61 62 6c 65 3e 63 61 70 74 69 6f 6e 2b 74 68 65 61 64 3e 74 72 3a 66 69 72 73 74 2d 63 68 69 6c 64 Data Ascii: p;border-top:1px solid #eee}.table>thead>tr>th{vertical-align:bottom;border-bottom:2px solid #eee}.table>caption+thead>tr:first-child>th,.table>colgroup+thead>tr:first-child>th,.table>thead:first-child>tr:first-child>th,.table>caption+thead>tr:first-child
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 65 2c 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 68 2e 61 63 74 69 76 65 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 68 2e 61 63 74 69 76 65 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 3e 74 68 2e 61 63 74 69 76 65 2c 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 2e 61 63 74 69 76 65 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 2e 61 63 74 69 76 65 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 2e 61 63 74 69 76 65 3e 74 64 2c 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 2e 61 63 74 69 76 65 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 2e 61 63 74 69 76 65 3e 74 68 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e 74 72 2e 61 63 74 69 76 65 3e 74 68 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 Data Ascii: e,.table>thead>tr>th.active,.table>tbody>tr>th.active,.table>tfoot>tr>th.active,.table>thead>tr.active>td,.table>tbody>tr.active>td,.table>tfoot>tr.active>td,.table>thead>tr.active>th,.table>tbody>tr.active>th,.table>tfoot>tr.active>th{background-color:#f
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 6f 64 79 3e 74 72 3e 74 64 2e 69 6e 66 6f 3a 68 6f 76 65 72 2c 2e 74 61 62 6c 65 2d 68 6f 76 65 72 3e 74 62 6f 64 79 3e 74 72 3e 74 68 2e 69 6e 66 6f 3a 68 6f 76 65 72 2c 2e 74 61 62 6c 65 2d 68 6f 76 65 72 3e 74 62 6f 64 79 3e 74 72 2e 69 6e 66 6f 3a 68 6f 76 65 72 3e 74 64 2c 2e 74 61 62 6c 65 2d 68 6f 76 65 72 3e 74 62 6f 64 79 3e 74 72 3a 68 6f 76 65 72 3e 2e 69 6e 66 6f 2c 2e 74 61 62 6c 65 2d 68 6f 76 65 72 3e 74 62 6f 64 79 3e 74 72 2e 69 6e 66 6f 3a 68 6f 76 65 72 3e 74 68 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 63 34 65 33 66 33 7d 2e 74 61 62 6c 65 3e 74 68 65 61 64 3e 74 72 3e 74 64 2e 77 61 72 6e 69 6e 67 2c 2e 74 61 62 6c 65 3e 74 62 6f 64 79 3e 74 72 3e 74 64 2e 77 61 72 6e 69 6e 67 2c 2e 74 61 62 6c 65 3e 74 66 6f 6f 74 3e Data Ascii: ody>tr>td.info:hover,.table-hover>tbody>tr>th.info:hover,.table-hover>tbody>tr.info:hover>td,.table-hover>tbody>tr:hover>.info,.table-hover>tbody>tr.info:hover>th{background-color:#c4e3f3}.table>thead>tr>td.warning,.table>tbody>tr>td.warning,.table>tfoot>

Timestamp	Bytes transferred	Direction	Data
2024-05-25 22:24:16 UTC	551	OUT	GET /css/telegram.css HTTP/1.1 Host: www.telegremapp.me Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telegremapp.me/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-05-25 22:24:16 UTC	778	IN	HTTP/1.1 200 OK Date: Sat, 25 May 2024 22:24:16 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: close Last-Modified: Sat, 26 Feb 2022 15:04:52 GMT Vary: Accept-Encoding ETag: W/"621a4194-1aef4" Expires: Sun, 26 May 2024 10:24:16 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 CF-Cache-Status: REVALIDATED Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mrJTYIjoKG%2FBchVYHtdekD1sB2x6BZJ3GtT7p1CjAqHH5SuW56xFetQk04WWiRY0Hb3PDgk08bPuWw8Ap77wKIef%2BgXYq1QG0w3%2BkBPa2%2FYfxbZV6agRcZcuonNQaGzw9IfnNZo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8898ef47ee1d4345-EWR alt-svc: h3=":443"; ma=86400
2024-05-25 22:24:16 UTC	591	IN	Data Raw: 37 63 61 36 0d 0a 62 6f 64 79 20 7b 0a 20 20 66 6f 6e 74 3a 20 31 32 70 78 2f 31 38 70 78 20 22 4c 75 63 69 64 61 20 47 72 61 6e 64 65 22 2c 20 22 4c 75 63 69 64 61 20 53 61 6e 73 20 55 6e 69 63 6f 64 65 22 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 20 20 2f 2a 2d 77 65 62 6b 69 74 2d 66 6f 6e 74 2d 73 6d 6f 6f 74 68 69 6e 67 3a 20 61 6e 74 69 61 6c 69 61 73 65 64 3b 2a 2f 0a 7d 0a 68 74 6d 6c 2e 6c 61 6e 67 5f 72 74 6c 20 7b 0a 20 20 64 69 72 65 63 74 69 6f 6e 3a 20 72 74 6c 3b 0a 7d 0a 0a 61 2c 0a 61 3a 68 6f 76 65 72 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 38 38 63 63 3b 0a 7d 0a 61 3a 66 6f 63 75 73 20 7b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e Data Ascii: 7ca6body { font: 12px/18px "Lucida Grande", "Lucida Sans Unicode", Arial, Helvetica, Verdana, sans-serif; /-webkit-font-smoothing: antialiased;/}html.lang_rtl { direction: rtl;}a,a:hover { color: #0088cc;}a:focus { text-decoration: n
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 69 64 74 68 3a 20 31 31 37 30 70 78 3b 0a 20 20 7d 0a 7d 0a 2e 63 6f 6e 74 61 69 6e 65 72 2d 66 6c 75 69 64 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 61 75 74 6f 3b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 61 75 74 6f 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 31 35 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 31 35 70 78 3b 0a 7d 0a 2e 72 6f 77 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 31 35 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 2d 31 35 70 78 3b 0a 7d 0a 0a 2e 63 6f 6e 74 61 69 6e 65 72 3a 62 65 66 6f 72 65 20 7b 0a 20 20 63 6f 6e 74 65 6e 74 3a 20 22 20 22 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 74 61 62 6c 65 3b 0a 7d 0a 2e 63 6f 6e 74 61 69 6e 65 72 3a 61 66 74 65 Data Ascii: idth: 1170px; }}.container-fluid { margin-right: auto; margin-left: auto; padding-left: 15px; padding-right: 15px;}.row { margin-left: -15px; margin-right: -15px;}.container:before { content: " "; display: table;}.container:afte
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 61 76 20 3e 20 2e 61 63 74 69 76 65 20 3e 20 61 3a 61 66 74 65 72 2c 0a 2e 6e 61 76 62 61 72 2d 74 67 20 2e 6e 61 76 20 3e 20 2e 6f 70 65 6e 20 3e 20 61 3a 61 66 74 65 72 2c 0a 2e 6e 61 76 62 61 72 2d 74 67 20 2e 6e 61 76 20 3e 20 6c 69 20 3e 20 61 3a 68 6f 76 65 72 3a 61 66 74 65 72 20 7b 0a 20 20 6f 70 61 63 69 74 79 3a 20 31 3b 0a 20 20 74 72 61 6e 73 66 6f 72 6d 3a 20 73 63 61 6c 65 58 28 31 2e 30 29 20 73 63 61 6c 65 59 28 31 2e 30 29 3b 0a 7d 0a 2e 6e 61 76 62 61 72 2d 74 67 20 2e 6e 61 76 20 3e 20 6c 69 20 3e 20 61 2c 0a 2e 6e 61 76 62 61 72 2d 74 67 20 2e 6e 61 76 20 3e 20 6c 69 20 3e 20 61 3a 68 6f 76 65 72 2c 0a 2e 6e 61 76 62 61 72 2d 74 67 20 2e 6e 61 76 20 3e 20 6c 69 20 3e 20 61 3a 66 6f 63 75 73 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 Data Ascii: av > .active > a:after,.navbar-tg .nav > .open > a:after,.navbar-tg .nav > li > a:hover:after { opacity: 1; transform: scaleX(1.0) scaleY(1.0);}.navbar-tg .nav > li > a,.navbar-tg .nav > li > a:hover,.navbar-tg .nav > li > a:focus { background
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 2d 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 31 70 78 20 72 67 62 61 28 32 30 2c 36 30 2c 38 33 2c 30 2e 31 29 3b 0a 7d 0a 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 20 3e 20 6c 69 20 3e 20 61 20 7b 0a 20 20 70 61 64 64 69 6e 67 3a 20 38 70 78 20 31 38 70 78 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 2d 31 70 78 3b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 38 63 3b 0a 7d 0a 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 20 3e 20 6c 69 20 3e 20 61 3a 66 69 72 73 74 2d 63 68 69 6c 64 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 31 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 74 6f 70 3a 20 39 70 78 3b 0a 7d 0a 2e 64 72 6f 70 64 6f 77 6e 2d 6d 65 6e 75 20 3e 20 6c 69 20 3e 20 61 3a 6c 61 73 74 2d 63 68 69 6c 64 20 7b 0a 20 20 6d 61 72 67 69 6e 2d 62 6f Data Ascii: -box-shadow: 0 1px 1px rgba(20,60,83,0.1);}.dropdown-menu > li > a { padding: 8px 18px; margin: 0 -1px; color: #08c;}.dropdown-menu > li > a:first-child { margin-top: -1px; padding-top: 9px;}.dropdown-menu > li > a:last-child { margin-bo
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 3e 20 75 6c 3a 6e 6f 74 28 2e 6e 61 76 29 20 6c 69 2c 0a 2e 69 73 5f 72 74 6c 20 23 64 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 3e 20 6f 6c 3a 6e 6f 74 28 2e 6e 61 76 29 20 75 6c 3a 6e 6f 74 28 2e 6e 61 76 29 20 6c 69 2c 0a 2e 69 73 5f 72 74 6c 20 23 64 65 76 5f 70 61 67 65 5f 63 6f 6e 74 65 6e 74 20 75 6c 2e 62 75 6c 6c 65 74 65 64 20 6c 69 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 70 6f 73 69 74 69 6f 6e 3a 20 31 30 30 25 20 38 70 78 3b 0a 20 20 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 20 30 3b 0a 20 20 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 20 32 30 70 78 3b 0a 7d 0a 0a 0a 0a 2e 62 72 65 61 64 63 72 75 6d 62 20 3e 20 6c 69 20 7b 0a 20 20 74 65 78 74 2d 73 68 61 64 6f 77 3a 20 6e 6f 6e 65 3b Data Ascii: ev_page_content > ul:not(.nav) li,.is_rtl #dev_page_content > ol:not(.nav) ul:not(.nav) li,.is_rtl #dev_page_content ul.bulleted li { background-position: 100% 8px; padding-left: 0; padding-right: 20px;}.breadcrumb > li { text-shadow: none;
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 6e 3a 20 6e 6f 6e 65 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 31 3b 0a 20 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 32 32 70 78 3b 0a 0a 20 20 63 75 72 73 6f 72 3a 20 64 65 66 61 75 6c 74 3b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 70 6f 73 69 74 69 6f 6e 3a 20 61 62 73 6f 6c 75 74 65 3b 0a 20 20 74 6f 70 3a 20 30 3b 0a 20 20 6c 65 66 74 3a 20 30 3b 0a 20 20 62 6f 74 74 6f 6d 3a 20 30 3b 0a 0a 20 20 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 30 70 78 20 73 6f 6c 69 64 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 20 20 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 2d 31 30 70 78 3b 0a 20 20 2d 77 65 62 6b 69 74 2d 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6c 69 70 3a 70 61 64 64 69 6e 67 2d 62 6f 78 3b 0a 20 20 2d 6d 6f 7a 2d 62 61 63 6b 67 72 Data Ascii: n: none; line-height: 1; margin-left: -22px; cursor: default; display: block; position: absolute; top: 0; left: 0; bottom: 0; border-top: 10px solid transparent; margin-top: -10px; -webkit-background-clip:padding-box; -moz-backgr
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 6e 74 3b 0a 7d 0a 0a 2e 62 72 65 61 64 63 72 75 6d 62 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 65 63 66 33 66 61 3b 0a 7d 0a 2e 62 72 65 61 64 63 72 75 6d 62 20 7b 0a 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 20 65 6c 6c 69 70 73 69 73 3b 0a 20 20 6f 76 65 72 66 6c 6f 77 3a 20 68 69 64 64 65 6e 3b 0a 7d 0a 2e 62 72 65 61 64 63 72 75 6d 62 20 6c 69 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 66 6c 6f 61 74 3a 20 6e 6f 6e 65 3b 0a 20 20 77 68 69 74 65 2d 73 70 61 63 65 3a 20 6e 6f 77 72 61 70 3b 0a 20 20 74 65 78 74 2d 6f 76 65 72 66 6c 6f 77 3a 20 65 6c 6c 69 70 73 69 73 3b 0a 7d 0a 2e 62 72 65 61 64 63 72 Data Ascii: nt;}.breadcrumb { background-color: #ecf3fa;}.breadcrumb { white-space: nowrap; text-overflow: ellipsis; overflow: hidden;}.breadcrumb li { display: inline-block; float: none; white-space: nowrap; text-overflow: ellipsis;}.breadcr
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 74 6f 5f 74 6f 70 5f 77 72 61 70 3a 68 6f 76 65 72 20 2e 62 61 63 6b 5f 74 6f 5f 74 6f 70 20 7b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 23 65 63 66 33 66 38 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 72 67 62 61 28 31 37 34 2c 20 31 39 38 2c 20 32 31 35 2c 20 30 2e 32 29 3b 0a 7d 0a 2e 69 63 6f 6e 2d 74 6f 2d 74 6f 70 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 69 6e 6c 69 6e 65 2d 62 6c 6f 63 6b 3b 0a 20 20 62 61 63 6b 67 72 6f 75 6e 64 3a 20 75 72 6c 28 2e 2e 2f 69 6d 67 2f 62 61 63 6b 5f 74 6f 5f 74 6f 70 5f 31 78 2e 70 6e 67 29 20 30 20 35 30 25 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 20 20 77 69 64 74 68 3a 20 31 36 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 37 70 78 3b 0a 20 20 6d 61 72 67 69 6e 2d 72 69 67 68 74 3a 20 31 32 70 78 3b 0a 20 20 6d Data Ascii: to_top_wrap:hover .back_to_top { background: #ecf3f8; background: rgba(174, 198, 215, 0.2);}.icon-to-top { display: inline-block; background: url(../img/back_to_top_1x.png) 0 50% no-repeat; width: 16px; height: 7px; margin-right: 12px; m
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 6e 65 3b 0a 7d 0a 2e 73 69 64 65 5f 62 6c 6f 67 5f 64 61 74 65 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 30 3b 0a 20 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 62 6f 6c 64 3b 0a 7d 0a 2e 73 69 64 65 5f 62 6c 6f 67 5f 74 69 74 6c 65 20 7b 0a 20 20 63 6f 6c 6f 72 3a 20 23 30 30 38 38 63 63 3b 0a 7d 0a 61 2e 73 69 64 65 5f 62 6c 6f 67 5f 65 6e 74 72 79 3a 68 6f 76 65 72 20 2e 73 69 64 65 5f 62 6c 6f 67 5f 74 69 74 6c 65 20 7b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 75 6e 64 65 72 6c 69 6e 65 3b 0a 7d 0a 2e 73 69 64 65 5f 74 6f 75 72 5f 65 6e 74 72 79 20 2e 73 69 64 65 5f 62 6c 6f 67 5f 74 69 74 6c 65 20 7b 0a 20 20 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 34 70 78 3b 0a 7d 0a 0a 2e 74 6c 5f 6d 61 69 6e 5f 62 6f 74 74 6f 6d 5f 62 6c 6f 67 2c Data Ascii: ne;}.side_blog_date { color: #000; font-weight: bold;}.side_blog_title { color: #0088cc;}a.side_blog_entry:hover .side_blog_title { text-decoration: underline;}.side_tour_entry .side_blog_title { font-size: 14px;}.tl_main_bottom_blog,
2024-05-25 22:24:16 UTC	1369	IN	Data Raw: 67 69 6e 3a 20 30 20 61 75 74 6f 3b 0a 20 20 70 61 64 64 69 6e 67 3a 20 32 30 70 78 20 30 20 32 30 70 78 3b 0a 7d 0a 61 2e 74 6c 5f 6d 61 69 6e 5f 6c 6f 67 6f 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 20 30 3b 0a 20 20 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 20 6e 6f 6e 65 20 21 69 6d 70 6f 72 74 61 6e 74 3b 0a 7d 0a 73 76 67 2e 74 6c 5f 6d 61 69 6e 5f 6c 6f 67 6f 2c 0a 69 6d 61 67 65 2e 74 6c 5f 6d 61 69 6e 5f 6c 6f 67 6f 2c 0a 69 6d 67 2e 74 6c 5f 6d 61 69 6e 5f 6c 6f 67 6f 20 7b 0a 20 20 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 20 20 77 69 64 74 68 3a 20 31 32 38 70 78 3b 0a 20 20 68 65 69 67 68 74 3a 20 31 32 38 70 78 3b 0a 20 20 6d 61 72 67 69 6e 3a 20 30 20 61 75 74 6f 3b Data Ascii: gin: 0 auto; padding: 20px 0 20px;}a.tl_main_logo { display: block; line-height: 0; text-decoration: none !important;}svg.tl_main_logo,image.tl_main_logo,img.tl_main_logo { display: block; width: 128px; height: 128px; margin: 0 auto;