Edit tour

Windows Analysis Report
http://www.rr8844.com

Overview

General Information

Sample URL:	http://www.rr8844.com
Analysis ID:	1583168
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

AI detected suspicious Javascript

Performs DNS queries to domains with low reputation

Connects to several IPs in different countries

Detected non-DNS traffic on DNS port

Classification

Process Tree

System is w10x64

chrome.exe (PID: 1004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3848 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,11860038956780945597,535589302757175344,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6548 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.rr8844.com" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://www.xtpag.top:2087/images/672e3dcf290341902fe11411.gif

Avira URL Cloud: Label: malware

Phishing

AI detected suspicious Javascript

Source: 1.13..script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://xmad.7wzx9.com/pangda/tbad.js... This script demonstrates several high-risk behaviors, including data exfiltration, redirects to suspicious domains, and the use of obfuscated URLs. The script appears to be generating a list of links and images, many of which point to untrusted or potentially malicious domains. This suggests the script may be part of a phishing or scam operation, and it should be considered a high-risk threat.

Source: unknown

HTTPS traffic detected: 23.145.136.94:443 -> 192.168.2.4:49760 version: TLS 1.2

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 61MB

Networking

Performs DNS queries to domains with low reputation

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: go.imgmimi.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: go.imgmimi.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: go.imgmimi.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: go.imgmimi.xyz

Source: unknown

Network traffic detected: IP country count 10

Source: global traffic

TCP traffic: 192.168.2.4:49746 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/style.css?v=19 HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/jquery.min.js HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/common15.js?v=100087799 HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /header.html?v=9999999 HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/html, /; q=0.01X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /footer.html?v=9999999 HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/html, /; q=0.01X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pangda/base.js?v=9999999 HTTP/1.1Host: xmad.7wzx9.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/search2.js HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/jquery.min.js HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/common15.js?v=100087799 HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /header.html?v=9999999 HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /footer.html?v=9999999 HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pangda/tbad.js HTTP/1.1Host: xmad.7wzx9.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/images/bgg.png HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/images/logo.jpg HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/fonts/iconfont1.woff2 HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://www.rr8844.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: fontReferer: https://www.rr8844.com/css/style.css?v=19Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1kkky_1300x240.gif HTTP/1.1Host: ig23.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/Fky_1300x240.gif HTTP/1.1Host: ig72.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_67f016f8ae5948e4a82fbfedd1ad400a~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/GYyh_1300x240.gif HTTP/1.1Host: ig32.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_4314275b0467418ab4bd32c8da4d6358~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/fftyc_1300x240.gif HTTP/1.1Host: ig38.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/search2.js HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pangda/base.js?v=9999999 HTTP/1.1Host: xmad.7wzx9.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /318d22cf923239b38dec8c9337224fb4.gif HTTP/1.1Host: go.imgmimi.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wns1300x200.gif HTTP/1.1Host: sezhang.s3.ap-southeast-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/996a_180x180.gif HTTP/1.1Host: ig79.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/FF98t_180x180.gif HTTP/1.1Host: ig82.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1300x200.gif HTTP/1.1Host: 5967.5967007.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /11.gif HTTP/1.1Host: 5967.5967007.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1KKky_150x150.gif HTTP/1.1Host: ig23.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_34be67cd0dc34bedbba06a4a787cba19~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /pangda/tbad.js HTTP/1.1Host: xmad.7wzx9.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_b1d6c5504d164c40835d918239dcd10e~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/GYyh_180x180.GIF HTTP/1.1Host: ig55.vipConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f3dab33316b44c64a6f119272fb4489e.gif HTTP/1.1Host: 555ww666yy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dd611258bd2c4f1a9cd4bcf648f7ef2e.gif HTTP/1.1Host: 555ww666yy.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2828/qqww-1300-240.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/1616/PPJJ-200-200.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2828/qqww-200-1.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/1616/PPJJ-1300-240.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /z.js?id=1281318611&async=1 HTTP/1.1Host: v1.cnzz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/11/08/1300x200.gif HTTP/1.1Host: hongniu.getehu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/11/09/150-150.gif HTTP/1.1Host: hongniu.getehu.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/12/05/1300-200.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/10/28/10ss8i9.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/08/11/u98s7t.gif HTTP/1.1Host: 69vvnstttaaa888.dzlndygh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/LD/SH131.gif HTTP/1.1Host: tycjb777.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/images/bgg.png HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655358e6aaad94a5e9fe6a141b3bc5ef.gif HTTP/1.1Host: we.zz17377.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7bd578c706a9f8fb6f46da207b46e618.gif HTTP/1.1Host: we.zz17377.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/07/26/12872no.gif HTTP/1.1Host: 69vvnstttaaa888.dzlndygh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/12/05/200-200.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /00165139bb76d845bfa39bde42b929c5.gif HTTP/1.1Host: go.imgmimi.xyzConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/10/28/1300-200_1.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /css/images/logo.jpg HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/LD/SH132.gif HTTP/1.1Host: tycjb777.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdbcb1b08e2d9dc97758d1ca7b53357b.gif HTTP/1.1Host: vnsimg.hfzkgw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /150x150w.gif HTTP/1.1Host: sezhang.s3.ap-southeast-1.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /yhgifjiami/xyh/150x150.js HTTP/1.1Host: yh88812345qwerasdf.lzaotw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tyc-4hu1300x200.gif HTTP/1.1Host: monkey.p2ld58.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tyc-sihu150x150.gif HTTP/1.1Host: monkey.p2ld58.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b9fb3076983380cf2d30af608afa0f94.gif.js HTTP/1.1Host: vns2.ezrent.hkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/Fky_1300x240.gif HTTP/1.1Host: ig72.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/tyxsc/xmspggTT2-1300X240.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/168sc/168-1300x240.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_67f016f8ae5948e4a82fbfedd1ad400a~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6d1a62e98f7abc0ea4a7ac9760cb2e97.gif HTTP/1.1Host: img.qxwoiv.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1kkky_1300x240.gif HTTP/1.1Host: ig23.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b38048b5589bcfb538c627481211202f.gif HTTP/1.1Host: img.qxwoiv.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/168sc/168-200x200-2.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/tyxsc/xmspggTT2-200X200.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/GYyh_1300x240.gif HTTP/1.1Host: ig32.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/fftyc_1300x240.gif HTTP/1.1Host: ig38.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/ny.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /318d22cf923239b38dec8c9337224fb4.gif HTTP/1.1Host: go.imgmimi.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /00165139bb76d845bfa39bde42b929c5.gif HTTP/1.1Host: go.imgmimi.xyzConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /yhgifjiami/xyh/1300x240.js HTTP/1.1Host: yh88812345qwerasdf.lzaotw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_34be67cd0dc34bedbba06a4a787cba19~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_4314275b0467418ab4bd32c8da4d6358~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /11.gif HTTP/1.1Host: 5967.5967007.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/yf1300-200.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/GYyh_180x180.GIF HTTP/1.1Host: ig55.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/yf150-150.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202401/30/a2146fa33ff3/cy1300.js HTTP/1.1Host: x-hweu2.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202401/30/a2146fa33ff3/cy150.js HTTP/1.1Host: x-hweu2.hccoeutg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2828/qqww-200-1.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2828/qqww-1300-240.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/1616/PPJJ-1300-240.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/FF98t_180x180.gif HTTP/1.1Host: ig82.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/1616/PPJJ-200-200.gif HTTP/1.1Host: amjs.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /7bd578c706a9f8fb6f46da207b46e618.gif HTTP/1.1Host: we.zz17377.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/uu-rt150x150.gif HTTP/1.1Host: monkey.p2ld58.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /655358e6aaad94a5e9fe6a141b3bc5ef.gif HTTP/1.1Host: we.zz17377.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/1KKky_150x150.gif HTTP/1.1Host: ig23.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/996a_180x180.gif HTTP/1.1Host: ig79.vipConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/dd9a87_b1d6c5504d164c40835d918239dcd10e~mv2.gif HTTP/1.1Host: static.wixstatic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1300x200.gif HTTP/1.1Host: 5967.5967007.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: X-SUDUN-WAF-R-C=0001695112
Source: global traffic	HTTP traffic detected: GET /6d1a62e98f7abc0ea4a7ac9760cb2e97.gif HTTP/1.1Host: ylg1.duyunfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /f3dab33316b44c64a6f119272fb4489e.gif HTTP/1.1Host: 555ww666yy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /dd611258bd2c4f1a9cd4bcf648f7ef2e.gif HTTP/1.1Host: 555ww666yy.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/10/28/10ss8i9.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/12/05/1300-200.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /z.js?id=1281318611&async=1 HTTP/1.1Host: v1.cnzz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/12/05/200-200.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/10/28/1300-200_1.gif HTTP/1.1Host: cc777img.dqsldz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wns1300x200.gif HTTP/1.1Host: sezhang.s3.ap-southeast-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /150x150w.gif HTTP/1.1Host: sezhang.s3.ap-southeast-1.amazonaws.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/11/09/150-150.gif HTTP/1.1Host: hongniu.getehu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/11/08/1300x200.gif HTTP/1.1Host: hongniu.getehu.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tyc-sihu150x150.gif HTTP/1.1Host: monkey.p2ld58.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/tyc-4hu1300x200.gif HTTP/1.1Host: monkey.p2ld58.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b38048b5589bcfb538c627481211202f.gif HTTP/1.1Host: ylg1.duyunfk.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/LD/SH132.gif HTTP/1.1Host: tycjb777.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b9fb3076983380cf2d30af608afa0f94.gif.js HTTP/1.1Host: vns2.ezrent.hkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/LD/SH131.gif HTTP/1.1Host: tycjb777.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/07/26/12872no.gif HTTP/1.1Host: 69vvnstttaaa888.dzlndygh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /i/2024/08/11/u98s7t.gif HTTP/1.1Host: 69vvnstttaaa888.dzlndygh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/tyxsc/xmspggTT2-200X200.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/168sc/168-1300x240.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202401/30/a2146fa33ff3/cy150.js HTTP/1.1Host: x-hweu2.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /yhgifjiami/xyh/150x150.js HTTP/1.1Host: yh88812345qwerasdf.lzaotw.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/tyxsc/xmspggTT2-1300X240.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdbcb1b08e2d9dc97758d1ca7b53357b.gif HTTP/1.1Host: vns3.ezrent.hkConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /img/uu-rt150x150.gif HTTP/1.1Host: monkey.p2ld58.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/yf150-150.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/yf1300-200.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202401/30/a2146fa33ff3/cy1300.js HTTP/1.1Host: x-hweu2.hccoeutg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b38048b5589bcfb538c627481211202f.gif HTTP/1.1Host: ylg1.duyunfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jiamigif/168sc/168-200x200-2.gif HTTP/1.1Host: www12.pengxunfei.siteConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/ny.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.js?web_id=1281318611&t=z HTTP/1.1Host: c.cnzz.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdbcb1b08e2d9dc97758d1ca7b53357b.gif HTTP/1.1Host: vns3.ezrent.hkConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/images/2.ico HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UM_distinctid=194256e0475528-0a57ea5506af81-26031e51-140000-194256e0476637; CNZZDATA1281318611=1014212052-1735794755-%7C1735794755
Source: global traffic	HTTP traffic detected: GET /6d1a62e98f7abc0ea4a7ac9760cb2e97.gif HTTP/1.1Host: ylg1.duyunfk.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c.js?web_id=1281318611&t=z HTTP/1.1Host: c.cnzz.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/images/2.ico HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UM_distinctid=194256e0475528-0a57ea5506af81-26031e51-140000-194256e0476637; CNZZDATA1281318611=1014212052-1735794755-%7C1735794755
Source: global traffic	HTTP traffic detected: GET /getDataInit HTTP/1.1Host: data.7wzx9.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnnjgp.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnn7uf.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unc7yj.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnnjgp.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnn7uf.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unbndf.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /forward HTTP/1.1Host: data.7wzx9.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unc7yj.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unae56.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/una04o.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unbndf.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/un9cdm.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/7ef7e0773c6f/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/ae7abced1eae/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/una04o.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unae56.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/un8bpb.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/705c2afa5b91/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/dd212f88e75a/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/60fb0c129ef8/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/d26727ebd6a5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/un8bpb.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2zdy8.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/un9cdm.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2yjhe.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2y5vq.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2zdy8.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/umz9e7.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2yjhe.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2y5vq.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/umz9e7.jpg HTTP/1.1Host: mtu.slinpic.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/094f2e05c08b/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/7e6af903fba5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/bf094940c1b9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/dd504259fce9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/705c2afa5b91/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/7ef7e0773c6f/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/ae7abced1eae/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/dd212f88e75a/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/d26727ebd6a5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/60fb0c129ef8/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/594a71024e23/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/dff801d16405/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/2f1cae3a3b29/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/be0657958f85/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/4f4f2ebcdda9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/094f2e05c08b/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/7e6af903fba5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/bf094940c1b9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202412/31/dd504259fce9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/471c43d96fe9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/594a71024e23/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/8fa79f499219/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/dff801d16405/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/b27072fa42df/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/ddf6cafcea0f/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/6d4fba52e3fe/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/2f1cae3a3b29/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/be0657958f85/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/4f4f2ebcdda9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/128ca5d2c073/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/471c43d96fe9/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/8fa79f499219/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/ddf6cafcea0f/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/d57e9b0e172a/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/a933eaf511ef/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/6d4fba52e3fe/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/b27072fa42df/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/0ae2048d140c/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/128ca5d2c073/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/9bafe24706b5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/d57e9b0e172a/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/981ed809e1e1/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/a933eaf511ef/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/ecfa86b60f78/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/3606672dc09e/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/0ae2048d140c/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/98521a9331a5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/9bafe24706b5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/981ed809e1e1/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/3606672dc09e/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/ecfa86b60f78/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/c56b3842c616/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/98521a9331a5/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202501/01/c56b3842c616/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video.html?typeId=21&typeMid=1 HTTP/1.1Host: www.rr8844.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: UM_distinctid=194256e0475528-0a57ea5506af81-26031e51-140000-194256e0476637; CNZZDATA1281318611=1014212052-1735794755-%7C1735794755
Source: global traffic	HTTP traffic detected: GET /cdbcb1b08e2d9dc97758d1ca7b53357b.gif HTTP/1.1Host: vnsimg.hfzkgw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /b38048b5589bcfb538c627481211202f.gif HTTP/1.1Host: img.qxwoiv.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /6d1a62e98f7abc0ea4a7ac9760cb2e97.gif HTTP/1.1Host: img.qxwoiv.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/yf150-150.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"If-None-Match: "2873-6293dfea22d2b"If-Modified-Since: Sat, 14 Dec 2024 17:08:22 GMTsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /yhgifjiami/xyh/150x150.js HTTP/1.1Host: yh88812345qwerasdf.lzaotw.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"If-None-Match: "66f6d93d-464e7"If-Modified-Since: Fri, 27 Sep 2024 16:11:41 GMTsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /getDataInit HTTP/1.1Host: data.7wzx9.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /forward HTTP/1.1Host: data.7wzx9.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/ny.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"If-None-Match: "121a00-6266293ae6576"If-Modified-Since: Fri, 08 Nov 2024 08:31:26 GMTsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jsgif/yf1300-200.js HTTP/1.1Host: 2024hwus1.heibanwa.mobiConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"If-None-Match: "82dbf-6293dfeb2c32a"If-Modified-Since: Sat, 14 Dec 2024 17:08:23 GMTsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/22/214c28054d30/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/23/fb1f13f7ea29/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/19/3f0e5a99be3b/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/18/1e6931ef5c8d/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/23/fb1f13f7ea29/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/17/314e2e628318/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/16/6b45b6b1daec/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/19/3f0e5a99be3b/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/15/b0422eef5536/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/22/214c28054d30/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/14/588b8dbc8bfb/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/12/5ef689465f78/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/18/1e6931ef5c8d/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/11/4600ac64a9aa/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/10/8eceeb2a583c/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/02/7256ef6b536e/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/16/6b45b6b1daec/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/01/4ac1fe3ea9de/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/17/314e2e628318/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/15/b0422eef5536/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/14/588b8dbc8bfb/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/30/babde3de6685/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/28/80c39ec0e790/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/12/5ef689465f78/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/27/f72a7fdb7fea/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/26/647e63b246a0/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/24/87dc8d74df0f/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/23/1e66f25c9133/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/02/7256ef6b536e/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/10/8eceeb2a583c/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/01/4ac1fe3ea9de/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/21/85ffd4f6e6d7/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202410/11/4600ac64a9aa/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/28/80c39ec0e790/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/30/babde3de6685/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/27/f72a7fdb7fea/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/26/647e63b246a0/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/24/87dc8d74df0f/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/23/1e66f25c9133/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /video/m3u8/202409/21/85ffd4f6e6d7/1.jpg HTTP/1.1Host: x-hweu5.rdfzsjs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.rr8844.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.rr8844.com
Source: global traffic	DNS traffic detected: DNS query: xmad.7wzx9.com
Source: global traffic	DNS traffic detected: DNS query: data.7wzx9.com
Source: global traffic	DNS traffic detected: DNS query: v1.cnzz.com
Source: global traffic	DNS traffic detected: DNS query: cc777img.dqsldz.com
Source: global traffic	DNS traffic detected: DNS query: x-hweu2.hccoeutg.com
Source: global traffic	DNS traffic detected: DNS query: yh88812345qwerasdf.lzaotw.com
Source: global traffic	DNS traffic detected: DNS query: 69vvnstttaaa888.dzlndygh.com
Source: global traffic	DNS traffic detected: DNS query: amjs.hccoeutg.com
Source: global traffic	DNS traffic detected: DNS query: static.wixstatic.com
Source: global traffic	DNS traffic detected: DNS query: hongniu.getehu.com
Source: global traffic	DNS traffic detected: DNS query: img.qxwoiv.com
Source: global traffic	DNS traffic detected: DNS query: sz.ggshezhantc.com
Source: global traffic	DNS traffic detected: DNS query: _8686._https.sz.ggshezhantc.com
Source: global traffic	DNS traffic detected: DNS query: 5967.5967007.com
Source: global traffic	DNS traffic detected: DNS query: ig23.vip
Source: global traffic	DNS traffic detected: DNS query: ig38.vip
Source: global traffic	DNS traffic detected: DNS query: ig72.vip
Source: global traffic	DNS traffic detected: DNS query: w0083.com
Source: global traffic	DNS traffic detected: DNS query: _33236._https.w0083.com
Source: global traffic	DNS traffic detected: DNS query: we.zz17377.com
Source: global traffic	DNS traffic detected: DNS query: sezhang.s3.ap-southeast-1.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: 2024hwus1.heibanwa.mobi
Source: global traffic	DNS traffic detected: DNS query: 555ww666yy.com
Source: global traffic	DNS traffic detected: DNS query: www12.pengxunfei.site
Source: global traffic	DNS traffic detected: DNS query: vnsimg.hfzkgw.com
Source: global traffic	DNS traffic detected: DNS query: ig32.vip
Source: global traffic	DNS traffic detected: DNS query: go.imgmimi.xyz
Source: global traffic	DNS traffic detected: DNS query: tycjb777.hccoeutg.com
Source: global traffic	DNS traffic detected: DNS query: www.xtpag.top
Source: global traffic	DNS traffic detected: DNS query: _2087._https.www.xtpag.top
Source: global traffic	DNS traffic detected: DNS query: monkey.p2ld58.com
Source: global traffic	DNS traffic detected: DNS query: ig79.vip
Source: global traffic	DNS traffic detected: DNS query: ig55.vip
Source: global traffic	DNS traffic detected: DNS query: w0082.com
Source: global traffic	DNS traffic detected: DNS query: _33236._https.w0082.com
Source: global traffic	DNS traffic detected: DNS query: vns2.ezrent.hk
Source: global traffic	DNS traffic detected: DNS query: ig82.vip
Source: global traffic	DNS traffic detected: DNS query: vns3.ezrent.hk
Source: global traffic	DNS traffic detected: DNS query: ylg1.duyunfk.com
Source: global traffic	DNS traffic detected: DNS query: z6.cnzz.com
Source: global traffic	DNS traffic detected: DNS query: c.cnzz.com
Source: global traffic	DNS traffic detected: DNS query: x-hweu5.rdfzsjs.com
Source: global traffic	DNS traffic detected: DNS query: mtu.slinpic.com

Source: unknown

HTTP traffic detected: POST /stat.htm?id=1281318611&r=&lg=en-us&ntime=none&cnzz_eid=1014212052-1735794755-&showp=1280x1024&p=https%3A%2F%2Fwww.rr8844.com%2F&t=%E6%9C%80%E6%96%B0%E7%83%AD%E9%97%A8%E7%94%B5%E5%BD%B1%E5%9C%A8%E7%BA%BF%E8%A7%82%E7%9C%8B%EF%BD%9C%E5%85%8D%E8%B4%B9%E9%AB%98%E6%B8%85%E7%94%B5%E5%BD%B1%E8%B5%84%E6%BA%90%EF%BD%9C%E7%94%B5%E5%BD%B1%E7%BD%91%E7%AB%99-%E5%85%8D%E8%B4%B9%E5%9C%A8%E7%BA%BF%E8%A7%82%E7%9C%8B%E7%83%AD%E9%97%A8%E7%94%B5%E5%BD%B1%EF%BD%9C%E9%AB%98%E6%B8%85%E7%94%BB%E8%B4%A8...&umuuid=194256e0475528-0a57ea5506af81-26031e51-140000-194256e0476637&h=1 HTTP/1.1Host: z6.cnzz.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.rr8844.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://www.rr8844.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: http://locked5-723840144.ap-east-1.elb.amazonaws.com/wns0x040/?shareName=wns0x040
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: http://woool.996m2.com/data/attachment/forum/202307/22/170443i7hi40474l44l07u.jpg
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: http://woool.996m2.com/data/attachment/forum/202307/22/170443zi8yxih33fyf8fj2.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://18.yjxxoa.com/?shareName=ylg18
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://2024hwus1.heibanwa.mobi/jsgif/ny.js
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://2024hwus1.heibanwa.mobi/jsgif/yf1300-200.js
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://2024hwus1.heibanwa.mobi/jsgif/yf150-150.js
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://214.lxqgg.com/?shareName=zhandian214
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://48670.5386yltz11.com:5386/ad88.html?25703
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://555ww666yy.com/dd611258bd2c4f1a9cd4bcf648f7ef2e.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://555ww666yy.com/f3dab33316b44c64a6f119272fb4489e.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://568.5683853.cc:8443/?shareName=568.5683853.cc
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://5967.5967007.com/11.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://5967.5967007.com/1300x200.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://69vvnstttaaa888.dzlndygh.com/i/2024/07/26/12872no.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://69vvnstttaaa888.dzlndygh.com/i/2024/08/11/u98s7t.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://787928.com:7888
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://ad.xmmnsl.com/uploads/images/1689155699.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://amjs.hccoeutg.com/i/1616/PPJJ-1300-240.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://amjs.hccoeutg.com/i/1616/PPJJ-200-200.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://amjs.hccoeutg.com/i/2828/qqww-1300-240.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://amjs.hccoeutg.com/i/2828/qqww-200-1.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://bjm.1vkx.cn/public/1/img/1597572842.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://cc777img.dqsldz.com/i/2024/10/28/10ss8i9.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://cc777img.dqsldz.com/i/2024/10/28/1300-200_1.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://cc777img.dqsldz.com/i/2024/10/28/620-210.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://cc777img.dqsldz.com/i/2024/12/05/1300-200.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://cc777img.dqsldz.com/i/2024/12/05/200-200.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ckxf00645.cc
Source: chromecache_225.2.dr, chromecache_373.2.dr	String found in binary or memory: https://data.7wzx9.com/forward
Source: chromecache_225.2.dr, chromecache_373.2.dr	String found in binary or memory: https://data.7wzx9.com/getDataInit
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://deiskm.memto51749.net:39006/3_medp/mdp1/158898.csv?mlm564
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://euk11.top
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ffyd.e5nk.com:8888
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://github.com/wyz7777/pangda/blob/main/README.md
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://go.imgmimi.xyz/00165139bb76d845bfa39bde42b929c5.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://go.imgmimi.xyz/318d22cf923239b38dec8c9337224fb4.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://gsygsaoc.209881.poker:23003/1_2JJ2AD
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://hdf.ggttddddbbfp835.com
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://hjf.pppttttkyhqq965.com
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://hongniu.getehu.com/i/2024/11/08/1300x200.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://hongniu.getehu.com/i/2024/11/09/150-150.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://hu101.cc
Source: chromecache_373.2.dr	String found in binary or memory: https://i.slgfjzz.com/20220105/c247889849d9d692850c37576f2812bc.jps
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://iawf05.cc/?cid=466400
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ig23.vip/img/1KKky_150x150.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://ig23.vip/img/1kkky_1300x240.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://ig32.vip/img/GYyh_1300x240.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://ig38.vip/img/fftyc_1300x240.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ig55.vip/img/GYyh_180x180.GIF
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://ig72.vip/img/Fky_1300x240.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ig79.vip/img/996a_180x180.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ig82.vip/img/FF98t_180x180.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://img.maldwin27.xyz/images/6471f2b049ada68764d1d429.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://img.qxwoiv.com/6d1a62e98f7abc0ea4a7ac9760cb2e97.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://img.qxwoiv.com/b38048b5589bcfb538c627481211202f.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://j4xok.vip/daxanja/youd150x350.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://j4xok.vip/dxj/xx150x350.gif
Source: chromecache_437.2.dr	String found in binary or memory: https://m776.co:65432/index.html?channelCode=1620
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://monkey.p2ld58.com/img/tyc-4hu1300x200.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://monkey.p2ld58.com/img/tyc-sihu150x150.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://monkey.p2ld58.com/img/uu-rt150x150.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://nyh32h.net/luodi_si26K
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://oetyc5.org
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://p555g557.vip
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://p8789.com
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://pj8923.com
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://qb3363.cc
Source: chromecache_395.2.dr, chromecache_457.2.dr	String found in binary or memory: https://quanjing.cnzz.com
Source: chromecache_437.2.dr	String found in binary or memory: https://s27ns.com
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://sezhang.s3.ap-southeast-1.amazonaws.com/150x150w.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://sezhang.s3.ap-southeast-1.amazonaws.com/wns1300x200.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://sm2kz.net/image/xiaolin119.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://sm2kz.net/image/yxyhd.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://static.wixstatic.com/media/dd9a87_34be67cd0dc34bedbba06a4a787cba19~mv2.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://static.wixstatic.com/media/dd9a87_4314275b0467418ab4bd32c8da4d6358~mv2.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://static.wixstatic.com/media/dd9a87_67f016f8ae5948e4a82fbfedd1ad400a~mv2.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://static.wixstatic.com/media/dd9a87_b1d6c5504d164c40835d918239dcd10e~mv2.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://sz.ggshezhantc.com:8686/1300x260caivip.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://sz.ggshezhantc.com:8686/150vip.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://t.me/CC91AV
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://t24120103-5e08b5a8a5bb9302.elb.ap-east-1.amazonaws.com:8888
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ttxmsp22.dahczv.com
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://tyc86q2.com/register
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://tycjb777.hccoeutg.com/i/LD/SH131.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://tycjb777.hccoeutg.com/i/LD/SH132.gif
Source: chromecache_288.2.dr, chromecache_379.2.dr	String found in binary or memory: https://v1.cnzz.com/z.js?id=1281318611&async=1
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://v1.cnzz.com/z_stat.php?id=1280624099&web_id=1280624099
Source: chromecache_437.2.dr	String found in binary or memory: https://vip2.loli.io/2023/08/14/ZXpMJbzHlNL7qPs.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://vns2.ezrent.hk/b9fb3076983380cf2d30af608afa0f94.gif.js
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://vnsimg.hfzkgw.com/cdbcb1b08e2d9dc97758d1ca7b53357b.gif
Source: chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://vuy81.top
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://w0082.com:33236/625a3d79f55d45618f08fe8d311c10b3.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://w0083.com:33236/1bd9e5d42614451ba8d203764d864d9d.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://we.zz17377.com/655358e6aaad94a5e9fe6a141b3bc5ef.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://we.zz17377.com/7bd578c706a9f8fb6f46da207b46e618.gif
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://www.5967ggxtz001.com/nice.htm?8175
Source: chromecache_437.2.dr	String found in binary or memory: https://www.baidu.com
Source: chromecache_395.2.dr, chromecache_457.2.dr	String found in binary or memory: https://www.cnzz.com/stat/website.php?web_id=
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://www.ff7722.com
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://www.pdsp.tv
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://www.xtpag.top:2087/images/672e3be2290341902fe11409.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://www.xtpag.top:2087/images/672e3dcf290341902fe11411.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://www12.pengxunfei.site/jiamigif/168sc/168-1300x240.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://www12.pengxunfei.site/jiamigif/168sc/168-200x200-2.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://www12.pengxunfei.site/jiamigif/tyxsc/xmspggTT2-1300X240.gif
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://www12.pengxunfei.site/jiamigif/tyxsc/xmspggTT2-200X200.gif
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy1300.js
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy150.js
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://x53683.com:6987
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://xh77td.vip
Source: chromecache_288.2.dr, chromecache_217.2.dr, chromecache_261.2.dr, chromecache_361.2.dr, chromecache_273.2.dr, chromecache_379.2.dr	String found in binary or memory: https://xmad.7wzx9.com/pangda/base.js?v=9999999
Source: chromecache_288.2.dr, chromecache_379.2.dr	String found in binary or memory: https://xmad.7wzx9.com/pangda/tbad.js
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://y24110601-9bb392c3295d6d9c.elb.ap-east-1.amazonaws.com:7777?channelCode=dff240763
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://yh24122203-c468081638d2b968.elb.ap-east-1.amazonaws.com:8888
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/1300x240.js
Source: chromecache_410.2.dr, chromecache_259.2.dr	String found in binary or memory: https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/150x150.js
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://yhc339.com
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://ymtd.6dae.com/350/?cid=776786
Source: chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	String found in binary or memory: https://z.zcc0115.cc:8443/?shareName=716839983
Source: chromecache_268.2.dr, chromecache_437.2.dr	String found in binary or memory: https://z4a.net/images/2023/05/08/150x350.gif

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50155 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50152 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50000 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50152
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50155
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50156
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49917 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 49962 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50126 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49970 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49946 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50134 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937

Source: unknown

HTTPS traffic detected: 23.145.136.94:443 -> 192.168.2.4:49760 version: TLS 1.2

Source: classification engine

Classification label: mal56.troj.win@17/408@180/53

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,11860038956780945597,535589302757175344,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.rr8844.com"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,11860038956780945597,535589302757175344,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Extra Window Memory Injection	1 Extra Window Memory Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.rr8844.com	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://www.rr8844.com/css/images/logo.jpg	0%	Avira URL Cloud	safe
https://j4xok.vip/dxj/xx150x350.gif	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/c56b3842c616/1.jpg	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2zdy8.jpg	0%	Avira URL Cloud	safe
https://xmad.7wzx9.com/pangda/base.js?v=9999999	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ddf6cafcea0f/1.jpg	0%	Avira URL Cloud	safe
https://hdf.ggttddddbbfp835.com	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/094f2e05c08b/1.jpg	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/bf094940c1b9/1.jpg	0%	Avira URL Cloud	safe
https://www.rr8844.com/css/fonts/iconfont1.woff2	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unc7yj.jpg	0%	Avira URL Cloud	safe
http://locked5-723840144.ap-east-1.elb.amazonaws.com/wns0x040/?shareName=wns0x040	0%	Avira URL Cloud	safe
https://hongniu.getehu.com/i/2024/11/08/1300x200.gif	0%	Avira URL Cloud	safe
https://ig38.vip/img/fftyc_1300x240.gif	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/10/8eceeb2a583c/1.jpg	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/d26727ebd6a5/1.jpg	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2y5vq.jpg	0%	Avira URL Cloud	safe
https://oetyc5.org	0%	Avira URL Cloud	safe
https://hjf.pppttttkyhqq965.com	0%	Avira URL Cloud	safe
https://we.zz17377.com/7bd578c706a9f8fb6f46da207b46e618.gif	0%	Avira URL Cloud	safe
https://tycjb777.hccoeutg.com/i/LD/SH131.gif	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/22/214c28054d30/1.jpg	0%	Avira URL Cloud	safe
https://w0082.com:33236/625a3d79f55d45618f08fe8d311c10b3.gif	0%	Avira URL Cloud	safe
https://www12.pengxunfei.site/jiamigif/168sc/168-200x200-2.gif	0%	Avira URL Cloud	safe
http://woool.996m2.com/data/attachment/forum/202307/22/170443i7hi40474l44l07u.jpg	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnn7uf.jpg	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/dff801d16405/1.jpg	0%	Avira URL Cloud	safe
https://ylg1.duyunfk.com/b38048b5589bcfb538c627481211202f.gif	0%	Avira URL Cloud	safe
https://gsygsaoc.209881.poker:23003/1_2JJ2AD	0%	Avira URL Cloud	safe
https://img.maldwin27.xyz/images/6471f2b049ada68764d1d429.gif	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnnjgp.jpg	0%	Avira URL Cloud	safe
https://18.yjxxoa.com/?shareName=ylg18	0%	Avira URL Cloud	safe
https://z.zcc0115.cc:8443/?shareName=716839983	0%	Avira URL Cloud	safe
https://ig79.vip/img/996a_180x180.gif	0%	Avira URL Cloud	safe
https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/1300x240.js	0%	Avira URL Cloud	safe
https://www.ff7722.com	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ecfa86b60f78/1.jpg	0%	Avira URL Cloud	safe
https://2024hwus1.heibanwa.mobi/jsgif/yf1300-200.js	0%	Avira URL Cloud	safe
http://www.rr8844.com/	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/una04o.jpg	0%	Avira URL Cloud	safe
https://vns2.ezrent.hk/b9fb3076983380cf2d30af608afa0f94.gif.js	0%	Avira URL Cloud	safe
https://www.pdsp.tv	0%	Avira URL Cloud	safe
https://5967.5967007.com/1300x200.gif	0%	Avira URL Cloud	safe
https://787928.com:7888	0%	Avira URL Cloud	safe
https://t24120103-5e08b5a8a5bb9302.elb.ap-east-1.amazonaws.com:8888	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202409/24/87dc8d74df0f/1.jpg	0%	Avira URL Cloud	safe
https://ig32.vip/img/GYyh_1300x240.gif	0%	Avira URL Cloud	safe
https://www.5967ggxtz001.com/nice.htm?8175	0%	Avira URL Cloud	safe
https://5967.5967007.com/11.gif	0%	Avira URL Cloud	safe
https://sm2kz.net/image/yxyhd.gif	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/9bafe24706b5/1.jpg	0%	Avira URL Cloud	safe
https://hongniu.getehu.com/i/2024/11/09/150-150.gif	0%	Avira URL Cloud	safe
https://ymtd.6dae.com/350/?cid=776786	0%	Avira URL Cloud	safe
https://ig23.vip/img/1KKky_150x150.gif	0%	Avira URL Cloud	safe
https://data.7wzx9.com/getDataInit	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/12/5ef689465f78/1.jpg	0%	Avira URL Cloud	safe
https://555ww666yy.com/f3dab33316b44c64a6f119272fb4489e.gif	0%	Avira URL Cloud	safe
https://ffyd.e5nk.com:8888	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unbndf.jpg	0%	Avira URL Cloud	safe
https://yh24122203-c468081638d2b968.elb.ap-east-1.amazonaws.com:8888	0%	Avira URL Cloud	safe
https://ttxmsp22.dahczv.com	0%	Avira URL Cloud	safe
https://2024hwus1.heibanwa.mobi/jsgif/ny.js	0%	Avira URL Cloud	safe
https://we.zz17377.com/655358e6aaad94a5e9fe6a141b3bc5ef.gif	0%	Avira URL Cloud	safe
https://p8789.com	0%	Avira URL Cloud	safe
https://yhc339.com	0%	Avira URL Cloud	safe
http://woool.996m2.com/data/attachment/forum/202307/22/170443zi8yxih33fyf8fj2.gif	0%	Avira URL Cloud	safe
https://www.rr8844.com/footer.html?v=9999999	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ae7abced1eae/1.jpg	0%	Avira URL Cloud	safe
https://www.rr8844.com/static/jquery.min.js	0%	Avira URL Cloud	safe
https://ckxf00645.cc	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2yjhe.jpg	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/6d4fba52e3fe/1.jpg	0%	Avira URL Cloud	safe
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/18/1e6931ef5c8d/1.jpg	0%	Avira URL Cloud	safe
https://i.slgfjzz.com/20220105/c247889849d9d692850c37576f2812bc.jps	0%	Avira URL Cloud	safe
https://deiskm.memto51749.net:39006/3_medp/mdp1/158898.csv?mlm564	0%	Avira URL Cloud	safe
https://hu101.cc	0%	Avira URL Cloud	safe
https://ig55.vip/img/GYyh_180x180.GIF	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unae56.jpg	0%	Avira URL Cloud	safe
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/umz9e7.jpg	0%	Avira URL Cloud	safe
https://sz.ggshezhantc.com:8686/150vip.gif	0%	Avira URL Cloud	safe
https://xmad.7wzx9.com/pangda/tbad.js	0%	Avira URL Cloud	safe
https://monkey.p2ld58.com/img/tyc-sihu150x150.gif	0%	Avira URL Cloud	safe
https://m776.co:65432/index.html?channelCode=1620	0%	Avira URL Cloud	safe
https://ig82.vip/img/FF98t_180x180.gif	0%	Avira URL Cloud	safe
https://www.xtpag.top:2087/images/672e3dcf290341902fe11411.gif	100%	Avira URL Cloud	malware
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/16/6b45b6b1daec/1.jpg	0%	Avira URL Cloud	safe
https://ig23.vip/img/1kkky_1300x240.gif	0%	Avira URL Cloud	safe
https://w0083.com:33236/1bd9e5d42614451ba8d203764d864d9d.gif	0%	Avira URL Cloud	safe
https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/150x150.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tycjb777.hccoeutg.com.bplslb.com	113.219.144.65	true	false	unknown
ig38.vip	23.224.82.187	true	false	high
ig55.vip	23.224.82.187	true	false	unknown
n97sevw8.n.cccdn88.top	23.145.136.94	true	false	unknown
69vvnstttaaa888.dzlndygh.com.bplslb.com	183.204.210.219	true	false	unknown
monkey.p2ld58.com.bplslb.com	116.162.210.150	true	false	unknown
ig72.vip	23.224.82.187	true	false	unknown
s3-r-w.ap-southeast-1.amazonaws.com	3.5.146.228	true	false	high
79rvc2.g.1112dns.com	154.91.91.54	true	false	high
zpnzdh.g.1112dns.com	154.91.91.56	true	false	unknown
all.cnzz.com.danuoyi.tbcache.com	106.225.241.95	true	false	high
5or0d1.c.1112dns.com	123.6.18.17	true	false	unknown
ns3.hii-go.com	88.99.67.51	true	false	unknown
g9cf36a.cn88.jhydns01.com	185.200.64.142	true	false	unknown
catu.imgapp.top	188.114.96.3	true	false	unknown
www12.pengxunfei.site.bplslb.com	183.204.210.219	true	false	unknown
aztsdjeg.xiaohongshu-mycdn.com	194.147.100.102	true	false	unknown
hcdnw122.maoyun.cdnhwcibv122.com	221.194.141.162	true	false	unknown
www.google.com	142.250.186.68	true	false	high
kegymmtv.jixingcdn.com	104.160.179.210	true	false	unknown
my109-site-01.cdn-ng.net	43.251.59.146	true	false	unknown
cc777img.dqsldz.com.bplslb.com	111.7.66.168	true	false	unknown
go.imgmimi.xyz	172.67.148.80	true	false	high
ig82.vip	216.180.227.131	true	false	unknown
h02wph.c.1112dns.com	123.6.18.115	true	false	unknown
hcdnw101.v3.cdnhwcprh113.com	61.54.86.170	true	false	high
mtu.slinpic.com	104.26.10.58	true	false	unknown
hongniu.getehu.com.bplslb.com	147.160.191.176	true	false	unknown
kcxgm62j.tyccdn888.com	194.147.100.10	true	false	unknown
vns2.ezrent.hk.w.cdngslb.com	163.181.131.208	true	false	unknown
d1cq301dpr7fww.cloudfront.net	99.86.4.79	true	false	high
ig32.vip	23.224.82.187	true	false	unknown
ig23.vip	216.180.227.131	true	false	unknown
amjs.hccoeutg.com.bplslb.com	147.160.191.176	true	false	unknown
hcdnd101.sme.cdnhwcaip122.cn	221.194.141.150	true	false	unknown
ig79.vip	23.224.82.187	true	false	unknown
ssh02.cdn.youziyundns.com	149.104.32.188	true	false	unknown
z.gds.cnzz.com	223.109.148.174	true	false	high
amjs.hccoeutg.com	unknown	unknown	false	high
vns2.ezrent.hk	unknown	unknown	false	unknown
sezhang.s3.ap-southeast-1.amazonaws.com	unknown	unknown	false	unknown
vnsimg.hfzkgw.com	unknown	unknown	false	high
yh88812345qwerasdf.lzaotw.com	unknown	unknown	false	unknown
data.7wzx9.com	unknown	unknown	false	unknown
v1.cnzz.com	unknown	unknown	false	high
ylg1.duyunfk.com	unknown	unknown	false	unknown
c.cnzz.com	unknown	unknown	false	high
img.qxwoiv.com	unknown	unknown	false	high
sz.ggshezhantc.com	unknown	unknown	false	unknown
www12.pengxunfei.site	unknown	unknown	false	unknown
_2087._https.www.xtpag.top	unknown	unknown	false	unknown
w0082.com	unknown	unknown	false	unknown
2024hwus1.heibanwa.mobi	unknown	unknown	false	unknown
hongniu.getehu.com	unknown	unknown	false	unknown
x-hweu2.hccoeutg.com	unknown	unknown	false	unknown
5967.5967007.com	unknown	unknown	false	unknown
www.rr8844.com	unknown	unknown	false	high
69vvnstttaaa888.dzlndygh.com	unknown	unknown	false	high
w0083.com	unknown	unknown	false	unknown
we.zz17377.com	unknown	unknown	false	unknown
static.wixstatic.com	unknown	unknown	false	high
vns3.ezrent.hk	unknown	unknown	false	high
555ww666yy.com	unknown	unknown	false	unknown
cc777img.dqsldz.com	unknown	unknown	false	high
_8686._https.sz.ggshezhantc.com	unknown	unknown	false	unknown
www.xtpag.top	unknown	unknown	false	unknown
monkey.p2ld58.com	unknown	unknown	false	unknown
_33236._https.w0083.com	unknown	unknown	false	unknown
tycjb777.hccoeutg.com	unknown	unknown	false	unknown
z6.cnzz.com	unknown	unknown	false	high
xmad.7wzx9.com	unknown	unknown	true	unknown
_33236._https.w0082.com	unknown	unknown	false	unknown
x-hweu5.rdfzsjs.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://xmad.7wzx9.com/pangda/base.js?v=9999999	false	Avira URL Cloud: safe	unknown
https://www.rr8844.com/css/images/logo.jpg	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2zdy8.jpg	false	Avira URL Cloud: safe	unknown
https://img.qxwoiv.com/b38048b5589bcfb538c627481211202f.gif	false		high
https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/bf094940c1b9/1.jpg	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ddf6cafcea0f/1.jpg	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/094f2e05c08b/1.jpg	false	Avira URL Cloud: safe	unknown
https://www.rr8844.com/css/fonts/iconfont1.woff2	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/c56b3842c616/1.jpg	false	Avira URL Cloud: safe	unknown
https://69vvnstttaaa888.dzlndygh.com/i/2024/08/11/u98s7t.gif	false		high
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unc7yj.jpg	false	Avira URL Cloud: safe	unknown
https://ig38.vip/img/fftyc_1300x240.gif	false	Avira URL Cloud: safe	unknown
https://hongniu.getehu.com/i/2024/11/08/1300x200.gif	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/10/8eceeb2a583c/1.jpg	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2y5vq.jpg	false	Avira URL Cloud: safe	unknown
https://amjs.hccoeutg.com/i/1616/PPJJ-1300-240.gif	false		high
https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/d26727ebd6a5/1.jpg	false	Avira URL Cloud: safe	unknown
https://we.zz17377.com/7bd578c706a9f8fb6f46da207b46e618.gif	false	Avira URL Cloud: safe	unknown
https://tycjb777.hccoeutg.com/i/LD/SH131.gif	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/22/214c28054d30/1.jpg	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnn7uf.jpg	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/dff801d16405/1.jpg	false	Avira URL Cloud: safe	unknown
https://www12.pengxunfei.site/jiamigif/168sc/168-200x200-2.gif	false	Avira URL Cloud: safe	unknown
https://ylg1.duyunfk.com/b38048b5589bcfb538c627481211202f.gif	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnnjgp.jpg	false	Avira URL Cloud: safe	unknown
https://ig79.vip/img/996a_180x180.gif	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ecfa86b60f78/1.jpg	false	Avira URL Cloud: safe	unknown
https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/1300x240.js	false	Avira URL Cloud: safe	unknown
https://2024hwus1.heibanwa.mobi/jsgif/yf1300-200.js	false	Avira URL Cloud: safe	unknown
http://www.rr8844.com/	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/una04o.jpg	false	Avira URL Cloud: safe	unknown
https://vns2.ezrent.hk/b9fb3076983380cf2d30af608afa0f94.gif.js	false	Avira URL Cloud: safe	unknown
https://go.imgmimi.xyz/318d22cf923239b38dec8c9337224fb4.gif	false		high
https://5967.5967007.com/1300x200.gif	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202409/24/87dc8d74df0f/1.jpg	false	Avira URL Cloud: safe	unknown
https://ig32.vip/img/GYyh_1300x240.gif	false	Avira URL Cloud: safe	unknown
https://5967.5967007.com/11.gif	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/9bafe24706b5/1.jpg	false	Avira URL Cloud: safe	unknown
https://ig23.vip/img/1KKky_150x150.gif	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/12/5ef689465f78/1.jpg	false	Avira URL Cloud: safe	unknown
https://data.7wzx9.com/getDataInit	false	Avira URL Cloud: safe	unknown
https://hongniu.getehu.com/i/2024/11/09/150-150.gif	false	Avira URL Cloud: safe	unknown
https://555ww666yy.com/f3dab33316b44c64a6f119272fb4489e.gif	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unbndf.jpg	false	Avira URL Cloud: safe	unknown
https://2024hwus1.heibanwa.mobi/jsgif/ny.js	false	Avira URL Cloud: safe	unknown
https://we.zz17377.com/655358e6aaad94a5e9fe6a141b3bc5ef.gif	false	Avira URL Cloud: safe	unknown
https://www.rr8844.com/footer.html?v=9999999	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ae7abced1eae/1.jpg	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2yjhe.jpg	false	Avira URL Cloud: safe	unknown
https://www.rr8844.com/static/jquery.min.js	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/6d4fba52e3fe/1.jpg	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/18/1e6931ef5c8d/1.jpg	false	Avira URL Cloud: safe	unknown
https://cc777img.dqsldz.com/i/2024/10/28/10ss8i9.gif	false		high
https://ig55.vip/img/GYyh_180x180.GIF	false	Avira URL Cloud: safe	unknown
https://www.rr8844.com/	false		unknown
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unae56.jpg	false	Avira URL Cloud: safe	unknown
https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/umz9e7.jpg	false	Avira URL Cloud: safe	unknown
https://x-hweu5.rdfzsjs.com/video/m3u8/202410/16/6b45b6b1daec/1.jpg	false	Avira URL Cloud: safe	unknown
https://xmad.7wzx9.com/pangda/tbad.js	true	Avira URL Cloud: safe	unknown
https://amjs.hccoeutg.com/i/1616/PPJJ-200-200.gif	false		high
https://ig82.vip/img/FF98t_180x180.gif	false	Avira URL Cloud: safe	unknown
https://monkey.p2ld58.com/img/tyc-sihu150x150.gif	false	Avira URL Cloud: safe	unknown
https://69vvnstttaaa888.dzlndygh.com/i/2024/07/26/12872no.gif	false		high
https://ig23.vip/img/1kkky_1300x240.gif	false	Avira URL Cloud: safe	unknown
https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/150x150.js	false	Avira URL Cloud: safe	unknown
https://www.rr8844.com/video.html?typeId=21&typeMid=1	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://hdf.ggttddddbbfp835.com	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://cc777img.dqsldz.com/i/2024/10/28/620-210.gif	chromecache_268.2.dr, chromecache_437.2.dr	false		high
https://j4xok.vip/dxj/xx150x350.gif	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
http://locked5-723840144.ap-east-1.elb.amazonaws.com/wns0x040/?shareName=wns0x040	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://oetyc5.org	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://hjf.pppttttkyhqq965.com	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://w0082.com:33236/625a3d79f55d45618f08fe8d311c10b3.gif	chromecache_410.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://v1.cnzz.com/z_stat.php?id=1280624099&web_id=1280624099	chromecache_268.2.dr, chromecache_437.2.dr	false		high
http://woool.996m2.com/data/attachment/forum/202307/22/170443i7hi40474l44l07u.jpg	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://gsygsaoc.209881.poker:23003/1_2JJ2AD	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://18.yjxxoa.com/?shareName=ylg18	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://img.maldwin27.xyz/images/6471f2b049ada68764d1d429.gif	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://z.zcc0115.cc:8443/?shareName=716839983	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://www.ff7722.com	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://www.5967ggxtz001.com/nice.htm?8175	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://www.pdsp.tv	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://t24120103-5e08b5a8a5bb9302.elb.ap-east-1.amazonaws.com:8888	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://787928.com:7888	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://sm2kz.net/image/yxyhd.gif	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://ymtd.6dae.com/350/?cid=776786	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://ffyd.e5nk.com:8888	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://yh24122203-c468081638d2b968.elb.ap-east-1.amazonaws.com:8888	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://ttxmsp22.dahczv.com	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://yhc339.com	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
http://woool.996m2.com/data/attachment/forum/202307/22/170443zi8yxih33fyf8fj2.gif	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://p8789.com	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://ckxf00645.cc	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://deiskm.memto51749.net:39006/3_medp/mdp1/158898.csv?mlm564	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://hu101.cc	chromecache_268.2.dr, chromecache_410.2.dr, chromecache_437.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://i.slgfjzz.com/20220105/c247889849d9d692850c37576f2812bc.jps	chromecache_373.2.dr	false	Avira URL Cloud: safe	unknown
https://sz.ggshezhantc.com:8686/150vip.gif	chromecache_410.2.dr, chromecache_259.2.dr	false	Avira URL Cloud: safe	unknown
https://m776.co:65432/index.html?channelCode=1620	chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown
https://www.xtpag.top:2087/images/672e3dcf290341902fe11411.gif	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: malware	unknown
https://w0083.com:33236/1bd9e5d42614451ba8d203764d864d9d.gif	chromecache_268.2.dr, chromecache_437.2.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.68	www.google.com	United States	15169	GOOGLEUS	false
154.91.91.56	zpnzdh.g.1112dns.com	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
154.91.91.54	79rvc2.g.1112dns.com	Seychelles	134705	ITACE-AS-APItaceInternationalLimitedHK	false
142.132.201.10	unknown	Canada	22686	UNIVERSITYOFWINNIPEG-ASNCA	false
104.26.11.58	unknown	United States	13335	CLOUDFLARENETUS	false
223.109.148.174	z.gds.cnzz.com	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
99.86.4.105	unknown	United States	16509	AMAZON-02US	false
111.174.12.113	unknown	China	136194	CHINATELECOM-HUBEI-HUANGSHI-IDCHuangshiHubeiProvinceP	false
88.99.67.51	ns3.hii-go.com	Germany	24940	HETZNER-ASDE	false
221.194.141.150	hcdnd101.sme.cdnhwcaip122.cn	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
218.12.76.163	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
113.219.144.65	tycjb777.hccoeutg.com.bplslb.com	China	63838	CT-HUNAN-HENGYANG-IDCHengyangCN	false
185.200.64.142	g9cf36a.cn88.jhydns01.com	United Kingdom	54600	PEGTECHINCUS	false
123.6.18.47	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
106.225.241.95	all.cnzz.com.danuoyi.tbcache.com	China	134238	CT-JIANGXI-IDCCHINANETJiangxprovinceIDCnetworkCN	false
183.204.210.219	69vvnstttaaa888.dzlndygh.com.bplslb.com	China	24445	CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN	false
43.251.59.146	my109-site-01.cdn-ng.net	Taiwan; Republic of China (ROC)	131603	WSN-TW-NET-ASWorldstarNetworkTW	false
123.6.18.89	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
104.160.179.210	kegymmtv.jixingcdn.com	United States	46844	ST-BGPUS	false
36.42.77.151	unknown	China	134768	CHINANET-SHAANXI-CLOUD-BASECHINANETSHAANXIprovinceCloud	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
23.145.136.94	n97sevw8.n.cccdn88.top	Reserved	6939	HURRICANEUS	false
23.145.136.95	unknown	Reserved	6939	HURRICANEUS	false
116.162.210.150	monkey.p2ld58.com.bplslb.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
61.54.86.170	hcdnw101.v3.cdnhwcprh113.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
194.147.100.10	kcxgm62j.tyccdn888.com	unknown	33965	LITECOMLitecomAGCH	false
163.181.131.208	vns2.ezrent.hk.w.cdngslb.com	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
103.170.14.197	unknown	unknown	7575	AARNET-AS-APAustralianAcademicandResearchNetworkAARNe	false
23.224.82.187	ig38.vip	United States	40065	CNSERVERSUS	false
123.6.18.17	5or0d1.c.1112dns.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
111.7.66.168	cc777img.dqsldz.com.bplslb.com	China	24445	CMNET-V4HENAN-AS-APHenanMobileCommunicationsCoLtdCN	false
163.181.131.209	unknown	United States	24429	TAOBAOZhejiangTaobaoNetworkCoLtdCN	false
99.86.4.79	d1cq301dpr7fww.cloudfront.net	United States	16509	AMAZON-02US	false
194.147.100.95	unknown	unknown	33965	LITECOMLitecomAGCH	false
36.99.2.62	unknown	China	139018	CHINANET-HENAN-LUOYANG-IDCHenanLuoyangIDCCN	false
216.180.227.131	ig82.vip	United States	11042	NTHLUS	false
175.6.201.25	unknown	China	63838	CT-HUNAN-HENGYANG-IDCHengyangCN	false
52.219.132.71	unknown	United States	16509	AMAZON-02US	false
149.104.32.188	ssh02.cdn.youziyundns.com	United States	174	COGENT-174US	false
218.60.100.167	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
194.147.100.102	aztsdjeg.xiaohongshu-mycdn.com	unknown	33965	LITECOMLitecomAGCH	false
172.67.148.80	go.imgmimi.xyz	United States	13335	CLOUDFLARENETUS	false
43.251.59.126	unknown	Taiwan; Republic of China (ROC)	131603	WSN-TW-NET-ASWorldstarNetworkTW	false
147.160.191.176	hongniu.getehu.com.bplslb.com	United States	398027	ASN-BELL2US	false
104.160.179.196	unknown	United States	46844	ST-BGPUS	false
120.233.179.91	unknown	China	56040	CMNET-GUANGDONG-APChinaMobilecommunicationscorporation	false
216.180.236.138	unknown	United States	11042	NTHLUS	false
104.26.10.58	mtu.slinpic.com	United States	13335	CLOUDFLARENETUS	false
221.194.141.162	hcdnw122.maoyun.cdnhwcibv122.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
3.5.146.228	s3-r-w.ap-southeast-1.amazonaws.com	United States	16509	AMAZON-02US	false
188.114.96.3	catu.imgapp.top	European Union	13335	CLOUDFLARENETUS	false
123.6.18.115	h02wph.c.1112dns.com	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583168
Start date and time:	2025-01-02 06:11:25 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.rr8844.com
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal56.troj.win@17/408@180/53

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.186.99, 216.58.206.78, 64.233.167.84, 216.58.212.142, 142.250.181.238, 142.250.74.206, 172.217.18.10, 142.250.184.202, 142.250.185.202, 142.250.185.74, 142.250.186.170, 142.250.184.234, 216.58.206.74, 216.58.206.42, 142.250.186.42, 142.250.185.234, 142.250.181.234, 142.250.186.138, 172.217.16.202, 142.250.74.202, 142.250.185.170, 142.250.186.106, 84.201.210.18, 192.229.221.95, 142.250.185.206, 172.217.18.14, 142.250.185.78, 172.217.16.195, 142.250.186.46, 184.28.90.27, 52.149.20.212, 4.245.163.56, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://www.rr8844.com

Input	Output
URL: http://www.rr8844.com Model: Joe Sandbox AI	{ "typosquatting": false, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": false, "third_party_hosting": true }
URL: http://www.rr8844.com
URL: https://www.rr8844.com/... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The script appears to have some moderate-risk indicators, such as external data transmission and aggressive DOM manipulation. However, it does not demonstrate any clear malicious intent or high-risk behaviors. The script seems to be related to displaying a pop-up with a list of URLs, potentially for sharing with friends. While the behavior may be considered aggressive or intrusive, it does not appear to be directly harmful. Further review may be necessary to determine the full context and purpose of the script." }
var ua = navigator.userAgent.toLowerCase(); $(document).ready(function () { getHomeV(); if (ua.indexOf('baidu') < 0 && moreUrl.length > 0) { var _moveUrl = moreUrl; if (_moveUrl.length > 5) { _moveUrl = getRandomArrayElements(_moveUrl, 5); } for (var i = 0; i < _moveUrl.length; i++) {} var allUrl = _moveUrl.join("\\r\\n"); var popDiv = document.createElement("dl"); popDiv.id = "popBox"; popDiv.setAttribute("class", "pop"); popDiv.style.backgroundImage = 'url(' + worldBgImage + ')'; popDiv.style.backgroundSize = 'cover'; popDiv.style.transform = 'scale(1)'; popDiv.style.border = '0px'; popDiv.innerHTML += ' <dd style="margin-top:95px;"></dd>'; for (var i = 0; i < _moveUrl.length; i++) { popDiv.innerHTML += ' <dd class="url" style="background:transparent;text-align:left;font-size: 12px;padding:0 25px;line-height:25px;letter-spacing: 1px;">' + _moveUrl[i] + '</dd>'; } popDiv.innerHTML += ' <dd class="url" style="background:transparent;text-align:left;font-size: 12px;padding:0 25px;line-height:25px;letter-spacing: 1px;">5</dd>'; popDiv.innerHTML += ' <dd class="btn-close" style="margin-top:20px;"><a href="javascript:void(0)" onclick="hideMask();return false;"><i class="icon-close"></i></a></dd>'; body.appendChild(popDiv); if(popDiv != null) { showMask("10"); } } })
URL: https://www.rr8844.com/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "This script appears to be a legitimate analytics/tracking script from the CNZZ analytics platform. While it uses the legacy `document.createElement` and `document.getElementsByTagName` methods, which are considered low-risk indicators, the script's purpose is for web analytics, which is a common and expected behavior. There are no signs of high-risk indicators like dynamic code execution, data exfiltration, or suspicious redirects. Overall, this script poses a low risk." }
var _czc = _czc \|\| []; (function () { var um = document.createElement("script"); um.src = "https://v1.cnzz.com/z.js?id=1281318611&async=1"; var s = document.getElementsByTagName("script")[0]; s.parentNode.insertBefore(um, s); })();
URL: https://xmad.7wzx9.com/pangda/tbad.js... Model: Joe Sandbox AI	{ "risk_score": 9, "reasoning": "This script demonstrates several high-risk behaviors, including data exfiltration, redirects to suspicious domains, and the use of obfuscated URLs. The script appears to be generating a list of links and images, many of which point to untrusted or potentially malicious domains. This suggests the script may be part of a phishing or scam operation, and it should be considered a high-risk threat." }
var appAbkDiv = document.getElementById('tbad'); function loadContent() { // var items = [ { link: "https://vuy81.top", image: "https://cc777img.dqsldz.com/i/2024/10/28/10ss8i9.gif", name: "同城约炮" }, { link: "https://euk11.top", image: "https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy150.js", name: "春药商城" }, { link: "https://t24120103-5e08b5a8a5bb9302.elb.ap-east-1.amazonaws.com:8888", image: "https://ig82.vip/img/FF98t_180x180.gif", name: "太阳城" }, { link: "https://787928.com:7888", image: "https://amjs.hccoeutg.com/i/2828/qqww-200-1.gif", name: "太阳城" }, { link: "https://www.5967ggxtz001.com/nice.htm?8175", image: "https://5967.5967007.com/11.gif", name: "必赢" }, { link: "https://pj8923.com", image: "https://amjs.hccoeutg.com/i/1616/PPJJ-200-200.gif", name: "新葡京" }, { link: "https://18.yjxxoa.com/?shareName=ylg18", image: "https://img.qxwoiv.com/b38048b5589bcfb538c627481211202f.gif", name: "澳门葡京" }, { link: "https://x53683.com:6987", image: "https://w0082.com:33236/625a3d79f55d45618f08fe8d311c10b3.gif", name: "澳门葡京" }, { link: "https://hu101.cc", image: "https://69vvnstttaaa888.dzlndygh.com/i/2024/08/11/u98s7t.gif", name: "威尼斯人" }, { link: "http://locked5-723840144.ap-east-1.elb.amazonaws.com/wns0x040/?shareName=wns0x040", image: "https://sezhang.s3.ap-southeast-1.amazonaws.com/150x150w.gif", name: "新普京" }, { link: "https://ymtd.6dae.com/350/?cid=776786", image: "https://www.xtpag.top:2087/images/672e3be2290341902fe11409.gif", name: "PG娱乐" }, { link: "https://gsygsaoc.209881.poker:23003/1_2JJ2AD", image: "https://static.wixstatic.com/media/dd9a87_4314275b0467418ab4bd32c8da4d6358~mv2.gif", name: "抖阴直播" }, { link: "https://hjf.pppttttkyhqq965.com", image: "https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/150x150.js", name: "澳门银河" }, { link: "https://ttxmsp22.dahczv.com", image: "https://www12.pengxunfei.site/jiamigif/tyxsc/xmspggTT2-200X200.gif", name: "太阳国际" }, { link: "https://214.lxqgg.com/?shareName=zhandian214", image: "https://vns2.ezrent.hk/b9fb3076983380cf2d30af608afa0f94.gif.js", name: "威尼斯人" }, { link: "https://nyh32h.net/luodi_si26K", image: "https://monkey.p2ld58.com/img/uu-rt150x150.gif", name: "学姐直播" }, { link: "https://z.zcc0115.cc:8443/?shareName=716839983", image: "https://we.zz17377.com/7bd578c706a9f8fb6f46da207b46e618.gif", name: "PG电子" }, { link: "https://568.5683853.cc:8443/?shareName=568.5683853.cc", image: "https://go.imgmimi.xyz/00165139bb76d845bfa39bde42b929c5.gif", name: "开元官方" }, { link: "https://yh24122203-c468081638d2b968.elb.ap-east-1.amazonaws.com:8888", image: "https://ig55.vip/im
URL: https://www.rr8844.com/... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript code appears to be a search functionality implementation with some basic user agent detection and handling of mobile devices. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is primarily focused on managing the user interface and search-related functionality, which is a common and legitimate use case. While it uses some legacy APIs like `XDomainRequest`, the overall behavior is benign and does not raise significant security concerns." }
var ua = navigator.userAgent.toLowerCase(); var isSafari = /Version[\|\/]([0-9.]+)([^0-9a-zA-Z]+)Mobile[\|\/]([0-9a-zA-Z]+)([^0-9a-zA-Z]+)Safari[\|\/]([0-9.]+)$/i.test(ua); var isMobile = ua.indexOf("windows nt") == -1 && ua.indexOf("macintosh") == -1 && ua.indexOf("pad") == -1 && ua.indexOf("x86_64") == -1; var isAndroid = ua.indexOf("android") > -1; var isPad = ua.indexOf("pad") > -1; /* / var helangSearch = { / / els: {}, / / searchIndex: 0, / / hot: { / / color: ['#ff2c00', '#ff5a00', '#ff8105', '#fd9a15', '#dfad1c', '#6bc211', '#3cc71e', '#3cbe85', '#51b2ef', '#53b0ff'], / / list: [ '', '', '', '', '', '', '', '', '', '' ] }, / / init: function () { var _this = this; this.els = { pickerBtn: $(".picker"), pickerList: $(".picker-list"), logo: $(".logo"), hotList: $(".hot-list"), input: $("#search-input"), button: $(".searchs") }; / / this.els.hotList.html(function () { var str = ''; $.each(_this.hot.list, function (index, item) { str += '<a href="movieSearch.html?content=' + item + '&typeMid=1&typeId=0&type=1">' + '<div class="number" style="color: ' + _this.hot.color[index] + '">' + (index + 1) + '</div>' + '<div>' + item + '</div>' + '</a>'; }); return str; }); / / / / this.els.pickerBtn.click(function () { if (_this.els.pickerList.is(':hidden')) { setTimeout(function () { _this.els.pickerList.show(); }, 100); } }); / / this.els.pickerList.on("click", ">li", function () { // _this.els.logo.css("background-image", ('url(img/' + $(this).data("logo") + ')')); _this.searchIndex = $(this).index(); _this.els.pickerBtn.html($(this).html() + "<i class=\"icon-searchsarrows\"></i>") }); / / this.els.input.click(function () { if (!$(this).val()) { if (!isAndroid && isSafari) { } else { setTimeout(function () { _this.els.hotList.show(); }, 100); } } }); / / this.els.input.on("input", function () { if ($(this).val()) { _this.els.hotList.hide(); } }); / / this.els.button.click(function () { var searchArr = ['', '', '']; if (_this.els.input.val() != "") { if (searchArr[_this.searchIndex] == "") { window.location.href = "movieSearch.html?content=" + _this.els.input.val()+"&typeMid="+1+"&typeId="+0+"&type="+1; } if (searchArr[_this.searchIndex] == "") { window.location.href = "imageSearch.html?content=" + _this.els.input.val()+"&typeMid="+2+"&typeId="+0+"&type="+2; } if (searchArr[_this.searchIndex] == "") { window.location.href = "novelSearch.html?content=" + _this.els.input.val()+"&typeMid="+2+"&typeId="+0+"&type="+3; } } });// / / $(document).click(function () { _this.els.pickerList.hide(); _this.els.hotList.hide(); }); / */ } };
URL: https://xmad.7wzx9.com/pangda/base.js?v=9999999... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "The provided JavaScript snippet contains several behaviors that raise moderate to high-risk concerns, including potential data exfiltration, use of obfuscated URLs, and aggressive DOM manipulation. While some of the content appears to be related to legitimate purposes like analytics and tracking, the overall behavior and the presence of suspicious domains and URLs suggest further investigation is warranted. The final risk score is in the medium range, indicating the need for closer scrutiny and potential mitigation measures." }
// var onlineHref ="https://t.me/CC91AV"; var wzfby = "https://www.pdsp.tv" var worldBgImage = "./css/images/bgg.png"; var body = document.body; var ua = navigator.userAgent.toLowerCase(); var domain = window.location.host; // var xl1 =""; var xl2 =""; var xl3 =""; var appName = ""; //APP var title = "QQ"; var appUrl = ""; //APP var appUrl1 = ""; var updateUrl = "https://github.com/wyz7777/pangda/blob/main/README.md"; // var emailUrl = "yy8y.email"; //"<em>g</em><span>s</span><em>et</em><span>ok</span><em>u</em><span>wb</span><em>r</em><span>qr</span><em>l</em><span>kt</span><em>@gm<span>zi</span>ai<span>mk</span>l.c<span>yq</span>om</em>"; // var countUrl = "";//"https://v1.cnzz.com/z_stat.php?id=1280624099&web_id=1280624099"; //JS var getSpons = true; var moreUrl = [ "https://4HTV", "https://www.ff7722.com", "https://www.ff7722.com", "", "www.pdsp.tv ()" ]; /* [150350] [2] / // var couplet = true; // var coupletData = [ // { imgs: ["https://sm2kz.net/image/xiaolin119.gif"], url: "https://s27ns.com" }, // //{ imgs: ["https://img.maldwin27.xyz/images/6471f2b049ada68764d1d429.gif"], url: "https://s27ns.com" }, // { imgs: ["https://z4a.net/images/2023/05/08/150x350.gif"], url: "https://yhc339.com" } // ]; // /* 1 [150350] [2] / // var couplet1 = true; // var coupletData1 = [ // { imgs: ["https://j4xok.vip/dxj/xx150x350.gif"], url: "https://m776.co:65432/index.html?channelCode=1620" }, // //{ imgs: ["https://j4xok.vip/daxanja/youd150x350.gif"], url: "https://m776.co:65432/index.html?channelCode=1620" }, // { imgs: ["https://z4a.net/images/2023/05/08/150x350.gif"], url: "https://yhc339.com" } // ]; /* 3 [960X400] [3] / var topData = [ // { imgs: ["https://sm2kz.net/image/yxyhd.gif"], url: "https://s27ns.com" } ]; / 4 [960X80] [4] / var btmData = [ // {imgs:["http://woool.996m2.com/data/attachment/forum/202307/22/170443i7hi40474l44l07u.jpg"],url:'https://qb3363.cc'}, //1 // {imgs:["http://woool.996m2.com/data/attachment/forum/202307/22/170443zi8yxih33fyf8fj2.gif"],url:'https://oetyc5.org'}, //2 ]; / 8 [960x400] [8] */ var midData = [ { imgs: ["https://cc777img.dqsldz.com/i/2024/10/28/1300-200_1.gif"], url: "https://vuy81.top" }, { imgs: ["https://cc777img.dqsldz.com/i/2024/10/28/1300-200_1.gif"], url: "https://vuy81.top" }, { imgs: ["https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy1300.js"], url: "https://euk11.top" }, { imgs: ["https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy1300.js"], url: "https://euk11.top" }, { imgs: ["https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/1300x240.js"], url: "https://hjf.pppttttkyhqq965.com" }, { imgs: ["https://69vvnstttaaa888.dzlndygh.com/i/2024/07/26/12872no.gif"], url: "https://hu101.cc" }, { imgs: ["https://amjs.hccoeutg.com/i/1616/PPJJ-1300-240.gif"], url: "https://pj8923.com" }, { imgs: ["https://static.wixstatic.com/media/dd9a87_b1d6c5504d164c40835d918239dcd10e~mv2.gif"], url: "https://deiskm.memto51749.net:39006/3_medp/mdp1/158898.csv?mlm564" }, { imgs: ["https://static.wixstatic.com/media/dd9a87_67f016f8ae5948e4a82fbfedd1ad400a~mv2.gif"], url: "https://gsygsaoc.209881.poker:23003/1_2JJ2AD" }, { imgs: ["https://w0083.com:33236/1bd9e5d42614451ba8d203764d864d9d.gif"], url: "https://x53683.com:6987" }, { imgs: ["https://hongniu.getehu.com/i/2024/11/08/1300x200.gif"], url: "https://ckxf00645.cc" }, { imgs: ["https://5967.5967007.com/1300x200.gif"], url: "https://www.5967ggxtz001.com/nice.htm?8175" }, { imgs: ["https://555ww666yy.com/f3dab33316b44c64a6f119272fb4489e.gif"], url: "https://p555g557.vip" }, { imgs: ["https://sezhang.s3.ap-southeast-1.amazonaws.com/wns1300x200.gif"], url: "http://locked5-723840144.ap-east-1.elb.amazonaws.com/wns0x040/?shareName=wns0x040" }, { imgs: ["https://we.zz17377.com/655358e6
URL: https://www.rr8844.com/... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The provided JavaScript snippet is a part of the jQuery library, which is a widely used and reputable open-source library for DOM manipulation and event handling. The code does not exhibit any high-risk behaviors such as dynamic code execution, data exfiltration, or redirects to malicious domains. It primarily consists of utility functions and object manipulations typical of a library. There are no interactions with external domains or obfuscated code present. Therefore, it is considered low risk." }
/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license / !function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?n[o.call(e)]\|\|"object":typeof e}var f="3.5.1",S=function(e,t){return new S.fn.init(e,t)};function p(e){var t=!!e&&"length"in e&&e.length,n=w(e);return!m(e)&&!x(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&0<t&&t-1 in e)}S.fn=S.prototype={jquery:f,constructor:S,length:0,toArray:function(){return s.call(this)},get:function(e){return null==e?s.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=S.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return S.each(this,e)},map:function(n){return this.pushStack(S.map(this,function(e,t){return n.call(e,t,e)}))},slice:function(){return this.pushStack(s.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},even:function(){return this.pushStack(S.grep(this,function(e,t){return(t+1)%2}))},odd:function(){return this.pushStack(S.grep(this,function(e,t){return t%2}))},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(0<=n&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:u,sort:t.sort,splice:t.splice},S.extend=S.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|m(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)r=e[t],"__proto__"!==t&&a!==r&&(l&&r&&(S.isPlainObject(r)\|\|(i=Array.isArray(r)))?(n=a[t],o=i&&!Array.isArray(n)?[]:i\|\|S.isPlainObject(n)?n:{},i=!1,a[t]=S.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},S.extend({expando:"jQuery"+(f+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==o.call(e))&&(!(t=r(e))\|\|"function"==typeof(n=v.call(t,"constructor")&&t.constructor)&&a.call(n)===l)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e,t,n){b(e,{nonce:t&&t.nonce},n)},each:function(e,t){var n,r=0;if(p(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(p(Object(e))?S.merge(n,"string"==typeof e?[e]:e):u.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:i.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r=[],i=0,o=e.length,a=!n;i<o;i++)!t(e[i],i)!==a&&r.push(e[i]);return r},map:function(e,t,n){var r,i,o=0,a=[];if(p(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&a.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&a.push(i);return g(a)},guid:1,support:y}),"function"==typeof Symbol&&(S.fn[Symbol.iterator]=t[Symbol.iterator]),S.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){n["[object "+t+"]"]=t.toLowerCase()});var d=function(n){var e,d,b,o,i,h,f,g,w,u,l,T,C,a,E,v,s,c,y,S="sizzle"+1*new Date,p=n.document,
URL: https://www.rr8844.com/... Model: Joe Sandbox AI	```json { "risk_score": 5, "reasoning": "The script sends user data to an external domain (https://data.7wzx9.com) using XMLHttpRequest, which is a moderate-risk indicator (+2 points). The domain is not recognized as a trusted or reputable domain, which adds suspicion (+1 point). The script also performs aggressive DOM manipulation by altering the innerHTML of elements based on the response data (+2 points). There is no evidence of high-risk behaviors such as dynamic code execution or data exfiltration of sensitive information. The final risk score is 5, indicating a medium risk that warrants further review." }
function init(){ var data = {name: "John", age: 31, city: "New York"}; var json = JSON.stringify(data); var xhr = new XMLHttpRequest(); xhr.open("POST", "https://data.7wzx9.com/getDataInit", true); xhr.setRequestHeader("Content-type", "application/json"); xhr.onreadystatechange = function(){ if(xhr.readyState === XMLHttpRequest.DONE){ if(xhr.status === 200){ var data = xhr.responseText var response = JSON.parse(data); var menu0ListMap = xhr.responseText // console.log("xhr.responseText:"+xhr.responseText) // console.log("response:"+response.data.menu0ListMap) var subMenu = ''; for(var i in response.data.menu0ListMap) { if (i.length > 0) { // menuData.sort(randomsort); subMenu += '<dl>'; subMenu += '<dt><a href="'+response.data.menu0ListMap[i].href+'?typeId='+response.data.menu0ListMap[i].typeId+'&typeMid='+response.data.menu0ListMap[i].typeMid+'" target="_blank" rel="nofollow">'+response.data.menu0ListMap[i].typeName+'</a></dt>'; console.log("response.data.menu0ListMap[i].length"+response.data.menu0ListMap[i].length) for (var z = 0; z < response.data.menu0ListMap[i].menu2List.length; z++) { var typeId = getQueryVariable("typeId"); if(null!=typeId && typeId == response.data.menu0ListMap[i].menu2List[z].typeId2){ subMenu += '<dd><a class="cur" id="'+response.data.menu0ListMap[i].menu2List[z].typeId2+'" href="' + response.data.menu0ListMap[i].menu2List[z].href+'?typeId='+ response.data.menu0ListMap[i].menu2List[z].typeId2+"&typeMid="+ response.data.menu0ListMap[i].menu2List[z].typeMid2+ '"rel="nofollow">' + response.data.menu0ListMap[i].menu2List[z].typeName2 + '</a></dd>'; }else{ subMenu += '<dd><a id="'+response.data.menu0ListMap[i].menu2List[z].typeId2+'" href="' + response.data.menu0ListMap[i].menu2List[z].href+'?typeId='+ response.data.menu0ListMap[i].menu2List[z].typeId2+"&typeMid="+ response.data.menu0ListMap[i].menu2List[z].typeMid2+ '"rel="nofollow">' + response.data.menu0ListMap[i].menu2List[z].typeName2 + '</a></dd>'; } } subMenu += '</dl>'; } } if(response.data.webInfoMationPoMap!=null&&response.data.webInfoMationPoMap.length>0){ onlineHref = response.data.webInfoMationPoMap.TG[0][0]; } xl1 = response.data.macVodLinkMap; console.log("init xl1"+xl1); // getId('banner1').innerHTML = ' <a href="'+response.data.uploadDetailPoMap.BANNER_1[0].link+'" target="_blank" rel="nofollow"><img src="'+response.data.uploadDetailPoMap.BANNER_1[0].imgName+'" alt=""></a>'; getId('menuBox').innerHTML = subMenu; } } } xhr.send(json); } function getHomeV() { var data = {command: "WEB_GET_ALL",languageType:"CN",content:""}; var json = JSON.stringify(data); var xhr = new XMLHttpRequest(); xhr.open("POST", "https://data.7wzx9.com/forward", true); xhr.setRequestHeader("Content-type", "application/json"); xhr.onreadystatechange = function(){ if(xhr.readyState === XMLHttpRequest.DONE){ if(xhr.status === 200){ var data = xhr.responseText var response = JSON.parse(data); var menu0ListMap = xhr.responseText var subMenu = ''; var newsData = response.data.count; for(var i in response.data.resultList) { if(response.data.resultList[i].t_type == "M_VOIDE"){ subMenu+= '<div class="wrap">'; subMenu+= '<div class="mod index-list">'; subMenu+= '<div class="title">'; subMenu+= '<h3><i class="icon-fire"></i><a href="'+response.data.resultList[i].href+"?typeId="+response.data.resultList[i].type_id+'&typeMid='+response.data.resultList[i].type_Mid+'">'+response.data.resultList[i].t_Name+'</a></h3>'; subMenu+= '</div>'; subMenu+= '<div class="row col5 clearfix" id ="">'; for(var z in response.data.resultList[i].t_list){ subMenu+= '<dl>'; subMenu+= '<dt><a href="'+response.data.resultList[i].t_list[z].href+'?id='+response.data.resultList[i].t_
URL: https://www.rr8844.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": " !", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": true, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

URL: https://www.rr8844.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "888", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

URL: https://www.rr8844.com/ Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "888", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

URL: https://www.rr8844.com/video.html?typeId=21&typeMid=1 Model: Joe Sandbox AI	{ "contains_trigger_text": true, "trigger_text": "888", "prominent_button_name": "888", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

URL: https://www.rr8844.com/ Model: Joe Sandbox AI	{ "brands": [ "Rr8844.com" ] }
	{ "brands": [ "Rr8844.com" ] }
URL: https://www.rr8844.com/ Model: Joe Sandbox AI	{ "brands": [ "Rr8844.com", "98t.com", "8v7.com", "5967.com", "x54.com", "993.com", "69v.com", "615.cc", "yh23.com", "2000.com", "pg.app", "pgb.app", "6636.cc", "888.com" ] }

URL: https://www.rr8844.com/ Model: Joe Sandbox AI	{ "brands": [ "Rr8844.Com", "98T.COM", "8V7.COM", "X54.COM", "168.VIP", "993.COM", "60V.COM", "615.CC", "YH23.COM", "07.CC", "PGE", "568.CC", "KY", "996.VIP", "PG", "6636.CC", "8888" ] }

URL: https://www.rr8844.com/video.html?typeId=21&typeMid=1 Model: Joe Sandbox AI	{ "brands": [ "Rr8844.Com", "98T.COM", "8V7.COM", "X54.COM", "993.COM", "60V.COM", "YH23.COM", "07.CC", "568.CC", "1888", "996.VIP", "PG", "8906.COM", "6636.CC", "548.CC", "1KK.VIP" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 280 x 280
Category:	dropped
Size (bytes):	86874
Entropy (8bit):	7.972092381041628
Encrypted:	false
SSDEEP:	1536:mHv6LRAfu59JBqwvwLQCuKQ1tMc5ec2sP2nZ/pTc76ZQo9ku/XB:mHCXREwYLNkjkc2sORTc76ZQoCoB
MD5:	4ADFF30DE339670B3F4D0BD2C2FEDB5B
SHA1:	78F96011FD35905C0467D35514DEB745BF454AA6
SHA-256:	49200B72E6C40D81B5535674D8045081B85B6BF2DB6C28BD233D8F6F4838C0A6
SHA-512:	DA22042EEF2169A6C1740E3483ED2F2F85814A19150013779F4F63DA7C1C157E3CB15C431EBA38C3F75C6DC9E74C5CF0CCCFD193E38FD7B8EF8CA1F6FE549485
Malicious:	false
Reputation:	low
Preview:	GIF89a....................H89.0:.:C...../...t.. H8...)Ax(8.Xs....N..q.(..7.S.(.<q.....(...........X.......,.-9(:.3..h.y.X...T..h......E..h.x........h.x.P..x.SLZ...\|n...J...((8......8J......d.5.Zo............i..._............L....).....I}.8...........S..H.....X..X..V..h..h..x..x........((........(88...................t..j..H....X..S..h..x..x........w...........................(.(8(.............GH@../..+..+...<<...d...((....88(..........................W..30(..........b.......}/.......(..8(.H8(..................dYP...U4.u....yg...X8'.sV..p.........;...hT_H=N(.h8'......(...h(.z9(.WL.xi....PGx=:.m.....(..S...((x((...h((8..X((h88H(((..X88...8((..........................rkk............888(((.........!..NETSCAPE2.0.....!...S...,........@...-X.00.......P@....6.H..C..3F.q.:...m[.M.5m..Y[I2]:f0.....&3....,.n.......o.&G:..!..........>..~:Zg.U.O.....^(\|...+..-(zo..KWW=]x...o.d..'CF8Z2w..G[.qcl.!.....E..+j...a.

Chrome Cache Entry: 206

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	261379
Entropy (8bit):	7.900210196966943
Encrypted:	false
SSDEEP:	6144:lWmsTXe1iX/f9Q9Ma9amerd5FhImAf/dioKDv99glDA:lWmK7X3pa9aPd5FhdA/dUDv99B
MD5:	BDBA0EE8156927876712EC78DD86ACF0
SHA1:	F977D845EDF9301F5199CE2F77C2CFC0D64CE1C6
SHA-256:	A7AE2DBE69F5C07578E096D785E615704A132924E1F8026AA906482D7D3533E5
SHA-512:	1E8C5FE2CFED964BD87ECFFB3A610D1C0C505C21CE60A7C19DEF98EF733936E12656A0E49931F5CDF9BB04CBE4D222A4EE0F838D395DFB23FCFB0068E739BC95
Malicious:	false
Reputation:	low
Preview:	GIF89a...........n.................E"............\.....(......z.....[.....z.a.vts....P.....sr.....]...qqK....t..u.d.......lL0"..L.......o.tqdo..p..........Qi...i....)..h^.......QINLI.)(..q..nkJ.o......OL...mgX...w..%jN+lQJ......rG....M,/)I,P.S...F....rq...OE+K2..R..n..F..p.m...C...)..].M.M-I..............f.nG..N.nK.M@d...'.. .....i0.3..p..+).M@..N..).g1..R}i-.2....o...O...-.T?.^.m-,k,...&...+..........&..........p....mOr...!.EB.r.INs.i.C...K..+&............Qv.........o.......O;..Hi\|,.3.t..Ur.HrL...?.......MhP.T.2...On.+...._g3I...L.."......"......................".........w......................."..................."..x..~.._..............<...........^....{..^......."..=.................=.....<....................Z......!..NETSCAPE2.0.....!.......,...............H.`.a..L.p.C..#Bl8....3j...Gl.C..).X5..1[.....+c.I.&.a.......O>Ix...t..H.f...@Jf.HJ.....h.z. ..W.8. .K...,h.];.-.n..e....L. U.. #.^..sT@.#G...m. .m..M...\CX.Y.<.-Y.

Chrome Cache Entry: 207

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	352730
Entropy (8bit):	7.9169633113118625
Encrypted:	false
SSDEEP:	6144:nZJpxN9LsMd2tlzw7+Hf7nIishdXcItCrYoGkOpBVlgrjWis3:Z7Hts/tqsnIiGdXdoqpBgrlY
MD5:	EF69E356E7B97F4B9A5A30BC5FBDAE12
SHA1:	262F11CBB6462B5229E4DD6577B8B1FA2BDD9DDF
SHA-256:	973271EE44CF9CBB921637CEEF796BA0598393AC7799D7A67C41C57A460310E3
SHA-512:	0AF9DEF3F9C000D18FBCE7260850EC24FA42C3093D664E86CADDD1DBD4D757DDAA925AD5E4710017098F899EEA3F47FF0C5B0B28CD381BF13EDDAED9183DA787
Malicious:	false
Reputation:	low
URL:	https://w0083.com:33236/1bd9e5d42614451ba8d203764d864d9d.gif
Preview:	GIF89a.........[U!.P(..."n1..........w`g[.gS...#..............l.......D...j.......E.I..L.....v.......]..h......f..o.n....h+.....nek..N.....M.k..)....j....e."3.g...3F).......k.S.`.c........k.n.-2....h...+..Kgk.G0.KM.ln.....f...u.........#\..r.+-.......\...K..rb.K....m...l...!.a+rl..........r.KK....rP.3..o......m...p..+...m2..Rs.\|n.R.qm.M...p).l..V4...E....M3....@..p..m.UH0q..N.J.....L.k..(...E.,.....3$.,.'.P...U...-..K....(S<.w..J-.).s,.2$.......M..+.l4.nI-...O.5k..6I.~.........R........Ls1..Lo'r......f...y...D...N.#T.....m..K..:.g.....".3.B...L.9p.F3.>.....=Iq..'<.&.S}...4L......."U.1.-.wD....fD"wD"wU...3.U3.D".B3wU.fD...4w@..".U........"fD......................fU.w@.wV..."fV..................9f;.......?dW...;.Y..........fX......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 208

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	116713
Entropy (8bit):	7.914751103544461
Encrypted:	false
SSDEEP:	1536:4Lk/oE+CwAHB+BYqw8nsJaXeq801EmvZR/wdZhbHcm+xL2uKibs4VXHnIua3lPo:VrmYX6XeqFESwvhjsI1ibsQ3LaS
MD5:	3478DEB38DBF1539FB79F3E7818E5232
SHA1:	8D4BA46E8DC3C93D4014355FFB842EB389A0C033
SHA-256:	55E1BEA8F050F06A3A7DDA4095656B937520D4FE8ACF5CE22125F7FCAFE83109
SHA-512:	5546FA29215AAC3AE58D88CD5F30EB9A9D7ECB4F257DCB8D35C8E07B47D6EB96C7E19D8230833A60BBE1749C0A63A29E2FE60B5CFE0C232FB2ECBC6A62CD0ED9
Malicious:	false
Reputation:	low
URL:	https://vns2.ezrent.hk/b9fb3076983380cf2d30af608afa0f94.gif.js
Preview:	GIF89a...........h.....ifS..&..-.P{{b....+)...ED7WWG.........l431....ye.l.fWts[..h......73..K...b..F6.MG....../...h0.....0.I.u-.sM....qOmQ...3 ...31).-.TI$$#.....t....g..y..........I..e...W&((!(((........W.{e.....@:/.A8uE....dZL..\..........kV..j.0..ocbN..Y.....?..u.....N-...Y.c...u...J.\U....)4.hh.&,....&"..E....d.q]e8....olW..V.E6..U...h&.0&..y........w.J..IC.%...EKK>.Q..z..b.Z..z`....wm.k`RJ6.....i.,...ZI....G.........eU......((......"..$.QF.#)...tsyvt.'".....PG.....s.......iien%.....E.....U.SWQ<QOD....{dD.e.....i..:<..[.\|f.....v...-,&ZJ...d.60... $.y..........$(.y..U..._.aRQ.......E......n.a..q.. &...z,.._..-.ZO.Y.qok..]\L.p].{A...m.../+...YC+$..E>.Q...F.g...@.1..Y..4..n.B.KA0..$...... ....#(. $.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 209

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	62537
Entropy (8bit):	7.97481419094728
Encrypted:	false
SSDEEP:	1536:JdXJiwHMgYs6bq347gJdVMMxE2pH36Pd7+K950Jx++:zMB1TbBceiKPdSK950t
MD5:	9562CC935B72E3BB88E35CB0F8D5842D
SHA1:	60EE786728402EF2CAD6531A5508824466685EA0
SHA-256:	840261AEE6D41F110C89BA7F4D698B23EEABEE254D5C86F36C0FD90119A12298
SHA-512:	FD081ED9108D8D38307FF1A157B1A78768BD332F03FCCD83C976921207E3240E84FD3C644F676FA7200944865C77A47C873ECF2B8B72FC341D4953757E0FDD76
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......A.....zhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:F715C2F1D63C11ECA83DB1A5ABC91489" xmpMM:InstanceID="xmp.iid:F715C2F0D63C11ECA83DB1A5ABC91489" xmp:CreatorTool="Adobe Photoshop CC 2017 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8a86368f-1302-8d4d-bb45-197751a6e302" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..................................................

Chrome Cache Entry: 210

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	1023445
Entropy (8bit):	7.829228927608337
Encrypted:	false
SSDEEP:	12288:3YaJvdGz7mUJ8F2jn7qC7Z28uLkaR0VtPnLhB0eyFA6WmU+cJOZS2+OjYYi7Sdmd:bJVmpfkk60lB0ez6WmyJlN00J
MD5:	90F2DEA660596779E49E9281AF1D0053
SHA1:	EC2D7ADAAFB2EBA5DFC2026C16903656F2AB070F
SHA-256:	F498E1AC28B8CB52ABE5C577851EC8DF3F8D6B3E396D56192BA91429D102E1D8
SHA-512:	6A34AE358B142AA4A668326F238A13B0FC204BE8A3B36D737D460A4BC50E09A20F466745A8B6C3BC2EF081358B6750A1A1D4FC3C452A3BF9CC543988BAC1B62C
Malicious:	false
Reputation:	low
Preview:	GIF89a............p..!.......`.Ti.h......%....[.j..o....'.......Ob.....%......(.QP.F.......i..S1$R&.m.n'..+.$p.R&..I.++SS......R......n....).K..m.K..PO..p......S..N'.#._...pm.G..lJ.....p,...oN..o."..s...plLWo.ML(..o."..)..mM..G...I.....s'mN%..H...n)..FU......q......pj-...pK..)."..M,.tj.....(../PNKm,..Q..H..KD.......+,nps.....5mD..,)..r....OGiTK.U.n....m...L,.JG..).ENt....n......I.tn,).nKr.....,..T?i).G..uc.1..'Ro..AqMOlp..../.-...F.#.....-.'.,((r...G./....p.p,*...%..I--2M.....f.-....8...1.......>q....Mtok..RG......p.?Og.:.M.0.Rh.=!...."..e....F.?..0...3...".@}...U$..E..1.<b...q...................6.....D..D.....U..X..A..X....3..3.U..D..3..D.Z.3......?."..".....Y.D......."......".....^..............\..............@.....................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a1cd12f41, 2024/11/08-16:09:20 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 211

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	117813
Entropy (8bit):	7.9655787158207625
Encrypted:	false
SSDEEP:	3072:OrnwPeL7pykbMY8e1CvGuSPqJoSisK5HE:Or79hMY8e1u4quSisK5HE
MD5:	845F0EEFEFB08D7B9772C14D0E306446
SHA1:	3EDA7362FD713C4B7D1C6F3054891A64E1AE2836
SHA-256:	BAA57EF07FD8462B772266F323180BEC957B2F66C6EE0D0266280F4C94A46740
SHA-512:	E6390B1F66833923E6C511F83484E2CA3410D610CABC3CAFDDFFD92E63353F5334AD37BA079A8386480695DA67AD6EFE9106ED36B63EBF26863A0FD97D1AC641
Malicious:	false
Reputation:	low
Preview:	GIF89a.........A...NO..oU..u.........H0...bF2.yg.Ui...-Q....sY....u.\|...:...N4(\X.....O....Ep.gT.m;...... 0[.y.1$%.sh....i.u.uVC.w.fu.W`.8"s+K'., .....y....we.$. .............. ............1.QMi.T?......u.{.jU.:-....p..b.....%...ET.$.........}..bW.......:...6.....WB..rW......r-..:....tgWg.Xq.$..w...........!1.D:......}4?j.dK.<Fd/...5...I.......A..."......eJ.......v.....#G..l8.........zi...f...>e.q...$.y...u{aS..........A.........Um..........6..{_b...(...y..B..........7\....H.zi.....~bY.........(....... ;M:>... .VE=.q\...f...6.y..s...?#....i]...].;...z.s..........EO~.......u.../+..aU..}...".%....................8x.N..]Z........!..-...@..(......aU.fU..............................^Q....}...h..................n^.......!..NETSCAPE2.0.....!...d...,............G..H......\....#J.H....3j....H.B..I...(S.\.....0......_8k.......8....T.H.]...P.J.J...X.j....`.5y....h.]...p..K...x...............+^....#CF......^dvq.B7g

Chrome Cache Entry: 212

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10194), with no line terminators
Category:	downloaded
Size (bytes):	10194
Entropy (8bit):	5.374309159168722
Encrypted:	false
SSDEEP:	192:aPIrrkHLVDhgHBAarTHFhSRIOPQyYq2oY26ORo4xKgs2f02Yoot2OdL9kU4E5PSO:aPI6sWanRYbiAC/BkU4IPSg2Lqn
MD5:	8A15F5F05410A92791292B8A9AEC1403
SHA1:	AEDA626C733DC969E968F7CB1EC04EF67204C7B6
SHA-256:	BC05E0C9565F6AB067733805971D2535B5245C9FBF1339F9FD53B4544FB239BA
SHA-512:	8B1A1580D1508160B2B5061E8A0B17FCC511EC2BBCFC113CA4EF290FD4F85A6251E74ED0F60327E87494EEC4C453EAFFB40B6287CA086ACA74F2DCF96007C341
Malicious:	false
Reputation:	low
URL:	https://v1.cnzz.com/z.js?id=1281318611&async=1
Preview:	!function(){var t,i="http:"==function(){for(var t=document.getElementsByTagName("script"),i=0,s=t.length;i<s;i++){var e,h=t[i];if(h.src&&(e=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(h.src)))return e[1]}return window.location.protocol}()?"http:":"https:",s=document,e=window,h=encodeURIComponent,r=decodeURIComponent,n=unescape,c=escape,a="navigator",o="location",u="screen",f="cookie",_="createElement",v="push",p="join",d="width",l="height",y="indexOf",g="length",m="split",z="parentNode",w="write",C="getElementById",b="toString",k="call",D="floor",j="random",x="onabort",S="onload",A="onerror",M="getTime",U="setTime",E="toUTCString",I=i+"//c.cnzz.com/c.js",P=i+"//ca.cnzz.com",V="userAgent",R="1281318611",N=function(t,i){try{Math.random()}catch(t){}return!0},T=function(){this.t=R,this.i="z",this.h="",this.o="",this.u="",this._=((new Date).getTime()/1e3).toFixed(0),this.v="z6.cnzz.com",this.p="",this.l="CNZZDATA"+this.t,this.m="_CNZZDbridge_"+this.t,this.C="_cnzz_CV"+this.t,this.k="CZ_UUI

Chrome Cache Entry: 213

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	dropped
Size (bytes):	11030
Entropy (8bit):	7.908119771931338
Encrypted:	false
SSDEEP:	192:eFQkxH7Yth7bPlayqScLL1dqpU3IXN3CyxHPcxf+HSO+QT5wnqhKJFZB+aMBEkL7:eOkxg7r87LLLua3IXNjH62+QTO+aMSk/
MD5:	7D47DCE123437FD5DFF1B0A6BD6A39D5
SHA1:	BB82B579BA72D3B628F4842314143AB1F7C0D3E6
SHA-256:	4519FDA04D6A4D4CBA56DB64424843F664AAFDE43B0A51B378A09C0F87BE2CA0
SHA-512:	A007DBB02501BA5CBE43DD87B9E3845DE2A7F79B7DF3BF733BDA0EF75165B84F34C2E1E21D48145CFAB96C8158825F1A0A0B6EBF22A7D7D0138CF651996D9F09
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...!..C\.:..;....2.J...j..r:S..cH.J.E4.`F.9.;.54.qTd\|g.,...<S.....j.6M..U.cLH..:.P.. ....d.U.....6/@.w..I.VZ?L.....f..EG?L...r.Z..F.1.o!...Z....[d....q.be...Y...#....W7z.e...#..T'<...CM....$...Wo...4.8.YI......1...8...4.i.b.P..JCE...@Z.:..@.0...8..@..s.Jy.....q.)....)..=Nz..i..=i..8.[..7.iE7......4.pi...7.....;.......3qHcL..5.$...=)).n....y.j.:.OCV`..+~..C4..w..V...z.....*.:r;.R.vR9..

Chrome Cache Entry: 214

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	20305
Entropy (8bit):	7.876782068906238
Encrypted:	false
SSDEEP:	384:w9hSgFDdQBsLeBgnjWjCmkLeAuRP7ekDLcoX3hJgzkyGITGF4fs:w3SglObBWWj5k0V7ekDLcO3hmzkyGITw
MD5:	FCCA8C526A0A8C01137306D61760DD52
SHA1:	D94F8C09D2ACBE556324698FE7CD24F1547B9187
SHA-256:	5CCF611CB8725814797F70132E2516C46630FC5E096B31DBE9B629DF790A842B
SHA-512:	E83833D4F6DEDB2E65EEB34E53BE4759CDBBCB0931F481256F84A9F7B13FBC4EA2E4E145B9D2A167F44ABF3E8EEBEFB1928D9518FB94C51F5192CDEE6485266E
Malicious:	false
Reputation:	low
Preview:	GIF89a..........M...u......,..qO/&...'.....or!.......Q....EA.+!..MIgN..........D6.6&.znj4+..dQ5..VG.....lE4......:3....$!.eR...\|FrYG..0'$;'..pd.....z..mU.j..............Z...q...D&........j......xg.............j3..G.....................J7........ee...........n[.....UGXu.OJK....b'........t>....UUn..zw.}lWD.....uko.B4.......NJ....:GV.........zL@......uk.I0..,.....J...LWf......g..eK@..N ......s....>.....x_<7.,1..8;Wdz...d.....5.........._Y.{C......TzZS..P3.E.79@..zdV.R.........+....s#..................dXR..pm....s.....^\.5..`..Y.d....aG....M.yS...............t"#(.zR.................o...l8.>#jOQ..`.!.LL....}........... .......(.......k__.R..U,.`M....~.zk.... ......,,,.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.0-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="h

Chrome Cache Entry: 215

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	287975
Entropy (8bit):	7.8932241489727115
Encrypted:	false
SSDEEP:	6144:lWmsTXe1iX/f9Q9Ma9amerd5FhImAf/dioKDv99glDrBv:lWmK7X3pa9aPd5FhdA/dUDv99Q
MD5:	567B142D6E6570D031D92DBC3053DA08
SHA1:	0D97FC7AE253179C756559BF7EE6DEF96DE4DC77
SHA-256:	11EEC13890B6DED595DB2A3F0CDE36E0692ECD53AD27CB1F2983AD3353AC478E
SHA-512:	91FA4338B486059073746DCF1D7B788991576F3BA57EE175499337B4B537A25D0F41CB1238493274A42D97E4C3016B28F21E6BCB15D1753AC84984D6773031C2
Malicious:	false
Reputation:	low
URL:	https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/150x150.js
Preview:	GIF89a...........n.................E"............\.....(......z.....[.....z.a.vts....P.....sr.....]...qqK....t..u.d.......lL0"..L.......o.tqdo..p..........Qi...i....)..h^.......QINLI.)(..q..nkJ.o......OL...mgX...w..%jN+lQJ......rG....M,/)I,P.S...F....rq...OE+K2..R..n..F..p.m...C...)..].M.M-I..............f.nG..N.nK.M@d...'.. .....i0.3..p..+).M@..N..).g1..R}i-.2....o...O...-.T?.^.m-,k,...&...+..........&..........p....mOr...!.EB.r.INs.i.C...K..+&............Qv.........o.......O;..Hi\|,.3.t..Ur.HrL...?.......MhP.T.2...On.+...._g3I...L.."......"......................".........w......................."..................."..x..~.._..............<...........^....{..^......."..=.................=.....<....................Z......!..NETSCAPE2.0.....!.......,...............H.`.a..L.p.C..#Bl8....3j...Gl.C..).X5..1[.....+c.I.&.a.......O>Ix...t..H.f...@Jf.HJ.....h.z. ..W.8. .K...,h.];.-.n..e....L. U.. #.^..sT@.#G...m. .m..M...\CX.Y.<.-Y.

Chrome Cache Entry: 216

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	308156
Entropy (8bit):	7.887805052867105
Encrypted:	false
SSDEEP:	6144:8HaW3rXcnJONqy2KEzdJSHZTCK15BfSHZTCK15BfSHZTCK15BfSHZTCK15BfSHZA:8HaOXcnJSvEzvATCK1fATCK1fATCK1fQ
MD5:	D77C62F390139B596590158386CA0BCE
SHA1:	C1A8CAF2A13DB4961A043D68B2AA2A822622A27A
SHA-256:	F38EBBA6BA727472CEFBB7D2C9F9363D97046FB9FE9FAEE063956159A26FDD11
SHA-512:	41C0A3D3CDA7BF1D6C7CA90835DB539C14A019ED58B85A7AA9CA175E6CD3CBEAD3336D7476FD3AAC5838A2764E8B4FEC6E3ED27951FEBDBC0242B5C5EF61BE8C
Malicious:	false
Reputation:	low
URL:	https://www12.pengxunfei.site/jiamigif/168sc/168-200x200-2.gif
Preview:	GIF89a.......S............n..V...........hfTTSF....N..........w.L...._.a....Z..p......U..)..pvved.q...\g.!T\nL.g.....-.M..o.-.......m...m...pK..L..FD8....m..p.n,.gP........DE..,.....-.o..!c..J..n....$..n.S..pM..J.v...mN(..N....i.)..)".....2R..(....,.Aw./...L!...H)..3&....K.....ul..P.........kSI,...J10..q,..M.tl....n..rl..3.)....L,sh-.r..oQ.O..3.....N".I..PIMmM.PI.M..........p....Q.CzTD..)&.m.p+Bpy.'....Z"]..-0...........wf.ERs.Sj../t...P..&...,l........t.(..Ix.OasRy..0;g=...(..$...1.).../5..""...............""".........534.34......73 ....we.UU.CC.ff.wx...5""..........UU.DD."3.............wx.ff...........!...UB......3!..............~........"=.3?.36""5.U?........."3".CV....................s....3........w[.@X4.>.fx.f\|....}....:...w...!..NETSCAPE2.0.....!.......,...............H.......Y......#J.H..E^..(..1.G..l.....-t.d....U.-c.tEs&MW._.L).53..!.Jt..H..Z*4.4i..DAH.....0.."._-^.......@7.dHt.d.E.rg.8Y...&N....NJx(+`..&...j...#S%S../..#x....X.

Chrome Cache Entry: 217

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	2092
Entropy (8bit):	6.121402478733278
Encrypted:	false
SSDEEP:	24:xjFJ9ek069E6zkQk8nCPwBfA1FA4kzeupvNV48AALtVVv4LV7fXipqPLiuSyR06M:xUEE6HCIBfOupZhv49ZmPyR0YTHEVj
MD5:	1C0C7FAB26E5DD0B753416C3FCEA5A79
SHA1:	BA410F7E3BAFBB7E29F9D4DD4E75835DADCF7438
SHA-256:	171F615BCAB8731CF60F834B1329FA345A94DFF2066C5C8C7297F9A7EA157DB1
SHA-512:	6FAFC9C723EEA21DCC230D7F6EEDC7118B0E27B808111E8AF72CAACE74D3E296F9C367BC46D0DE953420FD8A95B4258AE3E83A70E47E0F63840470957BEBF1BC
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/video.html?typeId=21&typeMid=1
Preview:	<html lang="zh-CN"><head>..<title>....\|.........</title>..<meta http-equiv="keywords" content="...........A...................................,.......">.<meta http-equiv="description" content="....................SWAG.................51..........................................................!,..................">.<meta charset="UTF-8">.<meta name="viewport" content="width=device-width, initial-scale=1">.<meta http-equiv="Content-type" name="viewport" content="initial-scale=1.0, maximum-scale=1.0, user-scalable=no, width=device-width">.<script src="./static/jquery.min.js"></script>.<link rel="Shortcut Icon" href="./static/images/2.ic

Chrome Cache Entry: 218

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 180 x 180
Category:	dropped
Size (bytes):	509971
Entropy (8bit):	7.948322558716451
Encrypted:	false
SSDEEP:	12288:a0muKvDRKewJw/CnWQkPU0IjECFfAQU+yIF9uT/S2GwUiN:aO8CWVixFfA9EKm8
MD5:	E745B25CC3F2D71D89ACBD2B5C7F7437
SHA1:	DD49A6B3A2B4E0F441F31E5E136CEFF85B3E1FE7
SHA-256:	373673FB30B1F49B727EB216F5E7E144D3E502EC6F5AD29BDBBB7ACD9886BE87
SHA-512:	F8027E26226CA9A6A43C29B90DBE1AD65A628FC24FE82E5683457E9747CE82A5F8512D7960EE07EE40E481B9993BF73E00DEF8A5AC36AA4ED57538DDA4578BB4
Malicious:	false
Reputation:	low
Preview:	GIF89a........I&....,I.......Mf....oJ."/"......J._.......+(O....\...D0.q...gL......."......g......p)$Dq.G-.Q.......o...Dn....o...]S7..%0K.u..3#..$..b...JMI.k,ac.....vi.....(g.%2k.v"..2.....f...=.w`.U<.3#.R.)...U;.1h..CRt.j-ELMir^ !-h......./T..&,/....w...+`..m&S..U....gz.f._mow...f.x.aknL.FR...Z..g.TgR...+)...V0E.O....uKN..."..+Q..-..!......5.. 0fr.+RkTh..I.....`....Lp....;...#.,.R.......r2-tD.ir.... ....1..#....1...1.-76.;..n8.."..".33w...."...D,.D.......3.....3........".."..3.."...D."........"...........3.......................3....................3..........."..................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 219

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x888, components 3
Category:	dropped
Size (bytes):	57085
Entropy (8bit):	7.903995485253351
Encrypted:	false
SSDEEP:	1536:kXKcyYU5b6wAuidfmvHefIwVUNRdqth6Zm7+3oUu099Taewr:kA5bHAgvHWIw+LAZIoDQ9bU
MD5:	882BA5B14D99148EDCC9F885441E37D6
SHA1:	00ADFCED5765A5865A56C1335855B50152C1198D
SHA-256:	EE0B67603342A277F7178682FD080DC1B04140B011D73EBD9FEF3D9CD71EE3BD
SHA-512:	C4A34E732D61D5C86AEC34F41FA4381A5D4FB2FE18E1B897FA3C75AE66DBEA4CFE881510FE7D8081706D7DBC120FB8B1547D12D8652D806927BFD9D884413F0B
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H..............................................................................!1A.Q.a."q2...BR#.b...r34..$..SC....s5.....D.t......................1..!2QA".q.aB.....R.#C......x...."...................?..4...A..2+D.!....S....t.....'6...M.....!.h.[gBU...x...gt...8S.4.m0.)..7....i...&T.VSK.u...e.[C..Q.k/L)Y.E.+J....0.,J....}...\|n.\.W.p..W.p.;.v...&.=..44.].NL:...Gj..\.:Us..V.V.0...i..f..6.G.8.M2. ....e.e. ....P.$..0.L.....l....Q.YE!...($..]uV.2!..[e..iY3#..(.%..w..KF.,V....+....."hWK.../`..F....^.+..UL.D..G).T.F..{H..fF........# B.@.....6....z1.$AD%.kF.L.L..H..Q1.sdQ..[.......KjYW&./..<.G.c....G...2E.x..`.y.x.....wk...\|.......@............n. .......@..............T............................. .!..........."2@........;l...I....-2......JfM.h.U.....zol.Yd.P.....R......rx.....@#m....$0.....p.....2..s.#.{B..C.t.}...Y..v.m..r.,..a.YV...=......\......8.......4P.

Chrome Cache Entry: 220

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	49493
Entropy (8bit):	7.926200574008499
Encrypted:	false
SSDEEP:	1536:WxO7LHgl5UHgozesU72XpCqBGGWwEQb9BEG:KE+CLqCXpCoW3QbAG
MD5:	EA9EAD97FEA6A4D0A2B0D70CB13466AF
SHA1:	B869317A2F918BD291FF2B2C31A666396EF3DAE1
SHA-256:	DD366BF1EA024FC78075F365E82394EACA3A1D1D19A958789D82804A20A82F09
SHA-512:	DD4A401C91B12651AEC3D175681F8CC31A24C291EB53E15C40DB0B531E67C87F3FE2E1A02C5F40A63FB3950F3B44262E5D2E5E5D7D95AA1EFF991A79DD7846EC
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnnjgp.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................E.......................!..1AQ..aq."......#2..BR.$3r..%..4Cbc....Ud................................,......................!.1.AQ.a."2q..B...#.............?..W.t....}!.'.......N.C."..b.I.A.R.D..dsQ.I4B.J....D....v".L..i.Hq...P..(...fI...\|....XP.3R..Z`.='5...../.....$! rb~.....]..p.B. 6.........{l....B....1....Ql.m-.=..Bc.........<..[>....b.....U....@.0.....Mt..."..Iv\|..@.E(.J3\..3..$..'....ctd..H..G..0r9.\|.vx.E.f......%bI.TL....r.5t.0:.....{...h1....4.qR.".:...EV^......fH.n.#..P...I*....."zWS;.zW.Fs.:.O.....T.Ts.C.@ ...).C@g.U.7..8....sM.k.......+.Q..SS"...T.$...M7H.%la%ch1..d.A..Oi).r{Q.5..90"..Hp..... ..Y.._......`2.....y...l...B)!."8.....@.Z,.!.....VH(..z..,.l.A..ZJj.J.(..7.dO.......i..KY. ..u.E..nB..#.:.U.[PP......qIvy..\|....~S@u.kn......j...

Chrome Cache Entry: 221

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	241927
Entropy (8bit):	7.901814415501523
Encrypted:	false
SSDEEP:	3072:1abd2+dm42M5LFOdYd2+dm42Mq3A5/CUY4e1CUY4e1CUY4e1CUYIOo3KTEaJEaJk:1ckolkh3A5/CUY4+CUY4+CUY4+CUYO3X
MD5:	38B66CFC72A1849329BE0B47A589463E
SHA1:	A3845BEFF0284E0B88A504CC032D236C13D819DD
SHA-256:	78E27EDBA1B0A402080C6D10AEC24BEB91F3EE83F5AF0A15C62C671E752C2332
SHA-512:	8C498CC7EED14EB864EEB84A90FD4D54EDF5CADB897A6A0F960B4741A645C7A9D4A4B2430C485FA0A5B3F2711D681E459DEF996CDF10A202C93CC0774CBA09E5
Malicious:	false
Reputation:	low
Preview:	GIF89a..........3.T.sJ..og.%.uR7.f.....p..z%{R.c9....T....PB.....)..t.......v...C.V......K...^.B.D.G8...8w8..L"wJFyJIu.6xEj.r.v....&W3....F.......hA........R....X.C.f.4..1....5yU..."fC....1A..m......&g6............zb..2i5..g..O../xdvq....E.h......Y5...c7.S$.."..q..z.........Q......sJ.........q-.t.v.........f....H$...........;OK.0+..wR.._l.W.(......"W.e.4..&3...E...V.wE.X........yS.h.U'E.s.......w...t...K.{.....;M.H........._.._1jG$iZ.H7.....W.V..k..+.....kR&t6..g...*.l.x8......V.W.G$.........i.G..iQ%f'V.I...5d&......r.. XFbx$..B.q.9...=..b....d&...?:..{j.d/.. Qj.H.H.....9s/...^....S@]4..\...\.n...`].Q.T.......7kQ.......6# G..s8.\.(s)>k..kJ.Z9.cB.......R9.R1.cJ.Z;.R1.R9.cB.kA.Z/....kJ.Z1....cK..........k@.........................ZY-.~.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 222

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 260
Category:	downloaded
Size (bytes):	1261742
Entropy (8bit):	7.948453894449031
Encrypted:	false
SSDEEP:	24576:v8zMzMzdzB4BnqrusQTuYwrusQTuYwrusQTuYwrusQTuYwruC:vO++pzTvZTvZTvZTvZh
MD5:	519F7BD425A071373B037D8AE1B6BE07
SHA1:	0FC5D674D0A99F3F447DFCAE22082C3C86EC2C13
SHA-256:	44C31696CF0EB192203286EED99219CE5B4FB8574FA60EF1D573175E632912F1
SHA-512:	99516445F5172E63BA3B3EE884D6637B557D4850F1072DFDEB7B795EBE340F3BBAE6F7125A8F87BCBA3E5A2E41734C1D1A860306185EDAEC88F8ECFCBBBA71F9
Malicious:	false
Reputation:	low
URL:	https://sz.ggshezhantc.com:8686/1300x260caivip.gif
Preview:	GIF89a....................H....**........../...s..M..-.....................!!!...................T..............n.................((................S.999...!...]^....D...m...{{{....<=.(BBBNNN.pn.........ooo..JZZZ.NN.tK....h-..........W(+.........(...{ccc....om[...NL,..`...b.kI......07&..>:..%llk....^[../.........?..........r..........E>..H.....Y..p$.A..W.......''&XXX........{z........}}}}.....e]e..(...F=BlcP......ZcZ{.{...............................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 223

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	downloaded
Size (bytes):	34303
Entropy (8bit):	7.962582163326109
Encrypted:	false
SSDEEP:	768:2i3lwME9lNAWIJgmGJ67AvQnXYuw1HzbkDg:plXYdJ67yQoxzbQg
MD5:	6C30AD14A9DAF31A5AAA83090368FFAE
SHA1:	EF00CCC5E4BEB8FA7BA5AF409560ACEDE877A43C
SHA-256:	B49714508978ED166FFDB3CE145B93E65E61EA481A2F46513040BC448E5A088A
SHA-512:	C7DBDF78A12DA060F8B5C0150477E13DA1C9E1BB60D57E07D96DF933D8F42ADB264946D39C356BFFD8288206273A20DEB14A6DE8EAA7D74E460728D4DF4C7817
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202409/26/647e63b246a0/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3............................................................................!..A.1..Qa."q3.RS2r....sB#...bC4.$..cD......................!..1.A".Q2qa3R............"...................?..q"#.....H&..>..q..3_...k......\|...g}O..e..O..>.]x.Y.{9..N(x.....z9....7.zx.Y.b^.."\|clW...g.......k.N.g.vpz.y~>.d.....yz.og?._.5...\|Q...\...Qlv...<....5....3..8.UN..s...N0]..:m...a.AuLx.uD....."2.@.D.&.....4......h.R$.(.....+...j'.G.h....aq..^.....H....h..t.d.'......t.J..+...Y........z.{`V..O..'.>.......a..].48.O....5...f :.ebl.^.t1.!.]........V.D>...1+.n^..e.&;...._.....o.y....<s./q.....=..v.8..^.d.\|."v.\u..m..T,.G...s...}.j.<....5.v{^..-Z.pf..S>:...^...4..b.._...*.U..\|..q.i...J..KPl..V\..Ml..k..=.9.2].....5...e...0......&{{..Y.......G..u0R.....K.L.u..xz.7r1Zg7L9\.F.Z.1..2.G/..\.{.~o...\|c...u.u.-..I..=.......yO6.^g.r.:f../..k...w..{.w..o.k.{..c.d..fg...

Chrome Cache Entry: 225

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (472)
Category:	dropped
Size (bytes):	64745
Entropy (8bit):	5.560409647959236
Encrypted:	false
SSDEEP:	768:PMBxa2CoSKD2Cm+KV2FODar2FcZac2mGYZ62mCYZ4if0PtGYMBxdMBxQkZ:qxK8hoSm+if0lkxExr
MD5:	37084958ADB7926DF8B7D6359A9D0E7C
SHA1:	DF3DB43EE6ED94925E8A9DC1F760F786E6E75C01
SHA-256:	CB2B695AD88FB24A110217E9A3EDD9ECEE4C1C5CDBC49B503C11E70E5DB158DD
SHA-512:	AA695C6F0674CCF371001FD788AD1DA5E2C1891FEBC2011EC9A94085466ED9D6F6EBCF668E9A9C3A76ACCFDD10F780FF661FB1F36184B57EB0557F95FE69A016
Malicious:	false
Reputation:	low
Preview:	function init(){..var data = {name: "John", age: 31, city: "New York"};..var json = JSON.stringify(data);...var xhr = new XMLHttpRequest();..xhr.open("POST", "https://data.7wzx9.com/getDataInit", true);..xhr.setRequestHeader("Content-type", "application/json");...xhr.onreadystatechange = function(){...if(xhr.readyState === XMLHttpRequest.DONE){....if(xhr.status === 200){.....var data = xhr.responseText.....var response = JSON.parse(data);.....var menu0ListMap = xhr.responseText..........// console.log("xhr.responseText:"+xhr.responseText).....// console.log("response:"+response.data.menu0ListMap)......var subMenu = '';.....for(var i in response.data.menu0ListMap).....{......if (i.length > 0) {.......// menuData.sort(randomsort);.......subMenu += '<dl>';.......subMenu += '<dt><a href="'+response.data.menu0ListMap[i].href+'?typeId='+response.data.menu0ListMap[i].typeId+'&typeMid='+response.data.menu0ListMap[i].typeMid+'" target="_blank" rel="nofollow">'+response.data.menu0ListMap[i].type

Chrome Cache Entry: 226

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	80571
Entropy (8bit):	7.96428573900965
Encrypted:	false
SSDEEP:	1536:AZqBqwbViwecwuPHj4gsuQYqTIu8U5MWVvtGbCkTV2UZRaa3LXkXIOP:AchZiwBwuPHjJtQLU2MygRJRlLMP
MD5:	3CB27BCDFA08A7974A1D54D7349666D3
SHA1:	101FC4F1482CFA5848FCFAF8B0E3FDDC1028895F
SHA-256:	7875AA7F535E9316C9C7844796DF546DA32A8E0F7D52AA4B06811D340BF520E9
SHA-512:	BF0801CEFCC9912D679977C09EA14C4392D44BD0F1ADF2304BE9B7295471F167F761566922A85D6F2BB47AB15CE959C70814171F625FF70C2FEB57225B39F584
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:2F201E1ECFB911ECAF71EEEDD564EC6F" xmpMM:InstanceID="xmp.iid:2F201E1DCFB911ECAF71EEEDD564EC6F" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6994BF4FB8CFEC11B9DA94D54914C398" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 227

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	91488
Entropy (8bit):	7.850954885067996
Encrypted:	false
SSDEEP:	1536:Zkq6LbFDanjXp+J9w7arPJgEmUSguAkKXHCwTCozBJw7arPJgEmUSguAkKXBHNb3:Zkqap2jQRATfGywTCMATfG7mZ+u+ui
MD5:	816E33F667B33B9DC57759242FB983E0
SHA1:	A06132355F4FFFB8A9A7F82A4C161BDA8BC9023C
SHA-256:	ABDE139895EBD0E28F46A889D902EEE9CFDCE281DA7EAA0451A94017EEDE939B
SHA-512:	AB531805565EB44A19D095791BDE2E96A7FEAF161121158CAFF918C7A7BAFC090C5154840836F5644447EDB52D6E8E8BC9BDEF4CE32EA99E21C2D4CA17080B54
Malicious:	false
Reputation:	low
URL:	https://sezhang.s3.ap-southeast-1.amazonaws.com/150x150w.gif
Preview:	GIF89a.........N....K....V.........w"...r...e........V5"...............h........8....R.X...w..#.....o.xH................q..9V4.uiJ......H.f#......hC...d9..U.........Q.6vI..`..y.nr..m...E&...tg3.u6E(.......8..ll.t#wW#..:....i....i%.flc..5TD&..f.d!NJD..1-.....yR......W3...A.z..v.x"...dR$j..wG..t..n..C..d.v.....y.5.%...pom.OP.XTD..i4...hW5F1.....NN..CjC..{/.T.O...V.g..WG...u%..f...ll..R..X.MO.6..0hI.0* ..w..].{.H7".y'.D..C.......B...L.}R..w5.i.z0......4.{,G3....N..)1.'..(.aYNT'.....v......k-.((vY6.".x_..wJ".......H#.......X.%*.e.;..9.{G.....V.".t!.E..e.BB.!)...3..#...........tgS..e\M4+....B..c........J..k.................J.................k........B..a...R).........A..L..]..P..k..p.......k...Z.k1??>.Z.....V>;.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 228

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	507238
Entropy (8bit):	7.922334306681101
Encrypted:	false
SSDEEP:	12288:frxDfFZqS0ACM3l3oauIVfYq2/zF9Oh1xJiLmjVYD:frxDfPeh83oaoq2cgma
MD5:	163CD4C2FC934E50744498166601AFFA
SHA1:	5AC022B06A53B29A6D1BF072C26527FEC8375089
SHA-256:	DB3D90F6AB8B811928FCFBF072D60EB199AD1FDE3B05C54F12EB0A8D96066C26
SHA-512:	60B053984D6A259C5BC9DCAEA85CE0FCA97EA593C9A4B53F73CCFB826CDA4B970388D260189FD9F49203EABD750B4AFF9889E2842A24875A365A24A5C13EA4D9
Malicious:	false
Reputation:	low
Preview:	GIF89a..............K.....I'..s......la.J.........u....s...!......kK..[.....[P........3."......Ri\S....gML...D+....o.q,....f.1...s...k+.vc.RG/...=.3".wa...T?.3#.....f.l......1"R........w...u$.....U<-(%..J..'V..(..,%.../..o.w~.R....."....Pex.S..........K.d.........&..."..........K....5B.,&..)......vW..I:?.".(.#.".,..f........H.+.BC.....(.*..r...."....."...".....D.3....."........"..3...D...."..3....."......".....................................4..................................3..........................................X.3............._.3..D...4.....UW...........................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 229

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 400x600, components 3
Category:	dropped
Size (bytes):	32633
Entropy (8bit):	7.957812866493121
Encrypted:	false
SSDEEP:	768:U1Pt/9ZhRdJVb2xenf9UCpiPfxYgRu3+wFmn:U1Pt/PXdJdEenePegK+L
MD5:	6462382D3BC425F8E74DDBB5D26F63B3
SHA1:	AFC96BD63F066E0918F5FB66CC076E35F66ADCAC
SHA-256:	7F15A842ECBC6BF719E3BE14D15F366BDD5BF34BF32B48AD08F9CC39A5A7ADAF
SHA-512:	E160BE67B229527F3DD13FB87385FA00E293CE1B5A5DEED32043755C471E053196A4FF532A5C7E7CA21F24462828EFC630A1F606F54AC671E8157330202BB517
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................D.......................!.1..AQaq.."....2......#BR.$3.4br..CS6Ec.........................................................!1A..Qaq..".2B....................?...!..B...!..B...!..B...!..B...!..B...!..B...!..B....".R..vOQ.9p.S./$...J.PHIte...Rx9..w..{.Z...+.../)..^.T....i......k.`.\. .....gc....N....rZ.".{..g.@%..".w.....reu...Bc........Z..cjl...hp2..4..{7l.q..k0.'..3 )V..vM).&.w..5>..VL..T5z....T....!.C.B...!..B...!..B...!..B.Uj.I.j....K......P......s.KK.7..=..m3......`.U..{j.J.I.qil..5...7.O...../.....(....j...u.4.v$....i>....1.,..:.\r}...L...kB....FY_......u'........!..B...!..P..R;....P{...^0...].Q.u..wC..7.X^..n;..g....Mh.Q...R.{.......\.W.Q.....A....%..\g.+.....5.M.w....T..S=1.Q.[.....,].@z+.Z......Ve....[."i8,j_.R<.}4\5...`p.R2.....e0.).4..5.....*....

Chrome Cache Entry: 230

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	438719
Entropy (8bit):	7.976679828003753
Encrypted:	false
SSDEEP:	6144:vKmsJvfMN2cN1kV+VetTTTnPHPK44f4f4f4f4f4fu:imnNc6e1/PK4kkkkkku
MD5:	D7D290C4A054E428465FACD44562F3B4
SHA1:	863654159F687BB0277D2FBC52F837EEADA8CFF6
SHA-256:	C00A957F41306D204CB5C9CED826128D93633649C3F4C367CCB59C7839A0F8AC
SHA-512:	331DE95FC0F1CDC350C05CFAA51B9D1A529C1BB4F651339801042885287A38DBB64367413200D80D3A83219605C63F185C151E84F86459D5287A1CDB46D1105E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......C3&....%.......-".........p#........./""nkj.*t.N$...........Pj..(`....N.....SD/.....s.,.a.....m..n..qiD2.g.....F....b......jUB.p#.rL....."..#.lN.s.l(PJI.....oQr.........N.E.F'.....m.......sN.rhN...uo..q....!..L.of.q.q..(.R.pa.....li.+........"..(..M....-+.pO.M...s..u..MM.P.....s&.p..Q.nj..n...r.K._.i.3"...vh.._c.........'.q,..O-.km..............mLMJ...h.)L..P..w...t../p..M)....D.....UF.p)...qj,.CP...F.....s1'R..Z%^.A.y.......(.NNH..FQl.OK..+2....M.K(....o..Iy..Q....z.o.8.....+:...poN{0j.....tRrq.Pq..j.....$.Bv&.(..U.......:Kh..2.+.4KiR:@.O.,-B.&./.i..,..$2{.53..C{3.+........................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 231

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	296725
Entropy (8bit):	7.9294190735780345
Encrypted:	false
SSDEEP:	6144:m/dxBTKLdC7dPLfMw+8zMDcpcEK87SQHxUMoUnZ+DL1jGQdze:6d7KL23+8zFcEKMqU+DpPze
MD5:	D81217D24677669C10129438BCD3E0AF
SHA1:	E75A85EB9230F88997F284004A977193B59A5AD1
SHA-256:	419953C726FDF8542D04439EF442A0BE60F946ACB9E7686901D2557EF0836521
SHA-512:	83AF7E6BC9C7F095AFD7CD25065BB1E7FD74EA0E14E0527ECD840FCE91D027CC81C8C8BF3334F4A0F63EF5D33B15D969E68F775A0966FC9A5D57A00954FD15A1
Malicious:	false
Reputation:	low
URL:	https://ig72.vip/img/Fky_1300x240.gif
Preview:	GIF89a........d.)....$.........dV..V".2..d....kI (m..........a../4...n....\.QrQ.ecVa.......Z......U.K....c.TT&..N..o.g3....F.tk.)...oZ.(.(o>...$..+...lE.m2...og......w.qP+...3.r.t..-.k.o....j......2iM3O........ob....m...nD...B....pn..K.v(KU...L............n...........?.....X'.JE..n.iW..........>..m@p........Jq.s..(.m..FsSh.m..Mn.o......"b+.pt..K...rm.PG.4..2G...Q..nL.G.....2.v.7.(.r.q...oq.Np....o.O)....U........P.TO...;..~..o...F+...m.6.o,.K..DP..k..Pr.o.H........Q..U..Q..D......M.2.....TF...:..Q......m..FB.^q..S.5.1...w..wU.xD.fU...Af..........w.....e.....f..........;........................eD......Ud.......w............eD....w......._...xD..................wU.........................fU..........^...........3...e_V!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 232

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	510915
Entropy (8bit):	7.982962682626086
Encrypted:	false
SSDEEP:	12288:z9u7N0aUaEmv9HEJVUXX1pO0JPBABNsnnryqnDBwTQ8X0:Ju3UaEM9HWynTOGiTsrwrX0
MD5:	32230F6EE2C8FAAE85B48936D3861C69
SHA1:	A3281423706F28E71B024ACF2B4A64D849A55299
SHA-256:	B3F13651C81C6B65BAFCF0C03D4D7E394E329A9C79F757DF29E8789A947DDCF0
SHA-512:	104F1BEAD30FB597B8ECAE8747F3B15D76CE1BF9E941AD9C0C9D041FEF01DFAC1798B19EBBA417E9C490C302EBF978FA767AB7DDA431308EFEB05D9AB10AED65
Malicious:	false
Reputation:	low
URL:	https://ig32.vip/img/GYyh_1300x240.gif
Preview:	GIF89a.......Y..fv.....%..."...b....nl...pn*.i.......u.....rG.rh.DDL p.L-t^X.o@ ...qd.rO...........B.w.....w.....v.m:..gS.@/....j(....39.....RB.A.....05U..m.........j/.....Uf..z.Uf.....vMo.DDf...D:.DU.UU.UU.......UU...w..w..........x...UUf..........r....t...............u.U<........U^....UC....CD....U=w..........f......w............D3f..nM..U8...e_V........................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c3a72d7b-3c6a-9c47-975e-ee01004bac65" xmpMM:DocumentID="xmp.did:E627633AC36711EFB0A1AA3E4A7B921F" xmpMM:InstanceID="xmp.iid:E627

Chrome Cache Entry: 233

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 6448, version 1.0
Category:	downloaded
Size (bytes):	6448
Entropy (8bit):	7.960009766678144
Encrypted:	false
SSDEEP:	192:UYTXAa1Tb+Pxd4HejkteSi/w2W1OJmhx7dt:fTQkWPxdUCWQYpt
MD5:	840EA0A641B0FB13FB04DB6E58387AB4
SHA1:	B45AA6B7113F172031654005BFC1C88D156E823C
SHA-256:	8F44BB7D733543B59C3EDD50DD73B86BC6C4822B6B0DDD0861DDC86231CEC71D
SHA-512:	5F1265A45F2DDE08A0706DF59A19D63024096814306593F62F8565B57E8F26B1345758FA205FD175F289AA97965EDB0EDE41E8EE1B2E82FF794119E7B915ACE2
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/css/fonts/iconfont1.woff2
Preview:	wOF2.......0....../..............................T.`..D..`.f.6.$..@.b.. ..g..L.J(E...[d._..1.......B[.Xh..a.\..Z...t<A8..a....B>.e.N%...1C)..Z...{wi..($.!Q.k.B._....9k6..#..!A.HH..R$H.<...`=(..A.\...w......=1B.\......(,..6.........n.......P.C..wO.....!.%.C......=..\.P......n.U.a.U.0[..o.....d..6...@....Rf.....0.X......O~n..)q.Qnx.....Iz#..6...9v.l..0r..MU..#.%.i..0....1..!-"......w.....'....\|v..._.,o8.o..r....""M....5!._..{.......w.R.'..sD/.....a.o^..?.........;..#...`Z..ex...d.\....Veu..E1H.z{..x...y!..]\...]..~..OG.......G.X.Z.........).m...Iw;.L.-.#.T....d.,,..e$...X.T....N..QPTRVQUS..1M-m.]=}........6.p...... .A.#....`.%... 4@...d ..!>..C........`.q..._D... .E.L!.@....t....`....A......C_.lp..L".....J.D.J.D.J.$..*....H.(u.hP. q.D ....JP. W........J.....H.(=.+..A..2...........2....G..`....@v..s.)..0.3.w.'.......!;j.A2!.b....H..xz..C.($_\...#..C.$2..].(x_6....d<K..l$...L.".!,..6-....w..-...QP}CI....-d...0Z..B.C.bF.....hyht..i#R??...+'..3....;8V......

Chrome Cache Entry: 234

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	143185
Entropy (8bit):	7.973654685436482
Encrypted:	false
SSDEEP:	3072:ctgDCXeR/fm9BhXdinqYC9yXO6L3PDTY3wLTKsQbHdzmN/0C:cWkeRm0nqYC9/6jPDzLTKTbHdzmN/0C
MD5:	C99AEFCA74185DD1DA314383B810AD85
SHA1:	56910F5F1F87E1DE26EEE9D75EDCBA06BFF493BD
SHA-256:	600433A540F45FE4D7807DA2A9A8FCA805440914A1CC38B86795D0FD37AA5DDD
SHA-512:	C7C8F28375F5D9F638FD1623451BAF8A1A3B4B78D59C3A7EF8ED60876C732781E1B182438005889BEC235C66B07EA056855B302AA50FDE21F7F15E7A8F93F05A
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/d26727ebd6a5/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......2..H...1Z...]^. >RN?,.Bpk...#..,\I..bA.A..[...=...c.s.P.Q+...\|.....k(...T......Sr....P/.>,.nRT.SS......?....muY.......a.a....U.qh.Sz.A.I..\.2.....e.AF.?.5..E=.+..@....T`.x.c4..NQ...2H.U...u.W......{/4..%...1Q.......c.D......N..+2y..."....B..k..#.p...1..1.t.m.4.t..t..z.p...4#..J0e...T.>..4.Q<..Z....}....;.r.[.J! ...:.c.=.j@".."...{T...j.~..5.}.M..O..

Chrome Cache Entry: 235

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	401269
Entropy (8bit):	7.9881588058858375
Encrypted:	false
SSDEEP:	12288:jQKFbwpdWbFI7yEyb4ZYG30+Zyi75ijSONB:CQ8fYG3b75USAB
MD5:	666051E9C993D40DDDCABDEB9E0BE587
SHA1:	14AC38E595867BD99E931ED4CA16910A072241A3
SHA-256:	07F2531F0F93BD06C32CBEAACC7E1A6B68B162D1E9353A520769C35948DA5B53
SHA-512:	C23B4BC24FF0B20C03081D8566D93B6687834E44FA6B56FDE962054CF31E8F31BCF02366B519339A19F90A19C8C8E9C4FB6364BB3992FB39EDFF9AE4C23656FE
Malicious:	false
Reputation:	low
Preview:	GIF89a......._..........Y...d... .....`Z....q.......]..gYT.........Q.mW.....q.................K......F.........f.Z....r.RF* c..bE2....m.....C.....k]i....&...........)(......w..3....D...E%U.Q.....m)......p.+(..'s.a.U....x.'o..r.R\|.P...H.o...I...=%.+.<.......)=g.E..$......+..=/J.Y,..@@9. ............}.#.:.."./7......-P....:......@.........\|.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 23.3 (Macintosh)" xmpMM:InstanceID="xmp.iid:6B28EA26CF9911EE8A049E38CC2EA754" xmpMM:DocumentID="xmp.did:6B28EA27CF9911EE8A049E

Chrome Cache Entry: 236

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	146762
Entropy (8bit):	7.965114097225366
Encrypted:	false
SSDEEP:	3072:egKGCEc7yp5r1D1mK7h7Z+PyFz++f7r6iRoOwvB4e5PVgTsALR4RwvW92Ct7:dfAKVBnhF+Pn+f7O4oO7yPGTs2RQ+Yt7
MD5:	42BA1927EDBE7697762220E3021182AC
SHA1:	85B27192419BB80667133970FE2D82F95FEF93A5
SHA-256:	D1BB983455B9022E7BAF2AFB8A69C34877BE56EEB292D871CB2F5C95827BD839
SHA-512:	F368D5C39510F09C756266DFC203582745C3AF84DE03D4B5356F3C5EC9810892A4EBCD271B9796509743F1712D5D7B06DAE84FD4FC5A0579798A645236F84A16
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....NM ..q^.\|.N.8.c...i2M4...zC..!.LBQE...E...@.........?J`8<t....LQ..zRn. ...P...M'...VbU.#.J..~1.a..@.1E1...).H.i..B)...sL.......f.u=j\|`.5...De\....i.........&uN.Mf..5iU...<..[.=9.v.y"...Wm.....x..t*..".:.....5............T..Vm...{.....Q.z.E...u..h.Z....c.."...<qWg...?1.#..U.8......6..:.......W..x8...W.=.G.uS..z.n..8....BF.O'.R.._z...eb...s.5..r.{..6

Chrome Cache Entry: 237

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	dropped
Size (bytes):	11062
Entropy (8bit):	7.906216245912831
Encrypted:	false
SSDEEP:	192:eY/1hwgJf7hJCvs4Tj4mtLyhOkUv/2rc2MScr7s3OxflM62f8L7N7geowvOrS:eYt54Amtw0/foajxy6Fh5tkS
MD5:	F3F780BCF4400BCCF4DFE7F8FCE073A8
SHA1:	7D2D9B165213506DAC994044DB8AECB4FF15FBD9
SHA-256:	8820971587DBB2D41493DD9F3859FEF2F48D9B71CB9F7EA04AA89165324E43A9
SHA-512:	9300E3FE67D8FA2B21A59C12398E74DCA46F1EE9BAD29357DA01C1AF57196A8254B76E31A8B3E59FDD38A7681F276EC3AC118136E2CD6A58978A99B97A0AACDC
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...-..^...na.....#...eS.R..8..cN.OJp.......4...(..I.AC.RR.........y....T.j.......N.M2.Q...G4...Z..`y.."...3)...I..A'...cG.P.+...N.8.S.T....T.4.1@...G"g.?p..q......xj........._...S.....k[uf..$&...i.....M.3.Y.B3\.....5.j.r@5...R.........D......S(..!..@.(......3E..f.4......Z.$8<.?.UaS..)..w...\..I....H......].Z.43.QB~....i..u.b.J.8t.R.Q@.....`=.8...w..q......{.N....}.}i......K.L..>...I.K.)..8.h.=

Chrome Cache Entry: 238

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 313x222, components 3
Category:	dropped
Size (bytes):	13298
Entropy (8bit):	7.884323541052186
Encrypted:	false
SSDEEP:	192:/0xhXBD4SvsPrRXl2krZ6x0IS28bB9chEtJFinbuDhOtSRRWv4Xnxisc:/0LVvGXlvPGSAbeOtSRRm2n8
MD5:	317821B40A686FB113305655873B74A4
SHA1:	F41D0D6B967A489A78BB5C657AB345A3A751DB05
SHA-256:	FC36D277D3C9A31E44A5720164215A7645B19420BC7497503C7B9FBDF436BE3C
SHA-512:	316AB08137C161F8CCE45A8E36D93B91E455830046E39E0E7BD6DFD4E7D36503DD417C83B6924FE7492DCE2B3576542B32E1B9215FEEBEB60D7823EC8B44CB4F
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................9.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...O..9.'..}WW.t......o.l...r......$.8...b/.v.......u....Q.v.J..P...js...6..e...)...._.>.x_L.D.5-A.x..Dh.bP..2.icm.I.@..S...G.KY=./.'.O./`..4......+.<...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....g.....^..`..:......y.n8...O..s...o.~._..ncYb

Chrome Cache Entry: 239

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1004x552, components 3
Category:	dropped
Size (bytes):	35910
Entropy (8bit):	7.856508623408437
Encrypted:	false
SSDEEP:	768:cGwePFXoFo3FZ3xSDgIJ48A1vi++aK4ARUechJ9NS:cPtiFZ3xSUIJaDK3+8
MD5:	28D96D2DBCA11E4CE2FED6C668308D59
SHA1:	656EE9F12F7B20AA67B0A17A9C2496F46557673D
SHA-256:	0A4F8EC1B5248DF549607ECD542BE5582162FDD83F49386B3D1CB6F660E195A6
SHA-512:	15F0267C8000620B867FB8C6AFCC04C4CD03987B9CD81EEF351FE9FF6B83EAB380EFBC6FE8C179A37074178D7302E9ABE067D887CF45E508836B1B2793E76098
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc......(...."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......oZ....nt....1..R.J...{..5.(.TQp.&....A52......@'.1G.q@.".zT...Q.sS.jh...j.e..m...>..\...@zb.;I\|..o.e$'.!.....t.ub.....d.....d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H....(...!.........Vi....@..E..F....um..Z.}.?......&.Y..I.+.+Z..#.+..p#.J...P....C.......EH...d.......t.ub....H

Chrome Cache Entry: 240

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	162820
Entropy (8bit):	7.945181676815322
Encrypted:	false
SSDEEP:	3072:sL6BnzyhOZKA+Bd7BB4rv6xaIFvgdh9TtBCVLpZTP0Az+8vx0YQ:tJoOZv+BdH4rix6TOVLphP/z+IK
MD5:	05FAB304132A328230B01FE3AE40024B
SHA1:	85ECCE021A028D2BAFCEAD8DEFF98232775F23E8
SHA-256:	A06C2FAE590047B280770F4AF95B59FA19099003A2DBA3596AEA738CAFD14046
SHA-512:	A0ACC33C12F56F5BDD1A1245AA19B632517C1BC6F3A7430517B73413B95FBC7C09AC82AC20AE72767886DBB0CA6277D1B9827B01EFFABA4189524CA772AA27A4
Malicious:	false
Reputation:	low
Preview:	GIF89a...............T...d].....##"..........o.........I......V................Q...s..../F...(....J.0....uk....q........Y.G(......0..u..iN....`...S.W.s.n.j.....pnknK..1'.-R... L/.eP.l.h....K.q.....y.m....NW.(..NKJ.Q.J.v.fQ..'.....T....o.qfW..okO.gJE3....2#.3..K?,.....n.?.oTG.....L.u......rM..D..LiD/..G....y............e.#...r.....OIg....l.I...9e.X..Wfe..O..u-....r.P....qj,O8........I8.SF.k'../'..g(..~jLr.4$.R.u...q\|..O..U".vf.....1..M...f..O.....-..2<...L..........7m'...MvL...l..x.....4...B..".8.;Qj...... S.89v_.LuOLw.Dz-..$...%w%....'.........0.-.....&....~.m............................w.................f..w....................................w.........`........33........................................"...d..................!..NETSCAPE2.0.....!.......,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...-.(]...P.J.J...X.j....`..K...h.]...p.-.....X....._.G...Z.e.Q[L-.5t..;n0......c..93..

Chrome Cache Entry: 241

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	139280
Entropy (8bit):	7.943840822885064
Encrypted:	false
SSDEEP:	3072:MOzm2+OOnGX9I55k8F/6ZqtgHbl1Bmpcw9Me/eU4:N3+1nG45JF/htABi9P/e1
MD5:	20CE2316DE3C309C60BDFEA5C75B26A8
SHA1:	1E00512EAF0B42B3B20650E8B331AD86D98475B8
SHA-256:	F2579E5BE716739CAFB7DF1C3D33F34463E2216C2FA267A0C7B48BAC5BCA226A
SHA-512:	5D4A2E5B6B8A673B2B741798E04B443975A94D77F13DF546FB9C0EFEBA5FE8572435E883B8303BA520DFD7471C01892D51484DFFB62F6A518CB3E6175C99F6A8
Malicious:	false
Reputation:	low
URL:	https://amjs.hccoeutg.com/i/2828/qqww-1300-240.gif
Preview:	GIF89a.....?......U......................M....S..c........P...........H..T...p[....a...`.\.....q.....[....@.......#EPD.U......V........./....\ncew..\....\[..c......j..........,......f....0.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:36E5E37EC38111EFAC33B1D89A333FB3" xmpMM:InstanceID="xmp.iid:36E5E37DC38111EFAC33B1D89A333FB3" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a079f286-73fe-2242-b74c-cb35473c8695" stRef:documentID="adobe:docid

Chrome Cache Entry: 242

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	401269
Entropy (8bit):	7.9881588058858375
Encrypted:	false
SSDEEP:	12288:jQKFbwpdWbFI7yEyb4ZYG30+Zyi75ijSONB:CQ8fYG3b75USAB
MD5:	666051E9C993D40DDDCABDEB9E0BE587
SHA1:	14AC38E595867BD99E931ED4CA16910A072241A3
SHA-256:	07F2531F0F93BD06C32CBEAACC7E1A6B68B162D1E9353A520769C35948DA5B53
SHA-512:	C23B4BC24FF0B20C03081D8566D93B6687834E44FA6B56FDE962054CF31E8F31BCF02366B519339A19F90A19C8C8E9C4FB6364BB3992FB39EDFF9AE4C23656FE
Malicious:	false
Reputation:	low
URL:	https://go.imgmimi.xyz/318d22cf923239b38dec8c9337224fb4.gif
Preview:	GIF89a......._..........Y...d... .....`Z....q.......]..gYT.........Q.mW.....q.................K......F.........f.Z....r.RF* c..bE2....m.....C.....k]i....&...........)(......w..3....D...E%U.Q.....m)......p.+(..'s.a.U....x.'o..r.R\|.P...H.o...I...=%.+.<.......)=g.E..$......+..=/J.Y,..@@9. ............}.#.:.."./7......-P....:......@.........\|.................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 23.3 (Macintosh)" xmpMM:InstanceID="xmp.iid:6B28EA26CF9911EE8A049E38CC2EA754" xmpMM:DocumentID="xmp.did:6B28EA27CF9911EE8A049E

Chrome Cache Entry: 243

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	165643
Entropy (8bit):	7.965256412522482
Encrypted:	false
SSDEEP:	3072:N5bTVwk0YMsnMIWAKPh5ltqzjo2mobKJIc10cwx6SfW75N6Q9J:bpwkzMog7hu8SOFFw5s5jJ
MD5:	C11B60A06F2B931E050764F1B1AC196C
SHA1:	60B029A1725CC1E79EC58208423CCCB9C58CBAD5
SHA-256:	A66246629527D69692DB494722278DC1FB0A977D14E9E9D840B7D6DB4113B068
SHA-512:	882F7AAC55945D44C9269B74538EA5420E2EC63793D4A3B2AF0A20266D2760B721A6FDDF0FD0DCBDBDB5722ECDE437C8F49151FB2586E47840ABC1616116AC36
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/705c2afa5b91/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..n\|..(...9...x.*d`.#..J............w..g.....7>.......6...}zVn..d+..Q^.C.%....P:t..I .4...S.....y...).F(..........s.....5H..L.0jJ.K......&..O&.:t....8.P..:n8...v.C.?.N...H.-H:~5...../z;Q..J.E..Q.Gn....<...N...MI...~."t..V..m+.i.."..:......F\.u.....g.'.;. .^g...n..;..z...")[x;.'a..q........../>..^,s.&.U#.............;...H>.D...1.......E..z.<.........e..+.../8...q.

Chrome Cache Entry: 244

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	downloaded
Size (bytes):	11062
Entropy (8bit):	7.906216245912831
Encrypted:	false
SSDEEP:	192:eY/1hwgJf7hJCvs4Tj4mtLyhOkUv/2rc2MScr7s3OxflM62f8L7N7geowvOrS:eYt54Amtw0/foajxy6Fh5tkS
MD5:	F3F780BCF4400BCCF4DFE7F8FCE073A8
SHA1:	7D2D9B165213506DAC994044DB8AECB4FF15FBD9
SHA-256:	8820971587DBB2D41493DD9F3859FEF2F48D9B71CB9F7EA04AA89165324E43A9
SHA-512:	9300E3FE67D8FA2B21A59C12398E74DCA46F1EE9BAD29357DA01C1AF57196A8254B76E31A8B3E59FDD38A7681F276EC3AC118136E2CD6A58978A99B97A0AACDC
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/2f1cae3a3b29/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...-..^...na.....#...eS.R..8..cN.OJp.......4...(..I.AC.RR.........y....T.j.......N.M2.Q...G4...Z..`y.."...3)...I..A'...cG.P.+...N.8.S.T....T.4.1@...G"g.?p..q......xj........._...S.....k[uf..$&...i.....M.3.Y.B3\.....5.j.r@5...R.........D......S(..!..@.(......3E..f.4......Z.$8<.?.UaS..)..w...\..I....H......].Z.43.QB~....i..u.b.J.8t.R.Q@.....`=.8...w..q......{.N....}.}i......K.L..>...I.K.)..8.h.=

Chrome Cache Entry: 245

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	377690
Entropy (8bit):	7.970499794821201
Encrypted:	false
SSDEEP:	6144:vg//TCYu/rxKXTy3YDRNmMzXR3zS0D8riNA2sr0T+aV8wPvc7Dfw:vo2xKXTqYDRNmMzX5zS48riNA2sr0FVT
MD5:	EC6C4E668466AA08452DCB91B53D5B07
SHA1:	8EEC3B915D5CDC96240AECE10CCF8A482A16ECD1
SHA-256:	14351176AD6CD2E5ACD12886668BB0909BBAADAC163FA63010E6AAD65E6E6D45
SHA-512:	7241EBB7C6E37CD25194CFF875C19FE9A941072932ACB900113A99CDD202B855C54DB3BE617351202C5CE02114A384A624588410897328B0A19FF1F95D8B2A82
Malicious:	false
Reputation:	low
URL:	https://ig23.vip/img/1kkky_1300x240.gif
Preview:	GIF89a.......j.....M3........v.......23....u....P.H.....qnw..$.......dVT.....mP.\...r.".....p....b........m.S#.hV..f..(.PI..n`R.......M,..1).......J-%...n"...2...ttnE6..M.K..E....q.)$..OD.ro.M..L...q.k..2-...OF.p&..L...q)n1).q..=.J)1..Pp.!S......s.....K...J...0\..Nw....lR.nmC..z).R...iO.kPF..J".n...2J......N4a.(.M...OE...........q.........Rkn.....I......1C.$.$G&o..B...o....0..a.-...J....JM....2.Or..r.<.......St....\|....m..K..A.1..lp....3.;..3..C.."......".......3....w3.............f3.."......y.....3................D.."...........U.......f....."..w.3.f3...".w4........9."........".......C........U."........3..f..............................w"....3..8.."......................."...:..>..9....".3...1.9.3........<......$....e_V!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a1cd12f41, 2024/11/08-16:09:20 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 246

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	535999
Entropy (8bit):	7.953741557017833
Encrypted:	false
SSDEEP:	12288:10LnQpUXbEPMh/aKiRUxAYY669nGhU/Zuep1S6N4aj:knQSXbSMAVCYxhLpE6N4aj
MD5:	75B50F3EE72767D085E865D0845D01AE
SHA1:	8639A9BAA0C635EAD47420D1EA504446BE811D9C
SHA-256:	4C092E1BDC0EDBD9363A66E95CF5938AF85B0B2725EF34B42B70D70A6EFC4FEF
SHA-512:	61BCEBD58778D63BF50807B61727C4D4F60F8E63913D8BD7176564C15CB31346E1D7A8D6C3A3A0D7AB96BF719FC82A8B8786FF675C761370308E24F1A8B705AE
Malicious:	false
Reputation:	low
URL:	https://2024hwus1.heibanwa.mobi/jsgif/yf1300-200.js
Preview:	GIF89a........b..pZ.....&......f.d..n...kYUT.I.....y.....S,..S.Z)..T.......E.K..6..f....cF.m........................hp.....K..^hP...j...............ML........e.....`.....%\....!".Nn....Q.%I.p..............p.....L_..5+.wK..J/.j.V,U..+li..............^pM..(.MK....}..qq....L..$N_.....p........i!....N.....,...,.......TI..rI*"..e.....v..........n..nN..........s,n1.....}m..a.)..3Y.......J-.........)/...&.5.28..M.1........{........"qMw.,r.My.w.n.L...:..w.5.+./.&1..............(.....4F..2............w..f.B......w.............b..w............w..<.............f..............Q2..8...w.E..4.3U.Kp.2f.........-......<..}.."...v..K.......".........s...f.....w......SI..w..c...s.f..Q..v&....DD.%.F0.1..f..w..f..-...K.....f..w....w........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.1b65a79b4, 2022/06/13-22:01:01 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 247

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	1023445
Entropy (8bit):	7.829228927608337
Encrypted:	false
SSDEEP:	12288:3YaJvdGz7mUJ8F2jn7qC7Z28uLkaR0VtPnLhB0eyFA6WmU+cJOZS2+OjYYi7Sdmd:bJVmpfkk60lB0ez6WmyJlN00J
MD5:	90F2DEA660596779E49E9281AF1D0053
SHA1:	EC2D7ADAAFB2EBA5DFC2026C16903656F2AB070F
SHA-256:	F498E1AC28B8CB52ABE5C577851EC8DF3F8D6B3E396D56192BA91429D102E1D8
SHA-512:	6A34AE358B142AA4A668326F238A13B0FC204BE8A3B36D737D460A4BC50E09A20F466745A8B6C3BC2EF081358B6750A1A1D4FC3C452A3BF9CC543988BAC1B62C
Malicious:	false
Reputation:	low
URL:	https://555ww666yy.com/dd611258bd2c4f1a9cd4bcf648f7ef2e.gif
Preview:	GIF89a............p..!.......`.Ti.h......%....[.j..o....'.......Ob.....%......(.QP.F.......i..S1$R&.m.n'..+.$p.R&..I.++SS......R......n....).K..m.K..PO..p......S..N'.#._...pm.G..lJ.....p,...oN..o."..s...plLWo.ML(..o."..)..mM..G...I.....s'mN%..H...n)..FU......q......pj-...pK..)."..M,.tj.....(../PNKm,..Q..H..KD.......+,nps.....5mD..,)..r....OGiTK.U.n....m...L,.JG..).ENt....n......I.tn,).nKr.....,..T?i).G..uc.1..'Ro..AqMOlp..../.-...F.#.....-.'.,((r...G./....p.p,*...%..I--2M.....f.-....8...1.......>q....Mtok..RG......p.?Og.:.M.0.Rh.=!...."..e....F.?..0...3...".@}...U$..E..1.<b...q...................6.....D..D.....U..X..A..X....3..3.U..D..3..D.Z.3......?."..".....Y.D......."......".....^..............\..............@.....................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a1cd12f41, 2024/11/08-16:09:20 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 248

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	148349
Entropy (8bit):	7.953297021263535
Encrypted:	false
SSDEEP:	3072:2mUc6CUlI4pLNcBm13c03/zxvvVHYTznt4tUFNgLo:21vCUlZpQwM0vN3VHYnt4tUQLo
MD5:	6543C524CE4220D5AF9217F0ADB44911
SHA1:	82CDDE904F7B1FC2BA4DAD2B08414D643F74B17D
SHA-256:	430040A34FB9EFC9A4684E2A49AB6645F0D5382C5FFB3C917DC87B7CE57A55B5
SHA-512:	3094768BECBAEBC466E87AA17432C7775B196CFDDA28BF1663CF4A10C8835ED2352D9EEE9A956E5AA2B54324B6E6C913856D6D4C37737B9DF80147372EC324CA
Malicious:	false
Reputation:	low
Preview:	GIF89a................]%.p[a...IJ...oc\..y...xt....YfWRY...05K{rk..).. .y.......xV\/f....G:D...YYd.Tlv....LwuvHCI.fkow..........{s...UEI.........hs.nz.......sjc...kcb....p.huxSLS....tm......0Ab...JHR.....z...c[\tlj(&4...q.ukiIR..........\|.....bCK.}tF2:ghvt..{kb83<......Ydk..\|....tj...3+6.kc}.....zmi]]..reb.....b...&.S_$!+rLW.ll..z.....cac.ur......`b...zmj..sltljk...qe...cal.....t..}.bj.}z...........fp....{~{a`y....ubSS........lk....ynkdj...e]...dPL....cklZUm.......KRY....ldmRSs......cd.........bYT....rr...4$+^TY..5...alolic.qe......nRZ./p...rdk...9P......x.........7W..x.....[PN........\|cj...T_^......mpp....t{...................,.9.....rXP...]n...sy.........;A........N@@..eig0EB..q.....oMP........yMOP....~m..................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 116.164766, 2021/02/19-23:10:07 "> <rdf:RDF xmlns:rdf="h

Chrome Cache Entry: 249

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 960 x 160
Category:	downloaded
Size (bytes):	108319
Entropy (8bit):	7.952635803991099
Encrypted:	false
SSDEEP:	3072:gLOoTxDeVtLV83aFWI7Asgfkf/8o9DTexzrs:FoFD2jmUW2gfzo9DGrs
MD5:	5451627C16677A31DBC37A3649833282
SHA1:	2CA37AC041EAD5ABBC5DE1023AB60D214758E94B
SHA-256:	711A7F567257B50DA4F95F730A171D595696026A23AD012D1BE65AFD5C2F63D4
SHA-512:	AACB93A7F7FC210CE08460FF4C3CB1E0137571A0B7BF3E430CE9B014DCF04FAE3DAC6C8A489DB873916C63EDDBDB88F797D9C0FF144FAC787474BCD862461292
Malicious:	false
Reputation:	low
URL:	https://www.xtpag.top:2087/images/672e3dcf290341902fe11411.gif
Preview:	GIF89a.........q....m...s'.5.........%.....N1.LP.1(..lN.....pLL1..11.PK.B...........w.C.E..G.......W..w.m..X...$.un..F..V..p..F.....5.......W..x..F.........g...w..g..E..'..w..V.#..6.f...0..6..U..4.lG..$....n+.)...h.....6.O/.....g..#........!........Y.-(..w....W..z&....'.M.W..N/.......E.....c.-..RK..7.F..kI...p..f.3...G..S..%.R....c...%.U.......Rjp...y.)).Q2...".1..&..3....:...o..1......o.....J.r.N....y...s.$..=.1&.[r........f.d..n7..S6.%...C....ed.C..7.-?.m.5...'.<<.;...p..........1.z......[..U.[\|\<.........8.O.............@Ix<+.{.....Z...B..!.....w...:....F............)..X.....{...........1.....B.....J..9........1..).....9..!..!..B..)..:..1...........Z!.Z..9.....)..9........=..P.......)..1..@..J..1..B........).)0..6..1...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rdf:RDF xmlns:rdf

Chrome Cache Entry: 250

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	97404
Entropy (8bit):	7.940384475814902
Encrypted:	false
SSDEEP:	1536:ks0UXNqTX6rGVqi3P99CULNbKKZZqC4cI6vekA6vekA6vekA6vekA6vU:ks0G/6V/P/CchKSAC4cy
MD5:	098514684514F7C2031BD8F211C054A0
SHA1:	D16B52732F1F4BEBCFE246A0AE9B711056A83E1A
SHA-256:	7F28D289045FAAF656891D98AC57ADFE85A8D8DEAACC2446FC445664BB8C8EF3
SHA-512:	930DEE29FDDA729935D564C17AFC88477D2E48CF382DEC8E0735514DF8F73DCBD9C721B3C53577F523C6DEAB41A0BA6EA885F680FF468B909C99AED252B4D12C
Malicious:	false
Reputation:	low
URL:	https://69vvnstttaaa888.dzlndygh.com/i/2024/08/11/u98s7t.gif
Preview:	GIF89a.....=.POF!! .)).)-.$%-("......)))vug..%..............!......:99BB<....!)541.)))11ggW.'(.....#w.........!).............................................................................x.Q..F".4"....\..t.....5!.o..P..?...../.....J..Q#ZZ[...p..............Z\KF1.l.....o....qF6&.56.xO....cZ31&....p.KK.]^vjYvuX.Z[wf.{vA.QO..0.x...p.EG.gS..3..n..q]ZI.e\.!..:@,......[B..vi.qq..K3..........H..........V%...kN.................!!....mo.)1..................LN.km.;<...................!!....C.[.w-....N.........K.......F:.!!whFhdE.p-.+.UhT'..O.hd....45..N.zs1$..@.U.k...I..R.H.4.C..7..BJ..).....l...F.....Q..u..+;)e(&.ZZ[R......}_.....~..n.K...sj....{r.n(1).B..L....3../...........2i1........b....S.p4....(..h..?.!)............!..NETSCAPE2.0.....!.....=.,............I..H..AN..}.....#J...b...3Z..`c.1 )\|....."K...R%.g..T.I..M.q.\.Y...D....4Q.7..%..)E..5....+..t..W..6.i.5.'X@..U.gL..J...n.Ov.j.(5#..V.`..`+..[.~.....I...YK. ,.p..$..S.

Chrome Cache Entry: 251

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	199338
Entropy (8bit):	7.947264826102204
Encrypted:	false
SSDEEP:	3072:Usw6v2vOLJEW9BQfaKDAQR22YXQQj33Qus6qKOyklnr//HwD1Xa:UWvyOLeG4LhkfA6OllnrHOxa
MD5:	D7D0D7E25D428EBF82BB5962CBB6A0E6
SHA1:	15076311517EE396A43F3D2753458FE3AFD64181
SHA-256:	54FE7E88E15DA86F63FE54D9FA6059EEC5F41804F2CD1343DFF2BE5FE516AEF1
SHA-512:	8E02C7DF9EC2B8A86E7777BEE02467E4E0E28032F13F1AC782F8FDEC1583E9CB85E32EECEBDAC101381536131EA01626A1AD6B484AD0CB0AFAF02AA8FD2FBA7B
Malicious:	false
Reputation:	low
Preview:	GIF89a.......j..mS.........L..neVd....P...iO.....U...e..........uD...F.q.j.i,..ee...............i.3..........n......(........D.......K.w..f...pP%..r...,..@..^...pqiA.".R..j.....m........n.W.....f$...........2.......6.f.U$..S.jK.......q.....u..)..O]...&.oY....K.u.^.q.-...ts.......w4..R.K....[b..k....L.sJ.o.e/......i..L.....7O.....m.0\..,....k......)..(..RD..N...Z.b.K0....J..P..(1y2....K\|.....$............9...>.(2.&..+..M;....$r.Pk..ND..m:9............'-......LB$o.9.../...+<.../...z1. >.3...5>.....h`.:".f3.w...D..3.eD.......".w..".....D..U...U.........3......D..................D.....U.D....U......U.....U...........3.b3.............<.......................".............Z.....................".z....=!.X.D.U.............+.f......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 252

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	705232
Entropy (8bit):	7.954172923869107
Encrypted:	false
SSDEEP:	12288:m4/qP/z+ER5UZR/ozGdWRlj2B7djNfVHK7CV4WhINY6S+0o6Jbr4jT5hu5BsyA:meqXz/gX/ozGwr29fVRTuq6S+0o6Nr4L
MD5:	6FD5F9C4DB301936F752DB820FC7B644
SHA1:	560CF8D86E6D2AF6B5682413F6DC79A52A5F8AB3
SHA-256:	098B5F1A13CEE71A108EB9B723085B1BDAB884F33A7F5B5CD5083E63108AE048
SHA-512:	7F130DD6BEDD855C3CD03472056176593003E49A486F2640C26B32510A555DF579381F6D83E27AE023603BB7A494A711E8F76563B131034A2B6BB47069B9D073
Malicious:	false
Reputation:	low
Preview:	GIF89a.......D............r.2.........iX.....s...XD.........SF.wc.m$....!....)..GH.........X({.............[....! ...].@.cUn....jd\.(..00....m...1.K...i"R....).........!..i`Q....V.....2....l.,,.!c.s.......4x.G...U.h.../......54O........m........%..U,.......Ce..G..........s..?{xe.dP;.....l...R.........B....lj.g....s..x......U4..............i.../......9..m....KS..T.....D...D...$...G..d.II....j..l.......r.........%$.x$C61...cK.!k..o....). 9.....Y.....!.1.!Z..>...F.....t..5..nD..h..on..X.....C?.P...2..z....b!s....l)(..]....$*..;........J..E" .Y...2..t.30..4..ST....:i....Ve......<y....O%....BT.Q........?^.w......\[........-k...........l........................................................................pR..........n.....Cv.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 253

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x656, components 3
Category:	dropped
Size (bytes):	47108
Entropy (8bit):	7.976765885523338
Encrypted:	false
SSDEEP:	768:j82qsHChImtLi/1W1P1JeHqIVSLcSvcNgRof55f6d4vAfqD+wVl/2du60Tgzt3HF:j8EHOLi/1W1P1FIVSoCcNgROCd4WmVVw
MD5:	E428B04619C0E637D3BA8CE4551DDA9A
SHA1:	D8FDA8B3245CDA6FF56F84A6EDE36BD588C7ED5A
SHA-256:	55FB6509F254786DD9E5C21AD1640C24BA745A88C98E2113E092701E21801DEA
SHA-512:	2AA1D798F5070625E1C7C0389FB7FA85B541AF43820CCC4D22A3B5921EFA6ACEE44FBBD0989ABF92A395B4EA6CC12522E15794028356E8FAC3274BC9E5F0CC54
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3.............................................................................!1A..aQ.q".2...B.R..#b3.r...$c.SC...4.%s......................1..!A2."Q.#..........."...................?..IQ........#......q.G..'N....GE........._.OtA.rV9>.....c.....r...#..%..(I."S....'E..nIR.'9V...r..6.m0.Q.$"R.r...-H*C.......%...H.....SJI..I.L..lv....lK..#.."...=K...."..S.";..}...Tz...."...>X..v.U.2.GlFL..A.X.PDv........D.TO.......Thb.5b.....2.E.w..,4....E...4...p....J4.I^.b.)......(.."8n>...R....,`.LpaC..\|]mH)/.#3JM.HsV....k....)pO...7....OvX.8........y.......f...;.\......uqq...k...?y.....e.Z8z........\|..O...(\|...>M.{...3...O.....n..s;...3....>.....q.^..{M..j{\|ueAc..'d.D.......s..A.="..Z.j'...5;x.`.q.....!)=...BIKr.UZ....i..'C[6Uf....9.T..sQ...R..N...G.....H....H....A.....(I.N....Oc......o.U.c.Cc.'IY...U1.1v.n0Q.....1v..2l..B.....?q..s-0.Q....{w.`.^.y.

Chrome Cache Entry: 254

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	1430876
Entropy (8bit):	7.918247771257563
Encrypted:	false
SSDEEP:	24576:AcI2xLw/eohHGdmHhcu6/gbiqgK72Ij9ywQc4GPYioIbtMc+QibTE:D1tieoNGdmBygHYGdQA
MD5:	001BE4610542E70DEE449A80E563E9EC
SHA1:	A23D88A1B3FC9CC595F6985BB2927CC46FA2A1A7
SHA-256:	7039F165EBADA1D92ADEA9F247239C021CA11A94264EAE14DEF1B5497B8C6A4E
SHA-512:	CDC5A1DFC8BDCB2D6E7556EFE888F75444A3C6B9B5D1718DC29D2F96DFF3206FDDFAA967C984CE1A0C226340631BD4EDFCE01D5365340602BE9353A44CC53263
Malicious:	false
Reputation:	low
Preview:	GIF89a........R....d..I..QXa..+^.......j....)m+s..o....c.g..b.......Ym...n2..........U......r.O..K...N.n..&..Hn.......$..L.'...p.K..M.3.2I_...2..(.U\$..&...i...m...'eC1Q..OM..%...P..j...j.....Q....E<...U...........hM....n;.ED.%J.i./(....OMH......(...Q/].p.U.........t.../....Lv....k.I.......vf.G..../...u=..ml....nq.3t......Mk.q...l....#.QGmJ..._.P..u..GS.........#...mL..l.q....3..J..J....sm.m..nm$*...)u.....Eqo....p../P..CB.nm.q...o.........n....N.m.......jPN..6$..Gw.#4.M..... .?....K..s.K..n..,.'.......T..A../....q...o.....L..r...q...26...P...N....6f...................w..U..D....f.......U..w..D...........D.......=........U................w................e.............w...................`........."..............e........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 255

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	148349
Entropy (8bit):	7.953297021263535
Encrypted:	false
SSDEEP:	3072:2mUc6CUlI4pLNcBm13c03/zxvvVHYTznt4tUFNgLo:21vCUlZpQwM0vN3VHYnt4tUQLo
MD5:	6543C524CE4220D5AF9217F0ADB44911
SHA1:	82CDDE904F7B1FC2BA4DAD2B08414D643F74B17D
SHA-256:	430040A34FB9EFC9A4684E2A49AB6645F0D5382C5FFB3C917DC87B7CE57A55B5
SHA-512:	3094768BECBAEBC466E87AA17432C7775B196CFDDA28BF1663CF4A10C8835ED2352D9EEE9A956E5AA2B54324B6E6C913856D6D4C37737B9DF80147372EC324CA
Malicious:	false
Reputation:	low
URL:	https://static.wixstatic.com/media/dd9a87_34be67cd0dc34bedbba06a4a787cba19~mv2.gif
Preview:	GIF89a................]%.p[a...IJ...oc\..y...xt....YfWRY...05K{rk..).. .y.......xV\/f....G:D...YYd.Tlv....LwuvHCI.fkow..........{s...UEI.........hs.nz.......sjc...kcb....p.huxSLS....tm......0Ab...JHR.....z...c[\tlj(&4...q.ukiIR..........\|.....bCK.}tF2:ghvt..{kb83<......Ydk..\|....tj...3+6.kc}.....zmi]]..reb.....b...&.S_$!+rLW.ll..z.....cac.ur......`b...zmj..sltljk...qe...cal.....t..}.bj.}z...........fp....{~{a`y....ubSS........lk....ynkdj...e]...dPL....cklZUm.......KRY....ldmRSs......cd.........bYT....rr...4$+^TY..5...alolic.qe......nRZ./p...rdk...9P......x.........7W..x.....[PN........\|cj...T_^......mpp....t{...................,.9.....rXP...]n...sy.........;A........N@@..eig0EB..q.....oMP........yMOP....~m..................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 116.164766, 2021/02/19-23:10:07 "> <rdf:RDF xmlns:rdf="h

Chrome Cache Entry: 256

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	1430876
Entropy (8bit):	7.918247771257563
Encrypted:	false
SSDEEP:	24576:AcI2xLw/eohHGdmHhcu6/gbiqgK72Ij9ywQc4GPYioIbtMc+QibTE:D1tieoNGdmBygHYGdQA
MD5:	001BE4610542E70DEE449A80E563E9EC
SHA1:	A23D88A1B3FC9CC595F6985BB2927CC46FA2A1A7
SHA-256:	7039F165EBADA1D92ADEA9F247239C021CA11A94264EAE14DEF1B5497B8C6A4E
SHA-512:	CDC5A1DFC8BDCB2D6E7556EFE888F75444A3C6B9B5D1718DC29D2F96DFF3206FDDFAA967C984CE1A0C226340631BD4EDFCE01D5365340602BE9353A44CC53263
Malicious:	false
Reputation:	low
URL:	https://tycjb777.hccoeutg.com/i/LD/SH131.gif
Preview:	GIF89a........R....d..I..QXa..+^.......j....)m+s..o....c.g..b.......Ym...n2..........U......r.O..K...N.n..&..Hn.......$..L.'...p.K..M.3.2I_...2..(.U\$..&...i...m...'eC1Q..OM..%...P..j...j.....Q....E<...U...........hM....n;.ED.%J.i./(....OMH......(...Q/].p.U.........t.../....Lv....k.I.......vf.G..../...u=..ml....nq.3t......Mk.q...l....#.QGmJ..._.P..u..GS.........#...mL..l.q....3..J..J....sm.m..nm$*...)u.....Eqo....p../P..CB.nm.q...o.........n....N.m.......jPN..6$..Gw.#4.M..... .?....K..s.K..n..,.'.......T..A../....q...o.....L..r...q...26...P...N....6f...................w..U..D....f.......U..w..D...........D.......=........U................w................e.............w...................`........."..............e........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 257

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	70941
Entropy (8bit):	7.963503432148807
Encrypted:	false
SSDEEP:	1536:Go60UzrvebsfSZys4wyniiUd2SVKUjhkLtSJnFBrlGGulWTvG:q0jsKZF4w4iRV1kpSJnfrlS8vG
MD5:	FE2EDF96B7F0DDC1CEE0F540E9908D56
SHA1:	A05B9BC25A96C027D21E33D716ABAD75D2CA468D
SHA-256:	A03321F58DACC7D5D63318B376B276BBD6F4D404295C8697DDBAD5233BF8C175
SHA-512:	F44594950F8669264C3EFE5F7A01E409F741C091F7D26DF2A520D0EE621C829A6AD856F12CDBF7B08A53C85E9C1E08FCB4B8771C61A2F5DD2D8FF73B3CDFDAC8
Malicious:	false
Reputation:	low
Preview:	......Lavc58.20.104....C........................................... ! ....!!###*((112<<H..........................................................................1!..A.Q."..a2q.....B#r3bR...4..Cs.$..5.S.D%t.6.....................A1..!.qQB"a.......8...."...................?....... ." .#EB.4+3@5c..2..CDT!..3..3i..EP.\.XUbC..G..K.U`.\.f.Q0.0.a.s.........\:.7r.......Yy.+.....WY..#4....C@D4.4@]Io..V.J..V.VZaPhh.....X.."0....W..^..#?.J..O..U..o...v....ynnI..%...a..Y...\|b#.a.g?..;B.9..d........h.b1..Yf..;OMs.v.:.@c.?!.S ..LfE.G....k";.i...%.@(.~.5.(.b.gA.k..k.Au+.[.1.X...[....]$o...WB..g.]#.......m....L.N....\C.V.d.k.8.e...D"!..20H.r..4,2.!. ...P.. ...;9...ha.l+.y5.?.C.s..a.].....^M5......K..f^.G......Z..a..:.5;.F....""...._$.8.X....g....?..a.sO..K.i}S...x....W..DrV....]...-...:..>.....bU.!V.\...........v\.......[..<o...H....(..H....db..."..h....h`Fh! ....$2......!.....8...~Q^..P,...u..yh.yE.."i....-E.,.TH.PB.E.aR.F..E......P.@.(....g..g...Bh...Q5.j...+.q:p

Chrome Cache Entry: 258

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	downloaded
Size (bytes):	11030
Entropy (8bit):	7.908119771931338
Encrypted:	false
SSDEEP:	192:eFQkxH7Yth7bPlayqScLL1dqpU3IXN3CyxHPcxf+HSO+QT5wnqhKJFZB+aMBEkL7:eOkxg7r87LLLua3IXNjH62+QTO+aMSk/
MD5:	7D47DCE123437FD5DFF1B0A6BD6A39D5
SHA1:	BB82B579BA72D3B628F4842314143AB1F7C0D3E6
SHA-256:	4519FDA04D6A4D4CBA56DB64424843F664AAFDE43B0A51B378A09C0F87BE2CA0
SHA-512:	A007DBB02501BA5CBE43DD87B9E3845DE2A7F79B7DF3BF733BDA0EF75165B84F34C2E1E21D48145CFAB96C8158825F1A0A0B6EBF22A7D7D0138CF651996D9F09
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/dff801d16405/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...!..C\.:..;....2.J...j..r:S..cH.J.E4.`F.9.;.54.qTd\|g.,...<S.....j.6M..U.cLH..:.P.. ....d.U.....6/@.w..I.VZ?L.....f..EG?L...r.Z..F.1.o!...Z....[d....q.be...Y...#....W7z.e...#..T'<...CM....$...Wo...4.8.YI......1...8...4.i.b.P..JCE...@Z.:..@.0...8..@..s.Jy.....q.)....)..=Nz..i..=i..8.[..7.iE7......4.pi...7.....;.......3qHcL..5.$...=)).n....y.j.:.OCV`..+~..C4..w..V...z.....*.:r;.R.vR9..

Chrome Cache Entry: 259

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	7051
Entropy (8bit):	4.965791913704773
Encrypted:	false
SSDEEP:	96:x6S06gJngGhRYLA7K1K8KZEsuj8FSe35owPpOQvG:x6miOLA7K1paSerp1u
MD5:	F414798173921459EBBDB393E74BFDA8
SHA1:	4190BA04AC8F79ED29809FD6E4E3471165530458
SHA-256:	94492A387654C1520D4C5A43D0EE7E1858452885E270286CC6FAFD81A043895A
SHA-512:	53D1913EE8815B46607709FA2CC658BC7A314E9B45DE94CEFAA3AEEFB6FA810DB342C6925DC30A84525261D1960FA5586BB848D79B7B51E05EED1A043FDAE774
Malicious:	false
Reputation:	low
Preview:	var appAbkDiv = document.getElementById('tbad');.function loadContent() {. // .................... var items = [. {. link: "https://vuy81.top",. image: "https://cc777img.dqsldz.com/i/2024/10/28/10ss8i9.gif",. name: "同城约炮". },. {. link: "https://euk11.top",. image: "https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy150.js",. name: "春药商城". },. {. link: "https://t24120103-5e08b5a8a5bb9302.elb.ap-east-1.amazonaws.com:8888",. image: "https://ig82.vip/img/FF98t_180x180.gif",. name: "太阳城". },. {. link: "https://787928.com:7888",. image: "https://amjs.hccoeutg.com/i/2828/qqww-200-1.gif",. name: "太阳城". },. {. link: "https://www.5967ggxtz0

Chrome Cache Entry: 260

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x286, components 3
Category:	downloaded
Size (bytes):	24960
Entropy (8bit):	7.95907988389541
Encrypted:	false
SSDEEP:	768:Tf/KBCMKIB7SbL/LsF8TyfWM0fNyHTmfe:TnyTG/Lszl0NyHTmfe
MD5:	3C515F64BE914583A5162577B6A4998B
SHA1:	273C3CD8158320321567B8E4D26B9379E4ABE1E9
SHA-256:	3F68E08A463252633B6DE42286ABD344BBF7EF80E650727A486B72450F16E0C1
SHA-512:	C2B1E3BE73E0FD9EF76A91FD342763B6D34D5878FBEC40ACB65BA7DD67C087D5ABE4D476B523DCA08A58432018447D9F900D224015E2F157B94A947ADF37FF00
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/4f4f2ebcdda9/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..W3..H4...8C..z._..6..f..!.1 s....2I.s.R....!<.?.....L...m.......HO.O6Q.l?.P........!.W......iY..Y........V.x..G.}}..vm...>.....[....f......}.......9..%..8...B.`.._..z7.h.d..~t.......A.LC...\|.f.5.....Q..?...7.h._....f(.0.e.....<.;H...i.P../..e. ..F..D.$.x#.<s.k{.[.....]Vu.........;....o$j..Xg...x.U.1H.t{.....1........t....bG.@gB.:.H.rT......8gl.q1..2T...Tv^ R.....fS.....A.8..#.6...

Chrome Cache Entry: 261

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	876
Entropy (8bit):	6.236860253810827
Encrypted:	false
SSDEEP:	24:pKSWhS6ik18XT2v57xb0Z61ehvitJNA4LtVVb:4hR8SvPbHeRynjhb
MD5:	0CDE9733D84A0491899139595EFEF673
SHA1:	3AD90EB2B8FF2ECD3CA0C0CFDF8D54E2358D6E07
SHA-256:	6E9C2A46ABEC8C35958A4FF0580853641E0F04BF7F34FA6A8A2C56B82EB6A558
SHA-512:	3B54BA66EE5AAD61EB10079CB10A548F88EE0D7DABBF2317D7E36D806BE2FB05256BB9BCF81984A1AD5086639B175D3ED6F74E7DAD9394D61792BE2A4051638E
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/footer.html?v=9999999
Preview:	.....<div id="btmBox">..</div>.. <div id="couplet">.....</div>..<div class="footer">...<div class="wrap">...........................................................18........................</div>...<div class="wrap">........................,..18................</div>..</div>..<div class="wrap">...<div class="guide">....<a href="home.html" title="...."><i class="icon-home"></i></a><a href="javascript:void(0)" id="btnGotop".....onclick="goTop();" style="display: none;" title="...."><i class="icon-top"></i></a>...</div>..</div>. <script src="https://xmad.7wzx9.com/pangda/base.js?v=9999999"></script>

Chrome Cache Entry: 262

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	33903
Entropy (8bit):	7.896216206637854
Encrypted:	false
SSDEEP:	768:wrzctrvkMEgqLa2O/w1oGDtl3z5JJDRyVcDya8atQ49FR:MzZ/aPaz5Jl66ya8up
MD5:	A741E4596F36EB2F02C58B018379519B
SHA1:	7F46A3C676C83D777A807B0DE8677BE2A0FFC36C
SHA-256:	040DEA9B423995623A17C700C90000653CE3FAC584A54EE6B5DA1A5C20F0E785
SHA-512:	0997E48E6A9ACDC99C8F5CFD22422ADF79CECC6149FB0A1AC9C2C73913F08991705125256F2249AF972D0D7F6531C5E368AB233AE2CDF2ABE86356D60D90DB02
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3.........................................................................!..A1.Qa.2."q..B..bR#..r3..$C...SD.4.Tsc.....................1.!.A.2Q..........."...................?.. .<.H...1....0..... .......... .......@..H.....................ENtl.OLt.l..Vl.i....d..R)..&.......?..X..(.sP.F.n..0E...DL.....d.`4...@f....3Y.h}....+....-._....g.Y#..RG..i.;-..X...Ts...G:..W.{.4G..h...EI a....`.....Yj...h.R....L.-..gcC;.pg.c..f....7.%...K.....km...U.K~......:...(..T..*h......K.'...e.._. .....u..t."JMR9.RE.H..$X.@.B(..h.j..#D..h.."Hv(....s...#K\.k...Af`.$.,".5H.k..2H..mh.@.%.A.X.;Z9.j1^u......H.BgM..&.f....3...X.=zX.<.v;.c-=..t.:.t.q.I`P.()...d.".e$.....P.L..B...K.P.P1....C.`..?&..@....`P....C..................... @..!..C......P....E..V.}Q..xl..QQ&...K....A].!.#..r.z299U..#c6.I@.qgs.Kg&Ml.....#D.".Rf9 .G&R9"..4#%. ....../......w'.x.U...W{...8u...N....

Chrome Cache Entry: 263

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	18288
Entropy (8bit):	7.8358878448650096
Encrypted:	false
SSDEEP:	384:c+6dea1Jw/oUffcsE7QJL1xVc/1KawXfiKP3oCwfBPFT:c+o1Jw/oCcOJZI/UaufHoptR
MD5:	E4A33E4103216A49A0AD6404BCA09454
SHA1:	87A2C634058971BA94B645A5F92BD557E0849414
SHA-256:	D7F84E01868DB211645EF4C36CE9CEF2B8C54EBDF0E697FF93CFA72BFAC5912E
SHA-512:	198F264DD87EE2DF4D3BC17582D8AA99A67FC68D99C6EAF70C5DC45F706F24DCEEC3D27BE7A86044062F274E5F17F5587CAAE5DDDB81614E53C0EC2DE92D83B2
Malicious:	false
Reputation:	low
URL:	https://go.imgmimi.xyz/00165139bb76d845bfa39bde42b929c5.gif
Preview:	GIF89a.......q...u..'.....lS....R..G................s..2.....Q&..n.$..uNnN0....r2.5....U..L........Jj+...k......5!.........L....O*..T..............X..U+.....G..3-'.g1rfN.....g..UF1JHC..\|&k.F........t.L.G7'...................o0!..1..........rH.xW....M..eG+...E..V.b..s............va....G..k8 .......j..$......X=.s...6....S.-.......i....0U..k.u0.j:./!H..Jb.t..eXC......zA..........m..{d.\A.e..uj.sKvq`......>....tB.l...Cw.0"z...s.......u.................kR......eD..g..!x.......YDm4y\|a6.]......._..........z.......9..........;................sIo.J........yc...!8............7........aV....%=.!.....^..].................O$..]_S.........................^D!.........$~................8}.C........Q.q.................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 264

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	134
Entropy (8bit):	4.834464958019401
Encrypted:	false
SSDEEP:	3:YRM9WREaD5dQW9DBL2ysrQaJ9WHXxQAfB4xCxKRTiAMSe4n:YsWiA5iSDBLX4QaJ8H6qKReVS1
MD5:	48F4073A36D0CE643589CAE1E7A6C495
SHA1:	D0733B48A0DDDA85FEE92B1B6CAAE372D9F1B626
SHA-256:	179AF4DB3AA73CC3AF7E40DD5DAA5ED60B95F4920CFB7BD51A2C1F4DAB24276E
SHA-512:	817E223E99447EB9F085953FBFD448C137B653B22977D87A9858D7E06BEEF30E62209E524D3CA010757B4F5332D849AC074261334AEE85D7E4363E4E40EE05A3
Malicious:	false
Reputation:	low
Preview:	{"timestamp":1735794810436,"status":405,"error":"Method Not Allowed","message":"Request method 'GET' not supported","path":"/forward"}

Chrome Cache Entry: 265

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	99246
Entropy (8bit):	7.973631388793161
Encrypted:	false
SSDEEP:	1536:RvLATzg9PiPjxX9zoaSKNu5YaLmAGnDX291ce+ik9w3938NYnSaIwv9lKXYrRqk:xL2g9KPjqKNtaSfD0ce+i3MoSa1trok
MD5:	9DAE3217A71D00FD94CC5E602E19C6B7
SHA1:	90C9183BB7AF3D588FF0B825147AA51170C90B62
SHA-256:	3BB45617A5D738996D3897A149E2A60983BA0CD68C5D57281F7AF3CC8C979BF5
SHA-512:	1087B9A0BC06E341202F2DFD4C3D1362E7C2D91D319425C196A45B5F2DE7848AE40F981990E81C2AEB85AB940A8462F3A9B0986F5BD2065D4225E37AAAFE4A14
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:B61609F7C71811EC8425A0F15301A1CB" xmpMM:InstanceID="xmp.iid:B61609F6C71811EC8425A0F15301A1CB" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:86354A3518C7EC11A48BA047D5A13547" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 266

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	308156
Entropy (8bit):	7.887805052867105
Encrypted:	false
SSDEEP:	6144:8HaW3rXcnJONqy2KEzdJSHZTCK15BfSHZTCK15BfSHZTCK15BfSHZTCK15BfSHZA:8HaOXcnJSvEzvATCK1fATCK1fATCK1fQ
MD5:	D77C62F390139B596590158386CA0BCE
SHA1:	C1A8CAF2A13DB4961A043D68B2AA2A822622A27A
SHA-256:	F38EBBA6BA727472CEFBB7D2C9F9363D97046FB9FE9FAEE063956159A26FDD11
SHA-512:	41C0A3D3CDA7BF1D6C7CA90835DB539C14A019ED58B85A7AA9CA175E6CD3CBEAD3336D7476FD3AAC5838A2764E8B4FEC6E3ED27951FEBDBC0242B5C5EF61BE8C
Malicious:	false
Reputation:	low
Preview:	GIF89a.......S............n..V...........hfTTSF....N..........w.L...._.a....Z..p......U..)..pvved.q...\g.!T\nL.g.....-.M..o.-.......m...m...pK..L..FD8....m..p.n,.gP........DE..,.....-.o..!c..J..n....$..n.S..pM..J.v...mN(..N....i.)..)".....2R..(....,.Aw./...L!...H)..3&....K.....ul..P.........kSI,...J10..q,..M.tl....n..rl..3.)....L,sh-.r..oQ.O..3.....N".I..PIMmM.PI.M..........p....Q.CzTD..)&.m.p+Bpy.'....Z"]..-0...........wf.ERs.Sj../t...P..&...,l........t.(..Ix.OasRy..0;g=...(..$...1.).../5..""...............""".........534.34......73 ....we.UU.CC.ff.wx...5""..........UU.DD."3.............wx.ff...........!...UB......3!..............~........"=.3?.36""5.U?........."3".CV....................s....3........w[.@X4.>.fx.f\|....}....:...w...!..NETSCAPE2.0.....!.......,...............H.......Y......#J.H..E^..(..1.G..l.....-t.d....U.-c.tEs&MW._.L).53..!.Jt..H..Z*4.4i..DAH.....0.."._-^.......@7.dHt.d.E.rg.8Y...&N....NJx(+`..&...j...#S%S../..#x....X.

Chrome Cache Entry: 267

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	47056
Entropy (8bit):	7.897111698306034
Encrypted:	false
SSDEEP:	768:lGOlDWtp1az5I348MNZqyeh8/jvPxP55isy5KmMVnW3+7F:gptpc5IIrk+TPH5iX5KmMVW3+J
MD5:	5FC8B1134812286D054891442B854C0C
SHA1:	090AB881A5D8723FD1C1BCADECC8F01333081DC9
SHA-256:	F7915CB8ECE7812EEC2111DA99BE64A2E996C7B1A0D596F114296C28F2E3ADBF
SHA-512:	B21028F6403B739A6694B7BDD0CDBA0B9AE65180E2EA02C42ED75F53BD26AC87EFF96508B55B15D7DA1527C7D554E956658D012319958FD732896C78376EB93D
Malicious:	false
Reputation:	low
Preview:	GIF89a.........'...lm,...BBC.........usi..u..olOb'$.r8..N.E)HL..%&....7.1$+.....33$...2F.UV"EE6..%EE#TTT..(...VV5.k..63USG^d....2.t..1&..2vL-..uGT!(2%.#.^ZQ../$23KJH....Y.9BBIR6..#!...R!TH$.cZxw....!bcPJRFSJ6......<4...cag)))111 ! .!).))99:.)):9/))!.!,.!119)!!:0/.) ).09>09,..0.."................................................2$............JRX.&(..s..@4('.))...A.)-.k]..........C..i9191)3.1&...................j..5.m4..),.G..n.UK.%$..S........5..o..9.)2........r.eU..O.NL...u.)!ru.z...)Q...]W...........%2.55.]].......................st.......yy............hh\f...................!!.)!...............s%'6;9LGGU..d.....T..f..V..X..O..2..FRPg)!).0..G.;4.....L..n.H..{..{..s....1..dRJY..T.I8..g..X..D..\|..2..a.'..h.t8.........b..p.Q..v..f..m......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 268

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (860)
Category:	dropped
Size (bytes):	24639
Entropy (8bit):	5.6173736700426335
Encrypted:	false
SSDEEP:	768:8qsM/NQu9wVClxk+yx8p0zGSX52UYYDt8H6gY4S6NzZ4RcDW:8qR/V9wVCfK8p0rX52UYiC9Nz+RcDW
MD5:	60CEF19F7C3826A7A63CFA0959EC8097
SHA1:	63586279BCEBA6AA6DEFBE943B4279D1A4922FD2
SHA-256:	6D97EE0CBBADE60B12E757F8B16C20F635119220998297370A50C6CCD017DBB5
SHA-512:	565463EF89E9FB0F9841DD3D0707EF09CB15A8F079B779525EC936B4E87C5126CB45AD0B7079A2BD1EAC00A5486F214804BD6FEC60E1A0346926B0A0C13B3B8F
Malicious:	false
Reputation:	low
Preview:	.// var onlineHref ="https://t.me/CC91AV";.var wzfby = "https://www.pdsp.tv".var worldBgImage = "./css/images/bgg.png";.var body = document.body;.var ua = navigator.userAgent.toLowerCase();.var domain = window.location.host; //...var xl1 ="";.var xl2 ="";.var xl3 ="";.var appName = "...."; //APP...var title = "........................QQ...................................................";.var appUrl = ""; //APP......var appUrl1 = "";.var updateUrl = "https://github.com/wyz7777/pangda/blob/main/README.md"; //........var emailUrl = "yy8y.email"; //"<em>g</em><span>s</span><em>et</em><span>ok</span><em>u</em><span>wb</span><em>r</em><span>qr</span><em>l</em><span>kt</span><em>@gm<span>zi</span>ai<span>mk</span>l.c<span>yq</span>om</em>";.//.......var countUrl = "";//"https://v1.cnzz.com/z_s

Chrome Cache Entry: 269

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 420x300, components 3
Category:	downloaded
Size (bytes):	22983
Entropy (8bit):	7.960646361196603
Encrypted:	false
SSDEEP:	384:YmFk6tie7ghz/dS8RPcz54RqEfBlA/6z4ZuzjKEo68dHyBjjQ:Yb+UhZtPjMilA0jKE4WfQ
MD5:	1007BD76295B1E9D93C1AFD37A5E5420
SHA1:	C5376FAC5816F8B5407FAFB963487DCC6E38DE61
SHA-256:	C877F8120B652D77FCE1E4457CE6EF4FDE6C911F13522BAF6222E934F7074259
SHA-512:	E30DAED7B068C72AA79E1CAB251C31BDD67D231D673AFC346C901C6605C3871F85DDF4B04CFA82C197A3A8854B7131D107B89B0E39E0B80D34AC69B684D649B2
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2y5vq.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."........................................K.......................!..1AQ.a.q....".2....#.$BR...3bf....4.%&6Vcer...................................0......................!1..AQa.q."...2....BR..............?..D......+ .+ w{..Tl...Q...y.....7.D1u.HR..Y,..QWB..QE0.(...(...(...(...(...(...(...(...(...(...(...(...(....+4R.1.1.f.)...+5.N(.r....=.v18.).....Z.....\|...."...:a...\x.x.)dew.m....u.n....v.9.t..:..,.1...,..9...2.L.sT............n1&.....$f.6f.)....%..ru..K....\.D/.r'0L..#...........n.X..;.86vrdT...w6.k.'W~...e;6R.f.vK...#..S"(....d..X..e.v_.._l...h..%..b.$.2.$......dY.5...s.5./.......G.8....i0.1...s.4Tv/k...e.&_.?..l._.d...~u.._.Z\`.z{..J.:..`:oK.j..Y...3l+4QWHAE.S...(...)X......QE.`wh.\..qe'.U...../,^.q..I..J-.O......Va..>...O.l.;jx.;.=...*-..{.UXM...Z..=<SR%..&QX.3Y.3.(...(...(...(...(...(

Chrome Cache Entry: 270

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	100244
Entropy (8bit):	7.975619711233213
Encrypted:	false
SSDEEP:	1536:DTFZBZ3uLsnXd17scojd/gXpqKl0Y++kRdBomvQV8rlwiNu2uZvUlROq:DBZ/3wsnt17Nohg5qKRv0zvQV8ryZv+
MD5:	9A7E82000864DDA0C222647F24AE7B01
SHA1:	98E9DF60C3DC5EEFFBAE5919033A219F08282B4C
SHA-256:	D8206492FF31A5482EC70BFB870620737A3A6F8613242D01930DAD7F43D34311
SHA-512:	29C7854EBBCFE10A66AFB767DD3A115968D0B243DE77E8715AB92D76D36034FC238CD2C7F82A3FA45ABBC649D8087ABA3B51DB66199FD40934D898941A826444
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:A68C9E41C1A411EC85A4FF256524C7BB" xmpMM:InstanceID="xmp.iid:A68C9E40C1A411EC85A4FF256524C7BB" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:055C837EA4C1EC11A7B7DAA66860BE5F" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 271

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 280 x 280
Category:	downloaded
Size (bytes):	86874
Entropy (8bit):	7.972092381041628
Encrypted:	false
SSDEEP:	1536:mHv6LRAfu59JBqwvwLQCuKQ1tMc5ec2sP2nZ/pTc76ZQo9ku/XB:mHCXREwYLNkjkc2sORTc76ZQoCoB
MD5:	4ADFF30DE339670B3F4D0BD2C2FEDB5B
SHA1:	78F96011FD35905C0467D35514DEB745BF454AA6
SHA-256:	49200B72E6C40D81B5535674D8045081B85B6BF2DB6C28BD233D8F6F4838C0A6
SHA-512:	DA22042EEF2169A6C1740E3483ED2F2F85814A19150013779F4F63DA7C1C157E3CB15C431EBA38C3F75C6DC9E74C5CF0CCCFD193E38FD7B8EF8CA1F6FE549485
Malicious:	false
Reputation:	low
URL:	https://cc777img.dqsldz.com/i/2024/10/28/10ss8i9.gif
Preview:	GIF89a....................H89.0:.:C...../...t.. H8...)Ax(8.Xs....N..q.(..7.S.(.<q.....(...........X.......,.-9(:.3..h.y.X...T..h......E..h.x........h.x.P..x.SLZ...\|n...J...((8......8J......d.5.Zo............i..._............L....).....I}.8...........S..H.....X..X..V..h..h..x..x........((........(88...................t..j..H....X..S..h..x..x........w...........................(.(8(.............GH@../..+..+...<<...d...((....88(..........................W..30(..........b.......}/.......(..8(.H8(..................dYP...U4.u....yg...X8'.sV..p.........;...hT_H=N(.h8'......(...h(.z9(.WL.xi....PGx=:.m.....(..S...((x((...h((8..X((h88H(((..X88...8((..........................rkk............888(((.........!..NETSCAPE2.0.....!...S...,........@...-X.00.......P@....6.H..C..3F.q.:...m[.M.5m..Y[I2]:f0.....&3....,.n.......o.&G:..!..........>..~:Zg.U.O.....^(\|...+..-(zo..KWW=]x...o.d..'CF8Z2w..G[.qcl.!.....E..+j...a.

Chrome Cache Entry: 272

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 856x480, components 3
Category:	dropped
Size (bytes):	19962
Entropy (8bit):	7.818674535428787
Encrypted:	false
SSDEEP:	384:0VHwzUkN1BHSGesO0rTmFG0JJOHSSCU7auccFymXlXZuSlgfWfW2e:0t291rlOQ/CJvSCUswr7dgefW2e
MD5:	EA956280E5DBB3E6961EB2E02B28B53F
SHA1:	F3F7A4E5CB211F9A32F9F3C52D78C8B87C162CB3
SHA-256:	35DD5977AD6943E4F9ED3F2D249C051A5EEE13BF9CE0CB5DAC66F9279F939CA5
SHA-512:	E1E0D02C5EF1442C3881BD7006F29AB572F8ED6B633279F51B685FB52D4DCA521C9C33F350BB4A27F44DE6B29942E277CCB1F975C020C72FB4A35CE4599E0496
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3.............................................................................!.A1Q.aq..."....2R.s..Bt..354rb..S.#....$CD%.c..T.....................1!..AQqa2...B......R........X.."...................?..................}......z0>2}......z03Z.hi.a..a...a.C.....j0d..(.d..0..h..`..(.0!.$..F+.P#f. ...P1.;..0.....B.46.P..4..(.4.....a=,LE..j...{..F.:KM.......tR.9.k...ui......H.....3.i&..TB.E....0..P..5.q.rDF......z}.+-.......e......4..f/.].:......./..(a...S..O...i....P......xO\.#....#.../.....H.+...i................................f.?......f.?..........h...h.c!..A....FC....C.)..8......! . ...b2FF...i...f!Z.1. C......A..a`..(...V0....!.0......=Qx.MQx.A...:Ea..E&...qne.k.qn+`5...........&D. D...a2....Yp....>...W:.4.0..9......x....)y.Z.{o............h.a......i......X....=...q........R...................................oS....H......oS....H....j=...l.1C!.C.0.A..i..

Chrome Cache Entry: 273

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	dropped
Size (bytes):	876
Entropy (8bit):	6.236860253810827
Encrypted:	false
SSDEEP:	24:pKSWhS6ik18XT2v57xb0Z61ehvitJNA4LtVVb:4hR8SvPbHeRynjhb
MD5:	0CDE9733D84A0491899139595EFEF673
SHA1:	3AD90EB2B8FF2ECD3CA0C0CFDF8D54E2358D6E07
SHA-256:	6E9C2A46ABEC8C35958A4FF0580853641E0F04BF7F34FA6A8A2C56B82EB6A558
SHA-512:	3B54BA66EE5AAD61EB10079CB10A548F88EE0D7DABBF2317D7E36D806BE2FB05256BB9BCF81984A1AD5086639B175D3ED6F74E7DAD9394D61792BE2A4051638E
Malicious:	false
Reputation:	low
Preview:	.....<div id="btmBox">..</div>.. <div id="couplet">.....</div>..<div class="footer">...<div class="wrap">...........................................................18........................</div>...<div class="wrap">........................,..18................</div>..</div>..<div class="wrap">...<div class="guide">....<a href="home.html" title="...."><i class="icon-home"></i></a><a href="javascript:void(0)" id="btnGotop".....onclick="goTop();" style="display: none;" title="...."><i class="icon-top"></i></a>...</div>..</div>. <script src="https://xmad.7wzx9.com/pangda/base.js?v=9999999"></script>

Chrome Cache Entry: 274

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	116713
Entropy (8bit):	7.914751103544461
Encrypted:	false
SSDEEP:	1536:4Lk/oE+CwAHB+BYqw8nsJaXeq801EmvZR/wdZhbHcm+xL2uKibs4VXHnIua3lPo:VrmYX6XeqFESwvhjsI1ibsQ3LaS
MD5:	3478DEB38DBF1539FB79F3E7818E5232
SHA1:	8D4BA46E8DC3C93D4014355FFB842EB389A0C033
SHA-256:	55E1BEA8F050F06A3A7DDA4095656B937520D4FE8ACF5CE22125F7FCAFE83109
SHA-512:	5546FA29215AAC3AE58D88CD5F30EB9A9D7ECB4F257DCB8D35C8E07B47D6EB96C7E19D8230833A60BBE1749C0A63A29E2FE60B5CFE0C232FB2ECBC6A62CD0ED9
Malicious:	false
Reputation:	low
Preview:	GIF89a...........h.....ifS..&..-.P{{b....+)...ED7WWG.........l431....ye.l.fWts[..h......73..K...b..F6.MG....../...h0.....0.I.u-.sM....qOmQ...3 ...31).-.TI$$#.....t....g..y..........I..e...W&((!(((........W.{e.....@:/.A8uE....dZL..\..........kV..j.0..ocbN..Y.....?..u.....N-...Y.c...u...J.\U....)4.hh.&,....&"..E....d.q]e8....olW..V.E6..U...h&.0&..y........w.J..IC.%...EKK>.Q..z..b.Z..z`....wm.k`RJ6.....i.,...ZI....G.........eU......((......"..$.QF.#)...tsyvt.'".....PG.....s.......iien%.....E.....U.SWQ<QOD....{dD.e.....i..:<..[.\|f.....v...-,&ZJ...d.60... $.y..........$(.y..U..._.aRQ.......E......n.a..q.. &...z,.._..-.ZO.Y.qok..]\L.p].{A...m.../+...YC+$..E>.Q...F.g...@.1..Y..4..n.B.KA0..$...... ....#(. $.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 275

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	97507
Entropy (8bit):	7.9562248491775005
Encrypted:	false
SSDEEP:	1536:OmDkPznz9Kul53lrbBkFc5S7QqI4h4p/EVZjo+mKHNLGSClrxOgjDt9FrS90E5KV:FG/4SIe5Scvgi/R+m/P3PpE0PZLKi
MD5:	CB942B5BB483ADC3AA21ED7673D95549
SHA1:	36A3B065B3FE6B9DFC5B391BC89E4C5499ECE37D
SHA-256:	1F65F0A48AF5FF91E8A1BFA8E45CD5CBEFD14044B3ABC06B495EBBB7F1B8A6C5
SHA-512:	AB63757316DF66B17C6B372B89F610889C4271331F4164EC7841B98EF4FDCCB654FE066CBF343D9CC3357301E3E39EEF639D97FBA51D56D5BBDF0CA220879D13
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/981ed809e1e1/1.jpg
Preview:	......Exif..II.................Ducky.......P......Adobe.d................................................................................................................................................... ............................................................................................!1..A.Qaq"2........B#3..Rbr.4...Cs$5..ScD...T%..t&..E6v7d..u.F8......................!1...AQ.a"q.2........#3.B...Rr$4b......CSs%............?.......... .@............<k..h{.I._r;Y..G\.P....z..D.bU..KA.......b.$.E.{.nf`.......(C[......j.\|"@............... ....p........ .@.....'8...1..w...P.(Z...j....<.9..:U...'....F....so+.....]...N.c..5+....4Ej.......v.m,..D......1z....EJ.....5.z...ja#../Zle..6.S.i)l.......U"wo...V.mkqR._.."\.1[...]...ki....[.(..U..=.#gj.[.7t_m5.m.t...Q..P..LtH.{"..M...o..WLn.Rm^f-.u...%.A..N./..O.e..f.4.Wb.].....d.)!I!IP.T1.."0................~....>.h....t...>.L................S.z.1b.sW.g..-.......c%[x..H......C.@............L..T3.....D.d!.........7.

Chrome Cache Entry: 276

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	47944
Entropy (8bit):	7.969618468151182
Encrypted:	false
SSDEEP:	768:mEIZpat8dwYevpaf1gdBBlwlxfeSvRCUEZ8qNoGdrsm0XQ3+7wG7nT3kj/tZBjNx:mlUm3evp+8NqRC9BNoGNsmWE+t7nTqtT
MD5:	C2CEDC4301693F7775D92091A77D677D
SHA1:	0670FE90D6E7C10AB49293A5898DE6596E665646
SHA-256:	DE3DA919EDCCA01867019DDF413C9FC0AE04DE7DE8F59C6086C1DACFFF52ED7D
SHA-512:	3AB4962F897C271AE0866D1688D846939A17EA0BC6A0A995707DBB522345D52E9CBEDF5FB938CEB9B1CF1C7438759D134B0C830FF8C8FE4E6984CE4D287B7D95
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................=.......................!1.A.Qaq..".......2.#B...R.$3%C.bSc.................................0......................!1..AQa.."q..2...#...3..............?.....cm..qq..v.&.]Y.0.'.>.`M.L.Z......G.o...3.1...%.@g.;......0...U...@..Q..z.Qs.......z..ppv....E.n......qb..../;.V.p....r,gm.].v..<.q.%'...{.u..VCr.8...=...&.gy...)._..WgSnX.nd.<.>...K.2.....%..s...m.7..._.r.l......[...$l.$.....[&q...O./^......./..};..j.F...[v....YZ..x.*.p.e{.C...].V...6.7..H...3..qv.m..+..\.U(..S.-m..../VN}O....'...Q...3....k.....m.pI....Y_.<>F..6%."&^.g.g..I...j.0.Tx."#..z&.W.o.Y...........J=.C..s...k.v.iX..T#l....u......PO>^.W\...#.vH......]..w.4...\.=....hz..Q3......`......l.....!;....Ey6.oEGE..>.[....R9......Y.i..f&\`"w..._...:.(.a.<..j....n.zCJ.K..6.2..Z..

Chrome Cache Entry: 277

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	downloaded
Size (bytes):	43506
Entropy (8bit):	7.967925889126763
Encrypted:	false
SSDEEP:	768:gqhWDDf/8iKzWgfVNhw5a1tp1rrIG3Zds+m4xDmW/22n5KTdX5q9j:X87/sfxhF00Ldm4sDO
MD5:	3FF55157C1B1A350497A885F413EF833
SHA1:	0D17A683B96CF17D82D3D40722DBF61F5B71296F
SHA-256:	83930F31CD824636DAB7C142307EF6EBEF311FF5737BC94FE008544E5CE1A0A4
SHA-512:	9780A793D2E30D9FD5E277B3D8C831F3FF1BC87EE22F7F3D48D83825EE010D77932CAE2662667682C9E55AC3A1359B516F134144CAB678351E8897E19188E468
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/15/b0422eef5536/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>............................................................................!..A1..aQq2".....R.B.rb#...3.C.DT$.4Ss....%.....................1..!AQ..2a".q.B............"...................?..VP.....[....;..$......RD".d.B...@...@1.@,C+..A....I..@H.C.r.D...@H..D(c.r..R0 $ .0d.1.D.."HA.....)...9 U.+.A.. .@H......2.XV.. .0$..=.\|M.j..v..O..].R..~..P..:F+f+}'...J....a.......2....V0-.X.....+... .D1H .Q....2A.D.aF2..a.....S.+~.J7..}.+..WW.....d};.w.u......-{.fJ..+...y,..\l.....s.Y.aN.%.k.Dl..V/..3......X..........;..>6..2.e..U9.$..q~..{..8..3O....V..kYR.v.....hg.....:.....M...'.%.}=.,.q..~.Za....n...{.^[l..s$...E>K.;$g.c..m..\=\|.x~....K.f.......C...!.A.E......P.^...54.,...#A!.p(...y..../.X..~5....nW*......>i.J.....h.y.#......S..C.g\n.c.....<k.9......f..nm..6...L8..}..3.Z.`..X.O.+Yq^.$.n-w({Z..U.g..c..{/..\.Z3..W..6.M.....:GG-..k.6..\w.%.x~.o.....)V .E.D2.

Chrome Cache Entry: 278

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 50x50, components 3
Category:	downloaded
Size (bytes):	1608
Entropy (8bit):	7.64209546664449
Encrypted:	false
SSDEEP:	24:no0XxDuLHeOWXG4OZ7DAJuLHenX3WnsmBB/F3sZrFD4G94a8tFn/cBCsNadi232Q:ouERAcRBB/F0uG9H8aCsgTn
MD5:	A364F03CFFC7B55181757B0BEE2CB8AE
SHA1:	6D012731D438767CBBE7E6B99168E9923121D1C3
SHA-256:	1344C1B5DC3D09ADB2153076834F7D8A4246A9B63C3B5D6653565F8D76A04098
SHA-512:	1B70CC10C32E22E06CDB6EB4425CC909FB474875FE6D9B264D9B6245B62554DBCB00CEF8D0E061786CDCBE9007BD1163B3ACE63AEAAF7B17E86A8C01538DB343
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/static/images/2.ico
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................2.2.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j....eq.i.jS5..%.ks4c-.E.v...._W.....?.K..1..'.{.A..\...l.. !.If$...C..9...T.S.8.n.....:.s.....W....w.x.]....;..;@.l..5.V...D0F..].M....'.yEk....].g(J..V.(.. (....#.....X\|v.o\|a..w...L..l.Uu....b9...'.K...~.x......hz.4.....hl..s...T"$">9..k.O.c...4..._.}k{...-n...>?..2F..,Yc..`..~lj\|p.G.\|j..4.....xCK.7..X.T..t.,....0...8....,F*K..okv]~....ae..h..9;_....

Chrome Cache Entry: 279

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	downloaded
Size (bytes):	9302
Entropy (8bit):	7.862948561810046
Encrypted:	false
SSDEEP:	192:eCxzFSM2OgUsOaDpsdXz0lWXfUarpC0nxr7qjQ9:eEzFSOgUkDpkj797xyc9
MD5:	15621CDA26A396DC007B9FF7D71F6943
SHA1:	6FDDA25F266636F231D7ADE0AB84B729A9D672B2
SHA-256:	8B0495D4C025C3CB31BD306822920BECC03732AF9F7CA89F4862FC031722461F
SHA-512:	4F0044AE2749F353C96D2E8F4C5C05C27AFC79E98496C0A5F24BD4DC4518D6473655C4151F40363AED8947AE0581E8B05E5B0CCBA3697AEE370BCC1842C6C4ED
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/be0657958f85/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S.J`.....*AQ.x...Zx......).5M8u...r...-..AN..O...:...4.p.......4f............qS.J.CAh...Vc..<..3sAHd......;..#._......P...L...8..JSc.t.Jq..P.R).Q......8t...p.@..p..p4.8S.Z`....N..O..p.O..J..J)...LC.(.L..(.C.Jp..N....p..p.Lx4.Q...h....isE.vh.%&h...)......4....E(..QH.S.F).@..x.)...x.O..N..p...kO...x.L....<t..)...`I...y..)...$...M.)h..&.iH..h..PKS.PH:.4S..U..Ve..Y8...W.l!....1.{T..<.l.(.v&p.5.T.x.@

Chrome Cache Entry: 280

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 404x720, components 3
Category:	downloaded
Size (bytes):	19748
Entropy (8bit):	7.957446465901979
Encrypted:	false
SSDEEP:	384:qK5jYu7Gjuio0WGYzYOS35x7T5yawW6hi1NdMYSEcYa3KrM/kXJ:qKv7GjuI8z5rsMYjfRXJ
MD5:	F09526D9F92FDD4561DD751A76A5DD1D
SHA1:	4727DAB51EC1AE6844991573D17A7A688D629CC8
SHA-256:	27EFB577C2DB6481E9714A5503D09DDB9F155B2D6FE66A8944B320522C01C074
SHA-512:	F98221F193C523CB65BD6E7D46B4F2B225044B8A1F4E2D3E1D2BC47F2FD70128D34A7A430A9B900DDF41E57306A62115D188BC735AACE1245EE94CFE9710E4D8
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202409/28/80c39ec0e790/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3............................................................................!.A1Q.qa"2.......r..Rb3#.B...S.T4C.c$..s.d%.5.......................1.!QAa.q2.."...B............"...................?.<...t...]..<.............p.i7.WO.=WO......\|..\|...F.........".7.WO.....C........T/U...p.zI..\|..\|....7.WO..WO...h..U../U..8@.................]>..]>..A.7.WO..WO.....o....z....a....\|..\|...D.z...z.... .p=WO..WO...h8....^...pXV....t...t....4...)....:.Nf95...m>._.....,.f........;...........v....u>..t8...q=]O....vy..:...g.Qm.".K...3......#.......h.... ...!..B..."....@A....2..@@!.d............. .aX"...@.B.......2.L.6..2.fK@.i.dB.@....GSq).N..6jw..FIS....3...........z..M@..,.B...!..B..."......."....$...p$.1sW...!.....!... .....!.!...A..,.".*H.6..2.fK@.m..@!...F..DU;....u..5;...~]&..W.Q.......z..M.A........".....B..!.....e....a.3.E9bR.R.W......g&.%....k..<..I.i...%.k.#Q2d.3(s...

Chrome Cache Entry: 281

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	43506
Entropy (8bit):	7.967925889126763
Encrypted:	false
SSDEEP:	768:gqhWDDf/8iKzWgfVNhw5a1tp1rrIG3Zds+m4xDmW/22n5KTdX5q9j:X87/sfxhF00Ldm4sDO
MD5:	3FF55157C1B1A350497A885F413EF833
SHA1:	0D17A683B96CF17D82D3D40722DBF61F5B71296F
SHA-256:	83930F31CD824636DAB7C142307EF6EBEF311FF5737BC94FE008544E5CE1A0A4
SHA-512:	9780A793D2E30D9FD5E277B3D8C831F3FF1BC87EE22F7F3D48D83825EE010D77932CAE2662667682C9E55AC3A1359B516F134144CAB678351E8897E19188E468
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>............................................................................!..A1..aQq2".....R.B.rb#...3.C.DT$.4Ss....%.....................1..!AQ..2a".q.B............"...................?..VP.....[....;..$......RD".d.B...@...@1.@,C+..A....I..@H.C.r.D...@H..D(c.r..R0 $ .0d.1.D.."HA.....)...9 U.+.A.. .@H......2.XV.. .0$..=.\|M.j..v..O..].R..~..P..:F+f+}'...J....a.......2....V0-.X.....+... .D1H .Q....2A.D.aF2..a.....S.+~.J7..}.+..WW.....d};.w.u......-{.fJ..+...y,..\l.....s.Y.aN.%.k.Dl..V/..3......X..........;..>6..2.e..U9.$..q~..{..8..3O....V..kYR.v.....hg.....:.....M...'.%.}=.,.q..~.Za....n...{.^[l..s$...E>K.;$g.c..m..\=\|.x~....K.f.......C...!.A.E......P.^...54.,...#A!.p(...y..../.X..~5....nW*......>i.J.....h.y.#......S..C.g\n.c.....<k.9......f..nm..6...L8..}..3.Z.`..X.O.+Yq^.$.n-w({Z..U.g..c..{/..\.Z3..W..6.M.....:GG-..k.6..\w.%.x~.o.....)V .E.D2.

Chrome Cache Entry: 282

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	97507
Entropy (8bit):	7.9562248491775005
Encrypted:	false
SSDEEP:	1536:OmDkPznz9Kul53lrbBkFc5S7QqI4h4p/EVZjo+mKHNLGSClrxOgjDt9FrS90E5KV:FG/4SIe5Scvgi/R+m/P3PpE0PZLKi
MD5:	CB942B5BB483ADC3AA21ED7673D95549
SHA1:	36A3B065B3FE6B9DFC5B391BC89E4C5499ECE37D
SHA-256:	1F65F0A48AF5FF91E8A1BFA8E45CD5CBEFD14044B3ABC06B495EBBB7F1B8A6C5
SHA-512:	AB63757316DF66B17C6B372B89F610889C4271331F4164EC7841B98EF4FDCCB654FE066CBF343D9CC3357301E3E39EEF639D97FBA51D56D5BBDF0CA220879D13
Malicious:	false
Reputation:	low
Preview:	......Exif..II.................Ducky.......P......Adobe.d................................................................................................................................................... ............................................................................................!1..A.Qaq"2........B#3..Rbr.4...Cs$5..ScD...T%..t&..E6v7d..u.F8......................!1...AQ.a"q.2........#3.B...Rr$4b......CSs%............?.......... .@............<k..h{.I._r;Y..G\.P....z..D.bU..KA.......b.$.E.{.nf`.......(C[......j.\|"@............... ....p........ .@.....'8...1..w...P.(Z...j....<.9..:U...'....F....so+.....]...N.c..5+....4Ej.......v.m,..D......1z....EJ.....5.z...ja#../Zle..6.S.i)l.......U"wo...V.mkqR._.."\.1[...]...ki....[.(..U..=.#gj.[.7t_m5.m.t...Q..P..LtH.{"..M...o..WLn.Rm^f-.u...%.A..N./..O.e..f.4.Wb.].....d.)!I!IP.T1.."0................~....>.h....t...>.L................S.z.1b.sW.g..-.......c%[x..H......C.@............L..T3.....D.d!.........7.

Chrome Cache Entry: 283

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	downloaded
Size (bytes):	33903
Entropy (8bit):	7.896216206637854
Encrypted:	false
SSDEEP:	768:wrzctrvkMEgqLa2O/w1oGDtl3z5JJDRyVcDya8atQ49FR:MzZ/aPaz5Jl66ya8up
MD5:	A741E4596F36EB2F02C58B018379519B
SHA1:	7F46A3C676C83D777A807B0DE8677BE2A0FFC36C
SHA-256:	040DEA9B423995623A17C700C90000653CE3FAC584A54EE6B5DA1A5C20F0E785
SHA-512:	0997E48E6A9ACDC99C8F5CFD22422ADF79CECC6149FB0A1AC9C2C73913F08991705125256F2249AF972D0D7F6531C5E368AB233AE2CDF2ABE86356D60D90DB02
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/11/4600ac64a9aa/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3.........................................................................!..A1.Qa.2."q..B..bR#..r3..$C...SD.4.Tsc.....................1.!.A.2Q..........."...................?.. .<.H...1....0..... .......... .......@..H.....................ENtl.OLt.l..Vl.i....d..R)..&.......?..X..(.sP.F.n..0E...DL.....d.`4...@f....3Y.h}....+....-._....g.Y#..RG..i.;-..X...Ts...G:..W.{.4G..h...EI a....`.....Yj...h.R....L.-..gcC;.pg.c..f....7.%...K.....km...U.K~......:...(..T..*h......K.'...e.._. .....u..t."JMR9.RE.H..$X.@.B(..h.j..#D..h.."Hv(....s...#K\.k...Af`.$.,".5H.k..2H..mh.@.%.A.X.;Z9.j1^u......H.BgM..&.f....3...X.=zX.<.v;.c-=..t.:.t.q.I`P.()...d.".e$.....P.L..B...K.P.P1....C.`..?&..@....`P....C..................... @..!..C......P....E..V.}Q..xl..QQ&...K....A].!.#..r.z299U..#c6.I@.qgs.Kg&Ml.....#D.".Rf9 .G&R9"..4#%. ....../......w'.x.U...W{...8u...N....

Chrome Cache Entry: 284

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	30163
Entropy (8bit):	7.79768556645262
Encrypted:	false
SSDEEP:	768:HuQCIOL488TvKHUC0lJc68gsvi9U5oSJdSdSwEgB5QcO:Hu/LL8TYUCWc6hsaK5jSUwEgB5QcO
MD5:	11FCF3EE78AA739195D80BA8558A7C45
SHA1:	C3EBFD76B58A8EF646261E13A32EF3C6FC603407
SHA-256:	B8313050BDC4AB79B7E4376505BC62D20A8381D07BD06273864C37AA8270D013
SHA-512:	8DF753821B6358729D4E873DA8B43E5C920C6F12CDD0B83B2E2DBC821656799592216F4E60B8BE6E2D29DCAED10183F3698F6072CF03CD4FDCA1A236F6058592
Malicious:	false
Reputation:	low
Preview:	GIF89a...........u!..-.....g..l.dV....J.&.H(.....$....&2.....s#..........e.....j..j...(...oI.....N...T."..0.Y.........C.m.XE..G.rU..g.....#.l(......"......$.v$....S..$d.e.R........G..E.6.W..u...x..V.o...j2...%..#..6.3..O...6.......U/.........',...e..5.../,......$...-..&.....:..5.!..eiQ.N.s..!....u...&....H7...&...V..x.%.xc..4&..F..L..3..X.I6.3.....T....8.. .......oQ+.L(...u.E..g..h...f...D.......2...........t.....w......&.x..n..&.....E...I..........{...Z@........~c+.y.......u...e...Z.%.9..........1..i....W......k!0NA.v..M...y.{....S.w.VJ(...g...H.2(.......m.6........!.7@.. ...../.y&...c...6M3...F.....F..........bE...z.....c..kFc9.A.......1..9.....9....................=..,../..1..9.....[..F.........{.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rdf:RDF xmlns:rdf

Chrome Cache Entry: 285

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	82843
Entropy (8bit):	7.982683451672264
Encrypted:	false
SSDEEP:	1536:pQwRzVimQlqOiSBpfouwbbOD4YlrhgjJwr75T6+e3d2ZND1wYF+r9NIpIt:aCsmQR/Pfo3bW4cr8w96Z2vFKDIw
MD5:	D17CB03071C348380CB50E43EC39F3BA
SHA1:	C0B30C165F556A406FAF312923265A2BAB8FCF27
SHA-256:	CB3C4281FDA6EF00305A0AC6D22DCF5B83F6EDA6311C01732CBDBF1134DCD5A4
SHA-512:	1964A11CC9B6D2E10DC092B8FC222521E83DDFDFDACDAAFEBA0FEE2A55BA2CBFC6248353A9E964438F378C7E0A2637CE09EC674D51CE370D45B7B33EF4D56CD7
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/98521a9331a5/1.jpg
Preview:	......Exif..II*.................Ducky.......F.....rhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6339279CD936EA11A6B1DA65E7665F87" xmpMM:DocumentID="xmp.did:AF597BB3CA6B11ECA270C4AF4F249508" xmpMM:InstanceID="xmp.iid:AF597BB2CA6B11ECA270C4AF4F249508" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:95CBFE051967EC11A877D848C2DDACFC" stRef:documentID="xmp.did:6339279CD936EA11A6B1DA65E7665F87"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..........................................................

Chrome Cache Entry: 286

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	281740
Entropy (8bit):	7.915575628680301
Encrypted:	false
SSDEEP:	6144:7cXqPU5e4+wiX3XQhlwOTXhPcVi3gAUCqkAS3sztW8j56dLMESl0haHOmK:7i+/XQh6kRP+iQhwAp6MExhqVK
MD5:	4373EE25A3F603B9AB0F9AFCEDA4D127
SHA1:	813DFFD03BCACA2C6A0D266D33B8A9AA24C08FEB
SHA-256:	3ABAA58B23E2DADC7AD8E7CCF3A06421393C14A06CA7C18F5250EC96F7C0B3FF
SHA-512:	C8208E7158220FBA82730F266B783EF0B8331AE127FAF325A8320B137F15260D502E97D4105C0217196BBE73ECBEFDA495792116046356B2CE6DCC8CF03FE346
Malicious:	false
Reputation:	low
URL:	https://www12.pengxunfei.site/jiamigif/tyxsc/xmspggTT2-1300X240.gif
Preview:	GIF89a............. ..m.."......%...hg..N.f...nH&#t.......Q......P...).....).....k......vin.pIE...+.-.....M.......a]....n.......J...Z.L.....q....r(..r_.E.l..2.p.Gp..L.b..E#.v..pmp...N.sn.O..+..LD.+.PI.oM.jM.KB.n....M...p.k.m/.FE.JJEG.rq.)..F..,).....m..H.kO...)..-,K%..t .'.'..S.,....g.qjp.J+......KI..K..m..R...=2G.mN..R.M)KPi....k#s..t..[...........Clz..DtjF..Fd ...-........<..8pT[..U....Or..&.Oq.....r..m.TZ..$..C..o.)<t...TZ..sf..w.....................................w..................f..V........_.................B........D.....Cw................................]..w...........................w^.......\..U.....................w......................e.......c.......w..@.........`..................9..z....._....3...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 287

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	241927
Entropy (8bit):	7.901814415501523
Encrypted:	false
SSDEEP:	3072:1abd2+dm42M5LFOdYd2+dm42Mq3A5/CUY4e1CUY4e1CUY4e1CUYIOo3KTEaJEaJk:1ckolkh3A5/CUY4+CUY4+CUY4+CUYO3X
MD5:	38B66CFC72A1849329BE0B47A589463E
SHA1:	A3845BEFF0284E0B88A504CC032D236C13D819DD
SHA-256:	78E27EDBA1B0A402080C6D10AEC24BEB91F3EE83F5AF0A15C62C671E752C2332
SHA-512:	8C498CC7EED14EB864EEB84A90FD4D54EDF5CADB897A6A0F960B4741A645C7A9D4A4B2430C485FA0A5B3F2711D681E459DEF996CDF10A202C93CC0774CBA09E5
Malicious:	false
Reputation:	low
URL:	https://w0082.com:33236/625a3d79f55d45618f08fe8d311c10b3.gif
Preview:	GIF89a..........3.T.sJ..og.%.uR7.f.....p..z%{R.c9....T....PB.....)..t.......v...C.V......K...^.B.D.G8...8w8..L"wJFyJIu.6xEj.r.v....&W3....F.......hA........R....X.C.f.4..1....5yU..."fC....1A..m......&g6............zb..2i5..g..O../xdvq....E.h......Y5...c7.S$.."..q..z.........Q......sJ.........q-.t.v.........f....H$...........;OK.0+..wR.._l.W.(......"W.e.4..&3...E...V.wE.X........yS.h.U'E.s.......w...t...K.{.....;M.H........._.._1jG$iZ.H7.....W.V..k..+.....kR&t6..g...*.l.x8......V.W.G$.........i.G..iQ%f'V.I...5d&......r.. XFbx$..B.q.9...=..b....d&...?:..{j.d/.. Qj.H.H.....9s/...^....S@]4..\...\.n...`].Q.T.......7kQ.......6# G..s8.\.(s)>k..kJ.Z9.cB.......R9.R1.cJ.Z;.R1.R9.cB.kA.Z/....kJ.Z1....cK..........k@.........................ZY-.~.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 288

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1318)
Category:	dropped
Size (bytes):	6098
Entropy (8bit):	5.387220747625111
Encrypted:	false
SSDEEP:	96:xE90pGW5vGXOu0at/tL4aaELmFH/N4V0jur:xE90pG4BH2G2LmFHF4V0jur
MD5:	340F7230D7ABE099CCBCF5F640CD51F1
SHA1:	161024822FEDCA9A144D5C2D1CFCDFC165B8B99D
SHA-256:	FE75718A62DDA7A9034F4B1A488A4FFFFCAC07D1BD88B5B5B075D2DF3D0052F6
SHA-512:	F6C9D912C001887DBD87353D7398FD5AC9F0243072738D04D8CA1734738514BE07BF0F83CE315262B7354B63D5EFA42864582A497C7D43E469D161B097FC0A42
Malicious:	false
Reputation:	low
Preview:	<link rel="stylesheet" href="./css/style.css?v=19">.<style>.abk-item{width:100%;display:block;overflow:hidden;position:relative}.abk-item .abk-image{width:100%;height:100%;overflow:hidden}.abk-item .abk-image img{width:100%;height:100%;display:block}.abk-frame{width:100%}.abk-banner{margin:5px 0}.abk-banner .abk-image img{max-height:100px}.app-abk{margin-top:10px;margin-bottom:-10px;display:grid;grid-template-columns:repeat(6,1fr);grid-gap:10px}.app-abk .app-abk-item{width:100%;overflow:hidden}.app-abk .app-abk-item .app-img{width:100%;border-radius:10px;position:relative;overflow:hidden}.app-abk .app-abk-item .app-img::before{content:'';width:100%;height:0;padding-bottom:100%;display:block}.app-abk .app-abk-item .app-img .abk-image{width:100%;height:100%;position:absolute;left:0;top:0}.app-abk .app-abk-item .app-img .abk-image img{width:100%;height:100%;object-fit:cover}.app-abk .app-abk-item p{width:100%;margin:5px 0 0;color:#000000;font-size:12px;text-align:center;overflow:hidden;wh

Chrome Cache Entry: 289

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	126008
Entropy (8bit):	7.973388079937638
Encrypted:	false
SSDEEP:	1536:+4i2ltDBCVvQa3efOErtLsREUm2hNe9U/syJBrvTcygJJrYFMRQkaG9VdAI+GGG4:O2fqvv8OXEI4UhZgWFEN9tGG4
MD5:	D81A3BE6DA7CBF79A3A40D27346777D0
SHA1:	B1C5ABA1BCA6417A6C467F8F1E2A7AC93259711C
SHA-256:	3F94989EF69D460959A7DFE733A790541D6C232D86D0A06FFF7D33256E8877AB
SHA-512:	1254380A1B8D1F1FC780848930324CB541E1843DDF7A1EE3B4AB4CD51AF2084E55EAFD4050C810EE1968C646E90A187FA57BB92A25B127EADDB105CFF2AD392D
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/094f2e05c08b/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..M.h#..Py2}..n..T..U...q..'.&){Q@.(..P..KHH..K@...(.4...1.7b.Fz...3.HzQ.b..v.<Pq.h9...Jw..qJ.3I.......Z)3.(4.1E.P.E.Q`.(...(...(...(....R.P.i)M%..QE..R.P..QE....-...4.E.#...B1..)..).sHCZ.j...O.).....z.jo.~4....1.('?./O..'Z.kc...).);..k.1I.i...#=)......G.@.zt.5IL>..H]~ni...sQ....#..4.3.N=i..4..A.NN).g5...'.Tf..*.LhCL#...4.FGJCNc....f9....i.....g...GPh..\.c8......

Chrome Cache Entry: 290

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	68809
Entropy (8bit):	7.872712876421757
Encrypted:	false
SSDEEP:	1536:AyuMeiefLCpGBM9/1Bty1kaDK2tYDhXrA2Ntddw1FNB+VO++nV:Aygt+GO9/1e13DbtYDpZddwbNBNV
MD5:	220F10F60DCA9B28D6CF33E65DB45C99
SHA1:	0140D8DFAC132DEE7B47B5713B2DE5FE0C1EFF57
SHA-256:	76E3E0556D38D24D3CB07E81177789859D211A81647C65FF20B7887B66DA9F85
SHA-512:	9AE9E72F5CF100F68F2402605C5A90DD213DA17871F1FC456AA8DE762F56B7F0F7701327E7BA0CEDFB8C4C2983FDE6EF6D382A65F9534D0A9C8577EBDBE92660
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/18/1e6931ef5c8d/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H.............................................................................!1.QAq.2a.."..rBR.3.#...b..4...t.$.5..sTC.S....E.D%..c.........................1.!.A.Q......8...."...................?...X.z.....F5..1...D.9.l..K^.G.y<.^........ZT..u.8Q..i..e...Z.B..V5...7@F.M...`0... 8.%K..YBYK0I....ZA ...r.").R.S.(.N.R.....QP...zuF...wa.....e..U,5..E....iU^R.........<.....T..BJ...R...u..au....k k................S...k...`0..k...(.5.........1S..1.....D..f.N.{.........g_n8.a.5.}O.{..k:....b.+\|.X..;d.GFO.ZuS._.7.6T.VRM..'@f....d..9....m.3A..X.w.%...A..u>\y...W...p:.,.J......;;.....+.kF.....O.L...t..rl..@.-.A.....].`.....-,i..'...u.h..k.Vu.nm$..BlV.J.>..,.\.i.0...GK..<f+..s.M...c.j...2FJ..G...\...b..m..0.V...7.d.)......................................k.........(......X.h............LP.k...`.@.4P..1.....=$a...*.......Q5....%...m/;..m.R.............. 0

Chrome Cache Entry: 291

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	120793
Entropy (8bit):	7.971996974058631
Encrypted:	false
SSDEEP:	3072:ZF1Wd5lpmaStZCQPofI7/zhs35+srRHAnt3vhzy8XKMz1yyA7r01:ZFcd5AtZ/PoEVa5+s9HARNy61U7I1
MD5:	D58728EDA92D56BDDB48F60093B53D74
SHA1:	41B4E78672B49682FA977D3159A619FF9D049DE2
SHA-256:	9ECB0092550246B8656EAC1B3CDA1642CA31BE3ACC64325D58371D08EBF41DF7
SHA-512:	DEF11FA49945D2D14C0FCEB9406EB337B72EC1A0F7F740D62096DB8DAA091F3B50FD1AE5F25365F33193CAEC2499BA6F1815150144D556449AFEF88D76A36136
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/60fb0c129ef8/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..'..4.i.&.6g.i....{.HL^=(...H....2~.d.R..<...y.7 ...K.wlP.w...s......Q+.'......P..-].....G..G..i.....J1.!$d..9.P8.<v.....w.P..'SI.ZP}(..b.~jBi..4..y.R/AI...R..P.....4.(...y.&.Fri....3@.......@.isM..}...&..7P!...I......{\|.jY...........l...Z..$.{..C.^...v.._.n....).+P.D.....F..Ji4].a7b.-..4...........(..A..8.C...<..+.z..(.5 (...i.)A...u/C.4.R..<...*

Chrome Cache Entry: 292

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 856x480, components 3
Category:	downloaded
Size (bytes):	19962
Entropy (8bit):	7.818674535428787
Encrypted:	false
SSDEEP:	384:0VHwzUkN1BHSGesO0rTmFG0JJOHSSCU7auccFymXlXZuSlgfWfW2e:0t291rlOQ/CJvSCUswr7dgefW2e
MD5:	EA956280E5DBB3E6961EB2E02B28B53F
SHA1:	F3F7A4E5CB211F9A32F9F3C52D78C8B87C162CB3
SHA-256:	35DD5977AD6943E4F9ED3F2D249C051A5EEE13BF9CE0CB5DAC66F9279F939CA5
SHA-512:	E1E0D02C5EF1442C3881BD7006F29AB572F8ED6B633279F51B685FB52D4DCA521C9C33F350BB4A27F44DE6B29942E277CCB1F975C020C72FB4A35CE4599E0496
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/16/6b45b6b1daec/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3.............................................................................!.A1Q.aq..."....2R.s..Bt..354rb..S.#....$CD%.c..T.....................1!..AQqa2...B......R........X.."...................?..................}......z0>2}......z03Z.hi.a..a...a.C.....j0d..(.d..0..h..`..(.0!.$..F+.P#f. ...P1.;..0.....B.46.P..4..(.4.....a=,LE..j...{..F.:KM.......tR.9.k...ui......H.....3.i&..TB.E....0..P..5.q.rDF......z}.+-.......e......4..f/.].:......./..(a...S..O...i....P......xO\.#....#.../.....H.+...i................................f.?......f.?..........h...h.c!..A....FC....C.)..8......! . ...b2FF...i...f!Z.1. C......A..a`..(...V0....!.0......=Qx.MQx.A...:Ea..E&...qne.k.qn+`5...........&D. D...a2....Yp....>...W:.4.0..9......x....)y.Z.{o............h.a......i......X....=...q........R...................................oS....H......oS....H....j=...l.1C!.C.0.A..i..

Chrome Cache Entry: 293

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	49875
Entropy (8bit):	7.775551361675693
Encrypted:	false
SSDEEP:	768:2BfmtuNty9o2/1zejjpvikQZM/9S2qU6GJ2eU8TQqNuAue9cOtl4G+OkBkIVYj9V:Vyty+2/1iBikQKXqU6GJ9rtl4G+OkZcV
MD5:	5EC514EA32B0F1AB224BCEFD929EFCF6
SHA1:	B210D2695423D2979A84E0730EB0B813D2FED1F2
SHA-256:	4AF82770B16AFF9F7ACAF4E7FEBA7A17D6C890E744AD4E6ACD9E7F63F947A077
SHA-512:	0FFED5155A47A7A0E0D63E60D45580068AC24648A84FB5A36DBC12DEC5ABC38419C0B7BEA750FD33F0D6C69C4C9E8412550A104C4D6EC350393613B65B304374
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/12/5ef689465f78/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>...........................................................................!..1QA..2a.q"...R..B...#3...sr.bS.c4C5$%..d..6......................1.!.qAa..Q2...".BR.r.C3..#.......8...."...................?...>;.,..FC.%.%.D.;=/O..g.\|^t..H...5.,^.............I.....2...........c..].,..j.........e.......C\|.5.c.5.q.,..9...~.i\|..}O.O..O.z.;/n^.Ov...b]....He......<.e0..Z...d...e........\|.....27G........J.`........F.......h..iA.D ...P..`..@..F.. .........$)...............H..........F...6....d..(# ..... ..a..N..FZ.h........h...]...V.H....T......`s.m..G.i.<>..QWhrL;.......[.O.W]...bv......TZe...V..uld.t.t{5.(...E.g.E-..\|5.fQ...Q...CL.lw..NX.....W...R.:..Y...\|..V.G...H:..D.v...v.n..C..[=.:.....z...Gv1`#@...XHmTH...G..{V..4.../e....I..A...HA[-.(c`...{..>``..@<.........<Hl9>.Q.0@`.@.!2.@..I..1..\|......!.yg...............` . ........RT...1......cGm\....mU.i......).....

Chrome Cache Entry: 294

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 480x856, components 3
Category:	dropped
Size (bytes):	27244
Entropy (8bit):	7.970569499465907
Encrypted:	false
SSDEEP:	768:oB8eWOU7DP++RP3nS+rHbWN/v/oHKPdOOIGU:C1U7DPJJ3nt7WZgK0
MD5:	43C84531CD8DDD96957D3026EADA6E9E
SHA1:	F30C47F77A389A17CAEDEE4D94BA9024D63C9050
SHA-256:	DDF3AF4FA56AF4C00AD92DC407394F31EC8F3A16F8BA0587DF102C58FEA1CCDF
SHA-512:	69080CB3557E854BC0059F7E22CC94EA6768C4E3522C5BED8F1BAAA82BCA12774BEB476B6ED0D204CD872C4316C92926AC752C2D9B2C9070F1ED82485B06A334
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3...........................................................................1..!AQ.a..q".....2BR..#r.b3....$C...4sS..c.......................!.1.Q"Aq.2a....#.3Br.R......X...."...................?.(.4..M.8@..;W..ZU .dP.R../.}....>Sx..NX..5.,..B...#X(&......T.YS...@...E.(.A...@h0..X.x?."....:...,MD.....CE...".J.$H.P...qp1.0... .! .el2.$.4.h..j,...LF....`0%l.2S#L..P.J..T......3..$..7....j)...M69..........EL..2.N..b=.~T2q........WL......P..!..&..[+,eb...LHAj-E(...$...P...... ...8.9.}.5.`.5.$ .E........$..z1...` ......4....HB0..,EE...ZT.@4....JYL.S...Ph.F...!.1.....`.5f..............)....4..8.c..64.eL...T...v7........M2.P...$..!.@d!...Yc+`...h.....R.... .@.X...Aj,+E....Tee.../..M..HV.hh..L.(..J.\.f...`0......f3D.$....b.8.\.JQh...F0%,.X.2...1...X.2..!T.m&G...V...%....:.b..&Sd.U62.jl........0.c.....{....i!.C..F.I,+0 D...@da...+e...V... ..".\.,E. ...b+E..4ZV...3..e(..

Chrome Cache Entry: 295

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	62537
Entropy (8bit):	7.97481419094728
Encrypted:	false
SSDEEP:	1536:JdXJiwHMgYs6bq347gJdVMMxE2pH36Pd7+K950Jx++:zMB1TbBceiKPdSK950t
MD5:	9562CC935B72E3BB88E35CB0F8D5842D
SHA1:	60EE786728402EF2CAD6531A5508824466685EA0
SHA-256:	840261AEE6D41F110C89BA7F4D698B23EEABEE254D5C86F36C0FD90119A12298
SHA-512:	FD081ED9108D8D38307FF1A157B1A78768BD332F03FCCD83C976921207E3240E84FD3C644F676FA7200944865C77A47C873ECF2B8B72FC341D4953757E0FDD76
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/9bafe24706b5/1.jpg
Preview:	......Exif..II*.................Ducky.......A.....zhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:F715C2F1D63C11ECA83DB1A5ABC91489" xmpMM:InstanceID="xmp.iid:F715C2F0D63C11ECA83DB1A5ABC91489" xmp:CreatorTool="Adobe Photoshop CC 2017 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:8a86368f-1302-8d4d-bb45-197751a6e302" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..................................................

Chrome Cache Entry: 296

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 313x222, components 3
Category:	downloaded
Size (bytes):	13298
Entropy (8bit):	7.884323541052186
Encrypted:	false
SSDEEP:	192:/0xhXBD4SvsPrRXl2krZ6x0IS28bB9chEtJFinbuDhOtSRRWv4Xnxisc:/0LVvGXlvPGSAbeOtSRRm2n8
MD5:	317821B40A686FB113305655873B74A4
SHA1:	F41D0D6B967A489A78BB5C657AB345A3A751DB05
SHA-256:	FC36D277D3C9A31E44A5720164215A7645B19420BC7497503C7B9FBDF436BE3C
SHA-512:	316AB08137C161F8CCE45A8E36D93B91E455830046E39E0E7BD6DFD4E7D36503DD417C83B6924FE7492DCE2B3576542B32E1B9215FEEBEB60D7823EC8B44CB4F
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/css/images/logo.jpg
Preview:	......JFIF.....`.`.....C....................................................................C.........................................................................9.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(.....(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...O..9.'..}WW.t......o.l...r......$.8...b/.v.......u....Q.v.J..P...js...6..e...)...._.>.x_L.D.5-A.x..Dh.bP..2.icm.I.@..S...G.KY=./.'.O./`..4......+.<...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(....g.....^..`..:......y.n8...O..s...o.~._..ncYb

Chrome Cache Entry: 297

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	63424
Entropy (8bit):	7.969482714309869
Encrypted:	false
SSDEEP:	1536:OsmqC6CYavXo/0e+ZabBxe4h7acYTmx/IDhM6koB:OQCYz/0xZabne4h2AJID60B
MD5:	9FD8B93B43DE3EFC5B04DA063D746BB2
SHA1:	E9F3DA5E4A17A336A0D447A1D99B6708E3745199
SHA-256:	9A157258B36D18F4E78FB8D4DF202FA914B4613A62412202D2C9CF6F59B0F733
SHA-512:	5F077E2EC79E71001C05021ED429A707F04256461E2956F045368518204003686C9107D4870A8079242102545A46223FC1892AEF2222161589D9A5AC370C611C
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......B.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:C04F9B9ECB2D11EC9874C22BF42896E6" xmpMM:InstanceID="xmp.iid:C04F9B9DCB2D11EC9874C22BF42896E6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5BF31A282DCBEC11A440C30EEA48CD58" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 298

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	dropped
Size (bytes):	15622
Entropy (8bit):	7.946077072162154
Encrypted:	false
SSDEEP:	384:eXcyEJTvcWfc4QohvEMAZMvZFt33IW+vjqAm1u2BuqN:eehfc4Rhvnc4ZFxIW+uAmFHN
MD5:	C2485B7804DD566EE03488CAF18348AD
SHA1:	9194A816E5D5A1E641411B0720B090DE6B318148
SHA-256:	4259E3B09D90D8983AD826EB84366785F3372114DDB684273E5B14A2452B699B
SHA-512:	D6395D827DBD0478A4FB14329BBB0803F99417A8CD417D43EEBAEC21526CAFDD68D4241F10DBE687CFEBD7B025D5909AB8D22E06510824615AD57FDA63DA667B
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......J......as..1......m..F...Z..D.1M....c=+e..$...AX..r.p...........#.V.....-.=...zU.)......W...M.r.......b........t$.....Q.....`.Og...(._....kOjAj=+.t......2~..T.m..........9....N6.._%.........A......Jz.J..4..~T..tQ...K....~?..qd1..C...Q~P..yPk8.......?..-.......C...AQ...?.......lq.@zc........b..}.zV..F.J........C.."...o..s....Q..$...p...V.%7-R....>.=(6C..8O%E.m..+...J........`

Chrome Cache Entry: 299

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 420x300, components 3
Category:	dropped
Size (bytes):	22983
Entropy (8bit):	7.960646361196603
Encrypted:	false
SSDEEP:	384:YmFk6tie7ghz/dS8RPcz54RqEfBlA/6z4ZuzjKEo68dHyBjjQ:Yb+UhZtPjMilA0jKE4WfQ
MD5:	1007BD76295B1E9D93C1AFD37A5E5420
SHA1:	C5376FAC5816F8B5407FAFB963487DCC6E38DE61
SHA-256:	C877F8120B652D77FCE1E4457CE6EF4FDE6C911F13522BAF6222E934F7074259
SHA-512:	E30DAED7B068C72AA79E1CAB251C31BDD67D231D673AFC346C901C6605C3871F85DDF4B04CFA82C197A3A8854B7131D107B89B0E39E0B80D34AC69B684D649B2
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......,...."........................................K.......................!..1AQ.a.q....".2....#.$BR...3bf....4.%&6Vcer...................................0......................!1..AQa.q."...2....BR..............?..D......+ .+ w{..Tl...Q...y.....7.D1u.HR..Y,..QWB..QE0.(...(...(...(...(...(...(...(...(...(...(...(...(....+4R.1.1.f.)...+5.N(.r....=.v18.).....Z.....\|...."...:a...\x.x.)dew.m....u.n....v.9.t..:..,.1...,..9...2.L.sT............n1&.....$f.6f.)....%..ru..K....\.D/.r'0L..#...........n.X..;.86vrdT...w6.k.'W~...e;6R.f.vK...#..S"(....d..X..e.v_.._l...h..%..b.$.2.$......dY.5...s.5./.......G.8....i0.1...s.4Tv/k...e.&_.?..l._.d...~u.._.Z\`.z{..J.:..`:oK.j..Y...3l+4QWHAE.S...(...)X......QE.`wh.\..qe'.U...../,^.q..I..J-.O......Va..>...O.l.;jx.;.=...*-..{.UXM...Z..=<SR%..&QX.3Y.3.(...(...(...(...(...(

Chrome Cache Entry: 300

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	145247
Entropy (8bit):	7.970011881494768
Encrypted:	false
SSDEEP:	3072:aMzI33Jc7jTQQtAwUSbw2IP4+MmyUug0IPG2GbvsA:aMs35oQ4Ao8PnMpUugvPG3bf
MD5:	450A2AADED9472149BD729D677CAAEE7
SHA1:	D22633E20A49763C08A134D42FBA722731CA56C1
SHA-256:	7E5B7698B0EA09371719FFD328254F1BFC31FC5679B15E4647405624D1A9E340
SHA-512:	AAC2DCB2CB9B7A7FEE97873923B1F9054C394A2CB8907D0BD36ABBAA02C52960D7536169BFA9015ED3FE521D3CC1918511CB93E869D37803B0D1FB074B93E1E2
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/dd504259fce9/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$...jm..y`.{$H3S.SB.N..(....QE0.1E/j.LR.w...~.... ..ZCH..(..)..Rf..v......XA..v...J..(.Fi..G'QO.?4....O.(..E.PF(.;.M8.M....'z..@.:.....v.S.4....?........4.~.......:z........j.N..e.=.\|..E......(XG<Cp..$..}1...xcR. ..r..F.(?.I..%Z..%..>.....?.i..........^?.E....b.....i..B>.Z..3.(@.e.m{/...[.R......\|.?.N.l..3...H?........'b.FI.VG.._..x.E..R....Y.S$..!{..s

Chrome Cache Entry: 301

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	138
Entropy (8bit):	4.8219046117621955
Encrypted:	false
SSDEEP:	3:YRM9WREaD5dQRkbL2ysrQaJ9WHXxQAfB4xCxKRTiAMSDH4p:YsWiA5iRaLX4QaJ8H6qKReVSzo
MD5:	65CA23A7833EB7DA83ACB56A0B338469
SHA1:	2B30B12A25BFA9FEF196BD56B564DE3C8EB0A6FB
SHA-256:	D28351777FD421495326A2B53BF8D3F82F07E067ECC517FA3ADF705F7A528616
SHA-512:	3FFC18FDE3ABBA039767047903D7E773CB23A8B01E4C45D50928EBF0E6EBA48CB1D78634F4156A306BDC9447C1328076DC3E3391E21DFCE7B9A4598970D25552
Malicious:	false
Reputation:	low
Preview:	{"timestamp":1735794810441,"status":405,"error":"Method Not Allowed","message":"Request method 'GET' not supported","path":"/getDataInit"}

Chrome Cache Entry: 302

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	68846
Entropy (8bit):	7.976953512813656
Encrypted:	false
SSDEEP:	1536:WS/gJkujwW/2CZvLdSmd4dU6mC5ehr4EtjERE/FF:hNujF/TZvZd3XC5Ex1/T
MD5:	8DDA44067021247B7482E81DB9F5DA79
SHA1:	A46C28B7492A002554862A106788D7DE0AB8B7E1
SHA-256:	01F24475434D711313AF6DE382F9474B76944A0BB6C30A75EE90BFC5378936F8
SHA-512:	967D64C9C3FC952BFC2EA1C262E5D61B955388B0CE41392ABEDDD3FE05E9205329251CF1A99EA43BCE13DB8BFCA2AF7F177B343E5F5E77AF5037A8EA376CAA3F
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......F......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B3F3E9889E48E211B366A6658BC12A0D" xmpMM:DocumentID="xmp.did:B3C810E2CFFC11ECB6D4FDACA404714A" xmpMM:InstanceID="xmp.iid:B3C810E1CFFC11ECB6D4FDACA404714A" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:41e86390-8879-4d44-b301-432f92a056d8" stRef:documentID="adobe:docid:photoshop:221d75d5-7fe4-6e48-b6aa-87b70b95b496"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................................

Chrome Cache Entry: 303

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	10355
Entropy (8bit):	7.972694101414642
Encrypted:	false
SSDEEP:	192:JSvdeEqL2cEZWjC8XP6ROtnXeKPVg7RPc3NNhCxFFukGDEhLtr9PSR1dc9NYYdui:JSvda9O8XP6M1eKdg7F6NNW8g5r9aAYG
MD5:	44425213286FAE05454C4B2A21AC24B9
SHA1:	32EF0D410E59FB222ECB262C06300A3A50FC8A77
SHA-256:	7F3D369EC459D1D65A78E206DE87B77B21AA159115BCFC0848C9ACA84D4E83C0
SHA-512:	16E8593F86F0ECEE89FB4FEBFF5D31476CA5CC3B064EAE15F36AFE832740D2E1E515ACE9EA09E19E1DCD3AA2B2C0FA87D49D0DA2997C2C56B8BF92B8AB95792D
Malicious:	false
Reputation:	low
URL:	https://2024hwus1.heibanwa.mobi/jsgif/yf150-150.js
Preview:	.PNG........IHDR....................pHYs...#...#.x.?v...)PLTEGpL..e=.J,......................Z-7#...........dI+....`........................................".....* ......7(.............C4..............`.rG...uW1Q0.`8.R?"`K,F$...5......~.s9.{^....qD...V..g@....HB9..N0....aXFqiV'....M..f..\.e..=..\|.h...p........r......V.u..'..8.......-6.>....tRNS..........b...j.:....... .IDATx..os.......L.i;.BH..(S...ds.#..T8.V+.B.K....!.6j==i{..Q@...z.............qj.x.....6.&=...............(..2{.?}..m.E...#...gN....s~..._.....z..#..i....ay.E..v...v.-.q.m..\w<.\....x....f..<.L.&......x..z..8..s....=.H.D$...[.*I...<..g.g;.j.. .9.=...C3p..-[..h2.n.x.,...Af....Q.i..EQ.c..G`/^m6..v7.L.....]...m6k.;^.Z..iA...o...6}..=...\|b..m].....I.m.:..Y6.jeQA..... .....Q.e...R....4..j...4C.......a.J)..Z..w..>D\|.).<.... ......S.....A..T_...YC....L<m.I...y\q^<.7.......u.q...L..Y.B.b........x..R....nGCm.M=.....@.&j....j..r..V.4.s......m\...T.=....J...k

Chrome Cache Entry: 304

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x281, components 3
Category:	dropped
Size (bytes):	21040
Entropy (8bit):	7.9630284189204605
Encrypted:	false
SSDEEP:	384:4VyWbs/9FsdoAlXnyRIcjHic6QQf4an8Z+FfQKxszQ87f:4Vyss/fXinyecjHiNNY+Ffvxs97f
MD5:	E6AE5547387E7DE695A3A1A2A2EE7122
SHA1:	4962FAF93328C97593E4743BCF0719B621708304
SHA-256:	978999875623F012BD69D3BFEDBF781BA117938AA41262DF65801EF6E14CF12B
SHA-512:	5D0BE52FE3EE9E3220A3F2D1D6AD64760ACB1F8D03432E72B22B9A95FD9821591A336D2D01E78C400315281B6764FA2C1C188EBAF6893ADE678A06CB7A90CF41
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?....../.O......?QOS.gvP-....~U2YZ....ST.....z.%...m......lO[H..6.V..zwb..V.z....".M#M=l.?..NG...v#].L=l`...E.t.......F.U......4.s.........I...}...V..(oz............Q..4.#m.#....Y..7.@..4...Z.?."....F..?..9S..?8.L.....ny...TV.:N.z....\|.{b0+F....+.i..#..MM+O.g.......** MM..5t.4......8h.g..A..\|T...S...E.Y..F.O.....4=7......W.....5..........C........};...].4=3........=3.....X...Fmi...D?y

Chrome Cache Entry: 305

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	1016730
Entropy (8bit):	7.928262266657669
Encrypted:	false
SSDEEP:	24576:Lvm4n/QWWT8//C9MzwtEfcU+JTgfUwxVRNgScqMVAOqjyaXf0:Tnn1WT6vzw2fcdCfbfD2o0
MD5:	294291294D851FECADAF4C11864F83E4
SHA1:	A19EE3FFAA8E85788E5041FA456472E882A83CDA
SHA-256:	FB6BA271C0F50ACE681CAC8436EDF96513F6E5624E09D5D50617775784539A84
SHA-512:	88F1FA55551B8E043D693F34FF481C82AB470AA6D1950FAA550C0FFDE730221FC9F19C283B85D6DB321C49C45FC68A0D49EE4101E87388E8C0F16ED03DF0259B
Malicious:	false
Reputation:	low
Preview:	GIF89a........vT.3.P.........g..........w....SLE..w.U.kw..E...........R72...7...J..........N4J..z.zz....zbH.jc.m..x.....ffX.<..g..l.d0.dZe..................[.........fT....Q..v...Zd.ZbzdT.xh.z...`.8B.......vf.............vxt....P.....hRDhXP..v...v.t.....tf.{..thf..x...xx..UVY......UA*...xf.XDtjv.hT.M..tV...jd.U....watthfF4..h....zz.xv..ffh.W.vXT.h\.................t....g.l6,..........\..rV.\|....XT...O...hR6.VB.XPvF4vVF.....vV8........hz.v.z.jv.jv...XR.[.....T...X...xv.....x......hhv.H@fHR....h..v...p.p.hr.h.fF.HS......fHB..z..h.r....jZ....p.`....vHRvHD.r.`.z...HRhdHxD&.....ZbV........jtvPAc....jhC"..x.dF......jrhhR(...^...Z...Zbf...rH..F>@@7vR(?..._..~.t..F...m.z.80..j~b8vsU.rH..z:6:.t`.$......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 306

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	184704
Entropy (8bit):	7.971400591380393
Encrypted:	false
SSDEEP:	3072:jzcf6z2cIVXOMVhtcrP7fI4WlaeS5/DR236UPdaq8L7S5wngPBnWRG93EE1Rym2n:jzc+bILVhtWTItan5DXqGULnWcXbZj0
MD5:	E9777506A494D0F4CAFE4D1A71F51A80
SHA1:	8A3352328B35C33FE30D5C056FB732F797A6A302
SHA-256:	1F955B37B283B5073BF7F26CD15D60D6CF5037CE86D9454A7D08CA2B42BB2F79
SHA-512:	9D08FB515DA94231EB3BBA39577169E894522D9D693DA3E49C509F80E7250ABE5A77B392E6B3159D7B810CD40083666214CB87537AA1DADDAA99410DA63B98FA
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ae7abced1eae/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......H.CS[..).w1.rI\..H...9...2.J.........J.2...z.j....)\|.;S..".).rO..W..<.. !.)..qS4G>...>*..D...zP...t'...(z.......=.SX`.Z......G.s.N..`...i=...)..T...8...=.J...V....t>.A.X.9...2q..L.).....X...rx.0..5;......Q.....)...z{g.0.M...9.#....9...C}).f("..#4l...})..v...j}....m$..1.z.h<.....&..:.P2....rD.s...s....@;z..d.5_`8..S...).IjC...j.....~4....4 D..

Chrome Cache Entry: 307

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	188092
Entropy (8bit):	7.972365610417208
Encrypted:	false
SSDEEP:	3072:X3ocUwifW+1daNJX+y6wukTLrH/680+3kzsuH7gk9qUBIDTmQUt64ULuNfxAjDTp:HPUV1upf/68LKH7Z5BeCQUtELIxALp
MD5:	6CC767431D6D9ECECC0DD3D7D1811FB6
SHA1:	0C5CCD275CEE030B08D8A2B4FAEF5AF11859D711
SHA-256:	3F64F84DEB02B090E22D1DD66A04E4FA2E2CAF071F1EAD8BD1CAF0CFF8EA1A94
SHA-512:	3C98FBC2D55136D9B20B005B5CDFF9332FBCA0A9A7381D827D0D8A97C886085EDE35B8815F1702EA5950E26BB8FB95417C258A86B69DA7D226FA2CF264916FC8
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/7ef7e0773c6f/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..D..U.\......f.h.g.~..SU.E.."..N.P..JF6.........F.......S.\.MM.r....G.:..].L.....W%.......DyB......-..r..l.9S.Goz..=i..@gn7............M.}B..^?. ........-........,r[.._.m.......k'M..y..pDk..~O.<W.}....t.l.V8..[>(.d..Yn..A.F......7..e....[w..#...5...g...x.....M.k.Ia.V..&v.\|i.C.=.._.....G.....;v(......^....'.,.i...yZ.X.1.N.^.5.V.....Uu.S6.>....

Chrome Cache Entry: 308

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 320 x 404, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	7395
Entropy (8bit):	7.927277387190768
Encrypted:	false
SSDEEP:	192:mUzcsHcq/3m8s4IcCUossFLBkN+USJcHPlmmcoTeKyK:psqPm8s4IXUWCN1SJKdmmcobyK
MD5:	904243EDB0B583E098BCA4D5A90A5458
SHA1:	E61650BD016894008295E59E8C0FECAAC958926C
SHA-256:	E3E342BE1E47A26F2C7FC40DBA0553C32F5F905D6D29E1243F13A3E1C1643D39
SHA-512:	02F3FA80AA1D1050B7622C829E8663EA4928C4A417245196B299094EA8BDD894C0DE670A3027B56A5E69C9AA5A2693E93E5FF937C32F01BAAB577CB98544492B
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/css/images/bgg.png
Preview:	.PNG........IHDR...@.........s.......PLTE....4..I..J.;j.<m.@..B.._~.]..HF&X..k3c..A.Wq..J.?...br..<.-l.\c1/b.Yi.G.C...G.<...b.K%.E/.?,..{.C.C...br..;.G..^jA..SP.F.v5T~.sk.G...U..X. [..Q..K..N.Bz.>..'a..H..[]<t.#^.?w..='2l.E}.6o...<d...R8q..../i.,f..V./..7R.@..........R...+{.'n.,..<..=..)u...8.R..Q..:D.....1H.:...sP3L........o..B..{P.{)....xP...e..K....TE..\........S........\|......Tn.o q../~...5......B....+t...E...[6.......oO.......c......F.......=.....f..d....................D2.u$....fL....kNi........u..0....^..................h.vP.}<.. ....UWy..k.....G.T@.K<.n1.Qj..2.J$...U....-....y.PI..'....i.../ds...Z.dJ...l..%].\E.S&X..An.@..:...n(<..F_...U.k5.aG..D;...p...w4\...y.\|9.r..p.x'...DU.U.....s>K._.c[..~1Xs..U...._z..i..a_..]..9..7.a ......r/x..ms.....bn.......t._Y../.o)..m...-tRNS..@.@.A..@......-......2.....rpV...taN....@.{...eIDATx..;..P..IA.....Ypp..L.vP......Bp..B...$.H.X..h..#.Q.PPq.[".... (".o.......'".A.......s...Nn..Lf\....v..0....

Chrome Cache Entry: 309

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 260
Category:	dropped
Size (bytes):	708549
Entropy (8bit):	7.88501088087608
Encrypted:	false
SSDEEP:	12288:J1wjADnUKtHbK4/R0edRXL0BMcU/tttf7mL2KamrK4/R0edRXL0BMcU/:J1wj+UyHbK43XLuqttfyCKamrK43XLue
MD5:	6D5A4B4E7D49B2D87A64631F14969942
SHA1:	EB7455A3F6D0C17281E044373FE67B9EC1ACC6F9
SHA-256:	4D56D5987F88313C9F5426DFEEF8E877F0D47A70CAC6A91F5198C72A14D19A35
SHA-512:	A97046B8DE384E5B5EE2536E28D672E201ABF100F2757731643D501918DC60EB9D297C76E78D4417E1620A902AC5F286C5952303D29987ECBB0D2F3F6798CF32
Malicious:	false
Reputation:	low
Preview:	GIF89a...................................$..!..''.(...$..". ................p..]..a..[#.?..$....#$";&$J3OO+SJ)c32.):.COnBOYHSK%a-.9I.Bg.@u.Vkqxow.}............yt.m].sH.{9..-.t.f(rf,.O2x>%.3!.H..K..T#.g..q..f".R..C1.>7.O .m%.n...........(.............................(..'..+..0..4..4..6..B..J..L..N..M..M.D.8.K..H..U.Q.\.{L.jI.XN.Y].cp.lq....v.........i.z.....o..l..m..n..m..\|................................................................................................................................................................................................................................c..W.a.\|............{..m..Z..L..J..G..C..2..*......j. c.)c./d.0[.BT.Z[.Zm.ku.y..wp.}e.[..Z..E..3x..p.&..$....v..u..t..j..+...........!..NETSCAPE2.0.....!.....'.,...............H......!4.P`1...>..b...3R$V...b.z...$/..P.,.r...%a.D.+..5O..S'O./u......Hy.:...,.O.J.....YUg...kW.[.r..u+.Yg.ve...,.p.eEw..p........d...x0+....]l..b.S.e%..e./S.....

Chrome Cache Entry: 310

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	221556
Entropy (8bit):	7.973070678135349
Encrypted:	false
SSDEEP:	6144:zF/mihAOdvKdmHehGzLcJPLHGDg2AJ9ST8Wxn:h/mihAGKdm+ehTL
MD5:	972490C760140B5388745A9585C22719
SHA1:	DE3F2A96A89790216EEF3B6139FB1DEB8449D37B
SHA-256:	97A7442BD27C13C4B308AA10A92FF97C41068F3134CBD8068EADE7E422B610C2
SHA-512:	9700CBEAC42142F7B69E0B56F48555F8C4578A23691E60260A70AB299CA2E2B4D98FC42B5E88F99CD9074C343B08C76919836904CCFFCAFFDE4D73952561CE7C
Malicious:	false
Reputation:	low
Preview:	GIF89a........ux.......DR..../?...,..4.......A.2T.Qm.l.....................uz.................(!$..................................z.............&..7..N..f................vms............\T\g_h5/6...LIV=;P........0"0T.%@m}.......Inv.....................,&......^R.B:,.P.\|.....................n<..F..n...................................A..@..M..>..B..=..L..D..B..7..L..T.....K..\..C..P..Suo%../YS...T..<..R.._.._..L..T..\..X..P..V.L..e..b........\|.................."........................................{.....F-#8%..gW..\|.................sg........\|.....~UJ.y..s...\|p.........M83......pe................hMI.....2...........{da...[CA......o84.YU.cbtYX.ml.....................................!..NETSCAPE2.0.....!...S...,........@......H......\....#J.H.....i..#..~v..I..H?&G..!...+...H..F.........;2.:...!F.".x...M.>...jS.E.~.c.._.\|...HY.h.v ..,.....;....I..IR....@..1B.H."A.'F.......~L..e.>2..a.;.

Chrome Cache Entry: 311

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	497098
Entropy (8bit):	7.958939189990073
Encrypted:	false
SSDEEP:	12288:ouFIgJ7l/yviJiCo2HwhWpN5AztJC7X6wPh/PBPeIMD93+/FNOfY:oxC7lKvMiCo6gG5KtJQp1BWIMB3+/XOA
MD5:	4E21198408F9F48584FA0EBC86D0F10C
SHA1:	31726F5F67F1ABCFD2AADBC04F6F0CFB4B566A63
SHA-256:	4F945D4E156791D2CBCAB72D77D4FBC3268734E521635B16775A0E9FF316F983
SHA-512:	5AE99EF959902C313B9A8DB70FFEAA4FD7EEB00755150CB6478C0EF0390A1F7ACD74BF128898265EA83002983C05C42EC990D845E5ED37A34898EAFB0C50CF39
Malicious:	false
Reputation:	low
Preview:	GIF89a.........+.....2_..T...S$.U..Q.......,.5..oqH.O.Uh(.$...rd......i._..'+G..\..2..g)O#.k.R.L..q.../.#'%...^..O%.........jF...ooq.s)..s.h..Y.O.u.lMKO.L,....j.l...$.R.g./$...../........J/.\|O...v3!p..3DU3HvGHk.......weS..o....?M...J'..K....".p4.s.sO?..z'....6.(....p...L....A.ln..qkF..=....$.o......(T22J.QGQi{...Jq<..........K...h0..O.....2l{.T;O....&.0#........!]Ui}....3+....F'u...........T3.H.(...38......F.T..G..)....Uq.?."wD.A.....\|."wU.o..UX.........V..f.....U...f.U..3..f..D......."."..U.9.........."..U..?..~.w...D........f..3..f..f.w...;.;.w3..U.....U.....>.f..@... ....U.. .A.w5.:..f........>..D.=.."..<.......................f.......U.f"..D.........f7...........3.......U.....D.f:.w4.....f..... .. ..35ZQ...7{(..D....b.. .........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.dba3da3b5, 2023/12/15-10:42:37 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 312

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	75037
Entropy (8bit):	7.900992390333463
Encrypted:	false
SSDEEP:	1536:+yB6hsKcoSIdujPQlcUENskGztEHyCiCDKLtRTlC+ijsb0GB:VB6hsKcZtCcXNdG5EHrKblj2swGB
MD5:	CF2F882D1FAF5569898B4F641443460B
SHA1:	48DA8F086A270E2F76BEFC14DAE3A231606C5E31
SHA-256:	2099A6A133477D768707F08F83CACE7C45159B89C63082672077B38A0F4D960B
SHA-512:	F24A6842A7847F3F4F688449C722880E7ECB79BDB4B84612177BF284AF5398CC94FFB8246A229AC2FEA9143E63B14C21D6FC2B30A0B9C88B93667E36C4940FC4
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202409/30/babde3de6685/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H...............................................................................1!A.".Q2qa.....B#3b.rs..4..R.$.5C..tS....T..c...D......................1.!A2Q.q"..aB.R.....r...3C.S......8...."...................?..F....m._Fqi.l.Sl........rZ#..DV..........z1.h.,%9:e}m..F.w..i%..Y?..\|.......$...mz....34M.g%..D......QW#.=.7.[.T...r^\|J.vSo>[.Y..e!~......vF..I...e-....vc..L.Q$-...ED..l..`..`.z.1.....P.....^3....3...^8.....~.............x....(...0..3.@.<g...<g....`..<g..s.])s'..>.sBZ....=?.9..7._/........5..]..K.o.>.'.M<I......?rNB.P....i ..f....U....m+.E'..1KU...c...)8.i\..z..2Bk.D/....j.T.......@.Y$.s....;$...N\|.=k.1.k.mcXa.5.... ..`h ....a....I...... .........cR..w....w..f.....c./..V....aTC.^.g...zBT<F..H.a.i..D...#..\.3R........u..q.r/.g..../......R..T..,..Qe.)....&...%...a.Bv..!.....${!)y..J.*J.U.g..!U.r..N]...I...........z.)...K......

Chrome Cache Entry: 313

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	190607
Entropy (8bit):	7.919631905962257
Encrypted:	false
SSDEEP:	3072:VLW4JB2u62uf6SARIyfgA7+mJ7+mbSu/rLdbiDpj2tgKxPZiDpj2tgKxPZiDpjV:g4D2F28RgIyfg/usDB2ttxIDB2ttxIDD
MD5:	173C02FF0EF0DC05D007B79B0C2D64E0
SHA1:	3D8261B69D139BBB8280C35C4651FA94B33FDE89
SHA-256:	7F9DD857B94D176EFF509415C8D9343AD7872CF239E8135C30DFC27AE06BB50D
SHA-512:	CCEAFB7510C7F088F47AE93928FAD4CBF9EB4EE23C5E81CF914A10E4EAFE35F027C83C3D0F12CB4924EFC6992F1050FE90FE1E4136586DB89853779803E14FBB
Malicious:	false
Reputation:	low
URL:	https://cc777img.dqsldz.com/i/2024/12/05/200-200.gif
Preview:	GIF89a...............U.v..j..k............c.........kp...\..$K...]...P.T3..O.......-..E..k.].........qY...#.....+.kb.gg".R.............N..]No.....V.5...n.........).$..+......//M\|+..+...v'......1...K-.5-i..i.......T.kW.#...,m/..Z.....s?...-....D.......9w.D.U&.... .58.;:.......%..}69...".f3.w.........6.e".y.........................".w7..6._.........!.]...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:FA9FAC92B2E011EF8631E254D455C0B4" xmpMM:DocumentID="xmp.did:FA9FAC93B2E011EF8631E254

Chrome Cache Entry: 314

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	68809
Entropy (8bit):	7.872712876421757
Encrypted:	false
SSDEEP:	1536:AyuMeiefLCpGBM9/1Bty1kaDK2tYDhXrA2Ntddw1FNB+VO++nV:Aygt+GO9/1e13DbtYDpZddwbNBNV
MD5:	220F10F60DCA9B28D6CF33E65DB45C99
SHA1:	0140D8DFAC132DEE7B47B5713B2DE5FE0C1EFF57
SHA-256:	76E3E0556D38D24D3CB07E81177789859D211A81647C65FF20B7887B66DA9F85
SHA-512:	9AE9E72F5CF100F68F2402605C5A90DD213DA17871F1FC456AA8DE762F56B7F0F7701327E7BA0CEDFB8C4C2983FDE6EF6D382A65F9534D0A9C8577EBDBE92660
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H.............................................................................!1.QAq.2a.."..rBR.3.#...b..4...t.$.5..sTC.S....E.D%..c.........................1.!.A.Q......8...."...................?...X.z.....F5..1...D.9.l..K^.G.y<.^........ZT..u.8Q..i..e...Z.B..V5...7@F.M...`0... 8.%K..YBYK0I....ZA ...r.").R.S.(.N.R.....QP...zuF...wa.....e..U,5..E....iU^R.........<.....T..BJ...R...u..au....k k................S...k...`0..k...(.5.........1S..1.....D..f.N.{.........g_n8.a.5.}O.{..k:....b.+\|.X..;d.GFO.ZuS._.7.6T.VRM..'@f....d..9....m.3A..X.w.%...A..u>\y...W...p:.,.J......;;.....+.kF.....O.L...t..rl..@.-.A.....].`.....-,i..'...u.h..k.Vu.nm$..BlV.J.>..,.\.i.0...GK..<f+..s.M...c.j...2FJ..G...\...b..m..0.V...7.d.)......................................k.........(......X.h............LP.k...`.@.4P..1.....=$a...*.......Q5....%...m/;..m.R.............. 0

Chrome Cache Entry: 315

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	133474
Entropy (8bit):	7.972662320873572
Encrypted:	false
SSDEEP:	3072:+t6MJrKpvn9BE6ZImupReXZlv/kqV6qdrISs:+mPTEQImuidkqV6TSs
MD5:	51729843201E781CA9300B9EEB97814D
SHA1:	DF65E09140353D9C96B987BD6B4AE860FAC7E97E
SHA-256:	38E320DF642670245DD20A5D425D74AA4073A5C0817F8960AABAFA32AD660830
SHA-512:	C2F68FB4F76A323CFB8129FA6EA4EA988CB566D4B3B1CE9156C9D81F1646FB3EE8CC3B15A3DB52CD2386896AA3DACBAF468D0625698A6B9F65E7662D3F8353E0
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..7....S.......6....iG....1F.&....o$q..LC..Q.GL.r}iw.gu.....I...0)......,I.h.+...9..N03..q=...W..A..(P@.H.#...0(...=...9..=i..Sp.GoJh<R.`!..~.n4g..{R.4g.@.F)3A4..h.&rh.@....4P.E.....f.(...J....b$.4. T`.S@?4...{Q.`Qp...7.F..@..&..G...;QA..E.-..N.P... ....h.s.!.Fy.&..R.R..i......:.N.SzRP..~tf..)wS......i.*...~j0H.d..LV...i...(..L,(.Ph..@.qK.o.8......F.d..ZF9.d.3.

Chrome Cache Entry: 316

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	56220
Entropy (8bit):	7.971711922058762
Encrypted:	false
SSDEEP:	1536:7js7m7aOHrOC3i7koIh72PlUwew1tIAAs8:7AmPliwHQlUCIAy
MD5:	2271F93CA77239FF84AD75FAE0F2C586
SHA1:	670F10F4953BEF2C08882AF4EAEF360DB5580352
SHA-256:	4919F87F38A0246763E05C84D84FFFD12E61D6EB18B3563B48FF0F377A4BBFED
SHA-512:	131171BEB5C4ABD92A1FDAC7DCDD2350D725C4651EB02316B8A8E7F7794587742573B977165C383F32EF2C90941AFB53F1F3FA4B0B3C71F6CF47A2272D022975
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................L........................!..1AQ.a"q.......#2B..R...$%3.4Sbr...5..6Cc..&Dds................................,.....................!1.A.Q.."2aqB....................?..@.z2...)...F.q\.N....x7.D....u.......$<..t6..B.sY.Dp..2......M....v.)...(:....y.#\..O.+l.d.ib\.1E....F..Ta.....`.....S..@.e.})....B..:........g...3.Q......RF'r.....YG.djO....Z...=.....LW@..=.^.Mg....vFH>).h={.LGDg.j.8.K....V$%.....[D....5T{OV.n....q.j..2.i...=43..8$>7....o=..mkmq K...;..R.E<..A...Q?..(..a.1#..K.K@S..o..M...$M...\|..\|...(`.....9....=..!1.v...3...o.3..T.....X...=..x...`...U........a.1..>.}..5[T........%.....d. W.q..O.-.b.1....q.<....W..Z..1...n.z.........%...........i..5...I.....A.aA8.I[)...................o.p^j..P...GV>j-.......SE...`.S.Px#F......r27#.X..........k.i6#./`4..A.7:.

Chrome Cache Entry: 317

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 320 x 404, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	7395
Entropy (8bit):	7.927277387190768
Encrypted:	false
SSDEEP:	192:mUzcsHcq/3m8s4IcCUossFLBkN+USJcHPlmmcoTeKyK:psqPm8s4IXUWCN1SJKdmmcobyK
MD5:	904243EDB0B583E098BCA4D5A90A5458
SHA1:	E61650BD016894008295E59E8C0FECAAC958926C
SHA-256:	E3E342BE1E47A26F2C7FC40DBA0553C32F5F905D6D29E1243F13A3E1C1643D39
SHA-512:	02F3FA80AA1D1050B7622C829E8663EA4928C4A417245196B299094EA8BDD894C0DE670A3027B56A5E69C9AA5A2693E93E5FF937C32F01BAAB577CB98544492B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@.........s.......PLTE....4..I..J.;j.<m.@..B.._~.]..HF&X..k3c..A.Wq..J.?...br..<.-l.\c1/b.Yi.G.C...G.<...b.K%.E/.?,..{.C.C...br..;.G..^jA..SP.F.v5T~.sk.G...U..X. [..Q..K..N.Bz.>..'a..H..[]<t.#^.?w..='2l.E}.6o...<d...R8q..../i.,f..V./..7R.@..........R...+{.'n.,..<..=..)u...8.R..Q..:D.....1H.:...sP3L........o..B..{P.{)....xP...e..K....TE..\........S........\|......Tn.o q../~...5......B....+t...E...[6.......oO.......c......F.......=.....f..d....................D2.u$....fL....kNi........u..0....^..................h.vP.}<.. ....UWy..k.....G.T@.K<.n1.Qj..2.J$...U....-....y.PI..'....i.../ds...Z.dJ...l..%].\E.S&X..An.@..:...n(<..F_...U.k5.aG..D;...p...w4\...y.\|9.r..p.x'...DU.U.....s>K._.c[..~1Xs..U...._z..i..a_..]..9..7.a ......r/x..ms.....bn.......t._Y../.o)..m...-tRNS..@.@.A..@......-......2.....rpV...taN....@.{...eIDATx..;..P..IA.....Ypp..L.vP......Bp..B...$.H.X..h..#.Q.PPq.[".... (".o.......'".A.......s...Nn..Lf\....v..0....

Chrome Cache Entry: 318

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	267600
Entropy (8bit):	7.9497692502485595
Encrypted:	false
SSDEEP:	6144:8eljrj+/U5fGvodjxugmiNwW/VFbtA4BYCZ7fcmPoXN:8elDHggrN7tFHrjcmgXN
MD5:	255D2547F187FFE25A9FEEF511734F25
SHA1:	2ED60645212F1838D2384BD82D7A3FB197DC592E
SHA-256:	11B8812C5E98956334C3AF95C326E16D946E35941BC79079B7F17D608D7E886D
SHA-512:	9598DD8C3152D06D49B8053AF63AC0BCE9B00DC240C74FAC4272E44011A3ABC874126BCA6DFD3D682769418124A5D2782A8CBBA5DAAB692AB95156A839673F78
Malicious:	false
Reputation:	low
Preview:	GIF89a...............wRHH.y....N3F.xi.hi..).(................f'....mR.RJ`C7.dU..J.........k..uy.........i..k62...j..F.1N.........fi....ju.O5...vy.Rv..uVf.....%..%.$...E&5F76x!.vhg.vi...-!.cWVhFF'.!.."4'&"..tp......+xVV....x.U46<-H3.%.l.744gEU'$$uHUxFD...6$3...........`9G..=H .4.......2.........4.'f..E#$...udXwSHo.$.......%&...ysv.....e....!.witice.6%o.E.y..hb.....yV3'Y&#..y...tsj4.3gSH...{.F1'...W_.(.%...sf,..61)...UPd..........)Z.{....Ijr...T(4........T.<.::...4........"...............%%32...k...9idx...3......kt.?l...(.2......\.............]E./......7".+K......6.3.........D:`.........&1).....R..........Ty...+...............!....y-_.....>....a../...U............;AA...'.3...@..i........E.......Z.!........................B{.m.....@e.....g.~\.....K...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.171c27fab, 2022/08/16-22:35:41 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 319

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	161888
Entropy (8bit):	7.972073486275394
Encrypted:	false
SSDEEP:	3072:G80mMcWEel9drtayszXr0SS8vJYb9M9ufBpykT7UulbUWvuQzMnnLC:Gjael3hayUXr0SS8gMxkfplbP3MnnLC
MD5:	6BFA767537B53234C7436598923464DF
SHA1:	6670838995F420CB61A643D7B70F8C44AD377CF8
SHA-256:	007D3BB86B2CCECE5C9CC72124398D3A4F08CE8288913B0634FA1D1F564DD27C
SHA-512:	49412E24BA54C54CCAC874B4EE0F36770A4894B92E4BFC669459CA54C5FA7AE3FDAFD51A41C6823ABC5F7E8B0B1E8EA68B5251197C71ACD1FFFE6F1B6EA61172
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/bf094940c1b9/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......a..{.T.....5.n..3..2..@.b..@.<. z.....i...)....;...=.i..p.T...._J.P.N ....I...\zR..G5 ^)...b)SO...:w4..S..r..g.Q..jr.4.?...=...).........&..GN.2g...oZz.8.t.9..>...KP.:S.....jz...... R.8'..?.i...D..T.,V..7v.)X........v0..."./'.Q(8.1J.......m=....6O.j..[.(.i......M#...J21K.....;.h.@..J(..Fh.q@..t..zP.c....h.@...*.....1@.....@.^.......i.\...8....

Chrome Cache Entry: 320

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	downloaded
Size (bytes):	35928
Entropy (8bit):	7.943689651442825
Encrypted:	false
SSDEEP:	768:2k41q4i4wHoW39nlqXFvzz7Gxev7RqjOUrYXCLksSg3hlgN7ARO:A1q4i4wH5SVvJDgjvrYXa9V3vgN7A0
MD5:	B72FB78F85C466994BD6F158ECF723D9
SHA1:	CA5091E534BFCE34E6A649E219D023E6ACB6D4DF
SHA-256:	E30327D457AB2006C9345AFB80CC25AD5047A137193198DD7A8A3F56E87380E2
SHA-512:	719476A3537DEB1FA60AEAD72F270944C836FCDB9961260F918E77FB4C48A8DDB82BE3A1F549F8980D43104B26E29F9672CA8833531E1459F7AD2C9F3AAEF1A2
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202409/21/85ffd4f6e6d7/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3...............................................................................!1AQ...qa"B..2..R..#...3C5b.r.sSt.$..........................!1.a.QAq..2."....B............."...................?..n..e.4t....:..}~...............Z\|...V...?.>..].zf.....0q`.j...bP.l..Z@..1.e.,.I!..5....p+qh.!.]..oAb..,....8.9.)....%...$.0.q...MY.J.Bq.+.GcE.i.....+.]4...Z.dX.Z.9C.....!:...d..Z.[m..Y...T.%.KR2....]2E..Z..J>BMx...v?..l;.....b.^'o......w....#...TV.Z.%t...0.......c..J.........b.!.......!...A.FemY`...)52..{...b9l.B.a.B.!.A.!.HB....!@.B.Hu.'.........rB.Fk.~...f.N......G].Q...=k..sN..?.......oN.(z..;........N.T.e.;9...C8.\|..8.V.....f.G........x._7+...4...;...-Ft...P@ ......"..B......".E@.m...!T.-L.Y.t.N4....l.....3;-.C....ecI..+c.e.4.....u.P.....\|..q6D.E.#>.7 ..1..K.;3.v\..XfL.3...h.C.t.........;s9..h....*.)F.'........P.%...b..~.2 6+8....[A.VV......`.ZV..+#...

Chrome Cache Entry: 321

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	110022
Entropy (8bit):	7.830253026927394
Encrypted:	false
SSDEEP:	3072:z47v/qjSuq0Ga8atLMuvAsdKthTqmLaOm:M7v/qjSuq3a8WLTAsdKTdRm
MD5:	3811051CE225AF55E95DDE62465297D6
SHA1:	07F9807EE04472B1D4CAFCA86A73FA4B11B79758
SHA-256:	69D14E2088827F32A456D6B4D8BD368E8B7EFC00BD5C8630ABEB4090E761A44E
SHA-512:	9D8A7902825986BCB546837E2B6BBD7BE8043D3F7C413D5BB0254A049C26E4DFB19E0BC9249A9358CAA2604A5D926947BB5C2C8714ACB42BEDD908C51F1F7A78
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/b27072fa42df/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc......8...."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......QKE..QE..QI@..Q@.Q....o.KQ..M..c0_..S....M..%-%;....C.e>.<g..e....4D.)..).p..R..E.P..(...(....)..QE0.Z(...(.b.E..(...(...Z(....(...(....c.E...J(.P0....aE.P.KIKL....PPQE..P(.P1h..c.(...h... .....E.S.ii)h.QE..)E%(.L.S...P...M...C.).)....p..\.T..R.U.....8.e]j..XF=.Q)A.^k...;..c..%.t.....m..L#.I#h.Kr9.J..j&P*f<TdU'cF.+..g.......!....yLkT....R.!./.>..CzV.....%...+..fcI.F..-}(...aX...W.Tt..

Chrome Cache Entry: 322

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	56220
Entropy (8bit):	7.971711922058762
Encrypted:	false
SSDEEP:	1536:7js7m7aOHrOC3i7koIh72PlUwew1tIAAs8:7AmPliwHQlUCIAy
MD5:	2271F93CA77239FF84AD75FAE0F2C586
SHA1:	670F10F4953BEF2C08882AF4EAEF360DB5580352
SHA-256:	4919F87F38A0246763E05C84D84FFFD12E61D6EB18B3563B48FF0F377A4BBFED
SHA-512:	131171BEB5C4ABD92A1FDAC7DCDD2350D725C4651EB02316B8A8E7F7794587742573B977165C383F32EF2C90941AFB53F1F3FA4B0B3C71F6CF47A2272D022975
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnn7uf.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................L........................!..1AQ.a"q.......#2B..R...$%3.4Sbr...5..6Cc..&Dds................................,.....................!1.A.Q.."2aqB....................?..@.z2...)...F.q\.N....x7.D....u.......$<..t6..B.sY.Dp..2......M....v.)...(:....y.#\..O.+l.d.ib\.1E....F..Ta.....`.....S..@.e.})....B..:........g...3.Q......RF'r.....YG.djO....Z...=.....LW@..=.^.Mg....vFH>).h={.LGDg.j.8.K....V$%.....[D....5T{OV.n....q.j..2.i...=43..8$>7....o=..mkmq K...;..R.E<..A...Q?..(..a.1#..K.K@S..o..M...$M...\|..\|...(`.....9....=..!1.v...3...o.3..T.....X...=..x...`...U........a.1..>.}..5[T........%.....d. W.q..O.-.b.1....q.<....W..Z..1...n.z.........%...........i..5...I.....A.aA8.I[)...................o.p^j..P...GV>j-.......SE...`.S.Px#F......r27#.X..........k.i6#./`4..A.7:.

Chrome Cache Entry: 323

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	161888
Entropy (8bit):	7.972073486275394
Encrypted:	false
SSDEEP:	3072:G80mMcWEel9drtayszXr0SS8vJYb9M9ufBpykT7UulbUWvuQzMnnLC:Gjael3hayUXr0SS8gMxkfplbP3MnnLC
MD5:	6BFA767537B53234C7436598923464DF
SHA1:	6670838995F420CB61A643D7B70F8C44AD377CF8
SHA-256:	007D3BB86B2CCECE5C9CC72124398D3A4F08CE8288913B0634FA1D1F564DD27C
SHA-512:	49412E24BA54C54CCAC874B4EE0F36770A4894B92E4BFC669459CA54C5FA7AE3FDAFD51A41C6823ABC5F7E8B0B1E8EA68B5251197C71ACD1FFFE6F1B6EA61172
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......a..{.T.....5.n..3..2..@.b..@.<. z.....i...)....;...=.i..p.T...._J.P.N ....I...\zR..G5 ^)...b)SO...:w4..S..r..g.Q..jr.4.?...=...).........&..GN.2g...oZz.8.t.9..>...KP.:S.....jz...... R.8'..?.i...D..T.,V..7v.)X........v0..."./'.Q(8.1J.......m=....6O.j..[.(.i......M#...J21K.....;.h.@..J(..Fh.q@..t..zP.c....h.@...*.....1@.....@.^.......i.\...8....

Chrome Cache Entry: 324

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	1399506
Entropy (8bit):	7.935177395625132
Encrypted:	false
SSDEEP:	24576:ztzEXuvzEXuvzEXuvzEP7B9vZbEcbEcbEcbt7W/ZOz+21/ZOz+21/ZOz+21/ZOr:ihhhP7B9vCpp+yO+MO+MO+M+
MD5:	C8B3D2F3119A81CC289EC5CA3AA6180D
SHA1:	B3047CF84B11DC2C460E0391684C99425C95B8B6
SHA-256:	F9399191A4A84B3EFABD647115F701BD111CDF620E657D6F800D8F20A57BE591
SHA-512:	69523F1B4A13EF6F87128E45E9BBF27FAFA7E4076E54C74547886192104DAE0A22871611AD7885FD03BFDBF7A43D08B1A58F23EC7BF3D97487A193D1FC44DDE9
Malicious:	false
Reputation:	low
Preview:	GIF89a.........m.....%.a........."...cs30/xtq.....`......ll......o......EG.....G....".......<...X]..t.W)&DD3...)".!....rSLZ.....B gif]3D......0h...pw...rq.GF...E3......TNi.....%...w.nPl...Uf.2<F"".51....W..VU....UfT.....Qhn....m.1D3ZT.....:pJm....$&:.......M.:Q.#.."..0....UUUDDD"".33.UUD...............""....WCC...3".33........................3"......DUD..DDW...\BUBU["3.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 26.1 (Macintosh)" xmpMM:InstanceID="xmp.iid:AC48F303B53911EFBCD285CAE455696C" xmpMM:DocumentID="xmp.did:AC48F304B53911EFBCD285

Chrome Cache Entry: 325

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	377690
Entropy (8bit):	7.970499794821201
Encrypted:	false
SSDEEP:	6144:vg//TCYu/rxKXTy3YDRNmMzXR3zS0D8riNA2sr0T+aV8wPvc7Dfw:vo2xKXTqYDRNmMzX5zS48riNA2sr0FVT
MD5:	EC6C4E668466AA08452DCB91B53D5B07
SHA1:	8EEC3B915D5CDC96240AECE10CCF8A482A16ECD1
SHA-256:	14351176AD6CD2E5ACD12886668BB0909BBAADAC163FA63010E6AAD65E6E6D45
SHA-512:	7241EBB7C6E37CD25194CFF875C19FE9A941072932ACB900113A99CDD202B855C54DB3BE617351202C5CE02114A384A624588410897328B0A19FF1F95D8B2A82
Malicious:	false
Reputation:	low
Preview:	GIF89a.......j.....M3........v.......23....u....P.H.....qnw..$.......dVT.....mP.\...r.".....p....b........m.S#.hV..f..(.PI..n`R.......M,..1).......J-%...n"...2...ttnE6..M.K..E....q.)$..OD.ro.M..L...q.k..2-...OF.p&..L...q)n1).q..=.J)1..Pp.!S......s.....K...J...0\..Nw....lR.nmC..z).R...iO.kPF..J".n...2J......N4a.(.M...OE...........q.........Rkn.....I......1C.$.$G&o..B...o....0..a.-...J....JM....2.Or..r.<.......St....\|....m..K..A.1..lp....3.;..3..C.."......".......3....w3.............f3.."......y.....3................D.."...........U.......f....."..w.3.f3...".w4........9."........".......C........U."........3..f..............................w"....3..8.."......................."...:..>..9....".3...1.9.3........<......$....e_V!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a1cd12f41, 2024/11/08-16:09:20 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 326

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	1016730
Entropy (8bit):	7.928262266657669
Encrypted:	false
SSDEEP:	24576:Lvm4n/QWWT8//C9MzwtEfcU+JTgfUwxVRNgScqMVAOqjyaXf0:Tnn1WT6vzw2fcdCfbfD2o0
MD5:	294291294D851FECADAF4C11864F83E4
SHA1:	A19EE3FFAA8E85788E5041FA456472E882A83CDA
SHA-256:	FB6BA271C0F50ACE681CAC8436EDF96513F6E5624E09D5D50617775784539A84
SHA-512:	88F1FA55551B8E043D693F34FF481C82AB470AA6D1950FAA550C0FFDE730221FC9F19C283B85D6DB321C49C45FC68A0D49EE4101E87388E8C0F16ED03DF0259B
Malicious:	false
Reputation:	low
URL:	https://static.wixstatic.com/media/dd9a87_4314275b0467418ab4bd32c8da4d6358~mv2.gif
Preview:	GIF89a........vT.3.P.........g..........w....SLE..w.U.kw..E...........R72...7...J..........N4J..z.zz....zbH.jc.m..x.....ffX.<..g..l.d0.dZe..................[.........fT....Q..v...Zd.ZbzdT.xh.z...`.8B.......vf.............vxt....P.....hRDhXP..v...v.t.....tf.{..thf..x...xx..UVY......UA*...xf.XDtjv.hT.M..tV...jd.U....watthfF4..h....zz.xv..ffh.W.vXT.h\.................t....g.l6,..........\..rV.\|....XT...O...hR6.VB.XPvF4vVF.....vV8........hz.v.z.jv.jv...XR.[.....T...X...xv.....x......hhv.H@fHR....h..v...p.p.hr.h.fF.HS......fHB..z..h.r....jZ....p.`....vHRvHD.r.`.z...HRhdHxD&.....ZbV........jtvPAc....jhC"..x.dF......jrhhR(...^...Z...Zbf...rH..F>@@7vR(?..._..~.t..F...m.z.80..j~b8vsU.rH..z:6:.t`.$......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 327

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 180 x 180
Category:	downloaded
Size (bytes):	509971
Entropy (8bit):	7.948322558716451
Encrypted:	false
SSDEEP:	12288:a0muKvDRKewJw/CnWQkPU0IjECFfAQU+yIF9uT/S2GwUiN:aO8CWVixFfA9EKm8
MD5:	E745B25CC3F2D71D89ACBD2B5C7F7437
SHA1:	DD49A6B3A2B4E0F441F31E5E136CEFF85B3E1FE7
SHA-256:	373673FB30B1F49B727EB216F5E7E144D3E502EC6F5AD29BDBBB7ACD9886BE87
SHA-512:	F8027E26226CA9A6A43C29B90DBE1AD65A628FC24FE82E5683457E9747CE82A5F8512D7960EE07EE40E481B9993BF73E00DEF8A5AC36AA4ED57538DDA4578BB4
Malicious:	false
Reputation:	low
URL:	https://ig79.vip/img/996a_180x180.gif
Preview:	GIF89a........I&....,I.......Mf....oJ."/"......J._.......+(O....\...D0.q...gL......."......g......p)$Dq.G-.Q.......o...Dn....o...]S7..%0K.u..3#..$..b...JMI.k,ac.....vi.....(g.%2k.v"..2.....f...=.w`.U<.3#.R.)...U;.1h..CRt.j-ELMir^ !-h......./T..&,/....w...+`..m&S..U....gz.f._mow...f.x.aknL.FR...Z..g.TgR...+)...V0E.O....uKN..."..+Q..-..!......5.. 0fr.+RkTh..I.....`....Lp....;...#.,.R.......r2-tD.ir.... ....1..#....1...1.-76.;..n8.."..".33w...."...D,.D.......3.....3........".."..3.."...D."........"...........3.......................3....................3..........."..................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 328

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	dropped
Size (bytes):	21142
Entropy (8bit):	7.9635438448009035
Encrypted:	false
SSDEEP:	384:ehPaeLEkYgrHiM0Q4Ci5MddU7nl9/4eUFnHvxwd2lzDTzyQlPSGZwJ2:ekewBgrHiM54Ctd67nLeHvxwOTBlPpg2
MD5:	0F492677875A89463037D8778A14B03D
SHA1:	665425BA76820FB097CC8948E5F545DB550615E2
SHA-256:	46A10B0D5B0B73437D519FC7E7016ABCC4E27CF419FD3FF70369D8A6198D68F2
SHA-512:	CBD21440E9F56956CA67FE58B09A7FD9D2AA1B9D806B2756F46982785F0AF0100EB3EC19601E0B19E52DCABF2795E011DFF7421E598DA61E7ACF3AE88908C391
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..,... .z...[..8-(Z.g;..MaL......l.p...B..B.+.c..cG......%q...^..!......zg..Y.ct.......+...G ........_.5.\..!.Lq.8.Tbku..Kt#...kX...:.:3.2..YP.a...T.U.z....z..<.!x..........9...Mm.Mq.K.....?.@z....k...SI...>...L..cT.%D?*.T..T..O. ......\..)...j=..A......Z.N.2#.f.i...L.#..A...!...1.8._'....?vy<v..ks..FI!u$2.....KYXtfu8..yj.....SX.q..F\|.s...k{...[..ue..1B{zdT9(.....5....yT._2H..t.....

Chrome Cache Entry: 329

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	189139
Entropy (8bit):	7.975159562817782
Encrypted:	false
SSDEEP:	3072:+p6a6a6a6a7PSlfKY+PSlfKY+PSlfKY+PSlfKY+PSlfKYLI0q0q0q0qA:BlllSaB+aB+aB+aB+aBLI0q0q0q0qA
MD5:	ABE6C7FDCB7234DA7723574BD58C9C16
SHA1:	150BE0E0770224585ADDACDBEB31386B520A4E93
SHA-256:	CF1CE7E6E3A4D91CCF52F813C1FE3B2E5AEFA10DF4D4B4A09E540F641F62E8B7
SHA-512:	DF6DC6E2AAE32E7367A90039B0FE9225D009AB5BC0942F9FD7BD9A8FCC38016A23461B6F6E11BA7A6CD57F45B6B71CF7B9EAE2B86E27184892B6D7CF3B6DC514
Malicious:	false
Reputation:	low
URL:	https://amjs.hccoeutg.com/i/2828/qqww-200-1.gif
Preview:	GIF89a........1.................Q.....w...tpp....\|..g..=..}......OMA....S.\.........R.Nq....................D.~&..VU....#.L...u..,...}.......1.y.........O.........,......+........_..jH..._A......._...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:2FA929E0C44311EF9B16C59026E582A2" xmpMM:InstanceID="xmp.iid:2FA929DFC44311EF9B16C59026E582A2" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c0bf165a-b239-1246-a657-a54a2bb39f82" stRef:documentID="adobe:docid

Chrome Cache Entry: 330

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	200258
Entropy (8bit):	7.929410283837095
Encrypted:	false
SSDEEP:	6144:QyWKBkBlSvPgzZUoPUJnWJGb6F34spYQdsbKPoFVpkHH+FzbL:nWHPSvePKx6Fmcbw
MD5:	1B32CE489FDD7B8FF79A5A9854D2C9A2
SHA1:	364ABE6A4721493E3B2E981A88845F0222CA2442
SHA-256:	117E900F144AB2B544BDC7AB5FDCB353DE8D35BA4B4EC732E330836432C2F8A1
SHA-512:	3BD4446B274A9E043892CAFDC36B5B60AA976F2032833D43097A4AEC74B144B0159BC3338C9A5BD328FE97519675DBF2993D286CB9576AD7DCFCDB8822E856F6
Malicious:	false
Reputation:	low
URL:	https://amjs.hccoeutg.com/i/1616/PPJJ-1300-240.gif
Preview:	GIF89a.............m......j..).............l^...`...+.....E.....n..../.....mY../fP..H.(..dYS./..........................i.....a.1.".......s...G....._....dT.H.....rc......H.=j.V....._)......e.....".K.WW....Hz...M."[.......i..u#q......-..m.2..5...D"&,.4,.3)..\|..r.....s.@H..1/.I8,....a....k....O.8+............s..........U..D..[..?..<........U.....R..................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:FD07343FBAA711EFAEDEACEBC96076FF" xmpMM:InstanceID="xmp.iid:FD07

Chrome Cache Entry: 331

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	33072
Entropy (8bit):	7.942485284893125
Encrypted:	false
SSDEEP:	384:10J8NbCPwZFyAjfVXB4+SQuKBsOtoNviqYEeeMq+xMomPIO//J88UhBgtuTr60Pa:2cGYjfjN2jOTaaay0/O89uC0tFizb
MD5:	64B1DC4EEFC3D7A1D354070D31C7246D
SHA1:	354BB499EF514441821E614870F6ACC308027685
SHA-256:	911658AF05CF8D1AB2EDC8A297AF6F86854B02A3FBE4D38F3F2F0D7FB5713E1F
SHA-512:	E028AAE6FF600ED3DDA2B2306AA4CC5DF26F64658A0413E9165892115F538F6D6C14818A60AA82D1642BA651B542C7ABF0F96864BB1041BEEA8BC068B28FA79C
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unc7yj.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................?.......................!.1A.Qaq...".....#2...B..R.$3b.%4rCs.................................-......................!1..A2Qa."q...B.....#............?...#q.9....<.z......".......H...H.AK.9..:e.eCn.~.x?..u..sd8fV....c.a.......!/.4..!....y..=.d..Tx.m..KPK}.C.BNBA.,...N..F.p).....Q..<.... )..(..x<.H.p<..`.....Pq...C..,.... p.s.@.......,.Q.T.."Q.%M."P,...p.@..IB.,.D... #.@..).9......P....B.?.'...2...=..........r..=Pr..)..V.p.9.NP..P...)....yM&.=.3..)...&...>....?.n..?.G>...B6#)...... ...U..]\|.f..=.I.....B.A(....!.J{L.=.F...8.V..%...&J...q.U.8.N.3.(07R%..z.'..PI.8.Q..N.......p0p.....p<(.p>.8R..p9..q)f...!:JbY.@.P.P=T..B_...%D.. l.vDe"=......L.D...G......Rs..).p.a..A9Gd.."?T...P!G.w...G(...'...._t....(..$..\|..9..I>..s..r.'(...........M.@9..[..

Chrome Cache Entry: 332

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	309347
Entropy (8bit):	7.974320549058613
Encrypted:	false
SSDEEP:	6144:9Aif7I6mXVrAyGW12o3iEVGO7QAhuPI83IPKRwhACAsxYbr:9Aif7I6mXiNWriEVGOcA18cv2O4
MD5:	051AD896596DBB87DFE6B82EAFF2DFF5
SHA1:	DD5E76A2E6F8D55B69C62BAE901844DE2992CF4E
SHA-256:	EADE9FD1CF4E255BBD0DD0E990833A3AC8B1B667DE2A1AFDDD75FB48E6661483
SHA-512:	873805075F4B2E62E595E2F8638FD719F9DA36AB5510A82F9B03449C79531BE86DF01A981793FB04B019DDF1BB210DA2B05A8D13C5C073A01C9193B8D2892DF8
Malicious:	false
Reputation:	low
Preview:	GIF89a..........1[.....g_.O.................g....n.................q!o.......XD...j...................U.........j..3......#....'..I....!.......')ihe.B....m.`U...N).!.........h.m...........Q.....^`.....s.]g..R..........6P..5V.k.l...........\C)........k..4..'&...9.....N.".... .B>...0..l..R.#:..6...]...{...........;.sB...+x....,1..?....(..Z...I.......;...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:C5E130E50AEF11EF9EB7E92EFD62D297" xmpMM:DocumentID="xmp.did:C5E130E60AEF11EF9EB7E92EFD6

Chrome Cache Entry: 333

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	200936
Entropy (8bit):	7.936207161651887
Encrypted:	false
SSDEEP:	6144:b6V5gXqcgXqcgXqcggF7NhHjzZXW/0TbPUyJha:uV5uuurFfH0/0Tb8yG
MD5:	CFD025DED33888BAF13AA3A9B433D526
SHA1:	9CACF14EB35821B84351C28F322A96D9D3206E38
SHA-256:	41D67E21A33B06DD15A34CD9A81DD1A65C802DBAAE736209D3AB4F02EADC6A39
SHA-512:	FEAEAA9704E73C4961A9F5E52C1193F8B7628E4EB514EAD9677AF738838599F49574D17DF7A901B494EB614A6DFEA65366E30E24C681FE741BCD47AF7333788E
Malicious:	false
Reputation:	low
Preview:	GIF89a...........cQ.}ae.....Q7...r...../.!r......H....R..FG......k.....y.qV.lR..-.bI.ZA....R..M.(R..;.....e_p.....vh.w....\..}....X.uZ.\..m.$E.5...m.fL.....W......7E.......b...i..........VM..f.........m...kk..`.GH.]Q.*...V.......U-S........O...................i.N[\|.y]..W.xC,k.....F...B.....3..v.ht.RL.................Om.....v....y].,I.e..k=..u....uj.tt...B...../En.....v.].....U..~.......jW]l.....i........qV.....;U..i..........GN....{....Q.R.........u....J..m.}^.pf."F....6`..\|.].....R..m..u..v.6U..m.6G.....FL.v..e....G\...=.F...D_...T...i..jL.t\.p...y...h.......)R....~.y.......v...`.tU{;(.VT.....J......SP..j\..~.............r..p...../.....].v.....f.U..e.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 334

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	170778
Entropy (8bit):	7.964947347065151
Encrypted:	false
SSDEEP:	3072:egKGCEc7yp5r1D1mK7h7Z+PyFz++f7r6iRoOwvB4e5PVgTsALR4RwvW92CtjX7p/:dfAKVBnhF+Pn+f7O4oO7yPGTs2RQ+YtF
MD5:	B32E304B035A09B66A8509E05ACC0C2A
SHA1:	B3BAE10B5EED78E58158726456D3270B8410194F
SHA-256:	85F1087D82EC9CED5B16A6B22D5A0FCBCED867CB20B083A1A68BB19A066410A8
SHA-512:	0A9C0D22810E3BE4E516597092D3D065C054C935876AD7565FEF5C09266C090A76BDDAA578D254581CA4CFB75FC7509064926008B4B89FB03D04D3CE0049D27F
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202412/31/7e6af903fba5/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.....NM ..q^.\|.N.8.c...i2M4...zC..!.LBQE...E...@.........?J`8<t....LQ..zRn. ...P...M'...VbU.#.J..~1.a..@.1E1...).H.i..B)...sL.......f.u=j\|`.5...De\....i.........&uN.Mf..5iU...<..[.=9.v.y"...Wm.....x..t*..".:.....5............T..Vm...{.....Q.z.E...u..h.Z....c.."...<qWg...?1.#..U.8......6..:.......W..x8...W.=.G.uS..z.n..8....BF.O'.R.._z...eb...s.5..r.{..6

Chrome Cache Entry: 335

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	569641
Entropy (8bit):	7.9342612974885105
Encrypted:	false
SSDEEP:	12288:/048CZNeI9r/lKqT2x4I9NNMqkCvulLYCipexOncIJd1Vbi7KfTSQdoelYKM4:/0BOrrSMqfvu6B7sKfZOSPM4
MD5:	6F3DA74816D4B2B65413F732991F8C10
SHA1:	257EC151983729497DE63FA674B2A730753DC360
SHA-256:	C82EFC6C479624811E07CCA50C6D63D8149B6176ABBAB9D6B931E3BAD16180D4
SHA-512:	AE5C49C25CBA921C427D64FB2A97F0323A570A679DEAF74488E4211A2F75531A9B5B3541A7E4A0373113B6405B986E2DD32B9D9AEC499B994E131DAC5442E98D
Malicious:	false
Reputation:	low
URL:	https://sezhang.s3.ap-southeast-1.amazonaws.com/wns1300x200.gif
Preview:	GIF89a.........................!..+......!.;2$?#.J;/M5 VF6\TB......!..-..gO5i\DkbGy]?zcA\|lQ.uO.q^.~^/..=..@..O!.iRBzB#.oM.}c..s@..Z;/.cE.yayQ>.neO..O..@..`!.>.....3.....b8.7..A..D........,..-%.>8-vi_...L........f&;!..).....TF$_I!.wL..b^..UP@~j@..L..e..w.....b..x.....................g..]..c.......e............n.........n......N....x..F......0..,..0%.4#.A .N..a$.?..nmH...t..kU(=2.L'..o8}`'..H..J...mTF.K.....I8....HE:iI..~6..r2.....B..R6.[9.^K.c;.f[]iH.mU.ywj^K....:98RE.LSEgkixO.zT#}d..[..['.n..b1.m".y..{ .o%.\..l..."....{8..6............<..H...P.b.M.U....k......\|c..o>...jW..7.....Q.X.....X..f....\|....^.FQXb.{?..M..M..P..W..{...c8....%#.:(.h:.T,.h.c:.H.R.U..[..^..c..d..d..g..m.......6$.T%..........................V..V..X..a.........!..NETSCAPE2.0.....!.......,...............HPF...."\.!R....J.H.E.../j..".. =f...$.&)>\........0.&.7_...3.2...j......M.t..P.JEZ...1.j..+.._.F.Kv.W.Y.U....p..[...]..t./.~..L..0..]$.......@...rc./_.....

Chrome Cache Entry: 336

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	33072
Entropy (8bit):	7.942485284893125
Encrypted:	false
SSDEEP:	384:10J8NbCPwZFyAjfVXB4+SQuKBsOtoNviqYEeeMq+xMomPIO//J88UhBgtuTr60Pa:2cGYjfjN2jOTaaay0/O89uC0tFizb
MD5:	64B1DC4EEFC3D7A1D354070D31C7246D
SHA1:	354BB499EF514441821E614870F6ACC308027685
SHA-256:	911658AF05CF8D1AB2EDC8A297AF6F86854B02A3FBE4D38F3F2F0D7FB5713E1F
SHA-512:	E028AAE6FF600ED3DDA2B2306AA4CC5DF26F64658A0413E9165892115F538F6D6C14818A60AA82D1642BA651B542C7ABF0F96864BB1041BEEA8BC068B28FA79C
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................?.......................!.1A.Qaq...".....#2...B..R.$3b.%4rCs.................................-......................!1..A2Qa."q...B.....#............?...#q.9....<.z......".......H...H.AK.9..:e.eCn.~.x?..u..sd8fV....c.a.......!/.4..!....y..=.d..Tx.m..KPK}.C.BNBA.,...N..F.p).....Q..<.... )..(..x<.H.p<..`.....Pq...C..,.... p.s.@.......,.Q.T.."Q.%M."P,...p.@..IB.,.D... #.@..).9......P....B.?.'...2...=..........r..=Pr..)..V.p.9.NP..P...)....yM&.=.3..)...&...>....?.n..?.G>...B6#)...... ...U..]\|.f..=.I.....B.A(....!.J{L.=.F...8.V..%...&J...q.U.8.N.3.(07R%..z.'..PI.8.Q..N.......p0p.....p<(.p>.8R..p9..q)f...!:JbY.@.P.P=T..B_...%D.. l.vDe"=......L.D...G......Rs..).p.a..A9Gd.."?T...P!G.w...G(...'...._t....(..$..\|..9..I>..s..r.'(...........M.@9..[..

Chrome Cache Entry: 337

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	dropped
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	low
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 338

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	63424
Entropy (8bit):	7.969482714309869
Encrypted:	false
SSDEEP:	1536:OsmqC6CYavXo/0e+ZabBxe4h7acYTmx/IDhM6koB:OQCYz/0xZabne4h2AJID60B
MD5:	9FD8B93B43DE3EFC5B04DA063D746BB2
SHA1:	E9F3DA5E4A17A336A0D447A1D99B6708E3745199
SHA-256:	9A157258B36D18F4E78FB8D4DF202FA914B4613A62412202D2C9CF6F59B0F733
SHA-512:	5F077E2EC79E71001C05021ED429A707F04256461E2956F045368518204003686C9107D4870A8079242102545A46223FC1892AEF2222161589D9A5AC370C611C
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/128ca5d2c073/1.jpg
Preview:	......Exif..II*.................Ducky.......B.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:C04F9B9ECB2D11EC9874C22BF42896E6" xmpMM:InstanceID="xmp.iid:C04F9B9DCB2D11EC9874C22BF42896E6" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:5BF31A282DCBEC11A440C30EEA48CD58" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 339

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65451)
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/static/jquery.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

Chrome Cache Entry: 340

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	1186304
Entropy (8bit):	7.964937540280997
Encrypted:	false
SSDEEP:	12288:usXedinGlPfolel02BfPnGlPfolel02BfPnGlPfolel02BfPnGlPfr+Q0ge6JH0B:ZX1qosNPqosNPqosNPqm6JUj6JUj6JUB
MD5:	4C773834FF3DBB159F83465ACC4025A2
SHA1:	C8718B12EDF84BA134D8884AAC3BD0BD7F7841A8
SHA-256:	27D58920C398BCD1711381B510ED67CEB891E126CA98C8146C0728ADBD18BF33
SHA-512:	2ADC2527630C519CDC1C8B1B804EB29A47704806FDF5C9891202ACF9D4537E79DF3B9FB8CFF153BEFA2FB75051D1E015A975C5990BF7C4500348D0FA91901E91
Malicious:	false
Reputation:	low
URL:	https://2024hwus1.heibanwa.mobi/jsgif/ny.js
Preview:	GIF89a.............I.....D....-"....".....3.".Sk......y.n.....D...."....hU+..0..)U.....p........b..wg.sm........(...-P....T.r.....Mq"o..n...'d.....x...t$.K.K.m.$.U...3.+%omq2...vm..........+....pSL...MHM.fW...hC0.".R%Q.....n./..D..fZ.....J.Cl.H/.$.r..s.R.......r..qN.p...Q...UF.P..o.L..Cp.45....L..T.J..qh.g..HELUo.03..0..k-..MgkPjo...f..M.o...\|wiQ.C.....C..o......D?..1......N.%.....!Ofx....oE.N......]k..-..,.Oi.....5.....m..-.",."...Kl.M@N$......w(:......<U...d.o...N...R1`O"....}.....G.z...y.'.U....................U...................U................................................................D...........B..................................................U...................................8...?....X...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 341

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	189703
Entropy (8bit):	7.879846054013433
Encrypted:	false
SSDEEP:	3072:eKwoyfzOLYB5fzOLYB5fzOLYB5fzOLYB5fzOLmCwTDxBHpviDxBHpviDxBHpviDH:jfyfGOfGOfGOfGOfGmCyxBHpviDxBHpJ
MD5:	5A73F2D2E9DDF22D34D58CED6E3E6E90
SHA1:	8BAE6F5623AE0034DD58DAFEB92BA40055F3284C
SHA-256:	6752D33F22785BFFAAF1ACC3B7F85A349BC54A903E0F6A47A89AD6B02D0C66E3
SHA-512:	E7A4C50F7E1695DC0ECF50AE98212AAC93E371ABF048FD9081C0054820566EAE5F83C1748FD002F092B303EF6FC8F711AEFD1A07FFFE5DEC1AD0ADDDB1E3C0A4
Malicious:	false
Reputation:	low
URL:	https://sz.ggshezhantc.com:8686/150vip.gif
Preview:	GIF89a................ONL.M..0..M+pnl.....w....n....../LF/............L_...smLda.C$"p...1+.........................f..m..oN..h....(..yW.......p..+..o...%$$...q..mi..sZU.......O..i......755.......m.........g/.....)......sm........-(....!....T.....x....UD.2....P......z.-974$...............`...".....F.....V.....c.M_V8.....+..3(%.....".......U.....Y.......3.............%...M....qk....................h..n..id>............j11..Hp........K...=o..........y."DM.....i.......8.....0..................6........lv...p9..Cr5.....u.w..................[.....5."..$..J...3..G..........{....G3.@:......................"..:qG........X`.!$6...jH....U "!......@$.v...;Kq............6D.....................XX^^^.'..........a.m!..B...Y:BAC!........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 342

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	122363
Entropy (8bit):	7.906228965112134
Encrypted:	false
SSDEEP:	1536:5p/nr1MuPuPXjbLSRHiKsHfnS/Tu5ACI5lPkCMGBxaanS/Tu5ACI5lPkCMGBxaaJ:5JJMeeXCdsHPSrtCItSrtCItSrtCIC
MD5:	CE34A5DA9B3E38EC9AB9572F8215A7BB
SHA1:	1FBFA0C0C8FED98DE24B709F6327A912E02E2EE6
SHA-256:	F4BF88FE459A47CB8634F44A14489F8829E4096901BC41AF14CD2749B0D04B0F
SHA-512:	9B4324F3C3DB547B117701510801D758979C08FD7CCAC1E220A1010B8684F483A056787390FD2FC0714CCC3357326EA4E5E2AEC551A1F0555F7339724DE776DC
Malicious:	false
Reputation:	low
URL:	https://tycjb777.hccoeutg.com/i/LD/SH132.gif
Preview:	GIF89a..........qqr.............c.......YC....$...[k...Z....1 ....Nq.R.....o_.................LKM.d..q.T.,!"$..T.Q..#.....H.......&j.....oig.!_l..........(....2T..........(+Y.C.......n#@.....m....Ol.o........Ks.q.o.J.....q........L....335...p3.....x...y.....O..2.....J......I.....o..B..........i...w..........O..I..........NR.kp.........@.........,2^........../V....4i.:...u........q.H...].&........N-......L.j..I0...sN...)...4P..(pjB.o..Z.YY]....m..3..........P.!"....n4f1.x.P.C..L..J....:...ol.....{EL...2....../D..R0.........]...o(1!..u.sM..K.....s./\|.........-8.('23......F...oH)),.H.....LL.5..{...ccd...H............V-q..............[^? .c.Jt.1...B......B.x......D6.......f..a..@.!5..9$B.53..........................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 343

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	63320
Entropy (8bit):	7.969320384200143
Encrypted:	false
SSDEEP:	1536:f8cLq45srm1xydaVJX5LkudkvOJ1SJlz3OEF0aGX1NQmBZAWTIuNJuet+P2a:UHr2xyaxdkvOJ1SJlz+ETSbQ+2W0uN8l
MD5:	792826237D13359C0EC9F68DD84971F7
SHA1:	A821E4294B4776310380E8D4ECBB7FAB11A19194
SHA-256:	F92576458C0EB2677F24C3411400A90907C8AA110E4545EEA950BDA55BFEDF25
SHA-512:	AA74E3A6560DD698DC5E7CF57876B17CA3AEE8D46D221F76592084C03BB4EB61A90CF47BCCA10A631A01864FE6AC06003FE850CC656FB5FBB888356FA06C89BE
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unae56.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................F.......................!..1AQaq.."....2...#r..Bb..3R.$Cc..4s..D.ST................................./......................!.1.AQ"2a.q....#....3B.............?.#........s.pq..v...Y.bo.....u=..i8..B.\;/...p9..Y+.b=.B.).Q.>.F..>.k_fy.'..^..8.JY..'n.I..f....A.sa.m.g[f......+wu.^YA......Z-=.KF^..w.M{c....#.Z`e.nR.rJ9..;M.K.&V4.yg$.nXd..s...8...k...~-.o...P........s.Ii.1.`_..j...Z._.1%.y.....A..xu.\...;.2.T.......%.e..K.?..;.._..h.?..q...[:..9.G....'.J7T.`..k.xW.x.....u6.w.;...3.\..F.....{.".......Y.......v./.bB=J~...<.....k..M...V~.p..s~~kM..:_......p> ..zI.[:z...h.g+...o....w.P...@!..Cv..i.....H:\|i..).D.4.MM...U...kb..[o.......o.#.x.....&.3.[....($=.g........C......M.A8]..Z.q.~..(.v..S...k..'.5......X?.'.$..5W.7.....@...>{W9...#.CT.

Chrome Cache Entry: 344

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1004x552, components 3
Category:	downloaded
Size (bytes):	35910
Entropy (8bit):	7.856508623408437
Encrypted:	false
SSDEEP:	768:cGwePFXoFo3FZ3xSDgIJ48A1vi++aK4ARUechJ9NS:cPtiFZ3xSUIJaDK3+8
MD5:	28D96D2DBCA11E4CE2FED6C668308D59
SHA1:	656EE9F12F7B20AA67B0A17A9C2496F46557673D
SHA-256:	0A4F8EC1B5248DF549607ECD542BE5582162FDD83F49386B3D1CB6F660E195A6
SHA-512:	15F0267C8000620B867FB8C6AFCC04C4CD03987B9CD81EEF351FE9FF6B83EAB380EFBC6FE8C179A37074178D7302E9ABE067D887CF45E508836B1B2793E76098
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ddf6cafcea0f/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc......(...."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......oZ....nt....1..R.J...{..5.(.TQp.&....A52......@'.1G.q@.".zT...Q.sS.jh...j.e..m...>..\...@zb.;I\|..o.e$'.!.....t.ub.....d.....d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H...:.E.W.$?.?..d.....P...C.....H....(...!.........Vi....@..E..F....um..Z.}.?......&.Y..I.+.+Z..#.+..p#.J...P....C.......EH...d.......t.ub....H

Chrome Cache Entry: 345

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	39603
Entropy (8bit):	7.96772396422886
Encrypted:	false
SSDEEP:	768:kGC6Ok+zuHrXSi0e7JcbXkdjX0PnOA0DeuskMQlYeorJ:kGL+KWi0e7JcbkVaOAIxM7R
MD5:	0A9962B140F33A97E9B91ECCD0EA5478
SHA1:	7D7A5837CF0604EFD875651511FE621B3A86B6A6
SHA-256:	84B70C5C706CA7DCFF7BB225A6E7620DB8B9B87C64E0E95AAE25E31E78BA38F2
SHA-512:	E0CA98B98FBF641A7C960835D38119AFD3CF3CFDCA7A598D598D9C81ED0B92C024FDC2CF4B1599FA1AE568F076D3996F7DC00D168DE64214944D81289094B688
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/un8bpb.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................F.......................!.1AQ..aq.".......2...#B..Rr.3b...$4C.%5DTc.......................................................!..1AQ...a...q."R..#2B.............?....X.D.Ln.J..^.~O6.....6(..qM14.T.7.L.".3.(.j.V..^T1...1..R8...+).1V.>.HU8...b.uI..>.T.hZb.A3Q.U.L......c....cs/z.#M.~V.~h..Q(^M..Xgj..l.j&N+....e..Z.]f..W<.GTgc.'V.....y..v...t..5.m..B.N)g.z.L...N........Rm]..1...r.+FwO".e..)+.<mN.l..F#..kI,....A%..v).mP......$c.P..m..@AM..,..F.........R.lw.~....lc..D.N3#.@.^t..j.)...G..Y.[C.&.Zy#t......%..p=.D.fm&.e...f..E.o.n-.L9.+..p....]Pvq.4..].R.js...1WR......J..9..<b..j,......V.f.@.1.Ka.n....1d..`...i.&F..q.Z..B...s.JB...r..J..6.`.j. .28.M.SQ.Z9.L.....9.S..Rc....v..T.ySL....p...0..9T.LU5.t_......e..l%......LM..."oK.3C$q.Vjf..Y.4.Nj....W.-..b.%...N..

Chrome Cache Entry: 346

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	199338
Entropy (8bit):	7.947264826102204
Encrypted:	false
SSDEEP:	3072:Usw6v2vOLJEW9BQfaKDAQR22YXQQj33Qus6qKOyklnr//HwD1Xa:UWvyOLeG4LhkfA6OllnrHOxa
MD5:	D7D0D7E25D428EBF82BB5962CBB6A0E6
SHA1:	15076311517EE396A43F3D2753458FE3AFD64181
SHA-256:	54FE7E88E15DA86F63FE54D9FA6059EEC5F41804F2CD1343DFF2BE5FE516AEF1
SHA-512:	8E02C7DF9EC2B8A86E7777BEE02467E4E0E28032F13F1AC782F8FDEC1583E9CB85E32EECEBDAC101381536131EA01626A1AD6B484AD0CB0AFAF02AA8FD2FBA7B
Malicious:	false
Reputation:	low
URL:	https://cc777img.dqsldz.com/i/2024/12/05/1300-200.gif
Preview:	GIF89a.......j..mS.........L..neVd....P...iO.....U...e..........uD...F.q.j.i,..ee...............i.3..........n......(........D.......K.w..f...pP%..r...,..@..^...pqiA.".R..j.....m........n.W.....f$...........2.......6.f.U$..S.jK.......q.....u..)..O]...&.oY....K.u.^.q.-...ts.......w4..R.K....[b..k....L.sJ.o.e/......i..L.....7O.....m.0\..,....k......)..(..RD..N...Z.b.K0....J..P..(1y2....K\|.....$............9...>.(2.&..+..M;....$r.Pk..ND..m:9............'-......LB$o.9.../...+<.../...z1. >.3...5>.....h`.:".f3.w...D..3.eD.......".w..".....D..U...U.........3......D..................D.....U.D....U......U.....U...........3.b3.............<.......................".............Z.....................".z....=!.X.D.U.............+.f......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 347

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	49448
Entropy (8bit):	7.821512628259457
Encrypted:	false
SSDEEP:	768:3t2tn1hWn8LxgYY8pA0egri3H+Cp5s4p95wGmCTCS5a4zkx3ZTL7LGFHoEr9q5WQ:3stTzLC+O3V3veSQdEI5sw6q
MD5:	7309E870090743A54254BA725713F788
SHA1:	45114E1E559CB3FFAC589DA6BCD3D45AC10839D4
SHA-256:	64BB6CE40E0E124204768740E39ECF30188306356B98214F959EAE7BEDA87A84
SHA-512:	3C2CA3A95D75CD48434863A8E335195104A7964D1FE6DF0DDAD87617DF47DF686465F7FE6E3F15199F0932848FB4BBA658A20E809A6CD9C18B34FE641B14CB03
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202409/24/87dc8d74df0f/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C.............................................................."")...........................................................................!1.AQ..2qa".....r.R.#B..s..3b4.$.%5..c...t..C.....................1.!.AqQa.......2"........8...."...................?...).m.l....". ..AQ..V..ms-..ZL.hh.4L5h..X..J.\Zm.-"........g.;N#j....rd..V(j..(. .(.UJ...h5..U.4..Y.f....UD.!@#...L.P..3..@..........D...a`.G.i..).........C#...C...(@..4aB.............j..h."Q@...@.$............J..$............#!@...P.1... ...0F.-(.R...J.$..........F.....[%i(....420..!..S.&.(.H........##..........p.B.".rRt"..7.rr.:.o....]...t..M.. d....@..J..FH..%.:...AS.U..%..f.@...35\D...z.i-....._..0.....''>N...A.X...*..wU......A.D.Q..&..TaIyD....KEE.. .D)..P....1j.+K.PA...F+.C"]@........ {..P..(.A.5....T.HRCO......##..P..................... ...........F...d....1H..h.(..d....2D2.R......\|.H........$..B0b.0"L.. `@. a.2..#........... ...` ...T..{!A..0........C....HP.$......R

Chrome Cache Entry: 348

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	31752
Entropy (8bit):	7.763236738233559
Encrypted:	false
SSDEEP:	768:8z9Lzdgjd8j9nhKotN8RyAC9HKY8Hi62J:8zRZ6RKQypFKYmyJ
MD5:	66B46218A77F8DA6C8F2555365FEFB79
SHA1:	C83EC406ED9F1114C55065852BCA0B65E43F95B7
SHA-256:	63C9BE4AFD63F921EA88A485684ED2A9BF1E18926B4EEDC5258F69A000266FC4
SHA-512:	578DC78F3831AEF427F4DC192BE3BD1658DAC5301EDFF1B9C001C29664ABEC720450467B88A3704972EE726827F59E7E784F9DAD83567197431D6EF0408C6B4A
Malicious:	false
Reputation:	low
URL:	https://hongniu.getehu.com/i/2024/11/09/150-150.gif
Preview:	GIF89a............h..XK.....w.O...W...........$........p..a..jV..K.................T....u+...v.S....R...Z#......-lkP..HyC......Q..........K....@..k&......T.44...5.....?.8. .:%...{O.........n..6.....k...?.._._...........?..2....u..................b..g.u...l..............p..m..c........h....h..../.......`.......u........>.....S.......c..K.......e..<..;....f......O3...KVE,.B..Oz...........Z..s...E.......y4....u......3..k..G.F.E..!..!.X........r.v....={#.w#q.@........u7.......7]>..G......r...u......S.....e(......^........"=.....G._,.[4..r....R.......'4#K..........!.............#.............&........#........(.....%................=..........?.....+..0..........-..6..'..+..5.'..?.y......2..9.!...........6.z#.........i@@..@.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 349

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3341
Entropy (8bit):	5.8318153197070615
Encrypted:	false
SSDEEP:	48:IZwVPnVY+h4VL6pIV3GlT5+545or6ZcY5XzqL8Zflryks57SdCYzZgG1cgXGrZ:IZwVPnVJioIV3Gve8n9XzNpIPn
MD5:	AF5915373165E7F27263FA4950650D01
SHA1:	5DA4C0A6F63AF5912AC5E934B1FD35B5FD35E915
SHA-256:	9086AE5EC243C2EBBDC8B17F207AB28EFD3F5128F54D3D06A14DC6EB1C2BF32C
SHA-512:	3EF55788AFCEDA198E89EA350A0B5AE4D7522E48C63AC92D4F7C2E0F06E1ADCA7EC40169F409730DC388FB99BF9BBECBFFAA8F1707EA47387D25692CD02C1F86
Malicious:	false
Reputation:	low
Preview:	var ua = navigator.userAgent.toLowerCase();....var isSafari = /Version[\|\/]([0-9.]+)([^0-9a-zA-Z]+)Mobile[\|\/]([0-9a-zA-Z]+)([^0-9a-zA-Z]+)Safari[\|\/]([0-9.]+)$/i.test(ua);..var isMobile = ua.indexOf("windows nt") == -1 && ua.indexOf("macintosh") == -1 && ua.indexOf("pad") == -1 && ua.indexOf("x86_64") == -1;..var isAndroid = ua.indexOf("android") > -1;..var isPad = ua.indexOf("pad") > -1;../* .. /..var helangSearch = {.../ ... /...els: {},.../ ...... /...searchIndex: 0,.../ ....... /...hot: {..../ .. /....color: ['#ff2c00', '#ff5a00', '#ff8105', '#fd9a15', '#dfad1c', '#6bc211', '#3cc71e', '#3cbe85', '#51b2ef', '#53b0ff'],..../ .. /....list: [.....'..',.....'...',.....'..',.....'..',.....'..',.....'..',.....'..',.....'..',.....'..',.....'..'....]...},.../ ... */...init: function () {....var _this = this;....this.els = {.....pickerBtn: $(".picker"),.....pickerList: $(".picker-list"),.

Chrome Cache Entry: 350

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	189703
Entropy (8bit):	7.879846054013433
Encrypted:	false
SSDEEP:	3072:eKwoyfzOLYB5fzOLYB5fzOLYB5fzOLYB5fzOLmCwTDxBHpviDxBHpviDxBHpviDH:jfyfGOfGOfGOfGOfGmCyxBHpviDxBHpJ
MD5:	5A73F2D2E9DDF22D34D58CED6E3E6E90
SHA1:	8BAE6F5623AE0034DD58DAFEB92BA40055F3284C
SHA-256:	6752D33F22785BFFAAF1ACC3B7F85A349BC54A903E0F6A47A89AD6B02D0C66E3
SHA-512:	E7A4C50F7E1695DC0ECF50AE98212AAC93E371ABF048FD9081C0054820566EAE5F83C1748FD002F092B303EF6FC8F711AEFD1A07FFFE5DEC1AD0ADDDB1E3C0A4
Malicious:	false
Reputation:	low
Preview:	GIF89a................ONL.M..0..M+pnl.....w....n....../LF/............L_...smLda.C$"p...1+.........................f..m..oN..h....(..yW.......p..+..o...%$$...q..mi..sZU.......O..i......755.......m.........g/.....)......sm........-(....!....T.....x....UD.2....P......z.-974$...............`...".....F.....V.....c.M_V8.....+..3(%.....".......U.....Y.......3.............%...M....qk....................h..n..id>............j11..Hp........K...=o..........y."DM.....i.......8.....0..................6........lv...p9..Cr5.....u.w..................[.....5."..$..J...3..G..........{....G3.@:......................"..:qG........X`.!$6...jH....U "!......@$.v...;Kq............6D.....................XX^^^.'..........a.m!..B...Y:BAC!........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 351

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	124953
Entropy (8bit):	7.982263722335583
Encrypted:	false
SSDEEP:	3072:sDC9JCHW7W76Ksnf0UKsnf0UKsnf0nGfLkYTuGfLkYTuGfLkYTa:sDowH++psfSsfSsfhT9T9Ta
MD5:	0A98BE5BE36B9EA1CFBB3C02981318AE
SHA1:	B7DC557737F318CC2F517A140834B365F4FBE12C
SHA-256:	8E08D6E6340F6A882ABA7504F3A98A2ED12B900764B534113F1D9A7FFBB40DD2
SHA-512:	CFC439EFFB2A15946D69D03108BEE182C543433B84A6FDA0760F1B348CAD264641A882C5CEE1277303278035F5D94DFE90E1552F9B46A5DC4EC1A9E286165653
Malicious:	false
Reputation:	low
URL:	https://www12.pengxunfei.site/jiamigif/tyxsc/xmspggTT2-200X200.gif
Preview:	GIF89a.........q..............iiW......k.........n............[.[.....o...r.......0..r.......gP....f...........rPb......L6....X....j.......%....U.....................5.qoT.i..G.q2$..X.'....ew...I.....i.....x..p%....qg...vG2.....0.......XE.^....................e..[...$4.....n..............................e....8(.Q.....I.......$.,..A;2..z...s-..V..l./0.Q.......`.e.u..M..k.>b..9O......J.NM.wa...%..+.......P.P.....a=&m../2.....,e....L&.Y .r..D...mf5.........(...8$...q.........f.......).........'..k......1.:.^...S..Y............\6.4....G..H..[.T.30....S..GZ7.......o...............2......C............a......a.7...v..]....^.................J..................). ....s..^....K.....................+..`=...&....2.c...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 352

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	705232
Entropy (8bit):	7.954172923869107
Encrypted:	false
SSDEEP:	12288:m4/qP/z+ER5UZR/ozGdWRlj2B7djNfVHK7CV4WhINY6S+0o6Jbr4jT5hu5BsyA:meqXz/gX/ozGwr29fVRTuq6S+0o6Nr4L
MD5:	6FD5F9C4DB301936F752DB820FC7B644
SHA1:	560CF8D86E6D2AF6B5682413F6DC79A52A5F8AB3
SHA-256:	098B5F1A13CEE71A108EB9B723085B1BDAB884F33A7F5B5CD5083E63108AE048
SHA-512:	7F130DD6BEDD855C3CD03472056176593003E49A486F2640C26B32510A555DF579381F6D83E27AE023603BB7A494A711E8F76563B131034A2B6BB47069B9D073
Malicious:	false
Reputation:	low
URL:	https://ylg1.duyunfk.com/6d1a62e98f7abc0ea4a7ac9760cb2e97.gif
Preview:	GIF89a.......D............r.2.........iX.....s...XD.........SF.wc.m$....!....)..GH.........X({.............[....! ...].@.cUn....jd\.(..00....m...1.K...i"R....).........!..i`Q....V.....2....l.,,.!c.s.......4x.G...U.h.../......54O........m........%..U,.......Ce..G..........s..?{xe.dP;.....l...R.........B....lj.g....s..x......U4..............i.../......9..m....KS..T.....D...D...$...G..d.II....j..l.......r.........%$.x$C61...cK.!k..o....). 9.....Y.....!.1.!Z..>...F.....t..5..nD..h..on..X.....C?.P...2..z....b!s....l)(..]....$*..;........J..E" .Y...2..t.30..4..ST....:i....Ve......<y....O%....BT.Q........?^.w......\[........-k...........l........................................................................pR..........n.....Cv.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 353

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 260
Category:	downloaded
Size (bytes):	708549
Entropy (8bit):	7.88501088087608
Encrypted:	false
SSDEEP:	12288:J1wjADnUKtHbK4/R0edRXL0BMcU/tttf7mL2KamrK4/R0edRXL0BMcU/:J1wj+UyHbK43XLuqttfyCKamrK43XLue
MD5:	6D5A4B4E7D49B2D87A64631F14969942
SHA1:	EB7455A3F6D0C17281E044373FE67B9EC1ACC6F9
SHA-256:	4D56D5987F88313C9F5426DFEEF8E877F0D47A70CAC6A91F5198C72A14D19A35
SHA-512:	A97046B8DE384E5B5EE2536E28D672E201ABF100F2757731643D501918DC60EB9D297C76E78D4417E1620A902AC5F286C5952303D29987ECBB0D2F3F6798CF32
Malicious:	false
Reputation:	low
URL:	https://555ww666yy.com/f3dab33316b44c64a6f119272fb4489e.gif
Preview:	GIF89a...................................$..!..''.(...$..". ................p..]..a..[#.?..$....#$";&$J3OO+SJ)c32.):.COnBOYHSK%a-.9I.Bg.@u.Vkqxow.}............yt.m].sH.{9..-.t.f(rf,.O2x>%.3!.H..K..T#.g..q..f".R..C1.>7.O .m%.n...........(.............................(..'..+..0..4..4..6..B..J..L..N..M..M.D.8.K..H..U.Q.\.{L.jI.XN.Y].cp.lq....v.........i.z.....o..l..m..n..m..\|................................................................................................................................................................................................................................c..W.a.\|............{..m..Z..L..J..G..C..2..*......j. c.)c./d.0[.BT.Z[.Zm.ku.y..wp.}e.[..Z..E..3x..p.&..$....v..u..t..j..+...........!..NETSCAPE2.0.....!.....'.,...............H......!4.P`1...>..b...3R$V...b.z...$/..P.,.r...%a.D.+..5O..S'O./u......Hy.:...,.O.J.....YUg...kW.[.r..u+.Yg.ve...,.p.eEw..p........d...x0+....]l..b.S.e%..e./S.....

Chrome Cache Entry: 354

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	30163
Entropy (8bit):	7.79768556645262
Encrypted:	false
SSDEEP:	768:HuQCIOL488TvKHUC0lJc68gsvi9U5oSJdSdSwEgB5QcO:Hu/LL8TYUCWc6hsaK5jSUwEgB5QcO
MD5:	11FCF3EE78AA739195D80BA8558A7C45
SHA1:	C3EBFD76B58A8EF646261E13A32EF3C6FC603407
SHA-256:	B8313050BDC4AB79B7E4376505BC62D20A8381D07BD06273864C37AA8270D013
SHA-512:	8DF753821B6358729D4E873DA8B43E5C920C6F12CDD0B83B2E2DBC821656799592216F4E60B8BE6E2D29DCAED10183F3698F6072CF03CD4FDCA1A236F6058592
Malicious:	false
Reputation:	low
URL:	https://www.xtpag.top:2087/images/672e3be2290341902fe11409.gif
Preview:	GIF89a...........u!..-.....g..l.dV....J.&.H(.....$....&2.....s#..........e.....j..j...(...oI.....N...T."..0.Y.........C.m.XE..G.rU..g.....#.l(......"......$.v$....S..$d.e.R........G..E.6.W..u...x..V.o...j2...%..#..6.3..O...6.......U/.........',...e..5.../,......$...-..&.....:..5.!..eiQ.N.s..!....u...&....H7...&...V..x.%.xc..4&..F..L..3..X.I6.3.....T....8.. .......oQ+.L(...u.E..g..h...f...D.......2...........t.....w......&.x..n..&.....E...I..........{...Z@........~c+.y.......u...e...Z.%.9..........1..i....W......k!0NA.v..M...y.{....S.w.VJ(...g...H.2(.......m.6........!.7@.. ...../.y&...c...6M3...F.....F..........bE...z.....c..kFc9.A.......1..9.....9....................=..,../..1..9.....[..F.........{.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rdf:RDF xmlns:rdf

Chrome Cache Entry: 355

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	497098
Entropy (8bit):	7.958939189990073
Encrypted:	false
SSDEEP:	12288:ouFIgJ7l/yviJiCo2HwhWpN5AztJC7X6wPh/PBPeIMD93+/FNOfY:oxC7lKvMiCo6gG5KtJQp1BWIMB3+/XOA
MD5:	4E21198408F9F48584FA0EBC86D0F10C
SHA1:	31726F5F67F1ABCFD2AADBC04F6F0CFB4B566A63
SHA-256:	4F945D4E156791D2CBCAB72D77D4FBC3268734E521635B16775A0E9FF316F983
SHA-512:	5AE99EF959902C313B9A8DB70FFEAA4FD7EEB00755150CB6478C0EF0390A1F7ACD74BF128898265EA83002983C05C42EC990D845E5ED37A34898EAFB0C50CF39
Malicious:	false
Reputation:	low
URL:	https://ig38.vip/img/fftyc_1300x240.gif
Preview:	GIF89a.........+.....2_..T...S$.U..Q.......,.5..oqH.O.Uh(.$...rd......i._..'+G..\..2..g)O#.k.R.L..q.../.#'%...^..O%.........jF...ooq.s)..s.h..Y.O.u.lMKO.L,....j.l...$.R.g./$...../........J/.\|O...v3!p..3DU3HvGHk.......weS..o....?M...J'..K....".p4.s.sO?..z'....6.(....p...L....A.ln..qkF..=....$.o......(T22J.QGQi{...Jq<..........K...h0..O.....2l{.T;O....&.0#........!]Ui}....3+....F'u...........T3.H.(...38......F.T..G..)....Uq.?."wD.A.....\|."wU.o..UX.........V..f.....U...f.U..3..f..D......."."..U.9.........."..U..?..~.w...D........f..3..f..f.w...;.;.w3..U.....U.....>.f..@... ....U.. .A.w5.:..f........>..D.=.."..<.......................f.......U.f"..D.........f7...........3.......U.....D.f:.w4.....f..... .. ..35ZQ...7{(..D....b.. .........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.dba3da3b5, 2023/12/15-10:42:37 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 356

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	281740
Entropy (8bit):	7.915575628680301
Encrypted:	false
SSDEEP:	6144:7cXqPU5e4+wiX3XQhlwOTXhPcVi3gAUCqkAS3sztW8j56dLMESl0haHOmK:7i+/XQh6kRP+iQhwAp6MExhqVK
MD5:	4373EE25A3F603B9AB0F9AFCEDA4D127
SHA1:	813DFFD03BCACA2C6A0D266D33B8A9AA24C08FEB
SHA-256:	3ABAA58B23E2DADC7AD8E7CCF3A06421393C14A06CA7C18F5250EC96F7C0B3FF
SHA-512:	C8208E7158220FBA82730F266B783EF0B8331AE127FAF325A8320B137F15260D502E97D4105C0217196BBE73ECBEFDA495792116046356B2CE6DCC8CF03FE346
Malicious:	false
Reputation:	low
Preview:	GIF89a............. ..m.."......%...hg..N.f...nH&#t.......Q......P...).....).....k......vin.pIE...+.-.....M.......a]....n.......J...Z.L.....q....r(..r_.E.l..2.p.Gp..L.b..E#.v..pmp...N.sn.O..+..LD.+.PI.oM.jM.KB.n....M...p.k.m/.FE.JJEG.rq.)..F..,).....m..H.kO...)..-,K%..t .'.'..S.,....g.qjp.J+......KI..K..m..R...=2G.mN..R.M)KPi....k#s..t..[...........Clz..DtjF..Fd ...-........<..8pT[..U....Or..&.Oq.....r..m.TZ..$..C..o.)<t...TZ..sf..w.....................................w..................f..V........_.................B........D.....Cw................................]..w...........................w^.......\..U.....................w......................e.......c.......w..@.........`..................9..z....._....3...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 357

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	dropped
Size (bytes):	9302
Entropy (8bit):	7.862948561810046
Encrypted:	false
SSDEEP:	192:eCxzFSM2OgUsOaDpsdXz0lWXfUarpC0nxr7qjQ9:eEzFSOgUkDpkj797xyc9
MD5:	15621CDA26A396DC007B9FF7D71F6943
SHA1:	6FDDA25F266636F231D7ADE0AB84B729A9D672B2
SHA-256:	8B0495D4C025C3CB31BD306822920BECC03732AF9F7CA89F4862FC031722461F
SHA-512:	4F0044AE2749F353C96D2E8F4C5C05C27AFC79E98496C0A5F24BD4DC4518D6473655C4151F40363AED8947AE0581E8B05E5B0CCBA3697AEE370BCC1842C6C4ED
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S.J`.....*AQ.x...Zx......).5M8u...r...-..AN..O...:...4.p.......4f............qS.J.CAh...Vc..<..3sAHd......;..#._......P...L...8..JSc.t.Jq..P.R).Q......8t...p.@..p..p4.8S.Z`....N..O..p.O..J..J)...LC.(.L..(.C.Jp..N....p..p.Lx4.Q...h....isE.vh.%&h...)......4....E(..QH.S.F).@..x.)...x.O..N..p...kO...x.L....<t..)...`I...y..)...$...M.)h..&.iH..h..PKS.PH:.4S..U..Ve..Y8...W.l!....1.{T..<.l.(.v&p.5.T.x.@

Chrome Cache Entry: 358

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	162820
Entropy (8bit):	7.945181676815322
Encrypted:	false
SSDEEP:	3072:sL6BnzyhOZKA+Bd7BB4rv6xaIFvgdh9TtBCVLpZTP0Az+8vx0YQ:tJoOZv+BdH4rix6TOVLphP/z+IK
MD5:	05FAB304132A328230B01FE3AE40024B
SHA1:	85ECCE021A028D2BAFCEAD8DEFF98232775F23E8
SHA-256:	A06C2FAE590047B280770F4AF95B59FA19099003A2DBA3596AEA738CAFD14046
SHA-512:	A0ACC33C12F56F5BDD1A1245AA19B632517C1BC6F3A7430517B73413B95FBC7C09AC82AC20AE72767886DBB0CA6277D1B9827B01EFFABA4189524CA772AA27A4
Malicious:	false
Reputation:	low
URL:	https://69vvnstttaaa888.dzlndygh.com/i/2024/07/26/12872no.gif
Preview:	GIF89a...............T...d].....##"..........o.........I......V................Q...s..../F...(....J.0....uk....q........Y.G(......0..u..iN....`...S.W.s.n.j.....pnknK..1'.-R... L/.eP.l.h....K.q.....y.m....NW.(..NKJ.Q.J.v.fQ..'.....T....o.qfW..okO.gJE3....2#.3..K?,.....n.?.oTG.....L.u......rM..D..LiD/..G....y............e.#...r.....OIg....l.I...9e.X..Wfe..O..u-....r.P....qj,O8........I8.SF.k'../'..g(..~jLr.4$.R.u...q\|..O..U".vf.....1..M...f..O.....-..2<...L..........7m'...MvL...l..x.....4...B..".8.;Qj...... S.89v_.LuOLw.Dz-..$...%w%....'.........0.-.....&....~.m............................w.................f..w....................................w.........`........33........................................"...d..................!..NETSCAPE2.0.....!.......,...............H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...-.(]...P.J.J...X.j....`..K...h.]...p.-.....X....._.G...Z.e.Q[L-.5t..;n0......c..93..

Chrome Cache Entry: 359

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x286, components 3
Category:	dropped
Size (bytes):	24960
Entropy (8bit):	7.95907988389541
Encrypted:	false
SSDEEP:	768:Tf/KBCMKIB7SbL/LsF8TyfWM0fNyHTmfe:TnyTG/Lszl0NyHTmfe
MD5:	3C515F64BE914583A5162577B6A4998B
SHA1:	273C3CD8158320321567B8E4D26B9379E4ABE1E9
SHA-256:	3F68E08A463252633B6DE42286ABD344BBF7EF80E650727A486B72450F16E0C1
SHA-512:	C2B1E3BE73E0FD9EF76A91FD342763B6D34D5878FBEC40ACB65BA7DD67C087D5ABE4D476B523DCA08A58432018447D9F900D224015E2F157B94A947ADF37FF00
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..W3..H4...8C..z._..6..f..!.1 s....2I.s.R....!<.?.....L...m.......HO.O6Q.l?.P........!.W......iY..Y........V.x..G.}}..vm...>.....[....f......}.......9..%..8...B.`.._..z7.h.d..~t.......A.LC...\|.f.5.....Q..?...7.h._....f(.0.e.....<.;H...i.P../..e. ..F..D.$.x#.<s.k{.[.....]Vu.........;....o$j..Xg...x.U.1H.t{.....1........t....bG.@gB.:.H.rT......8gl.q1..2T...Tv^ R.....fS.....A.8..#.6...

Chrome Cache Entry: 360

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x888, components 3
Category:	downloaded
Size (bytes):	57085
Entropy (8bit):	7.903995485253351
Encrypted:	false
SSDEEP:	1536:kXKcyYU5b6wAuidfmvHefIwVUNRdqth6Zm7+3oUu099Taewr:kA5bHAgvHWIw+LAZIoDQ9bU
MD5:	882BA5B14D99148EDCC9F885441E37D6
SHA1:	00ADFCED5765A5865A56C1335855B50152C1198D
SHA-256:	EE0B67603342A277F7178682FD080DC1B04140B011D73EBD9FEF3D9CD71EE3BD
SHA-512:	C4A34E732D61D5C86AEC34F41FA4381A5D4FB2FE18E1B897FA3C75AE66DBEA4CFE881510FE7D8081706D7DBC120FB8B1547D12D8652D806927BFD9D884413F0B
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/22/214c28054d30/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H..............................................................................!1A.Q.a."q2...BR#.b...r34..$..SC....s5.....D.t......................1..!2QA".q.aB.....R.#C......x...."...................?..4...A..2+D.!....S....t.....'6...M.....!.h.[gBU...x...gt...8S.4.m0.)..7....i...&T.VSK.u...e.[C..Q.k/L)Y.E.+J....0.,J....}...\|n.\.W.p..W.p.;.v...&.=..44.].NL:...Gj..\.:Us..V.V.0...i..f..6.G.8.M2. ....e.e. ....P.$..0.L.....l....Q.YE!...($..]uV.2!..[e..iY3#..(.%..w..KF.,V....+....."hWK.../`..F....^.+..UL.D..G).T.F..{H..fF........# B.@.....6....z1.$AD%.kF.L.L..H..Q1.sdQ..[.......KjYW&./..<.G.c....G...2E.x..`.y.x.....wk...\|.......@............n. .......@..............T............................. .!..........."2@........;l...I....-2......JfM.h.U.....zol.Yd.P.....R......rx.....@#m....$0.....p.....2..s.#.{B..C.t.}...Y..v.m..r.,..a.YV...=......\......8.......4P.

Chrome Cache Entry: 361

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	3124
Entropy (8bit):	6.043102389547096
Encrypted:	false
SSDEEP:	48:x8Xup/difX7Mh5MPfPlsXrKr4p77oMMpZoDJR3WrXFhaAM:x4u04SfPlsbK0pMboD7WrXKAM
MD5:	01E9E2672D31FFFC7BD63BC84E26588A
SHA1:	178746780744AD33E237DD82155C857843482854
SHA-256:	439DDE31332B411162ECC1420F5EC3C304F63FBABDC72B303105C4AA3D9E8A79
SHA-512:	2963DE5C61B94E08A256F8DC1026B6D46C434961B4894274692A387D50832744DB3F8955CD20F6C0DBC7A57BCC4550F3FE2CDD44125F1CF862B26A5C0C40A16B
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/
Preview:	<html lang="zh-CN">..<head>..<meta charset="utf8">..<meta http-equiv="Content-type" name="viewport"...content="initial-scale=1.0, maximum-scale=1.0, user-scalable=no, width=device-width">..<title>........................-.................................</title>..<meta name="keywords" content="...............................">..<meta name="description" content=".....................................................................">..<script src="./static/jquery.min.js"></script>..<link rel="stylesheet" href="./css/style.css?v=19">...<link rel="Shortcut Icon" href="./static/images/2.ico" type="image/x-icon">..<link rel="Bookmark" href="./static/images/2.ico" type="image/x-icon">

Chrome Cache Entry: 362

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	220928
Entropy (8bit):	7.90375485331912
Encrypted:	false
SSDEEP:	6144:vMzYHTToHsZEOXaWYaZ83GiHqo3LNCBJ162WF/xGK:vMXHn8d8bKyLsJINxr
MD5:	950878EB37B90BB944EE5AEFAD468EE0
SHA1:	5DDA295DFD005AC32EA26F6F79089D25990495C8
SHA-256:	D38102D17DECB24450CEA1DB7D234B2D150CB7F945FAF1B23372834097AB8D3C
SHA-512:	04BE9D17A988D0BE08FE54E40767AC5AFB8D8C902EB37958E29B35A25B385BEB9EA46E6E44C8E400E67425836ADEE959614203F67499C8520D67BD3E8634471E
Malicious:	false
Reputation:	low
Preview:	GIF89a.........ieF8..ufTC.{l..se...).....4..I3%.......i6..d.[MS7)..YTB.....'fT;..z**51).ih.j..Qzqc..........}.uP.yX..sXQ;.wf......iY...........dd.....( .slY..@'...].O.mtX2..y3+"...ySCvgG.cQIB3.G.{.N-.aS""!rQB..]..j.r.v6531pK:{YK...m`ldS..r.....h?.i[k`G{rXW<.{\P....m.eX...fM?.uA[K:..o.Q\A3C:....tYL.R,..HD- rUITB1.rE..fj92[B)SL9..F}`6uLA.qGqiSB2.`L..........VcJ..}.f+)![E7...}aR.dXxm]..X...\|UHvV..w..dTI3qZ@.......{S)#.\|.D.f....~t.ia.l`.r.x.....3{ZDf\N[J2....y..{.kZ.H.iUqeR...xmQ..\.w....4......V..;...GjkQ,..KSE6.r.mF...`....]MWW!....+..l.V.M>-...~oJ.q."$(.r2...._Z...kS..Q.#....fc....UUoe[.}i. (....d.\|F.5.........bO........hr1,,...vN ......\|eV...,$%sY{b;.]`,~fz.<"((-.d $(*/0"B6.....\q......$]=>0f.@.u...........a......RP........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 363

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	63320
Entropy (8bit):	7.969320384200143
Encrypted:	false
SSDEEP:	1536:f8cLq45srm1xydaVJX5LkudkvOJ1SJlz3OEF0aGX1NQmBZAWTIuNJuet+P2a:UHr2xyaxdkvOJ1SJlz+ETSbQ+2W0uN8l
MD5:	792826237D13359C0EC9F68DD84971F7
SHA1:	A821E4294B4776310380E8D4ECBB7FAB11A19194
SHA-256:	F92576458C0EB2677F24C3411400A90907C8AA110E4545EEA950BDA55BFEDF25
SHA-512:	AA74E3A6560DD698DC5E7CF57876B17CA3AEE8D46D221F76592084C03BB4EB61A90CF47BCCA10A631A01864FE6AC06003FE850CC656FB5FBB888356FA06C89BE
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................F.......................!..1AQaq.."....2...#r..Bb..3R.$Cc..4s..D.ST................................./......................!.1.AQ"2a.q....#....3B.............?.#........s.pq..v...Y.bo.....u=..i8..B.\;/...p9..Y+.b=.B.).Q.>.F..>.k_fy.'..^..8.JY..'n.I..f....A.sa.m.g[f......+wu.^YA......Z-=.KF^..w.M{c....#.Z`e.nR.rJ9..;M.K.&V4.yg$.nXd..s...8...k...~-.o...P........s.Ii.1.`_..j...Z._.1%.y.....A..xu.\...;.2.T.......%.e..K.?..;.._..h.?..q...[:..9.G....'.J7T.`..k.xW.x.....u6.w.;...3.\..F.....{.".......Y.......v./.bB=J~...<.....k..M...V~.p..s~~kM..:_......p> ..zI.[:z...h.g+...o....w.P...@!..Cv..i.....H:\|i..).D.4.MM...U...kb..[o.......o.#.x.....&.3.[....($=.g........C......M.A8]..Z.q.~..(.v..S...k..'.5......X?.'.$..5W.7.....@...>{W9...#.CT.

Chrome Cache Entry: 364

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	31752
Entropy (8bit):	7.763236738233559
Encrypted:	false
SSDEEP:	768:8z9Lzdgjd8j9nhKotN8RyAC9HKY8Hi62J:8zRZ6RKQypFKYmyJ
MD5:	66B46218A77F8DA6C8F2555365FEFB79
SHA1:	C83EC406ED9F1114C55065852BCA0B65E43F95B7
SHA-256:	63C9BE4AFD63F921EA88A485684ED2A9BF1E18926B4EEDC5258F69A000266FC4
SHA-512:	578DC78F3831AEF427F4DC192BE3BD1658DAC5301EDFF1B9C001C29664ABEC720450467B88A3704972EE726827F59E7E784F9DAD83567197431D6EF0408C6B4A
Malicious:	false
Reputation:	low
Preview:	GIF89a............h..XK.....w.O...W...........$........p..a..jV..K.................T....u+...v.S....R...Z#......-lkP..HyC......Q..........K....@..k&......T.44...5.....?.8. .:%...{O.........n..6.....k...?.._._...........?..2....u..................b..g.u...l..............p..m..c........h....h..../.......`.......u........>.....S.......c..K.......e..<..;....f......O3...KVE,.B..Oz...........Z..s...E.......y4....u......3..k..G.F.E..!..!.X........r.v....={#.w#q.@........u7.......7]>..G......r...u......S.....e(......^........"=.....G._,.[4..r....R.......'4#K..........!.............#.............&........#........(.....%................=..........?.....+..0..........-..6..'..+..5.'..?.y......2..9.!...........6.z#.........i@@..@.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 365

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	352730
Entropy (8bit):	7.9169633113118625
Encrypted:	false
SSDEEP:	6144:nZJpxN9LsMd2tlzw7+Hf7nIishdXcItCrYoGkOpBVlgrjWis3:Z7Hts/tqsnIiGdXdoqpBgrlY
MD5:	EF69E356E7B97F4B9A5A30BC5FBDAE12
SHA1:	262F11CBB6462B5229E4DD6577B8B1FA2BDD9DDF
SHA-256:	973271EE44CF9CBB921637CEEF796BA0598393AC7799D7A67C41C57A460310E3
SHA-512:	0AF9DEF3F9C000D18FBCE7260850EC24FA42C3093D664E86CADDD1DBD4D757DDAA925AD5E4710017098F899EEA3F47FF0C5B0B28CD381BF13EDDAED9183DA787
Malicious:	false
Reputation:	low
Preview:	GIF89a.........[U!.P(..."n1..........w`g[.gS...#..............l.......D...j.......E.I..L.....v.......]..h......f..o.n....h+.....nek..N.....M.k..)....j....e."3.g...3F).......k.S.`.c........k.n.-2....h...+..Kgk.G0.KM.ln.....f...u.........#\..r.+-.......\...K..rb.K....m...l...!.a+rl..........r.KK....rP.3..o......m...p..+...m2..Rs.\|n.R.qm.M...p).l..V4...E....M3....@..p..m.UH0q..N.J.....L.k..(...E.,.....3$.,.'.P...U...-..K....(S<.w..J-.).s,.2$.......M..+.l4.nI-...O.5k..6I.~.........R........Ls1..Lo'r......f...y...D...N.#T.....m..K..:.g.....".3.B...L.9p.F3.>.....=Iq..'<.&.S}...4L......."U.1.-.wD....fD"wD"wU...3.U3.D".B3wU.fD...4w@..".U........"fD......................fU.w@.wV..."fV..................9f;.......?dW...;.Y..........fX......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 366

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (10194), with no line terminators
Category:	dropped
Size (bytes):	10194
Entropy (8bit):	5.374309159168722
Encrypted:	false
SSDEEP:	192:aPIrrkHLVDhgHBAarTHFhSRIOPQyYq2oY26ORo4xKgs2f02Yoot2OdL9kU4E5PSO:aPI6sWanRYbiAC/BkU4IPSg2Lqn
MD5:	8A15F5F05410A92791292B8A9AEC1403
SHA1:	AEDA626C733DC969E968F7CB1EC04EF67204C7B6
SHA-256:	BC05E0C9565F6AB067733805971D2535B5245C9FBF1339F9FD53B4544FB239BA
SHA-512:	8B1A1580D1508160B2B5061E8A0B17FCC511EC2BBCFC113CA4EF290FD4F85A6251E74ED0F60327E87494EEC4C453EAFFB40B6287CA086ACA74F2DCF96007C341
Malicious:	false
Reputation:	low
Preview:	!function(){var t,i="http:"==function(){for(var t=document.getElementsByTagName("script"),i=0,s=t.length;i<s;i++){var e,h=t[i];if(h.src&&(e=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(h.src)))return e[1]}return window.location.protocol}()?"http:":"https:",s=document,e=window,h=encodeURIComponent,r=decodeURIComponent,n=unescape,c=escape,a="navigator",o="location",u="screen",f="cookie",_="createElement",v="push",p="join",d="width",l="height",y="indexOf",g="length",m="split",z="parentNode",w="write",C="getElementById",b="toString",k="call",D="floor",j="random",x="onabort",S="onload",A="onerror",M="getTime",U="setTime",E="toUTCString",I=i+"//c.cnzz.com/c.js",P=i+"//ca.cnzz.com",V="userAgent",R="1281318611",N=function(t,i){try{Math.random()}catch(t){}return!0},T=function(){this.t=R,this.i="z",this.h="",this.o="",this.u="",this._=((new Date).getTime()/1e3).toFixed(0),this.v="z6.cnzz.com",this.p="",this.l="CNZZDATA"+this.t,this.m="_CNZZDbridge_"+this.t,this.C="_cnzz_CV"+this.t,this.k="CZ_UUI

Chrome Cache Entry: 367

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	97404
Entropy (8bit):	7.940384475814902
Encrypted:	false
SSDEEP:	1536:ks0UXNqTX6rGVqi3P99CULNbKKZZqC4cI6vekA6vekA6vekA6vekA6vU:ks0G/6V/P/CchKSAC4cy
MD5:	098514684514F7C2031BD8F211C054A0
SHA1:	D16B52732F1F4BEBCFE246A0AE9B711056A83E1A
SHA-256:	7F28D289045FAAF656891D98AC57ADFE85A8D8DEAACC2446FC445664BB8C8EF3
SHA-512:	930DEE29FDDA729935D564C17AFC88477D2E48CF382DEC8E0735514DF8F73DCBD9C721B3C53577F523C6DEAB41A0BA6EA885F680FF468B909C99AED252B4D12C
Malicious:	false
Reputation:	low
Preview:	GIF89a.....=.POF!! .)).)-.$%-("......)))vug..%..............!......:99BB<....!)541.)))11ggW.'(.....#w.........!).............................................................................x.Q..F".4"....\..t.....5!.o..P..?...../.....J..Q#ZZ[...p..............Z\KF1.l.....o....qF6&.56.xO....cZ31&....p.KK.]^vjYvuX.Z[wf.{vA.QO..0.x...p.EG.gS..3..n..q]ZI.e\.!..:@,......[B..vi.qq..K3..........H..........V%...kN.................!!....mo.)1..................LN.km.;<...................!!....C.[.w-....N.........K.......F:.!!whFhdE.p-.+.UhT'..O.hd....45..N.zs1$..@.U.k...I..R.H.4.C..7..BJ..).....l...F.....Q..u..+;)e(&.ZZ[R......}_.....~..n.K...sj....{r.n(1).B..L....3../...........2i1........b....S.p4....(..h..?.!)............!..NETSCAPE2.0.....!.....=.,............I..H..AN..}.....#J...b...3Z..`c.1 )\|....."K...R%.g..T.I..M.q.\.Y...D....4Q.7..%..)E..5....+..t..W..6.i.5.'X@..U.gL..J...n.Ov.j.(5#..V.`..`+..[.~.....I...YK. ,.p..$..S.

Chrome Cache Entry: 368

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 180 x 180
Category:	downloaded
Size (bytes):	353124
Entropy (8bit):	7.967378743322888
Encrypted:	false
SSDEEP:	6144:mvpR72S+gsadIUfGK2I0SmPQfLJ6YFRapZ3N3NupUkcDePZ:WRCSxsaPuK2ti9rE7zhdDex
MD5:	8224141C2ABF28264ED21B6B60BF32D9
SHA1:	93F2502B28F8ABBB8620853BF5A4DF93E1AAFE1B
SHA-256:	325F973C36CAC0601B6C0605EC0B77CC9D59EDF1ABD116553D0E43441D558E9B
SHA-512:	CD9BBA1427A03E3DAC24841A1706B008662F6536D98E63EB4D90C30F3E85CB44234C12B71E0F40E839D0B587ED9E3C693CDBD9421AAD4610C60A618E6117696C
Malicious:	false
Reputation:	low
URL:	https://ig55.vip/img/GYyh_180x180.GIF
Preview:	GIF89a........&&.................~...........vA..Z.S0..........].5...........$...M....`....j.....R........;:..t.Ymmq....0..............22..H.q?..V............g)..........o..K@S...N...........q..l........8V.9..............e..........................;...+...............6..vh..$.................???..Y.p.hY.'.....M...6.....S...8....D.....ywitu\|Yle.........&.......>{[}......XP.......bx....Y~...cdj....~P..y.nP.....4.Ruev.......}..........>.... .....+..vqS..ap...........................@....9A......!.q..Nf\..............*..... ..,+.............{<".A..].........A.!...............2<.`................Zxj/.............o.........uN.7......F!......7.....qpj$.....w-....[T.V....................UVZ......................................t...V5.h....O%...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 369

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	47056
Entropy (8bit):	7.897111698306034
Encrypted:	false
SSDEEP:	768:lGOlDWtp1az5I348MNZqyeh8/jvPxP55isy5KmMVnW3+7F:gptpc5IIrk+TPH5iX5KmMVW3+J
MD5:	5FC8B1134812286D054891442B854C0C
SHA1:	090AB881A5D8723FD1C1BCADECC8F01333081DC9
SHA-256:	F7915CB8ECE7812EEC2111DA99BE64A2E996C7B1A0D596F114296C28F2E3ADBF
SHA-512:	B21028F6403B739A6694B7BDD0CDBA0B9AE65180E2EA02C42ED75F53BD26AC87EFF96508B55B15D7DA1527C7D554E956658D012319958FD732896C78376EB93D
Malicious:	false
Reputation:	low
URL:	https://ylg1.duyunfk.com/b38048b5589bcfb538c627481211202f.gif
Preview:	GIF89a.........'...lm,...BBC.........usi..u..olOb'$.r8..N.E)HL..%&....7.1$+.....33$...2F.UV"EE6..%EE#TTT..(...VV5.k..63USG^d....2.t..1&..2vL-..uGT!(2%.#.^ZQ../$23KJH....Y.9BBIR6..#!...R!TH$.cZxw....!bcPJRFSJ6......<4...cag)))111 ! .!).))99:.)):9/))!.!,.!119)!!:0/.) ).09>09,..0.."................................................2$............JRX.&(..s..@4('.))...A.)-.k]..........C..i9191)3.1&...................j..5.m4..),.G..n.UK.%$..S........5..o..9.)2........r.eU..O.NL...u.)!ru.z...)Q...]W...........%2.55.]].......................st.......yy............hh\f...................!!.)!...............s%'6;9LGGU..d.....T..f..V..X..O..2..FRPg)!).0..G.;4.....L..n.H..{..{..s....1..dRJY..T.I8..g..X..D..\|..2..a.'..h.t8.........b..p.Q..v..f..m......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c006 79.164753, 2021/02/15-11:52:13 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 370

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	62885
Entropy (8bit):	7.971065149873646
Encrypted:	false
SSDEEP:	1536:/0V+THmBjwWu2IYb5mfllVez7L9gpqxL968HZVID:/2+THz2Is7D9Qu95s
MD5:	15C0747BFAA6F563DE6D0455420C9530
SHA1:	1B84F28518AA9FD4E554A273F976AE8054915257
SHA-256:	882230B6935A038C786FBDC7F55C9A7139A31CF88D129AD70406E142182CE76D
SHA-512:	AF6F72F485FFB7AEED33D052679FBA22488EC71980CF8392174BC6C25A41499AD8874296FC1F3A96C54160EF4079C13871774A096DB3F5D4543A50F6B110C0C0
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/a933eaf511ef/1.jpg
Preview:	......Exif..II.................Ducky.......<......Adobe.d................................................................................................................................................... ........................................................................................!...1AQaq......."2.R3....Bbr..#S4...s5..Cc.Tt....$d.DU6..%E&.....................!1..QAa..q."..2....Rb3.B..............?......9.........{.U.]...A..W.]...U.O.wi.+...V6......[..Y...,.m.MW...W.......+.R.....l,....=.x..8.....l....:o..?.mF...........9......U.......2~...);..].....}....X...^..<\...sM.J?/..c.iQ...4........(.?....X.RZG.............B..;,{....Ry?h+.<.1.v.]...p8..1........v;../fzBhe5.}8....W.{g.n..s..H...K1.o.......r.....]...M8...k.....y]=i.X9..8mj.1._%..B..S+.....0.t.N...bI<.......W{...8..1..oE.m.\..=_..^.....8..].F\|.s....gx..I...44 ..,y.^..J......S\Z.x....,...1.....%...L. ...Y...\|:..............+.^de.....~..............}..OU......h)I..#a.GhA: A....G..._.....ey

Chrome Cache Entry: 371

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 50x50, components 3
Category:	dropped
Size (bytes):	1608
Entropy (8bit):	7.64209546664449
Encrypted:	false
SSDEEP:	24:no0XxDuLHeOWXG4OZ7DAJuLHenX3WnsmBB/F3sZrFD4G94a8tFn/cBCsNadi232Q:ouERAcRBB/F0uG9H8aCsgTn
MD5:	A364F03CFFC7B55181757B0BEE2CB8AE
SHA1:	6D012731D438767CBBE7E6B99168E9923121D1C3
SHA-256:	1344C1B5DC3D09ADB2153076834F7D8A4246A9B63C3B5D6653565F8D76A04098
SHA-512:	1B70CC10C32E22E06CDB6EB4425CC909FB474875FE6D9B264D9B6245B62554DBCB00CEF8D0E061786CDCBE9007BD1163B3ACE63AEAAF7B17E86A8C01538DB343
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C....................................................................C.......................................................................2.2.."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j....eq.i.jS5..%.ks4c-.E.v...._W.....?.K..1..'.{.A..\...l.. !.If$...C..9...T.S.8.n.....:.s.....W....w.x.]....;..;@.l..5.V...D0F..].M....'.yEk....].g(J..V.(.. (....#.....X\|v.o\|a..w...L..l.Uu....b9...'.K...~.x......hz.4.....hl..s...T"$">9..k.O.c...4..._.}k{...-n...>?..2F..,Yc..`..~lj\|p.G.\|j..4.....xCK.7..X.T..t.,....0...8....,F*K..okv]~....ae..h..9;_....

Chrome Cache Entry: 372

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	49875
Entropy (8bit):	7.775551361675693
Encrypted:	false
SSDEEP:	768:2BfmtuNty9o2/1zejjpvikQZM/9S2qU6GJ2eU8TQqNuAue9cOtl4G+OkBkIVYj9V:Vyty+2/1iBikQKXqU6GJ9rtl4G+OkZcV
MD5:	5EC514EA32B0F1AB224BCEFD929EFCF6
SHA1:	B210D2695423D2979A84E0730EB0B813D2FED1F2
SHA-256:	4AF82770B16AFF9F7ACAF4E7FEBA7A17D6C890E744AD4E6ACD9E7F63F947A077
SHA-512:	0FFED5155A47A7A0E0D63E60D45580068AC24648A84FB5A36DBC12DEC5ABC38419C0B7BEA750FD33F0D6C69C4C9E8412550A104C4D6EC350393613B65B304374
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>...........................................................................!..1QA..2a.q"...R..B...#3...sr.bS.c4C5$%..d..6......................1.!.qAa..Q2...".BR.r.C3..#.......8...."...................?...>;.,..FC.%.%.D.;=/O..g.\|^t..H...5.,^.............I.....2...........c..].,..j.........e.......C\|.5.c.5.q.,..9...~.i\|..}O.O..O.z.;/n^.Ov...b]....He......<.e0..Z...d...e........\|.....27G........J.`........F.......h..iA.D ...P..`..@..F.. .........$)...............H..........F...6....d..(# ..... ..a..N..FZ.h........h...]...V.H....T......`s.m..G.i.<>..QWhrL;.......[.O.W]...bv......TZe...V..uld.t.t{5.(...E.g.E-..\|5.fQ...Q...CL.lw..NX.....W...R.:..Y...\|..V.G...H:..D.v...v.n..C..[=.:.....z...Gv1`#@...XHmTH...G..{V..4.../e....I..A...HA[-.(c`...{..>``..@<.........<Hl9>.Q.0@`.@.!2.@..I..1..\|......!.yg...............` . ........RT...1......cGm\....mU.i......).....

Chrome Cache Entry: 373

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (472)
Category:	downloaded
Size (bytes):	64745
Entropy (8bit):	5.560409647959236
Encrypted:	false
SSDEEP:	768:PMBxa2CoSKD2Cm+KV2FODar2FcZac2mGYZ62mCYZ4if0PtGYMBxdMBxQkZ:qxK8hoSm+if0lkxExr
MD5:	37084958ADB7926DF8B7D6359A9D0E7C
SHA1:	DF3DB43EE6ED94925E8A9DC1F760F786E6E75C01
SHA-256:	CB2B695AD88FB24A110217E9A3EDD9ECEE4C1C5CDBC49B503C11E70E5DB158DD
SHA-512:	AA695C6F0674CCF371001FD788AD1DA5E2C1891FEBC2011EC9A94085466ED9D6F6EBCF668E9A9C3A76ACCFDD10F780FF661FB1F36184B57EB0557F95FE69A016
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/static/common15.js?v=100087799
Preview:	function init(){..var data = {name: "John", age: 31, city: "New York"};..var json = JSON.stringify(data);...var xhr = new XMLHttpRequest();..xhr.open("POST", "https://data.7wzx9.com/getDataInit", true);..xhr.setRequestHeader("Content-type", "application/json");...xhr.onreadystatechange = function(){...if(xhr.readyState === XMLHttpRequest.DONE){....if(xhr.status === 200){.....var data = xhr.responseText.....var response = JSON.parse(data);.....var menu0ListMap = xhr.responseText..........// console.log("xhr.responseText:"+xhr.responseText).....// console.log("response:"+response.data.menu0ListMap)......var subMenu = '';.....for(var i in response.data.menu0ListMap).....{......if (i.length > 0) {.......// menuData.sort(randomsort);.......subMenu += '<dl>';.......subMenu += '<dt><a href="'+response.data.menu0ListMap[i].href+'?typeId='+response.data.menu0ListMap[i].typeId+'&typeMid='+response.data.menu0ListMap[i].typeMid+'" target="_blank" rel="nofollow">'+response.data.menu0ListMap[i].type

Chrome Cache Entry: 374

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	120793
Entropy (8bit):	7.971996974058631
Encrypted:	false
SSDEEP:	3072:ZF1Wd5lpmaStZCQPofI7/zhs35+srRHAnt3vhzy8XKMz1yyA7r01:ZFcd5AtZ/PoEVa5+s9HARNy61U7I1
MD5:	D58728EDA92D56BDDB48F60093B53D74
SHA1:	41B4E78672B49682FA977D3159A619FF9D049DE2
SHA-256:	9ECB0092550246B8656EAC1B3CDA1642CA31BE3ACC64325D58371D08EBF41DF7
SHA-512:	DEF11FA49945D2D14C0FCEB9406EB337B72EC1A0F7F740D62096DB8DAA091F3B50FD1AE5F25365F33193CAEC2499BA6F1815150144D556449AFEF88D76A36136
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..'..4.i.&.6g.i....{.HL^=(...H....2~.d.R..<...y.7 ...K.wlP.w...s......Q+.'......P..-].....G..G..i.....J1.!$d..9.P8.<v.....w.P..'SI.ZP}(..b.~jBi..4..y.R/AI...R..P.....4.(...y.&.Fri....3@.......@.isM..}...&..7P!...I......{\|.jY...........l...Z..$.{..C.^...v.._.n....).+P.D.....F..Ji4].a7b.-..4...........(..A..8.C...<..+.z..(.5 (...i.)A...u/C.4.R..<...*

Chrome Cache Entry: 375

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	54997
Entropy (8bit):	7.859604653990447
Encrypted:	false
SSDEEP:	1536:ujbArzDcTYAJigvB0xNk5N7YfaHlZn51NqAgC1FRbwRtOjh2G:ugDc8Evp2aFZp9FsIh2G
MD5:	3A055B91BE2066F58AB200A4EE982DF2
SHA1:	0E150894A92320480799FB721175EBD7443F5C6B
SHA-256:	EF0A28B3FB4B5A21F73AB7B692CAA58BA601A836C4A09006EBA350F7B48AEDAD
SHA-512:	AAD8AE0A8C2FCF6DB986AD1EE110F18654D4185419B88AD79647D0CB8D50F84A2D737EB9FD20185C653263760650AEB594583746788CD9D154E3BCEDCE9F6027
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>............................................................................!.1qQA..Ra2."...SB3.#..r.b..C..4$c.s........................1!.Aa.Q".Bq2......8...."...................?..@...#UH.e....P..4.@B.....q.Ql........5.F...X.%.$....i.Z...8.......F...l6..00.....#m.....qz9.L$].(...0.......\...A.t.).Z....U...c....:.7.>..ym.....Fr.T....-..heJ..I...F".FV.m.[A.....a.n7..D....%b..H.T........(cg.H.....2.H.#hf..j..d..i...+...*4...X..Tk.0.L...$...X$."8.(.&.bh.&.bX.e4K...<I.....`fF.....2d.,2.......e..o..45....!#.....l..@.0.2.@..........2...T+-....i./.<...b.47..v....Ak.dX@.S...&..+ ..z..rkxM.....3.q.......q.t.../_.c...).K.G><.K..\...1._..^W}....0..\..U..s..........~w=U..................././j.c.........:_.g....Kw..'.^....\=.=7...lUry.O..y.5=.W.Y.<..H.s\|..N...^.+...,r..........yp.7.k.c.^...5..a..L....G.y0.......y..A..m.mQ......=".>.G.s..3....:.`v..H..

Chrome Cache Entry: 376

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	3341
Entropy (8bit):	5.8318153197070615
Encrypted:	false
SSDEEP:	48:IZwVPnVY+h4VL6pIV3GlT5+545or6ZcY5XzqL8Zflryks57SdCYzZgG1cgXGrZ:IZwVPnVJioIV3Gve8n9XzNpIPn
MD5:	AF5915373165E7F27263FA4950650D01
SHA1:	5DA4C0A6F63AF5912AC5E934B1FD35B5FD35E915
SHA-256:	9086AE5EC243C2EBBDC8B17F207AB28EFD3F5128F54D3D06A14DC6EB1C2BF32C
SHA-512:	3EF55788AFCEDA198E89EA350A0B5AE4D7522E48C63AC92D4F7C2E0F06E1ADCA7EC40169F409730DC388FB99BF9BBECBFFAA8F1707EA47387D25692CD02C1F86
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/static/search2.js
Preview:	var ua = navigator.userAgent.toLowerCase();....var isSafari = /Version[\|\/]([0-9.]+)([^0-9a-zA-Z]+)Mobile[\|\/]([0-9a-zA-Z]+)([^0-9a-zA-Z]+)Safari[\|\/]([0-9.]+)$/i.test(ua);..var isMobile = ua.indexOf("windows nt") == -1 && ua.indexOf("macintosh") == -1 && ua.indexOf("pad") == -1 && ua.indexOf("x86_64") == -1;..var isAndroid = ua.indexOf("android") > -1;..var isPad = ua.indexOf("pad") > -1;../* .. /..var helangSearch = {.../ ... /...els: {},.../ ...... /...searchIndex: 0,.../ ....... /...hot: {..../ .. /....color: ['#ff2c00', '#ff5a00', '#ff8105', '#fd9a15', '#dfad1c', '#6bc211', '#3cc71e', '#3cbe85', '#51b2ef', '#53b0ff'],..../ .. /....list: [.....'..',.....'...',.....'..',.....'..',.....'..',.....'..',.....'..',.....'..',.....'..',.....'..'....]...},.../ ... */...init: function () {....var _this = this;....this.els = {.....pickerBtn: $(".picker"),.....pickerList: $(".picker-list"),.

Chrome Cache Entry: 377

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1280x720, components 3
Category:	downloaded
Size (bytes):	79030
Entropy (8bit):	7.932975676379696
Encrypted:	false
SSDEEP:	1536:23j1raC9pNPiHcWgMA7ZRgt+vINH524kgIS448grdBH+zxPI0mo1iYQ:EjlaC9pN68WhAFRgxx2grdBezxPI8i/
MD5:	C5F1F90862996A876570838FEBC94BA9
SHA1:	CE1E93707BDE729410A6AD509C1A7FA36F2CA1D9
SHA-256:	BCB914BA77622EE5DD17542247299B12F007E50F8E8DE6E7AE391153F4542F6C
SHA-512:	CCB8FF105D7EA132B5556F89650114E721BB1B62CE0EE7D4B09A3F1FAFD2CD85F7F4ECDE948B697F47AD91E860ED96EEF4AA34A52E7522EFD6B51DD814A42E9B
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/6d4fba52e3fe/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3...G...EG.+..,I....K...,.$.C.tQ......b_<..tRy........\|...Hg?....X,L&l}.G........a.s.tQ..E2.v.......=..).Q`...9..(....E.a.s.tQ.7.E2.......y...L....7.E.s.tS(......G.....(.O9..(.......$.....9..).P...7.E/........s.tQ.7.V.....<....o..........9..).Q`.'.....s.tS(..a.s.tQ.7.V.K@Xw...Z<....@....K.7.V.E.?.o.<...Q@.....9....(.....G...Zm.X.y....o.6..w...Z<..Zm...y..y...)..y..y...(.....I.7.V.E.a

Chrome Cache Entry: 378

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	69118
Entropy (8bit):	7.936939917232383
Encrypted:	false
SSDEEP:	1536:a9Ofr+iD3rD85JNSTJ7T9TS452v5Z2TaI19uQp5k8ht55OcfT9m:aArjT0AtYhZWr1HnOcE
MD5:	66E4564420EE3E88DBCA440A9F81106D
SHA1:	657DD45605D08C932CF3B53952B24A38CD2AF029
SHA-256:	D1D07A5EFD6D1EDF9B6F7BB2E5684EA1CEF8469461BC21304BDD187F3B79CD93
SHA-512:	B81019F37FEFFEECB803A978C784CFD243AE3B882DC1A2D557C81BEDB2E13B417A73693DF5F334419A6CC861C5BCD66ACCFA07D74E713975F9B1E8E97818EC56
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202409/23/1e66f25c9133/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3............................................................................1.!A..Qa.2.q.".....B..#.rR3b..S4...C$s...cE%.5D......................1.!.Q.A2qa..".B........8...."...................?...^U<..I.X...._....v..k..A.uD.U..e5'.B.....Gow....t...^....\|...Z'.V^......Un...5.(_P(.ee=.??#....<+...[...<}...G..\|.Be.C..!...UB.v....OX{........(.....................;..,Q>.yDz.=..g.y....M._..._..q.V.p.......I..... M..\b....\|..~...u...~gO...4.'..ZE1.Z/.).........P..o.G.U.%./`.h...L=. .h...[._0.........k.\|....?D.-.A'.z....(..(G...((g...O.....EA......H......0.OUtJ..j..g..\.....~.._Q.4....Q[.6.._kMx..O..1Vw.,z.}YVQ...}..ys.0..'.^.T..3..D....)..%...ZG..-?..N.......%~{P....._....R.P>......._...... .;.}.O.R....]>.n.:..+..l.......A^..%o.......I.S....xJ..G..ED..zh..A..j.Y.J.....UMA...M(.. .")F..(...5.5.*;0w`.....j=.7......v..[1..j.". .t..........M&..P..`... .J.#..%J.

Chrome Cache Entry: 379

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1318)
Category:	downloaded
Size (bytes):	6098
Entropy (8bit):	5.387220747625111
Encrypted:	false
SSDEEP:	96:xE90pGW5vGXOu0at/tL4aaELmFH/N4V0jur:xE90pG4BH2G2LmFHF4V0jur
MD5:	340F7230D7ABE099CCBCF5F640CD51F1
SHA1:	161024822FEDCA9A144D5C2D1CFCDFC165B8B99D
SHA-256:	FE75718A62DDA7A9034F4B1A488A4FFFFCAC07D1BD88B5B5B075D2DF3D0052F6
SHA-512:	F6C9D912C001887DBD87353D7398FD5AC9F0243072738D04D8CA1734738514BE07BF0F83CE315262B7354B63D5EFA42864582A497C7D43E469D161B097FC0A42
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/header.html?v=9999999
Preview:	<link rel="stylesheet" href="./css/style.css?v=19">.<style>.abk-item{width:100%;display:block;overflow:hidden;position:relative}.abk-item .abk-image{width:100%;height:100%;overflow:hidden}.abk-item .abk-image img{width:100%;height:100%;display:block}.abk-frame{width:100%}.abk-banner{margin:5px 0}.abk-banner .abk-image img{max-height:100px}.app-abk{margin-top:10px;margin-bottom:-10px;display:grid;grid-template-columns:repeat(6,1fr);grid-gap:10px}.app-abk .app-abk-item{width:100%;overflow:hidden}.app-abk .app-abk-item .app-img{width:100%;border-radius:10px;position:relative;overflow:hidden}.app-abk .app-abk-item .app-img::before{content:'';width:100%;height:0;padding-bottom:100%;display:block}.app-abk .app-abk-item .app-img .abk-image{width:100%;height:100%;position:absolute;left:0;top:0}.app-abk .app-abk-item .app-img .abk-image img{width:100%;height:100%;object-fit:cover}.app-abk .app-abk-item p{width:100%;margin:5px 0 0;color:#000000;font-size:12px;text-align:center;overflow:hidden;wh

Chrome Cache Entry: 380

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	62885
Entropy (8bit):	7.971065149873646
Encrypted:	false
SSDEEP:	1536:/0V+THmBjwWu2IYb5mfllVez7L9gpqxL968HZVID:/2+THz2Is7D9Qu95s
MD5:	15C0747BFAA6F563DE6D0455420C9530
SHA1:	1B84F28518AA9FD4E554A273F976AE8054915257
SHA-256:	882230B6935A038C786FBDC7F55C9A7139A31CF88D129AD70406E142182CE76D
SHA-512:	AF6F72F485FFB7AEED33D052679FBA22488EC71980CF8392174BC6C25A41499AD8874296FC1F3A96C54160EF4079C13871774A096DB3F5D4543A50F6B110C0C0
Malicious:	false
Reputation:	low
Preview:	......Exif..II.................Ducky.......<......Adobe.d................................................................................................................................................... ........................................................................................!...1AQaq......."2.R3....Bbr..#S4...s5..Cc.Tt....$d.DU6..%E&.....................!1..QAa..q."..2....Rb3.B..............?......9.........{.U.]...A..W.]...U.O.wi.+...V6......[..Y...,.m.MW...W.......+.R.....l,....=.x..8.....l....:o..?.mF...........9......U.......2~...);..].....}....X...^..<\...sM.J?/..c.iQ...4........(.?....X.RZG.............B..;,{....Ry?h+.<.1.v.]...p8..1........v;../fzBhe5.}8....W.{g.n..s..H...K1.o.......r.....]...M8...k.....y]=i.X9..8mj.1._%..B..S+.....0.t.N...bI<.......W{...8..1..oE.m.\..=_..^.....8..].F\|.s....gx..I...44 ..,y.^..J......S\Z.x....,...1.....%...L. ...Y...\|:..............+.^de.....~..............}..OU......h)I..#a.GhA: A....G..._.....ey

Chrome Cache Entry: 381

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	196027
Entropy (8bit):	7.881099486573102
Encrypted:	false
SSDEEP:	3072:0tbe9pqQ4JL3mR8iKv+8Tu1C5xd/PE75MGRU7clCs38UcQIHoRJvv0Fz793oV:0c97Q3mRd+TsjmG67clCs387qi793oV
MD5:	D13AEA6DF56765CB1E4938B1F6671251
SHA1:	F783706879FB65F5478FBFE47AB9C844EFDFBB5A
SHA-256:	4E81454C04C803ACDEC6DB9610DFAB286F86BAD5A51AD3B7B4EDDDEBFBFBFF49
SHA-512:	274092DE772702CF2FD2B2B7AF8CEFB2EE271AE82F9BDF11C703CC764FF740060D130C86C6D21A6C18F69A40D61533A77E3625F8AA003040E445015CE96FA948
Malicious:	false
Reputation:	low
Preview:	GIF89a............e.......4iK.........Z...^...m....d...b......H..V.ff..)((Xb...N.n......C.h...L.....)..N.M...b..........-..n..-....ii..!...H......L.....p.-.m.n.........Ll...c..e.........m......O....GEB..o.)..l.%...LL.&1.J..p)...%aPu.mN.n.s.....M..mM....L.nN.t.M&.m..I..L(.....K.."...#.[.3$'.n...JJ...O(L.+...qPi.d....,U2.....Z....)2j0&.nrL?.m+..-6..1..".3.j..(...4+.....QH.TG.+..(..p-.+(.xoohB.ukX.O.J-...V.'omt..9.MI.....so..$....p..-#..Eu.).....U...MMRg&s....p..L.....UamE{.$-......Aj..........Ryq...3...9..1.P~ ..&O...<#D.p.....@..Hp3..9..l....9.Q. .x.....%.6......S.0...6.3........................................................................................................................................x................. .....!..NETSCAPE2.0.....!.......,...............H......\....#J.H..E.}.$.H..=n.Q`.(S.\...0c.I...8s.....@...J..Q..5r..)H.!3-y..X.j....`..K...B.v.Z..S.M.2...N.\Hq..[...Sw...L.....+^....2Or..1A.\.0..,u...

Chrome Cache Entry: 382

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	54997
Entropy (8bit):	7.859604653990447
Encrypted:	false
SSDEEP:	1536:ujbArzDcTYAJigvB0xNk5N7YfaHlZn51NqAgC1FRbwRtOjh2G:ugDc8Evp2aFZp9FsIh2G
MD5:	3A055B91BE2066F58AB200A4EE982DF2
SHA1:	0E150894A92320480799FB721175EBD7443F5C6B
SHA-256:	EF0A28B3FB4B5A21F73AB7B692CAA58BA601A836C4A09006EBA350F7B48AEDAD
SHA-512:	AAD8AE0A8C2FCF6DB986AD1EE110F18654D4185419B88AD79647D0CB8D50F84A2D737EB9FD20185C653263760650AEB594583746788CD9D154E3BCEDCE9F6027
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/01/4ac1fe3ea9de/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>............................................................................!.1qQA..Ra2."...SB3.#..r.b..C..4$c.s........................1!.Aa.Q".Bq2......8...."...................?..@...#UH.e....P..4.@B.....q.Ql........5.F...X.%.$....i.Z...8.......F...l6..00.....#m.....qz9.L$].(...0.......\...A.t.).Z....U...c....:.7.>..ym.....Fr.T....-..heJ..I...F".FV.m.[A.....a.n7..D....%b..H.T........(cg.H.....2.H.#hf..j..d..i...+...*4...X..Tk.0.L...$...X$."8.(.&.bh.&.bX.e4K...<I.....`fF.....2d.,2.......e..o..45....!#.....l..@.0.2.@..........2...T+-....i./.<...b.47..v....Ak.dX@.S...&..+ ..z..rkxM.....3.q.......q.t.../_.c...).K.G><.K..\...1._..^W}....0..\..U..s..........~w=U..................././j.c.........:_.g....Kw..'.^....\=.=7...lUry.O..y.5=.W.Y.<..H.s\|..N...^.+...,r..........yp.7.k.c.^...5..a..L....G.y0.......y..A..m.mQ......=".>.G.s..3....:.`v..H..

Chrome Cache Entry: 383

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 480x856, components 3
Category:	downloaded
Size (bytes):	27244
Entropy (8bit):	7.970569499465907
Encrypted:	false
SSDEEP:	768:oB8eWOU7DP++RP3nS+rHbWN/v/oHKPdOOIGU:C1U7DPJJ3nt7WZgK0
MD5:	43C84531CD8DDD96957D3026EADA6E9E
SHA1:	F30C47F77A389A17CAEDEE4D94BA9024D63C9050
SHA-256:	DDF3AF4FA56AF4C00AD92DC407394F31EC8F3A16F8BA0587DF102C58FEA1CCDF
SHA-512:	69080CB3557E854BC0059F7E22CC94EA6768C4E3522C5BED8F1BAAA82BCA12774BEB476B6ED0D204CD872C4316C92926AC752C2D9B2C9070F1ED82485B06A334
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202409/27/f72a7fdb7fea/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3...........................................................................1..!AQ.a..q".....2BR..#r.b3....$C...4sS..c.......................!.1.Q"Aq.2a....#.3Br.R......X...."...................?.(.4..M.8@..;W..ZU .dP.R../.}....>Sx..NX..5.,..B...#X(&......T.YS...@...E.(.A...@h0..X.x?."....:...,MD.....CE...".J.$H.P...qp1.0... .! .el2.$.4.h..j,...LF....`0%l.2S#L..P.J..T......3..$..7....j)...M69..........EL..2.N..b=.~T2q........WL......P..!..&..[+,eb...LHAj-E(...$...P...... ...8.9.}.5.`.5.$ .E........$..z1...` ......4....HB0..,EE...ZT.@4....JYL.S...Ph.F...!.1.....`.5f..............)....4..8.c..64.eL...T...v7........M2.P...$..!.@d!...Yc+`...h.....R.... .@.X...Aj,+E....Tee.../..M..HV.hh..L.(..J.\.f...`0......f3D.$....b.8.\.JQh...F0%,.X.2...1...X.2..!T.m&G...V...%....:.b..&Sd.U62.jl........0.c.....{....i!.C..F.I,+0 D...@da...+e...V... ..".\.,E. ...b+E..4ZV...3..e(..

Chrome Cache Entry: 384

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	1186304
Entropy (8bit):	7.964937540280997
Encrypted:	false
SSDEEP:	12288:usXedinGlPfolel02BfPnGlPfolel02BfPnGlPfolel02BfPnGlPfr+Q0ge6JH0B:ZX1qosNPqosNPqosNPqm6JUj6JUj6JUB
MD5:	4C773834FF3DBB159F83465ACC4025A2
SHA1:	C8718B12EDF84BA134D8884AAC3BD0BD7F7841A8
SHA-256:	27D58920C398BCD1711381B510ED67CEB891E126CA98C8146C0728ADBD18BF33
SHA-512:	2ADC2527630C519CDC1C8B1B804EB29A47704806FDF5C9891202ACF9D4537E79DF3B9FB8CFF153BEFA2FB75051D1E015A975C5990BF7C4500348D0FA91901E91
Malicious:	false
Reputation:	low
Preview:	GIF89a.............I.....D....-"....".....3.".Sk......y.n.....D...."....hU+..0..)U.....p........b..wg.sm........(...-P....T.r.....Mq"o..n...'d.....x...t$.K.K.m.$.U...3.+%omq2...vm..........+....pSL...MHM.fW...hC0.".R%Q.....n./..D..fZ.....J.Cl.H/.$.r..s.R.......r..qN.p...Q...UF.P..o.L..Cp.45....L..T.J..qh.g..HELUo.03..0..k-..MgkPjo...f..M.o...\|wiQ.C.....C..o......D?..1......N.%.....!Ofx....oE.N......]k..-..,.Oi.....5.....m..-.",."...Kl.M@N$......w(:......<U...d.o...N...R1`O"....}.....G.z...y.'.U....................U...................U................................................................D...........B..................................................U...................................8...?....X...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 385

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x520, components 3
Category:	dropped
Size (bytes):	44093
Entropy (8bit):	7.96083245774429
Encrypted:	false
SSDEEP:	768:WSihohJ6ALq1Zh0q225J+GqATDKA6XH5Eh18gE946KM:WdR1Zh0qZ51TuAGH08g6L
MD5:	9D2C9A9F5CE202FF2766B40018EE35DA
SHA1:	30BF007B7C3D1B91A2C0976B9BF4E64D958C5EDE
SHA-256:	0272D331EF78EAEA308C182DBF22C892A9048A96E304383D78E3BFDD8AF87A19
SHA-512:	CBE27154DE6ADA47E962E0EB1F4DA8C58F87AB1DF8EC0FEF22E8AF36493168B1CF3023743D633B0EEF1545F9CAF8D9B0D27E6E53D2C4D512BA373F71E5E3AFEC
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........ .."........................................F.......................!.1A.Q.aq.."...2....#..$BR..3br.%4C....65DSs...............................+......................1.!AQ.."2aq...................?.Z...Z4$..,.~ ..p.}.e...P@..n.c...9..er...)F.......8...5^......0...TN...r.llD..I.=....@.X.....R..9.T@d.3.)G...0;z.rv.%4o...........d..v.>h1...>..H$.......F..4..30....H..Os%.....h.n...;@.H{.....9.).<..H2.r>...2b?$@w.CfD.wHI'?.vc'm._...d..H#.0.....G.@%I.T..%@.$K..(B..B..B......#.P')e..@{.<...P&.....R..B. .J.B..HJ.q.........!.!.......P$BUB..I9P..t.B......!'..>...D.().))...4...N.!..'.....q.i.@.Sg).t..D.b.#...>...r:..].....&......B.......V.rw_..Z.6YV.-J.h.(.l..(..E7."......V.(..FS.i.T0...wV....F.N...C.].Z4..L....[.6.V.......>U.`..!.Z`.."FaXfx'}.UvI..4.'..Q;6.H.a;F\|.,"...VF..."%.O.e ....d..J@q.ywT<.....

Chrome Cache Entry: 386

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	downloaded
Size (bytes):	15622
Entropy (8bit):	7.946077072162154
Encrypted:	false
SSDEEP:	384:eXcyEJTvcWfc4QohvEMAZMvZFt33IW+vjqAm1u2BuqN:eehfc4Rhvnc4ZFxIW+uAmFHN
MD5:	C2485B7804DD566EE03488CAF18348AD
SHA1:	9194A816E5D5A1E641411B0720B090DE6B318148
SHA-256:	4259E3B09D90D8983AD826EB84366785F3372114DDB684273E5B14A2452B699B
SHA-512:	D6395D827DBD0478A4FB14329BBB0803F99417A8CD417D43EEBAEC21526CAFDD68D4241F10DBE687CFEBD7B025D5909AB8D22E06510824615AD57FDA63DA667B
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/8fa79f499219/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......J......as..1......m..F...Z..D.1M....c=+e..$...AX..r.p...........#.V.....-.=...zU.)......W...M.r.......b........t$.....Q.....`.Og...(._....kOjAj=+.t......2~..T.m..........9....N6.._%.........A......Jz.J..4..~T..tQ...K....~?..qd1..C...Q~P..yPk8.......?..-.......C...AQ...?.......lq.@zc........b..}.zV..F.J........C.."...o..s....Q..$...p...V.%7-R....>.=(6C..8O%E.m..+...J........`

Chrome Cache Entry: 387

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	82843
Entropy (8bit):	7.982683451672264
Encrypted:	false
SSDEEP:	1536:pQwRzVimQlqOiSBpfouwbbOD4YlrhgjJwr75T6+e3d2ZND1wYF+r9NIpIt:aCsmQR/Pfo3bW4cr8w96Z2vFKDIw
MD5:	D17CB03071C348380CB50E43EC39F3BA
SHA1:	C0B30C165F556A406FAF312923265A2BAB8FCF27
SHA-256:	CB3C4281FDA6EF00305A0AC6D22DCF5B83F6EDA6311C01732CBDBF1134DCD5A4
SHA-512:	1964A11CC9B6D2E10DC092B8FC222521E83DDFDFDACDAAFEBA0FEE2A55BA2CBFC6248353A9E964438F378C7E0A2637CE09EC674D51CE370D45B7B33EF4D56CD7
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......F.....rhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:6339279CD936EA11A6B1DA65E7665F87" xmpMM:DocumentID="xmp.did:AF597BB3CA6B11ECA270C4AF4F249508" xmpMM:InstanceID="xmp.iid:AF597BB2CA6B11ECA270C4AF4F249508" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:95CBFE051967EC11A877D848C2DDACFC" stRef:documentID="xmp.did:6339279CD936EA11A6B1DA65E7665F87"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d..........................................................

Chrome Cache Entry: 388

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 260
Category:	dropped
Size (bytes):	1261742
Entropy (8bit):	7.948453894449031
Encrypted:	false
SSDEEP:	24576:v8zMzMzdzB4BnqrusQTuYwrusQTuYwrusQTuYwrusQTuYwruC:vO++pzTvZTvZTvZTvZh
MD5:	519F7BD425A071373B037D8AE1B6BE07
SHA1:	0FC5D674D0A99F3F447DFCAE22082C3C86EC2C13
SHA-256:	44C31696CF0EB192203286EED99219CE5B4FB8574FA60EF1D573175E632912F1
SHA-512:	99516445F5172E63BA3B3EE884D6637B557D4850F1072DFDEB7B795EBE340F3BBAE6F7125A8F87BCBA3E5A2E41734C1D1A860306185EDAEC88F8ECFCBBBA71F9
Malicious:	false
Reputation:	low
Preview:	GIF89a....................H....**........../...s..M..-.....................!!!...................T..............n.................((................S.999...!...]^....D...m...{{{....<=.(BBBNNN.pn.........ooo..JZZZ.NN.tK....h-..........W(+.........(...{ccc....om[...NL,..`...b.kI......07&..>:..%llk....^[../.........?..........r..........E>..H.....Y..p$.A..W.......''&XXX........{z........}}}}.....e]e..(...F=BlcP......ZcZ{.{...............................................................................................................................................................................................................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 389

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	220928
Entropy (8bit):	7.90375485331912
Encrypted:	false
SSDEEP:	6144:vMzYHTToHsZEOXaWYaZ83GiHqo3LNCBJ162WF/xGK:vMXHn8d8bKyLsJINxr
MD5:	950878EB37B90BB944EE5AEFAD468EE0
SHA1:	5DDA295DFD005AC32EA26F6F79089D25990495C8
SHA-256:	D38102D17DECB24450CEA1DB7D234B2D150CB7F945FAF1B23372834097AB8D3C
SHA-512:	04BE9D17A988D0BE08FE54E40767AC5AFB8D8C902EB37958E29B35A25B385BEB9EA46E6E44C8E400E67425836ADEE959614203F67499C8520D67BD3E8634471E
Malicious:	false
Reputation:	low
URL:	https://monkey.p2ld58.com/img/tyc-sihu150x150.gif
Preview:	GIF89a.........ieF8..ufTC.{l..se...).....4..I3%.......i6..d.[MS7)..YTB.....'fT;..z**51).ih.j..Qzqc..........}.uP.yX..sXQ;.wf......iY...........dd.....( .slY..@'...].O.mtX2..y3+"...ySCvgG.cQIB3.G.{.N-.aS""!rQB..]..j.r.v6531pK:{YK...m`ldS..r.....h?.i[k`G{rXW<.{\P....m.eX...fM?.uA[K:..o.Q\A3C:....tYL.R,..HD- rUITB1.rE..fj92[B)SL9..F}`6uLA.qGqiSB2.`L..........VcJ..}.f+)![E7...}aR.dXxm]..X...\|UHvV..w..dTI3qZ@.......{S)#.\|.D.f....~t.ia.l`.r.x.....3{ZDf\N[J2....y..{.kZ.H.iUqeR...xmQ..\.w....4......V..;...GjkQ,..KSE6.r.mF...`....]MWW!....+..l.V.M>-...~oJ.q."$(.r2...._Z...kS..Q.#....fc....UUoe[.}i. (....d.\|F.5.........bO........hr1,,...vN ......\|eV...,$%sY{b;.]`,~fz.<"((-.d $(*/0"B6.....\q......$]=>0f.@.u...........a......RP........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 390

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	784465
Entropy (8bit):	7.980170811170881
Encrypted:	false
SSDEEP:	12288:xfdhEkwGhuWMnWT4lNDTeq1JSs/pPpjwvOupe2zWr03vGo3PXW1b0JD4C74:ddhbJQvL1JTPpEvi2aR68C8
MD5:	86C3E62F0EDC57833945E062638E4811
SHA1:	6BA127314A756E47C5E86B758D93C304B802C649
SHA-256:	F02A2ED964E70DE2E7DAF8C1068F603F99BB25442DB84F8440A7107A972E859A
SHA-512:	99DA7C217ADD2FF988D6ED53800F9E0680815D2AE572A4DB0D87F4018A11BDF307F1B55939EE36D0A05C4CB520D995EED0F369FE5E1D83D3C067F119C6380377
Malicious:	false
Reputation:	low
Preview:	GIF89a.......%""...jD/.r.............M.....l.......whH......fd.....j....e....Q..h......d...o..wf......(..... ..g.s.b.rfK..BRD1..m..$`".......q....D".ce..q00".."......f........w.f2....UD............k......M..i.b.X.P..Y.4......ZO.....n..O..K.....RMA..[.,f3#...vM..).L...c..ukj...........Q.J..&.p.......F../..t..R-..g.,....R.t&.....O0.n.M]ug0........n.........K....L.)))..k..M(.M(......o.K..r..z......,..+-..jL.....2k....[....x..Fz..N.....N..F.Cz.IO..)r%.sF~+.2.-+Jn~.+)Q..HzOlM\|.mGCv..+..-..(.En.?m.5.....om.Q.<.=.1H..$+6...s.[..>..;.=m..r.=............ .9.1........fUU3!..w..w....fV>3"wUA.........fUA.wUfDDD""U33;33wUU..e...fD.fD.wZ............w.....d...w<.xA..w....`UVV".................X..............^......?"G.{.....y..=Jg8da"H...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 391

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	34821
Entropy (8bit):	7.959886152989542
Encrypted:	false
SSDEEP:	768:VCWhDMztrIKN6gZxxXlKxVIGb4A6pP4A2SJprXOlrvKpoX/:VfM5rt3zplCTXPDSHHoX/
MD5:	4AC77312038C071E9C5552E2EAFA305F
SHA1:	B4E9EB802178B558836DB1AA0E3E10F9545E0E22
SHA-256:	E4329D2E45385CC20BB40FADE56F720D8D5F538A0A2CE4ECC33C0D9A6566F6F0
SHA-512:	A9DEFBFBF99658EE216B7530EFD6D16E431CD85BB847841A63FFD4D982A5D7188856067703E9FD31141AC488E47F9B40D01922B7A531237BCE80B1563B638204
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/una04o.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................H.......................!..1A.Qaq."......#2...BR..b$3r....4S.&Ccs..6D................................'......................!1.AQ..a"2#..q.............?...(....(.(....(.(....(.(....(.(....(.(....(.(....(.(.o....2.:....MX.G....8^.......P..5.b.......c.8g..p......N..U7...'..k...'9Iw-t...=..#j.!.1..`).RM..(..j..E9mD:s.....\.l..2S.P:S.j6o.Zc=...h.d....k-.C..)..M\.U......U.U.Znh......&h.4...5h...]..U....j.V.U._ZE..A..E..QE...Q@QE...Q@QE...Q@QE...Q@QE...Q@QE...Q@QM..n.."0...+.S.......B[.n&6.<.^..-...A._........Z..\|^..7.Z..g......7.Y....._...>....;.{ZkE.0!...jJ(..(......9.n.B....Q.....Sq.P,..L..gQ..E...........j...M\.-5j.ZFT.MZ........R.i.P.H....j..h]....i........;.(...(....(.(....(.(....(.(....(.(....(.(.@W.n.B..Z.#cA..f. u..Tu<^wn...c..;3.C...&..F.

Chrome Cache Entry: 392

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	downloaded
Size (bytes):	133474
Entropy (8bit):	7.972662320873572
Encrypted:	false
SSDEEP:	3072:+t6MJrKpvn9BE6ZImupReXZlv/kqV6qdrISs:+mPTEQImuidkqV6TSs
MD5:	51729843201E781CA9300B9EEB97814D
SHA1:	DF65E09140353D9C96B987BD6B4AE860FAC7E97E
SHA-256:	38E320DF642670245DD20A5D425D74AA4073A5C0817F8960AABAFA32AD660830
SHA-512:	C2F68FB4F76A323CFB8129FA6EA4EA988CB566D4B3B1CE9156C9D81F1646FB3EE8CC3B15A3DB52CD2386896AA3DACBAF468D0625698A6B9F65E7662D3F8353E0
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/dd212f88e75a/1.jpg
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..7....S.......6....iG....1F.&....o$q..LC..Q.GL.r}iw.gu.....I...0)......,I.h.+...9..N03..q=...W..A..(P@.H.#...0(...=...9..=i..Sp.GoJh<R.`!..~.n4g..{R.4g.@.F)3A4..h.&rh.@....4P.E.....f.(...J....b$.4. T`.S@?4...{Q.`Qp...7.F..@..&..G...;QA..E.-..N.P... ....h.s.!.Fy.&..R.R..i......:.N.SzRP..~tf..)wS......i.*...~j0H.d..LV...i...(..L,(.Ph..@.qK.o.8......F.d..ZF9.d.3.

Chrome Cache Entry: 393

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 720x1280, components 3
Category:	downloaded
Size (bytes):	34306
Entropy (8bit):	7.909405149895421
Encrypted:	false
SSDEEP:	768:85bAWMF0tnCB12LymdSbk/e5rvGQ7eGAQsiMGHDD22JkvtqnXH8OsaRsPzjE:UUWMyn6yyBbkG5rteGhsiZH22J58gaU
MD5:	E51E478CF8D3E6579B3021BEBABF044F
SHA1:	B1001093D769AB13EA2B17BC034B3BE1FE5A8504
SHA-256:	89DDDAF31CC1C14A06467B6438FA90AB7B59D19220BEBBF4D4F10BBD657B9589
SHA-512:	DE70F536DC383B156F977A99BB5514066CF6581FDEC0BE2B2865887C23398A8A7C7F94DA4906F1F48D801DAF8DA8A623D02BBCC1D4F3BC3C3AF390D7FE7FBC17
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/02/7256ef6b536e/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C.............................................................."")............................................................................!1.AQ"..a2.q.B.#.R..C3r.b......................1..A!.Qa..".q.............."...................?..UBa..=!....."....,`.......y.......^..Q.1...Xm._.`..l4.......L..].W...;.Svj.....[.g.....;n...,..'".&.vQ\|9.r.a.i...".O}..... 5.\|1.eJ:w/S......@..{..d..f\|.&.....v..9...X.Q\..<n.k......v.5..3$&.z.......].....)77H.N.~"} ..a...R2..d..Kn.......t.D@N.Eo..B...V.....NLQ..L......FiF....j..=@....!D!.@.J...FB.$B.x..TK6...e....V...#..3....E.......}r...J."....S.FF.].t...._&.Y.L... ..9.....@...L...`.. V....w..{...j.0W!.#._!.. .C&).4......=,8.`.M.j...EnM.....g...Tl@Mj.VX.B/.....!A."..37...4.fh..,.Y...]$fe.-.E..&...qq..A@...x.......K.Em\.x.H............tH..(..4..?U.,M...F......#.d........!E..r..y..C..S..Z.V....e.V.d..[.[. t..n...;d.i...(..,..Q.Q.4R4k*...X.\|.8.8.vi..G.A.6....9i..N. .[...)!

Chrome Cache Entry: 394

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	481785
Entropy (8bit):	7.957789828119145
Encrypted:	false
SSDEEP:	12288:gdv/recyhoi3w1MPkThQ9KSzmv1TSMLGJh47QEbGQv:E3ScM7wdhQcOO/iE7hbGQv
MD5:	BDA76C1D4BA3EB281D334B8B1AA7E6FB
SHA1:	506C72EDBF5F678B51A52A9BE34EEA44167CF075
SHA-256:	E79D21AAE463FFBFC7C6D0F6E7B235A99BA5D835585194939E3FBD74FC9DFE26
SHA-512:	444A32BCE80CDCE26C0BACDDF4C7971E9293C8C97415A2D3157C5CDF63E0B98EB58E9512AE00A9E2E03C6721931BC76E4C0C7F69541A8CB9AECAE94B0EF7AAB9
Malicious:	false
Reputation:	low
Preview:	GIF89a..........m....Y.N.......n.....gY..............v..L....g......II..Z....#...)))....&..61....K1.......E...+.......uut.r....\#.....lN..K....o...J.........op.d...w...m............./....&........Y...MNL....Q.0)DF..m...]..qn....OH....u.iN....4...2^....2....K4...ZL+..g...Y.[.m.....4,W......U...........Q.....dv.....................H...g.V`....#.slIk.....#.........v.&....!.......&.v........p.!.y.e..1......./...m..g9..w......sP.X........".J...1......8.........~..5....y+..6.'#.C9..".....V.....9TW.........i.."...U....oV<.:..........{8$.e...:....#..Qh..M4W...I,.JyO>E7n7...`...PemB....bBp...!!!?s....666!.....___..=.... %.....7...........................................................................................................!..NETSCAPE2.0.....!.......,...............H......\....#.......2j.... C..I...(S.. c.....q..8g.....>......H....h.+.r.E...X.j..k.P..I...h...#).Y..+.Hw..x......8...GX.........L.....(....f..Y`..

Chrome Cache Entry: 395

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (906), with no line terminators
Category:	dropped
Size (bytes):	906
Entropy (8bit):	5.43803072983903
Encrypted:	false
SSDEEP:	24:cOQRWZ1rnSV9K/MedOUnRwtYQOZ+36PYW2GPR:SwzrYIDnQ25
MD5:	6DE0173D7DFB8FFFB7D42304832598B0
SHA1:	149C6988FCF4D3965CB0AA3D6D90A813CD3C84B2
SHA-256:	CE81211868C0483FA302DCFC94A949ABE7C84D79099BCD96F88D89C5DE8E2848
SHA-512:	4281C85BBAE91BC9CC41F9B27C1FD1766C08C844EBDAC572AA1052FEC9FD95020CFC38B2E22EF6F5439DF1364BCC37E2B92A3D22FDBD5A1993BD301C9C200BFF
Malicious:	false
Reputation:	low
Preview:	!function(){var _="http:"==function(){for(var _=document.getElementsByTagName("script"),t=0,e=_.length;t<e;t++){var n,i=_[t];if(i.src&&(n=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(i.src)))return n[1]}return window.location.protocol}()?"http:":"https:",t=encodeURIComponent,e="1281318611",n="",i="",o="z6.cnzz.com",c="1",r="text",a="z",s="站长统计",p=window["_CNZZDbridge_"+e].bobject,h=_+"//online.cnzz.com/o.js",f=[];if(f.push("id="+e),f.push("h="+o),f.push("on="+t(i)),f.push("s="+t(n)),h+="?"+f.join("&"),c)if(""!==i)p.createScriptIcon(h,"utf-8");else{var w,z;if(z="z"==a?"https://www.cnzz.com/stat/website.php?web_id="+e:"https://quanjing.cnzz.com","pic"===r)w="<a href='"+z+"' target=_blank title='"+s+"'><img border=0 hspace=0 vspace=0 src='"+(_+"//icon.cnzz.com/img/"+n+".gif")+"'></a>";else w="<a href='"+z+"' target=_blank title='"+s+"'>"+s+"</a>";p.createIcon([w])}}();

Chrome Cache Entry: 396

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	510915
Entropy (8bit):	7.982962682626086
Encrypted:	false
SSDEEP:	12288:z9u7N0aUaEmv9HEJVUXX1pO0JPBABNsnnryqnDBwTQ8X0:Ju3UaEM9HWynTOGiTsrwrX0
MD5:	32230F6EE2C8FAAE85B48936D3861C69
SHA1:	A3281423706F28E71B024ACF2B4A64D849A55299
SHA-256:	B3F13651C81C6B65BAFCF0C03D4D7E394E329A9C79F757DF29E8789A947DDCF0
SHA-512:	104F1BEAD30FB597B8ECAE8747F3B15D76CE1BF9E941AD9C0C9D041FEF01DFAC1798B19EBBA417E9C490C302EBF978FA767AB7DDA431308EFEB05D9AB10AED65
Malicious:	false
Reputation:	low
Preview:	GIF89a.......Y..fv.....%..."...b....nl...pn*.i.......u.....rG.rh.DDL p.L-t^X.o@ ...qd.rO...........B.w.....w.....v.m:..gS.@/....j(....39.....RB.A.....05U..m.........j/.....Uf..z.Uf.....vMo.DDf...D:.DU.UU.UU.......UU...w..w..........x...UUf..........r....t...............u.U<........U^....UC....CD....U=w..........f......w............D3f..nM..U8...e_V........................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:c3a72d7b-3c6a-9c47-975e-ee01004bac65" xmpMM:DocumentID="xmp.did:E627633AC36711EFB0A1AA3E4A7B921F" xmpMM:InstanceID="xmp.iid:E627

Chrome Cache Entry: 397

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	267600
Entropy (8bit):	7.9497692502485595
Encrypted:	false
SSDEEP:	6144:8eljrj+/U5fGvodjxugmiNwW/VFbtA4BYCZ7fcmPoXN:8elDHggrN7tFHrjcmgXN
MD5:	255D2547F187FFE25A9FEEF511734F25
SHA1:	2ED60645212F1838D2384BD82D7A3FB197DC592E
SHA-256:	11B8812C5E98956334C3AF95C326E16D946E35941BC79079B7F17D608D7E886D
SHA-512:	9598DD8C3152D06D49B8053AF63AC0BCE9B00DC240C74FAC4272E44011A3ABC874126BCA6DFD3D682769418124A5D2782A8CBBA5DAAB692AB95156A839673F78
Malicious:	false
Reputation:	low
URL:	https://static.wixstatic.com/media/dd9a87_67f016f8ae5948e4a82fbfedd1ad400a~mv2.gif
Preview:	GIF89a...............wRHH.y....N3F.xi.hi..).(................f'....mR.RJ`C7.dU..J.........k..uy.........i..k62...j..F.1N.........fi....ju.O5...vy.Rv..uVf.....%..%.$...E&5F76x!.vhg.vi...-!.cWVhFF'.!.."4'&"..tp......+xVV....x.U46<-H3.%.l.744gEU'$$uHUxFD...6$3...........`9G..=H .4.......2.........4.'f..E#$...udXwSHo.$.......%&...ysv.....e....!.witice.6%o.E.y..hb.....yV3'Y&#..y...tsj4.3gSH...{.F1'...W_.(.%...sf,..61)...UPd..........)Z.{....Ijr...T(4........T.<.::...4........"...............%%32...k...9idx...3......kt.?l...(.2......\.............]E./......7".+K......6.3.........D:`.........&1).....R..........Ty...+...............!....y-_.....>....a../...U............;AA...'.3...@..i........E.......Z.!........................B{.m.....@e.....g.~\.....K...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c000 79.171c27fab, 2022/08/16-22:35:41 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 398

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	70941
Entropy (8bit):	7.963503432148807
Encrypted:	false
SSDEEP:	1536:Go60UzrvebsfSZys4wyniiUd2SVKUjhkLtSJnFBrlGGulWTvG:q0jsKZF4w4iRV1kpSJnfrlS8vG
MD5:	FE2EDF96B7F0DDC1CEE0F540E9908D56
SHA1:	A05B9BC25A96C027D21E33D716ABAD75D2CA468D
SHA-256:	A03321F58DACC7D5D63318B376B276BBD6F4D404295C8697DDBAD5233BF8C175
SHA-512:	F44594950F8669264C3EFE5F7A01E409F741C091F7D26DF2A520D0EE621C829A6AD856F12CDBF7B08A53C85E9C1E08FCB4B8771C61A2F5DD2D8FF73B3CDFDAC8
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/19/3f0e5a99be3b/1.jpg
Preview:	......Lavc58.20.104....C........................................... ! ....!!###*((112<<H..........................................................................1!..A.Q."..a2q.....B#r3bR...4..Cs.$..5.S.D%t.6.....................A1..!.qQB"a.......8...."...................?....... ." .#EB.4+3@5c..2..CDT!..3..3i..EP.\.XUbC..G..K.U`.\.f.Q0.0.a.s.........\:.7r.......Yy.+.....WY..#4....C@D4.4@]Io..V.J..V.VZaPhh.....X.."0....W..^..#?.J..O..U..o...v....ynnI..%...a..Y...\|b#.a.g?..;B.9..d........h.b1..Yf..;OMs.v.:.@c.?!.S ..LfE.G....k";.i...%.@(.~.5.(.b.gA.k..k.Au+.[.1.X...[....]$o...WB..g.]#.......m....L.N....\C.V.d.k.8.e...D"!..20H.r..4,2.!. ...P.. ...;9...ha.l+.y5.?.C.s..a.].....^M5......K..f^.G......Z..a..:.5;.F....""...._$.8.X....g....?..a.sO..K.i}S...x....W..DrV....]...-...:..>.....bU.!V.\...........v\.......[..<o...H....(..H....db..."..h....h`Fh! ....$2......!.....8...~Q^..P,...u..yh.yE.."i....-E.,.TH.PB.E.aR.F..E......P.@.(....g..g...Bh...Q5.j...+.q:p

Chrome Cache Entry: 399

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	49493
Entropy (8bit):	7.926200574008499
Encrypted:	false
SSDEEP:	1536:WxO7LHgl5UHgozesU72XpCqBGGWwEQb9BEG:KE+CLqCXpCoW3QbAG
MD5:	EA9EAD97FEA6A4D0A2B0D70CB13466AF
SHA1:	B869317A2F918BD291FF2B2C31A666396EF3DAE1
SHA-256:	DD366BF1EA024FC78075F365E82394EACA3A1D1D19A958789D82804A20A82F09
SHA-512:	DD4A401C91B12651AEC3D175681F8CC31A24C291EB53E15C40DB0B531E67C87F3FE2E1A02C5F40A63FB3950F3B44262E5D2E5E5D7D95AA1EFF991A79DD7846EC
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................E.......................!..1AQ..aq."......#2..BR.$3r..%..4Cbc....Ud................................,......................!.1.AQ.a."2q..B...#.............?..W.t....}!.'.......N.C."..b.I.A.R.D..dsQ.I4B.J....D....v".L..i.Hq...P..(...fI...\|....XP.3R..Z`.='5...../.....$! rb~.....]..p.B. 6.........{l....B....1....Ql.m-.=..Bc.........<..[>....b.....U....@.0.....Mt..."..Iv\|..@.E(.J3\..3..$..'....ctd..H..G..0r9.\|.vx.E.f......%bI.TL....r.5t.0:.....{...h1....4.qR.".:...EV^......fH.n.#..P...I*....."zWS;.zW.Fs.:.O.....T.Ts.C.@ ...).C@g.U.7..8....sM.k.......+.Q..SS"...T.$...M7H.%la%ch1..d.A..Oi).r{Q.5..90"..Hp..... ..Y.._......`2.....y...l...B)!."8.....@.Z,.!.....VH(..z..,.l.A..ZJj.J.(..7.dO.......i..KY. ..u.E..nB..#.:.U.[PP......qIvy..\|....~S@u.kn......j...

Chrome Cache Entry: 400

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	downloaded
Size (bytes):	301616
Entropy (8bit):	7.963368680200277
Encrypted:	false
SSDEEP:	6144:blPDMLyi41s2ukrQmBL6iR66uMTh+5phJRAygAYJRj4UjhOsd:J2yiELQkNR66uMNErJRAdAYJRj4UjhOs
MD5:	E9E4556D2A69D1CCD0C4272A31458BA2
SHA1:	F4A689EFDEB8756474EC8A568CFC6B7ECDABE7DF
SHA-256:	F998194B2AD32242D621DBEF286EDAC16F9825133D91F3363EE84B98324F37C5
SHA-512:	AB901A3425FABBEB6884B08C63EE77DB5EC66AA4D27A120CCFE04F6208E0255EFEB8BDD702FA22131C2EA46833D0D9F5412A87D686AACD6F92F7EFF158D9A420
Malicious:	false
Reputation:	low
URL:	https://amjs.hccoeutg.com/i/1616/PPJJ-200-200.gif
Preview:	GIF89a.....?......N.....0....I..h....,.....g.........,..I...S...e...s...J.......bM.....0.nn.......4.............kjf.6...p.........74.gL.3......+.:3<g...i..L..z.....1-..0...........q........:g.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:9B43ACD2BA1B11EFBF978F1455323974" xmpMM:InstanceID="xmp.iid:9B43ACD1BA1B11EFBF978F1455323974" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e2a79cc0-6b82-b64f-91e3-52e6fbf6d140" stRef:documentID="adobe:docid

Chrome Cache Entry: 401

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	99246
Entropy (8bit):	7.973631388793161
Encrypted:	false
SSDEEP:	1536:RvLATzg9PiPjxX9zoaSKNu5YaLmAGnDX291ce+ik9w3938NYnSaIwv9lKXYrRqk:xL2g9KPjqKNtaSfD0ce+i3MoSa1trok
MD5:	9DAE3217A71D00FD94CC5E602E19C6B7
SHA1:	90C9183BB7AF3D588FF0B825147AA51170C90B62
SHA-256:	3BB45617A5D738996D3897A149E2A60983BA0CD68C5D57281F7AF3CC8C979BF5
SHA-512:	1087B9A0BC06E341202F2DFD4C3D1362E7C2D91D319425C196A45B5F2DE7848AE40F981990E81C2AEB85AB940A8462F3A9B0986F5BD2065D4225E37AAAFE4A14
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/3606672dc09e/1.jpg
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:B61609F7C71811EC8425A0F15301A1CB" xmpMM:InstanceID="xmp.iid:B61609F6C71811EC8425A0F15301A1CB" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:86354A3518C7EC11A48BA047D5A13547" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 402

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	56963
Entropy (8bit):	7.866193204186524
Encrypted:	false
SSDEEP:	1536:IAxwJK31c8AZH4GQHA/JkOwVS6Y/gvWXJNyh:/xwYFlAZHJyA6q6Y/gkA
MD5:	C4AA1483E054255E47BF4430B800240D
SHA1:	E3FC4416C875F2A4B9E67959E2A31FBF01B4C1F7
SHA-256:	DE37B7760B7C981B01136467A28AD3F98C14B5FD67B1EAA0AA21774F719EE543
SHA-512:	BCBB351151BC7B60336D0E409DEBB4DD67DC4ECFFB581AB27BD72C273C3B0F666662910F25D8744A50E566E771FC19934953C8AB251C694DB3153F2703F00989
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3...........................................................................!1Q.A..a.".2.qB..R..#.bsr..3....S..C.4TD.5Uc..$%.tE.....................!..1AqQ..a2..."..3..#R..b......8...."...................?..@....!.....................Q#GL.....h.f`FF.. .........F...P..h..W.@..Vj..PG..@.E9....@k.\`h..(.28.....#.o...@............d".....NE..tz.j.)5 Sp{._'...o....O.v.-....\|..<.........O.=...~.;.}...8.....^l..~o..y.........qx.....y%.....=.D.......B.rm.C.n./i......e..~.....k....;..c..^....N..x........z..8=,0.....9:#M.v[\dn..<..\|q..w..I.v..f]....4...n.Z.8:`....4...cQf.i:LV:G....k.,.uVu..p......$G.x..G....*..91......2.......2..;s.q.....p....i\|{......t....h........j.2.Ty....x.Cc.5.F.A.W.l.T...i..S ..X.H.E...L[ew....3..pc%...?.....D......kW...?N.#k...."...(.......I. iQ.hhhhB...#.@........)........`@FB.........H..(....!`...B.$...(#..d ..%....4J..."R@..@#

Chrome Cache Entry: 403

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 180 x 180
Category:	dropped
Size (bytes):	353124
Entropy (8bit):	7.967378743322888
Encrypted:	false
SSDEEP:	6144:mvpR72S+gsadIUfGK2I0SmPQfLJ6YFRapZ3N3NupUkcDePZ:WRCSxsaPuK2ti9rE7zhdDex
MD5:	8224141C2ABF28264ED21B6B60BF32D9
SHA1:	93F2502B28F8ABBB8620853BF5A4DF93E1AAFE1B
SHA-256:	325F973C36CAC0601B6C0605EC0B77CC9D59EDF1ABD116553D0E43441D558E9B
SHA-512:	CD9BBA1427A03E3DAC24841A1706B008662F6536D98E63EB4D90C30F3E85CB44234C12B71E0F40E839D0B587ED9E3C693CDBD9421AAD4610C60A618E6117696C
Malicious:	false
Reputation:	low
Preview:	GIF89a........&&.................~...........vA..Z.S0..........].5...........$...M....`....j.....R........;:..t.Ymmq....0..............22..H.q?..V............g)..........o..K@S...N...........q..l........8V.9..............e..........................;...+...............6..vh..$.................???..Y.p.hY.'.....M...6.....S...8....D.....ywitu\|Yle.........&.......>{[}......XP.......bx....Y~...cdj....~P..y.nP.....4.Ruev.......}..........>.... .....+..vqS..ap...........................@....9A......!.q..Nf\..............*..... ..,+.............{<".A..].........A.!...............2<.`................Zxj/.............o.........uN.7......F!......7.....qpj$.....w-....[T.V....................UVZ......................................t...V5.h....O%...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 404

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	49035
Entropy (8bit):	7.661077170556799
Encrypted:	false
SSDEEP:	768:Gyh+bzX9NBbk76WL0N3WctUWoUXsgjrD31r0T7D5zIX5fm6MYqrES+gh1/rhE:Gyh+HNbk76WLGntUWoUXRnDyD58LgV5m
MD5:	2962F6878C4E987FF79C45F37A59A54D
SHA1:	E6532C310AEC7C4C9CCA3D4B02109393A79F720A
SHA-256:	A6680FCB1AFACA5616E37A20ACFA909365358F8A6AF8303569BEE8DD4EC0121D
SHA-512:	921DD75320BE20142B77166F641B9D43E3787CDB3B7CD6D6048880157D9C2D88D695DCB3BD10C5329DB6DBE0C0EB29EA5D85BEE33E80C521CC18502C3039DF55
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H..............................................................................1.!AQ."....2qa.BR.rSs3..54..#..b.....6.$TcC%DE.&......................!1A..Q......8...."...................?....(.............$....H........ ..$....H..................,................@........ .."@.............s.....l.Z.....Kf%......Y..H....L.K..B...B.,..........mm......@Yd:@......Y).w..9i.!..rK..njK............8Y.-.5e..e..\.j.....UxU..awXR.`.u.. ."....."WVTk...ZA.\..\e.UYVE@.......4...............e@............................H...... ....$................@.....X......@.......T.@.. ....@..TX.$H..,.....A ......0.@........:C.....pY..n.$..J.C.xr.hAp.UUYQ.eV...M..M'@...+........t.m.n.j...K.[.T....e%.G)t. UU....(,...R..R.k5e.f......9..,.`...V..............(..;C.9C.(.8.6T..........F..K..K". .... ....@........J. .....$A. ...............@..............................@.H.............`..

Chrome Cache Entry: 405

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	784465
Entropy (8bit):	7.980170811170881
Encrypted:	false
SSDEEP:	12288:xfdhEkwGhuWMnWT4lNDTeq1JSs/pPpjwvOupe2zWr03vGo3PXW1b0JD4C74:ddhbJQvL1JTPpEvi2aR68C8
MD5:	86C3E62F0EDC57833945E062638E4811
SHA1:	6BA127314A756E47C5E86B758D93C304B802C649
SHA-256:	F02A2ED964E70DE2E7DAF8C1068F603F99BB25442DB84F8440A7107A972E859A
SHA-512:	99DA7C217ADD2FF988D6ED53800F9E0680815D2AE572A4DB0D87F4018A11BDF307F1B55939EE36D0A05C4CB520D995EED0F369FE5E1D83D3C067F119C6380377
Malicious:	false
Reputation:	low
URL:	https://monkey.p2ld58.com/img/tyc-4hu1300x200.gif
Preview:	GIF89a.......%""...jD/.r.............M.....l.......whH......fd.....j....e....Q..h......d...o..wf......(..... ..g.s.b.rfK..BRD1..m..$`".......q....D".ce..q00".."......f........w.f2....UD............k......M..i.b.X.P..Y.4......ZO.....n..O..K.....RMA..[.,f3#...vM..).L...c..ukj...........Q.J..&.p.......F../..t..R-..g.,....R.t&.....O0.n.M]ug0........n.........K....L.)))..k..M(.M(......o.K..r..z......,..+-..jL.....2k....[....x..Fz..N.....N..F.Cz.IO..)r%.sF~+.2.-+Jn~.+)Q..HzOlM\|.mGCv..+..-..(.En.?m.5.....om.Q.<.=.1H..$+6...s.[..>..;.=m..r.=............ .9.1........fUU3!..w..w....fV>3"wUA.........fUA.wUfDDD""U33;33wUU..e...fD.fD.wZ............w.....d...w<.xA..w....`UVV".................X..............^......?"G.{.....y..=Jg8da"H...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 406

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	143185
Entropy (8bit):	7.973654685436482
Encrypted:	false
SSDEEP:	3072:ctgDCXeR/fm9BhXdinqYC9yXO6L3PDTY3wLTKsQbHdzmN/0C:cWkeRm0nqYC9/6jPDzLTKTbHdzmN/0C
MD5:	C99AEFCA74185DD1DA314383B810AD85
SHA1:	56910F5F1F87E1DE26EEE9D75EDCBA06BFF493BD
SHA-256:	600433A540F45FE4D7807DA2A9A8FCA805440914A1CC38B86795D0FD37AA5DDD
SHA-512:	C7C8F28375F5D9F638FD1623451BAF8A1A3B4B78D59C3A7EF8ED60876C732781E1B182438005889BEC235C66B07EA056855B302AA50FDE21F7F15E7A8F93F05A
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?......2..H...1Z...]^. >RN?,.Bpk...#..,\I..bA.A..[...=...c.s.P.Q+...\|.....k(...T......Sr....P/.>,.nRT.SS......?....muY.......a.a....U.qh.Sz.A.I..\.2.....e.AF.?.5..E=.+..@....T`.x.c4..NQ...2H.U...u.W......{/4..%...1Q.......c.D......N..+2y..."....B..k..#.p...1..1.t.m.4.t..t..z.p...4#..J0e...T.>..4.Q<..Z....}....;.r.[.J! ...:.c.=.j@".."...{T...j.~..5.}.M..O..

Chrome Cache Entry: 407

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	200936
Entropy (8bit):	7.936207161651887
Encrypted:	false
SSDEEP:	6144:b6V5gXqcgXqcgXqcggF7NhHjzZXW/0TbPUyJha:uV5uuurFfH0/0Tb8yG
MD5:	CFD025DED33888BAF13AA3A9B433D526
SHA1:	9CACF14EB35821B84351C28F322A96D9D3206E38
SHA-256:	41D67E21A33B06DD15A34CD9A81DD1A65C802DBAAE736209D3AB4F02EADC6A39
SHA-512:	FEAEAA9704E73C4961A9F5E52C1193F8B7628E4EB514EAD9677AF738838599F49574D17DF7A901B494EB614A6DFEA65366E30E24C681FE741BCD47AF7333788E
Malicious:	false
Reputation:	low
URL:	https://monkey.p2ld58.com/img/uu-rt150x150.gif
Preview:	GIF89a...........cQ.}ae.....Q7...r...../.!r......H....R..FG......k.....y.qV.lR..-.bI.ZA....R..M.(R..;.....e_p.....vh.w....\..}....X.uZ.\..m.$E.5...m.fL.....W......7E.......b...i..........VM..f.........m...kk..`.GH.]Q.*...V.......U-S........O...................i.N[\|.y]..W.xC,k.....F...B.....3..v.ht.RL.................Om.....v....y].,I.e..k=..u....uj.tt...B...../En.....v.].....U..~.......jW]l.....i........qV.....;U..i..........GN....{....Q.R.........u....J..m.}^.pf."F....6`..\|.].....R..m..u..v.6U..m.6G.....FL.v..e....G\...=.F...D_...T...i..jL.t\.p...y...h.......)R....~.y.......v...`.tU{;(.VT.....J......SP..j\..~.............r..p...../.....].v.....f.U..e.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 408

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x656, components 3
Category:	downloaded
Size (bytes):	47108
Entropy (8bit):	7.976765885523338
Encrypted:	false
SSDEEP:	768:j82qsHChImtLi/1W1P1JeHqIVSLcSvcNgRof55f6d4vAfqD+wVl/2du60Tgzt3HF:j8EHOLi/1W1P1FIVSoCcNgROCd4WmVVw
MD5:	E428B04619C0E637D3BA8CE4551DDA9A
SHA1:	D8FDA8B3245CDA6FF56F84A6EDE36BD588C7ED5A
SHA-256:	55FB6509F254786DD9E5C21AD1640C24BA745A88C98E2113E092701E21801DEA
SHA-512:	2AA1D798F5070625E1C7C0389FB7FA85B541AF43820CCC4D22A3B5921EFA6ACEE44FBBD0989ABF92A395B4EA6CC12522E15794028356E8FAC3274BC9E5F0CC54
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/23/fb1f13f7ea29/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3.............................................................................!1A..aQ.q".2...B.R..#b3.r...$c.SC...4.%s......................1..!A2."Q.#..........."...................?..IQ........#......q.G..'N....GE........._.OtA.rV9>.....c.....r...#..%..(I."S....'E..nIR.'9V...r..6.m0.Q.$"R.r...-H*C.......%...H.....SJI..I.L..lv....lK..#.."...=K...."..S.";..}...Tz...."...>X..v.U.2.GlFL..A.X.PDv........D.TO.......Thb.5b.....2.E.w..,4....E...4...p....J4.I^.b.)......(.."8n>...R....,`.LpaC..\|]mH)/.#3JM.HsV....k....)pO...7....OvX.8........y.......f...;.\......uqq...k...?y.....e.Z8z........\|..O...(\|...>M.{...3...O.....n..s;...3....>.....q.^..{M..j{\|ueAc..'d.D.......s..A.="..Z.j'...5;x.`.q.....!)=...BIKr.UZ....i..'C[6Uf....9.T..sQ...R..N...G.....H....H....A.....(I.N....Oc......o.U.c.Cc.'IY...U1.1v.n0Q.....1v..2l..B.....?q..s-0.Q....{w.`.^.y.

Chrome Cache Entry: 409

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.75
Encrypted:	false
SSDEEP:	3:H1iY:B
MD5:	FC0C2C1DABAAD47E9326246C9A79BE6C
SHA1:	1C9D79C5E158B02A0C8D8122D1A9046D0E5F4C8F
SHA-256:	3C7F396070A3D52A06E09E040DC01A0479FAF6D6EF96A645B559BB1B00BFA342
SHA-512:	319FAAAB00DDF3A5BCF057B50D7156E8B5B82FB48CC630A454B710F07623C7D04F48D0FD6D0CDB4E7FE5C64C297E03ADE3AC23134EBF329AC46B7166426AED8F
Malicious:	false
Reputation:	low
URL:	https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAkXD3eutLpIexIFDXsS_EE=?alt=proto
Preview:	CgkKBw17EvxBGgA=

Chrome Cache Entry: 410

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	7051
Entropy (8bit):	4.965791913704773
Encrypted:	false
SSDEEP:	96:x6S06gJngGhRYLA7K1K8KZEsuj8FSe35owPpOQvG:x6miOLA7K1paSerp1u
MD5:	F414798173921459EBBDB393E74BFDA8
SHA1:	4190BA04AC8F79ED29809FD6E4E3471165530458
SHA-256:	94492A387654C1520D4C5A43D0EE7E1858452885E270286CC6FAFD81A043895A
SHA-512:	53D1913EE8815B46607709FA2CC658BC7A314E9B45DE94CEFAA3AEEFB6FA810DB342C6925DC30A84525261D1960FA5586BB848D79B7B51E05EED1A043FDAE774
Malicious:	false
Reputation:	low
URL:	https://xmad.7wzx9.com/pangda/tbad.js
Preview:	var appAbkDiv = document.getElementById('tbad');.function loadContent() {. // .................... var items = [. {. link: "https://vuy81.top",. image: "https://cc777img.dqsldz.com/i/2024/10/28/10ss8i9.gif",. name: "同城约炮". },. {. link: "https://euk11.top",. image: "https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy150.js",. name: "春药商城". },. {. link: "https://t24120103-5e08b5a8a5bb9302.elb.ap-east-1.amazonaws.com:8888",. image: "https://ig82.vip/img/FF98t_180x180.gif",. name: "太阳城". },. {. link: "https://787928.com:7888",. image: "https://amjs.hccoeutg.com/i/2828/qqww-200-1.gif",. name: "太阳城". },. {. link: "https://www.5967ggxtz0

Chrome Cache Entry: 411

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	241438
Entropy (8bit):	7.914672772752952
Encrypted:	false
SSDEEP:	6144:d0et+/9vEqh1KXHgzRfX+7l30O6h53/xz/xd1HRT2Qe0bg:9teyI1K2fXOl3m75rTTs
MD5:	F115A2082833B7ADFFC3A83DA77799E0
SHA1:	4F4A50C637431B97B81213C8C1A5769E7D21B93D
SHA-256:	CF47E61FDDF49DD53F0780BD69060C61C61AC2D57D5CF97E7C2AB1F25ECF27D0
SHA-512:	9CB85D1156DF68CB32F12D8B25FC0766EBDADB0A33019DE3BE028D0323F53C8F3DB48DB43D786BCBD513CDDB9F83C0ED2C2539BA7C91CE83AD083873376776ED
Malicious:	false
Reputation:	low
URL:	https://hongniu.getehu.com/i/2024/11/08/1300x200.gif
Preview:	GIF89a.......S#,.oG..\"V...S.....pV].n..P....P./.l.R......]F.J..h....6x.2.........T...v1.......%w%......X...wG#...R...#&...R%............E........F#.3.....-.3.v#....V.`.#.....!....n....d..6e)G7.........E..D...#..<........uH....4...a.....^..............l.......6x...h..j..<..p..........i.......(+.p...f......2......B.......c..X.>...+.i...f.t.......h.N..F........Y..q.;..4"..............0...r......b....UD0...u.5........B.........p`../..bRF.........* d........Y....2.ar.}......\|vyf............yf ......y...Z..I...n..Q............M..T..2....`..Z.....M...j.......L/./.@s:..........A>q....`..........$U.s.....w..m.*/b..w.b..............P9...%.".}.8.#&. 8.5..s9.#........>...%.5.....[.....t9.7..E..\..`.....@..w..................................x..@..a......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 412

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	68846
Entropy (8bit):	7.976953512813656
Encrypted:	false
SSDEEP:	1536:WS/gJkujwW/2CZvLdSmd4dU6mC5ehr4EtjERE/FF:hNujF/TZvZd3XC5Ex1/T
MD5:	8DDA44067021247B7482E81DB9F5DA79
SHA1:	A46C28B7492A002554862A106788D7DE0AB8B7E1
SHA-256:	01F24475434D711313AF6DE382F9474B76944A0BB6C30A75EE90BFC5378936F8
SHA-512:	967D64C9C3FC952BFC2EA1C262E5D61B955388B0CE41392ABEDDD3FE05E9205329251CF1A99EA43BCE13DB8BFCA2AF7F177B343E5F5E77AF5037A8EA376CAA3F
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/0ae2048d140c/1.jpg
Preview:	......Exif..II*.................Ducky.......F......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:B3F3E9889E48E211B366A6658BC12A0D" xmpMM:DocumentID="xmp.did:B3C810E2CFFC11ECB6D4FDACA404714A" xmpMM:InstanceID="xmp.iid:B3C810E1CFFC11ECB6D4FDACA404714A" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:41e86390-8879-4d44-b301-432f92a056d8" stRef:documentID="adobe:docid:photoshop:221d75d5-7fe4-6e48-b6aa-87b70b95b496"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................................

Chrome Cache Entry: 413

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	38421
Entropy (8bit):	7.901365446107834
Encrypted:	false
SSDEEP:	768:BsCvUJJT2fw/Ccq7c2BhvxNz/o6qQ3h/A+GIXk9kteJ1j:Bs2U+wacEc0LpbqQ5A+G8CB
MD5:	07C528F61C372E01F2F96AD03173E0C1
SHA1:	DDFD8366DB1093905DEED637F172B7D3AD3844F3
SHA-256:	E3DD0AC923B4DF23F8ED5DC87D0F817DD1AD8EAA65B70C803EC3677669255AF7
SHA-512:	36805164D7742DAB56B69940A8DC01E71D1CC65F6442E470C3E51646934B3EB34E9FA73D7F963CD2A881A4FFF4828E9B2203A05259607383F023D2FB075B131A
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>............................................................................1..!2QA.q3".a....B.R#..rCb......4.$.S.s......................1.!.A"Qa2..q#....b....r..........."...................?...Y..L.........>.#._....3...^.....w..Z..E.h..?...._....srg..g.v.P...H.P.9.JI5d..~ ..\.S.J.G-....0N.m.Z.....H..?R..I.H.>..S.y\._.R.e..z8.6n...t...R.rY,.j1Q.+f.9U./..?B.n.i..\.v...d......N.t...._..[u..s]..c..+.J4......N.....?F..w........iQ..b...O.E'>..eif.8(.q.....6...]9.v.%...{...j..t.H...Ll..1..X.eG#...^.Z.e9)TXiv...e{]..8.q;..:}.}..)U.:.}..i..m.{}D..().C'..pI....9..C.....kk......W.......WYJYZ~.:.....]-X.m.k.Ml....9A(R..N.d...i. i.e..:...PJ.........+'G+..9Q.I..^........i..NU....q..'..~V2.R.]FRq.e....\|.%.N...RzU.vKl.f....ymz.KUZ.Xm}...4.gM....GE..5+i..6..5...R..F5g9I.....0i.46..N.YhVyzNug)E4..m..\|awr'pQ...]...FW...o..s :e.*:..E.!.6..B.K..9..........

Chrome Cache Entry: 414

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	569641
Entropy (8bit):	7.9342612974885105
Encrypted:	false
SSDEEP:	12288:/048CZNeI9r/lKqT2x4I9NNMqkCvulLYCipexOncIJd1Vbi7KfTSQdoelYKM4:/0BOrrSMqfvu6B7sKfZOSPM4
MD5:	6F3DA74816D4B2B65413F732991F8C10
SHA1:	257EC151983729497DE63FA674B2A730753DC360
SHA-256:	C82EFC6C479624811E07CCA50C6D63D8149B6176ABBAB9D6B931E3BAD16180D4
SHA-512:	AE5C49C25CBA921C427D64FB2A97F0323A570A679DEAF74488E4211A2F75531A9B5B3541A7E4A0373113B6405B986E2DD32B9D9AEC499B994E131DAC5442E98D
Malicious:	false
Reputation:	low
Preview:	GIF89a.........................!..+......!.;2$?#.J;/M5 VF6\TB......!..-..gO5i\DkbGy]?zcA\|lQ.uO.q^.~^/..=..@..O!.iRBzB#.oM.}c..s@..Z;/.cE.yayQ>.neO..O..@..`!.>.....3.....b8.7..A..D........,..-%.>8-vi_...L........f&;!..).....TF$_I!.wL..b^..UP@~j@..L..e..w.....b..x.....................g..]..c.......e............n.........n......N....x..F......0..,..0%.4#.A .N..a$.?..nmH...t..kU(=2.L'..o8}`'..H..J...mTF.K.....I8....HE:iI..~6..r2.....B..R6.[9.^K.c;.f[]iH.mU.ywj^K....:98RE.LSEgkixO.zT#}d..[..['.n..b1.m".y..{ .o%.\..l..."....{8..6............<..H...P.b.M.U....k......\|c..o>...jW..7.....Q.X.....X..f....\|....^.FQXb.{?..M..M..P..W..{...c8....%#.:(.h:.T,.h.c:.H.R.U..[..^..c..d..d..g..m.......6$.T%..........................V..V..X..a.........!..NETSCAPE2.0.....!.......,...............HPF...."\.!R....J.H.E.../j..".. =f...$.&)>\........0.&.7_...3.2...j......M.t..P.JEZ...1.j..+.._.F.Kv.W.Y.U....p..[...]..t./.~..L..0..]$.......@...rc./_.....

Chrome Cache Entry: 415

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 800x520, components 3
Category:	downloaded
Size (bytes):	44093
Entropy (8bit):	7.96083245774429
Encrypted:	false
SSDEEP:	768:WSihohJ6ALq1Zh0q225J+GqATDKA6XH5Eh18gE946KM:WdR1Zh0qZ51TuAGH08g6L
MD5:	9D2C9A9F5CE202FF2766B40018EE35DA
SHA1:	30BF007B7C3D1B91A2C0976B9BF4E64D958C5EDE
SHA-256:	0272D331EF78EAEA308C182DBF22C892A9048A96E304383D78E3BFDD8AF87A19
SHA-512:	CBE27154DE6ADA47E962E0EB1F4DA8C58F87AB1DF8EC0FEF22E8AF36493168B1CF3023743D633B0EEF1545F9CAF8D9B0D27E6E53D2C4D512BA373F71E5E3AFEC
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2yjhe.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222........ .."........................................F.......................!.1A.Q.aq.."...2....#..$BR..3br.%4C....65DSs...............................+......................1.!AQ.."2aq...................?.Z...Z4$..,.~ ..p.}.e...P@..n.c...9..er...)F.......8...5^......0...TN...r.llD..I.=....@.X.....R..9.T@d.3.)G...0;z.rv.%4o...........d..v.>h1...>..H$.......F..4..30....H..Os%.....h.n...;@.H{.....9.).<..H2.r>...2b?$@w.CfD.wHI'?.vc'm._...d..H#.0.....G.@%I.T..%@.$K..(B..B..B......#.P')e..@{.<...P&.....R..B. .J.B..HJ.q.........!.!.......P$BUB..I9P..t.B......!'..>...D.().))...4...N.!..'.....q.i.@.Sg).t..D.b.#...>...r:..].....&......B.......V.rw_..Z.6YV.-J.h.(.l..(..E7."......V.(..FS.i.T0...wV....F.N...C.].Z4..L....[.6.V.......>U.`..!.Z`.."FaXfx'}.UvI..4.'..Q;6.H.a;F\|.,"...VF..."%.O.e ....d..J@q.ywT<.....

Chrome Cache Entry: 416

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	481785
Entropy (8bit):	7.957789828119145
Encrypted:	false
SSDEEP:	12288:gdv/recyhoi3w1MPkThQ9KSzmv1TSMLGJh47QEbGQv:E3ScM7wdhQcOO/iE7hbGQv
MD5:	BDA76C1D4BA3EB281D334B8B1AA7E6FB
SHA1:	506C72EDBF5F678B51A52A9BE34EEA44167CF075
SHA-256:	E79D21AAE463FFBFC7C6D0F6E7B235A99BA5D835585194939E3FBD74FC9DFE26
SHA-512:	444A32BCE80CDCE26C0BACDDF4C7971E9293C8C97415A2D3157C5CDF63E0B98EB58E9512AE00A9E2E03C6721931BC76E4C0C7F69541A8CB9AECAE94B0EF7AAB9
Malicious:	false
Reputation:	low
URL:	https://yh88812345qwerasdf.lzaotw.com/yhgifjiami/xyh/1300x240.js
Preview:	GIF89a..........m....Y.N.......n.....gY..............v..L....g......II..Z....#...)))....&..61....K1.......E...+.......uut.r....\#.....lN..K....o...J.........op.d...w...m............./....&........Y...MNL....Q.0)DF..m...]..qn....OH....u.iN....4...2^....2....K4...ZL+..g...Y.[.m.....4,W......U...........Q.....dv.....................H...g.V`....#.slIk.....#.........v.&....!.......&.v........p.!.y.e..1......./...m..g9..w......sP.X........".J...1......8.........~..5....y+..6.'#.C9..".....V.....9TW.........i.."...U....oV<.:..........{8$.e...:....#..Qh..M4W...I,.JyO>E7n7...`...PemB....bBp...!!!?s....666!.....___..=.... %.....7...........................................................................................................!..NETSCAPE2.0.....!.......,...............H......\....#.......2j.... C..I...(S.. c.....q..8g.....>......H....h.+.r.E...X.j..k.P..I...h...#).Y..+.Hw..x......8...GX.........L.....(....f..Y`..

Chrome Cache Entry: 417

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	190607
Entropy (8bit):	7.919631905962257
Encrypted:	false
SSDEEP:	3072:VLW4JB2u62uf6SARIyfgA7+mJ7+mbSu/rLdbiDpj2tgKxPZiDpj2tgKxPZiDpjV:g4D2F28RgIyfg/usDB2ttxIDB2ttxIDD
MD5:	173C02FF0EF0DC05D007B79B0C2D64E0
SHA1:	3D8261B69D139BBB8280C35C4651FA94B33FDE89
SHA-256:	7F9DD857B94D176EFF509415C8D9343AD7872CF239E8135C30DFC27AE06BB50D
SHA-512:	CCEAFB7510C7F088F47AE93928FAD4CBF9EB4EE23C5E81CF914A10E4EAFE35F027C83C3D0F12CB4924EFC6992F1050FE90FE1E4136586DB89853779803E14FBB
Malicious:	false
Reputation:	low
Preview:	GIF89a...............U.v..j..k............c.........kp...\..$K...]...P.T3..O.......-..E..k.].........qY...#.....+.kb.gg".R.............N..]No.....V.5...n.........).$..+......//M\|+..+...v'......1...K-.5-i..i.......T.kW.#...,m/..Z.....s?...-....D.......9w.D.U&.... .58.;:.......%..}69...".f3.w.........6.e".y.........................".w7..6._.........!.]...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmpMM:InstanceID="xmp.iid:FA9FAC92B2E011EF8631E254D455C0B4" xmpMM:DocumentID="xmp.did:FA9FAC93B2E011EF8631E254

Chrome Cache Entry: 418

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	80571
Entropy (8bit):	7.96428573900965
Encrypted:	false
SSDEEP:	1536:AZqBqwbViwecwuPHj4gsuQYqTIu8U5MWVvtGbCkTV2UZRaa3LXkXIOP:AchZiwBwuPHjJtQLU2MygRJRlLMP
MD5:	3CB27BCDFA08A7974A1D54D7349666D3
SHA1:	101FC4F1482CFA5848FCFAF8B0E3FDDC1028895F
SHA-256:	7875AA7F535E9316C9C7844796DF546DA32A8E0F7D52AA4B06811D340BF520E9
SHA-512:	BF0801CEFCC9912D679977C09EA14C4392D44BD0F1ADF2304BE9B7295471F167F761566922A85D6F2BB47AB15CE959C70814171F625FF70C2FEB57225B39F584
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/d57e9b0e172a/1.jpg
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:2F201E1ECFB911ECAF71EEEDD564EC6F" xmpMM:InstanceID="xmp.iid:2F201E1DCFB911ECAF71EEEDD564EC6F" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6994BF4FB8CFEC11B9DA94D54914C398" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 419

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 720x1280, components 3
Category:	dropped
Size (bytes):	34306
Entropy (8bit):	7.909405149895421
Encrypted:	false
SSDEEP:	768:85bAWMF0tnCB12LymdSbk/e5rvGQ7eGAQsiMGHDD22JkvtqnXH8OsaRsPzjE:UUWMyn6yyBbkG5rteGhsiZH22J58gaU
MD5:	E51E478CF8D3E6579B3021BEBABF044F
SHA1:	B1001093D769AB13EA2B17BC034B3BE1FE5A8504
SHA-256:	89DDDAF31CC1C14A06467B6438FA90AB7B59D19220BEBBF4D4F10BBD657B9589
SHA-512:	DE70F536DC383B156F977A99BB5514066CF6581FDEC0BE2B2865887C23398A8A7C7F94DA4906F1F48D801DAF8DA8A623D02BBCC1D4F3BC3C3AF390D7FE7FBC17
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C.............................................................."")............................................................................!1.AQ"..a2.q.B.#.R..C3r.b......................1..A!.Qa..".q.............."...................?..UBa..=!....."....,`.......y.......^..Q.1...Xm._.`..l4.......L..].W...;.Svj.....[.g.....;n...,..'".&.vQ\|9.r.a.i...".O}..... 5.\|1.eJ:w/S......@..{..d..f\|.&.....v..9...X.Q\..<n.k......v.5..3$&.z.......].....)77H.N.~"} ..a...R2..d..Kn.......t.D@N.Eo..B...V.....NLQ..L......FiF....j..=@....!D!.@.J...FB.$B.x..TK6...e....V...#..3....E.......}r...J."....S.FF.].t...._&.Y.L... ..9.....@...L...`.. V....w..{...j.0W!.#._!.. .C&).4......=,8.`.M.j...EnM.....g...Tl@Mj.VX.B/.....!A."..37...4.fh..,.Y...]$fe.-.E..&...qq..A@...x.......K.Em\.x.H............tH..(..4..?U.,M...F......#.d........!E..r..y..C..S..Z.V....e.V.d..[.[. t..n...;d.i...(..,..Q.Q.4R4k*...X.\|.8.8.vi..G.A.6....9i..N. .[...)!

Chrome Cache Entry: 420

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (3607)
Category:	downloaded
Size (bytes):	42149
Entropy (8bit):	5.404864418197451
Encrypted:	false
SSDEEP:	768:PvTz/Tw20uWFohIoMAVVAckSHF/szvIcLIwRFKgFmFLF+FhfFUkcye:PvThWwq43CvIqIwRbcBQnfHC
MD5:	015358EF0A3F1A5EEC701914395EA0EE
SHA1:	A76D7074BDE72B74BF68285643276A68400463AF
SHA-256:	7FFDF612AC06681C21EA6F9255F869CF2FA99BEFCA91AB2834D28AFA2AA6339C
SHA-512:	D2DFEBA180F16D71B6B2B98DB4686B470930B1C3CD5B32DE63D85A0832C23D954FFFD29717033257BE943645E5CB6842A18E6C7B1CFD4626F1AD542A77AB0946
Malicious:	false
Reputation:	low
URL:	https://www.rr8844.com/css/style.css?v=19
Preview:	./* .. */html{font-size:100px;}.html,body{height:100%;}.html,body,div,h1,h2,h3,h4,h5,h6,p,span,em,a,img,ul,li,ol,form,button,input,textarea,dl,dt,dd,iframe{margin:0;padding:0;}.body{background:#eee;text-align:left;font:14px/1.5 Microsoft Yahei,Avenir,Segoe UI,Hiragino Sans GB,STHeiti,Microsoft Sans Serif,WenQuanYi Micro Hei,sans-serif;color:#0086CF;}.a{cursor:pointer;text-decoration:none;outline:0 none;}.a:hover,a:focus{text-decoration:none;color:#fff;outline:none;-webkit-transition:all .5s linear;-moz-transition:all .5s linear;-ms-transition:all .5s linear;transition:all .5s linear;}.h1,h2,h3,h4,h5,h6,em{font-size:16px;font-weight:normal;}.ol,ul{list-style:none;}.em{font-style:normal;}.img{border:0;vertical-align:middle;}.img,a{-webkit-touch-callout:none;}..clearfix:after{content:'';display:block;clear:both;visibility:hidden;height:0;}..clearfix{zoom:1;}..wrap{margin:0 auto;width:1300px;overflow:hidden;color:#aaa;}..pc{display:inline;}..mt{display:none;}.@font-face{.font-family:

Chrome Cache Entry: 421

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	145247
Entropy (8bit):	7.970011881494768
Encrypted:	false
SSDEEP:	3072:aMzI33Jc7jTQQtAwUSbw2IP4+MmyUug0IPG2GbvsA:aMs35oQ4Ao8PnMpUugvPG3bf
MD5:	450A2AADED9472149BD729D677CAAEE7
SHA1:	D22633E20A49763C08A134D42FBA722731CA56C1
SHA-256:	7E5B7698B0EA09371719FFD328254F1BFC31FC5679B15E4647405624D1A9E340
SHA-512:	AAC2DCB2CB9B7A7FEE97873923B1F9054C394A2CB8907D0BD36ABBAA02C52960D7536169BFA9015ED3FE521D3CC1918511CB93E869D37803B0D1FB074B93E1E2
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..$...jm..y`.{$H3S.SB.N..(....QE0.1E/j.LR.w...~.... ..ZCH..(..)..Rf..v......XA..v...J..(.Fi..G'QO.?4....O.(..E.PF(.;.M8.M....'z..@.:.....v.S.4....?........4.~.......:z........j.N..e.=.\|..E......(XG<Cp..$..}1...xcR. ..r..F.(?.I..%Z..%..>.....?.i..........^?.E....b.....i..B>.Z..3.(@.e.m{/...[.R......\|.?.N.l..3...H?........'b.FI.VG.._..x.E..R....Y.S$..!{..s

Chrome Cache Entry: 422

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	downloaded
Size (bytes):	223344
Entropy (8bit):	7.8912893190057485
Encrypted:	false
SSDEEP:	6144:0c97Q3mRd+TsjmG67clCs387qi793oVSW:l7HRd+LwlCpel
MD5:	79C32DD3571AA1A83F7D8EFD0C895037
SHA1:	E9910D36375C14340304F8AB22DC7F2BEEE3E562
SHA-256:	20D4CF0E18186DA09873EEF77AC0D84937DC4C183A4E516A84B4CA29FB51E5D5
SHA-512:	97036EB59D4C1443D8987632B25E9D1918B35047E2E44517ABF8568BC221D8651317C94F094E9A9C4C27D64D1D6EAE7B79D6215A5B7FD9A06D940904C76BA32C
Malicious:	false
Reputation:	low
URL:	https://www12.pengxunfei.site/jiamigif/168sc/168-1300x240.gif
Preview:	GIF89a............e.......4iK.........Z...^...m....d...b......H..V.ff..)((Xb...N.n......C.h...L.....)..N.M...b..........-..n..-....ii..!...H......L.....p.-.m.n.........Ll...c..e.........m......O....GEB..o.)..l.%...LL.&1.J..p)...%aPu.mN.n.s.....M..mM....L.nN.t.M&.m..I..L(.....K.."...#.[.3$'.n...JJ...O(L.+...qPi.d....,U2.....Z....)2j0&.nrL?.m+..-6..1..".3.j..(...4+.....QH.TG.+..(..p-.+(.xoohB.ukX.O.J-...V.'omt..9.MI.....so..$....p..-#..Eu.).....U...MMRg&s....p..L.....UamE{.$-......Aj..........Ryq...3...9..1.P~ ..&O...<#D.p.....@..Hp3..9..l....9.Q. .x.....%.6......S.0...6.3........................................................................................................................................x................. .....!..NETSCAPE2.0.....!.......,...............H......\....#J.H..E.}.$.H..=n.Q`.(S.\...0c.I...8s.....@...J..Q..5r..)H.!3-y..X.j....`..K...B.v.Z..S.M.2...N.\Hq..[...Sw...L.....+^....2Or..1A.\.0..,u...

Chrome Cache Entry: 423

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	10355
Entropy (8bit):	7.972694101414642
Encrypted:	false
SSDEEP:	192:JSvdeEqL2cEZWjC8XP6ROtnXeKPVg7RPc3NNhCxFFukGDEhLtr9PSR1dc9NYYdui:JSvda9O8XP6M1eKdg7F6NNW8g5r9aAYG
MD5:	44425213286FAE05454C4B2A21AC24B9
SHA1:	32EF0D410E59FB222ECB262C06300A3A50FC8A77
SHA-256:	7F3D369EC459D1D65A78E206DE87B77B21AA159115BCFC0848C9ACA84D4E83C0
SHA-512:	16E8593F86F0ECEE89FB4FEBFF5D31476CA5CC3B064EAE15F36AFE832740D2E1E515ACE9EA09E19E1DCD3AA2B2C0FA87D49D0DA2997C2C56B8BF92B8AB95792D
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................pHYs...#...#.x.?v...)PLTEGpL..e=.J,......................Z-7#...........dI+....`........................................".....* ......7(.............C4..............`.rG...uW1Q0.`8.R?"`K,F$...5......~.s9.{^....qD...V..g@....HB9..N0....aXFqiV'....M..f..\.e..=..\|.h...p........r......V.u..'..8.......-6.>....tRNS..........b...j.:....... .IDATx..os.......L.i;.BH..(S...ds.#..T8.V+.B.K....!.6j==i{..Q@...z.............qj.x.....6.&=...............(..2{.?}..m.E...#...gN....s~..._.....z..#..i....ay.E..v...v.-.q.m..\w<.\....x....f..<.L.&......x..z..8..s....=.H.D$...[.*I...<..g.g;.j.. .9.=...C3p..-[..h2.n.x.,...Af....Q.i..EQ.c..G`/^m6..v7.L.....]...m6k.;^.Z..iA...o...6}..=...\|b..m].....I.m.:..Y6.jeQA..... .....Q.e...R....4..j...4C.......a.J)..Z..w..>D\|.).<.... ......S.....A..T_...YC....L<m.I...y\q^<.7.......u.q...L..Y.B.b........x..R....nGCm.M=.....@.&j....j..r..V.4.s......m\...T.=....J...k

Chrome Cache Entry: 424

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	975329
Entropy (8bit):	7.894171300294655
Encrypted:	false
SSDEEP:	12288:PME5XxAY2DedG03FpKLWkFAN62yjfjk5q0gR5q595I78fyhAfNc89Apne0dWETs6:+DedG01pK0OaggI7I19gv4mZH
MD5:	C935AD6DDE4CF98F305EAF0D69F195CC
SHA1:	0F8C55CEE7BC26C54D310A41409F3C7756B77753
SHA-256:	D67ED1D0C15DE75079D8758B73BA0F6575A28806368C3F44F7CF35C64BD43B9D
SHA-512:	EC8A9010C88321614FD5770C7F035C54231FE8ACB2461227FF03D3BBE8116A550D1E18A9DC934AC944A45E6B401F2617C6F594127F8A14D12FC3C25BE33FC802
Malicious:	false
Reputation:	low
URL:	https://static.wixstatic.com/media/dd9a87_b1d6c5504d164c40835d918239dcd10e~mv2.gif
Preview:	GIF89a.........gD2.s.P.._....uoh..r.fP.+&'.........a.......rTF#..b.........L2+..OHG.wj.pL.q..P......u.........gdYv....&.......b.TI... X........"..........%,O......m..q..kf[+Hh.p."..m..,".N-F.uE#.....w.r..T..]..O..m1)%.&........(R...#'...r.Ojq....h...lPT].K..........KDo.....T.s.$b....5.kShb1......./.....i....T.0..M...."w....NmLfNCp.H.2.....Q...."...*...=D7.I......o.N..#......Ro.8.3..3........0....3D......................w.........w...................wc...............................w\|..............we....................................ww.................f.....w.ff.ff...............e.............................w..........................................f.f}.]...d~........w..........B.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 425

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	301616
Entropy (8bit):	7.963368680200277
Encrypted:	false
SSDEEP:	6144:blPDMLyi41s2ukrQmBL6iR66uMTh+5phJRAygAYJRj4UjhOsd:J2yiELQkNR66uMNErJRAdAYJRj4UjhOs
MD5:	E9E4556D2A69D1CCD0C4272A31458BA2
SHA1:	F4A689EFDEB8756474EC8A568CFC6B7ECDABE7DF
SHA-256:	F998194B2AD32242D621DBEF286EDAC16F9825133D91F3363EE84B98324F37C5
SHA-512:	AB901A3425FABBEB6884B08C63EE77DB5EC66AA4D27A120CCFE04F6208E0255EFEB8BDD702FA22131C2EA46833D0D9F5412A87D686AACD6F92F7EFF158D9A420
Malicious:	false
Reputation:	low
Preview:	GIF89a.....?......N.....0....I..h....,.....g.........,..I...S...e...s...J.......bM.....0.nn.......4.............kjf.6...p.........74.gL.3......+.:3<g...i..L..z.....1-..0...........q........:g.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:9B43ACD2BA1B11EFBF978F1455323974" xmpMM:InstanceID="xmp.iid:9B43ACD1BA1B11EFBF978F1455323974" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:e2a79cc0-6b82-b64f-91e3-52e6fbf6d140" stRef:documentID="adobe:docid

Chrome Cache Entry: 426

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	18264
Entropy (8bit):	7.872068184441072
Encrypted:	false
SSDEEP:	384:TUPOLSIksxCgVi1217Lm6VEWJOT2h7wsEGQV/nlBPyu8gT:0i9h/K27XYlB6ujT
MD5:	AB0DCF746525E1DCF969121F17AEBB69
SHA1:	8D2B463BAA66BFAF1B1A70FDAC55E44A3EC92E84
SHA-256:	7C1CB48E97E20EA22EA070395F334019256C568879F0D6D5C9C231CBBB9DE961
SHA-512:	BE9C7C92E88BEE827EB27B3875B85FB684327901B0A4957292BCED26E4E58FBE209E0FAE6D95F5AEDC689433BA756C31FA24AAD8754AAAF187A2193E4A1DAC42
Malicious:	false
Reputation:	low
URL:	https://we.zz17377.com/7bd578c706a9f8fb6f46da207b46e618.gif
Preview:	GIF89a...........oQE67$....................).,++......_..yaD....GEB......h&..`.L$......:::..\|yy......!! F7%...XWV'...................hgf...555....c.....^"F=3..........:1(..........#35+#gVI...xdR.Y..V....F%%....C..............~..rL...0.RI@...7........)..///..........J...lB...0?..%Nt...ZQB...........wia...H...........[.lE9..E.!.F...=83....P.........tN8...:50}sfQ:5...+.n.)............l\`%3;...3..#...........X..........O&'...d;-..................("t'....G,.(-0.Z.&5#...1.......... !#..........OB".^....(((442............Ej_......T.............2DA.........Q.0.....!...^.5..#$%..2:=LNG...55851-..........68/.e ..8..965MKK......`_]&&&...623ROL(%%222067...RRP........I(........4-+..............pon............-61.....888<<<............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 427

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	126008
Entropy (8bit):	7.973388079937638
Encrypted:	false
SSDEEP:	1536:+4i2ltDBCVvQa3efOErtLsREUm2hNe9U/syJBrvTcygJJrYFMRQkaG9VdAI+GGG4:O2fqvv8OXEI4UhZgWFEN9tGG4
MD5:	D81A3BE6DA7CBF79A3A40D27346777D0
SHA1:	B1C5ABA1BCA6417A6C467F8F1E2A7AC93259711C
SHA-256:	3F94989EF69D460959A7DFE733A790541D6C232D86D0A06FFF7D33256E8877AB
SHA-512:	1254380A1B8D1F1FC780848930324CB541E1843DDF7A1EE3B4AB4CD51AF2084E55EAFD4050C810EE1968C646E90A187FA57BB92A25B127EADDB105CFF2AD392D
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..M.h#..Py2}..n..T..U...q..'.&){Q@.(..P..KHH..K@...(.4...1.7b.Fz...3.HzQ.b..v.<Pq.h9...Jw..qJ.3I.......Z)3.(4.1E.P.E.Q`.(...(...(...(....R.P.i)M%..QE..R.P..QE....-...4.E.#...B1..)..).sHCZ.j...O.).....z.jo.~4....1.('?./O..'Z.kc...).);..k.1I.i...#=)......G.@.zt.5IL>..H]~ni...sQ....#..4.3.N=i..4..A.NN).g5...'.Tf..*.LhCL#...4.FGJCNc....f9....i.....g...GPh..\.c8......

Chrome Cache Entry: 428

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	179685
Entropy (8bit):	7.925657150137518
Encrypted:	false
SSDEEP:	3072:Qy+coKpr/kBFfA3bvPgzGCYze1uMBeNwPkHdENEnCp1gPiJGb6F345+IepYQS6s6:QyWKBkBlSvPgzZUoPUJnWJGb6F34spYc
MD5:	3D7DA376B28F31DD30D0E9A1EFD9E528
SHA1:	43A65318B98342D7647D90C82635D4953074D2FA
SHA-256:	C08F8578C2196F5B7CC834B9A125A46B40D3B878D95E25DCFCF7D07E64BA7B5E
SHA-512:	642187E5C62817C665D27B69A6B8A67E327747790DA5B4234ED206B3DCC17E5D21ACE8CBDEF5D704B533A4378C567DE2CB3DD90A3398D959C0501FA5D43222C8
Malicious:	false
Reputation:	low
Preview:	GIF89a.............m......j..).............l^...`...+.....E.....n..../.....mY../fP..H.(..dYS./..........................i.....a.1.".......s...G....._....dT.H.....rc......H.=j.V....._)......e.....".K.WW....Hz...M."[.......i..u#q......-..m.2..5...D"&,.4,.3)..\|..r.....s.@H..1/.I8,....a....k....O.8+............s..........U..D..[..?..<........U.....R..................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:FD07343FBAA711EFAEDEACEBC96076FF" xmpMM:InstanceID="xmp.iid:FD07

Chrome Cache Entry: 429

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	188092
Entropy (8bit):	7.972365610417208
Encrypted:	false
SSDEEP:	3072:X3ocUwifW+1daNJX+y6wukTLrH/680+3kzsuH7gk9qUBIDTmQUt64ULuNfxAjDTp:HPUV1upf/68LKH7Z5BeCQUtELIxALp
MD5:	6CC767431D6D9ECECC0DD3D7D1811FB6
SHA1:	0C5CCD275CEE030B08D8A2B4FAEF5AF11859D711
SHA-256:	3F64F84DEB02B090E22D1DD66A04E4FA2E2CAF071F1EAD8BD1CAF0CFF8EA1A94
SHA-512:	3C98FBC2D55136D9B20B005B5CDFF9332FBCA0A9A7381D827D0D8A97C886085EDE35B8815F1702EA5950E26BB8FB95417C258A86B69DA7D226FA2CF264916FC8
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..D..U.\......f.h.g.~..SU.E.."..N.P..JF6.........F.......S.\.MM.r....G.:..].L.....W%.......DyB......-..r..l.9S.Goz..=i..@gn7............M.}B..^?. ........-........,r[.._.m.......k'M..y..pDk..~O.<W.}....t.l.V8..[>(.d..Yn..A.F......7..e....[w..#...5...g...x.....M.k.Ia.V..&v.\|i.C.=.._.....G.....;v(......^....'.,.i...yZ.X.1.N.^.5.V.....Uu.S6.>....

Chrome Cache Entry: 430

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	39603
Entropy (8bit):	7.96772396422886
Encrypted:	false
SSDEEP:	768:kGC6Ok+zuHrXSi0e7JcbXkdjX0PnOA0DeuskMQlYeorJ:kGL+KWi0e7JcbkVaOAIxM7R
MD5:	0A9962B140F33A97E9B91ECCD0EA5478
SHA1:	7D7A5837CF0604EFD875651511FE621B3A86B6A6
SHA-256:	84B70C5C706CA7DCFF7BB225A6E7620DB8B9B87C64E0E95AAE25E31E78BA38F2
SHA-512:	E0CA98B98FBF641A7C960835D38119AFD3CF3CFDCA7A598D598D9C81ED0B92C024FDC2CF4B1599FA1AE568F076D3996F7DC00D168DE64214944D81289094B688
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................F.......................!.1AQ..aq.".......2...#B..Rr.3b...$4C.%5DTc.......................................................!..1AQ...a...q."R..#2B.............?....X.D.Ln.J..^.~O6.....6(..qM14.T.7.L.".3.(.j.V..^T1...1..R8...+).1V.>.HU8...b.uI..>.T.hZb.A3Q.U.L......c....cs/z.#M.~V.~h..Q(^M..Xgj..l.j&N+....e..Z.]f..W<.GTgc.'V.....y..v...t..5.m..B.N)g.z.L...N........Rm]..1...r.+FwO".e..)+.<mN.l..F#..kI,....A%..v).mP......$c.P..m..@AM..,..F.........R.lw.~....lc..D.N3#.@.^t..j.)...G..Y.[C.&.Zy#t......%..p=.D.fm&.e...f..E.o.n-.L9.+..p....]Pvq.4..].R.js...1WR......J..9..<b..j,......V.f.@.1.Ka.n....1d..`...i.&F..q.Z..B...s.JB...r..J..6.`.j. .28.M.SQ.Z9.L.....9.S..Rc....v..T.ySL....p...0..9T.LU5.t_......e..l%......LM..."oK.3C$q.Vjf..Y.4.Nj....W.-..b.%...N..

Chrome Cache Entry: 431

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	296725
Entropy (8bit):	7.9294190735780345
Encrypted:	false
SSDEEP:	6144:m/dxBTKLdC7dPLfMw+8zMDcpcEK87SQHxUMoUnZ+DL1jGQdze:6d7KL23+8zFcEKMqU+DpPze
MD5:	D81217D24677669C10129438BCD3E0AF
SHA1:	E75A85EB9230F88997F284004A977193B59A5AD1
SHA-256:	419953C726FDF8542D04439EF442A0BE60F946ACB9E7686901D2557EF0836521
SHA-512:	83AF7E6BC9C7F095AFD7CD25065BB1E7FD74EA0E14E0527ECD840FCE91D027CC81C8C8BF3334F4A0F63EF5D33B15D969E68F775A0966FC9A5D57A00954FD15A1
Malicious:	false
Reputation:	low
Preview:	GIF89a........d.)....$.........dV..V".2..d....kI (m..........a../4...n....\.QrQ.ecVa.......Z......U.K....c.TT&..N..o.g3....F.tk.)...oZ.(.(o>...$..+...lE.m2...og......w.qP+...3.r.t..-.k.o....j......2iM3O........ob....m...nD...B....pn..K.v(KU...L............n...........?.....X'.JE..n.iW..........>..m@p........Jq.s..(.m..FsSh.m..Mn.o......"b+.pt..K...rm.PG.4..2G...Q..nL.G.....2.v.7.(.r.q...oq.Np....o.O)....U........P.TO...;..~..o...F+...m.6.o,.K..DP..k..Pr.o.H........Q..U..Q..D......M.2.....TF...:..Q......m..FB.^q..S.5.1...w..wU.xD.fU...Af..........w.....e.....f..........;........................eD......Ud.......w............eD....w......._...xD..................wU.........................fU..........^...........3...e_V!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 432

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	75037
Entropy (8bit):	7.900992390333463
Encrypted:	false
SSDEEP:	1536:+yB6hsKcoSIdujPQlcUENskGztEHyCiCDKLtRTlC+ijsb0GB:VB6hsKcZtCcXNdG5EHrKblj2swGB
MD5:	CF2F882D1FAF5569898B4F641443460B
SHA1:	48DA8F086A270E2F76BEFC14DAE3A231606C5E31
SHA-256:	2099A6A133477D768707F08F83CACE7C45159B89C63082672077B38A0F4D960B
SHA-512:	F24A6842A7847F3F4F688449C722880E7ECB79BDB4B84612177BF284AF5398CC94FFB8246A229AC2FEA9143E63B14C21D6FC2B30A0B9C88B93667E36C4940FC4
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H...............................................................................1!A.".Q2qa.....B#3b.rs..4..R.$.5C..tS....T..c...D......................1.!A2Q.q"..aB.R.....r...3C.S......8...."...................?..F....m._Fqi.l.Sl........rZ#..DV..........z1.h.,%9:e}m..F.w..i%..Y?..\|.......$...mz....34M.g%..D......QW#.=.7.[.T...r^\|J.vSo>[.Y..e!~......vF..I...e-....vc..L.Q$-...ED..l..`..`.z.1.....P.....^3....3...^8.....~.............x....(...0..3.@.<g...<g....`..<g..s.])s'..>.sBZ....=?.9..7._/........5..]..K.o.>.'.M<I......?rNB.P....i ..f....U....m+.E'..1KU...c...)8.i\..z..2Bk.D/....j.T.......@.Y$.s....;$...N\|.=k.1.k.mcXa.5.... ..`h ....a....I...... .........cR..w....w..f.....c./..V....aTC.^.g...zBT<F..H.a.i..D...#..\.3R........u..q.r/.g..../......R..T..,..Qe.)....&...%...a.Bv..!.....${!)y..J.*J.U.g..!U.r..N]...I...........z.)...K......

Chrome Cache Entry: 433

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1280x720, components 3
Category:	dropped
Size (bytes):	79030
Entropy (8bit):	7.932975676379696
Encrypted:	false
SSDEEP:	1536:23j1raC9pNPiHcWgMA7ZRgt+vINH524kgIS448grdBH+zxPI0mo1iYQ:EjlaC9pN68WhAFRgxx2grdBezxPI8i/
MD5:	C5F1F90862996A876570838FEBC94BA9
SHA1:	CE1E93707BDE729410A6AD509C1A7FA36F2CA1D9
SHA-256:	BCB914BA77622EE5DD17542247299B12F007E50F8E8DE6E7AE391153F4542F6C
SHA-512:	CCB8FF105D7EA132B5556F89650114E721BB1B62CE0EE7D4B09A3F1FAFD2CD85F7F4ECDE948B697F47AD91E860ED96EEF4AA34A52E7522EFD6B51DD814A42E9B
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..3...G...EG.+..,I....K...,.$.C.tQ......b_<..tRy........\|...Hg?....X,L&l}.G........a.s.tQ..E2.v.......=..).Q`...9..(....E.a.s.tQ.7.E2.......y...L....7.E.s.tS(......G.....(.O9..(.......$.....9..).P...7.E/........s.tQ.7.V.....<....o..........9..).Q`.'.....s.tS(..a.s.tQ.7.V.K@Xw...Z<....@....K.7.V.E.?.o.<...Q@.....9....(.....G...Zm.X.y....o.6..w...Z<..Zm...y..y...)..y..y...(.....I.7.V.E.a

Chrome Cache Entry: 434

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 180 x 180
Category:	downloaded
Size (bytes):	476245
Entropy (8bit):	7.961351451700483
Encrypted:	false
SSDEEP:	12288:iKa7WiL9sj2ldDgtSqC5psvn4xyA38wZmziJ:9aSiL9y2rDFqCs/45s5w
MD5:	5E9BF3DDAE6EB7B634F7007B369FCCDC
SHA1:	D8FCA5D34BC816FA73D20C08033AF0314856ED61
SHA-256:	863113E6F9C1689F7BB9BB78E7668DE286B66D802EB9B5FE20F53D7F0CB840B4
SHA-512:	052707B631595726724F05E4E545A9CE3EC15F83EC56698F0A9775DE0A8DBE217324179707D2953D15A2E48D313709CBC838820D0A63FC7F972212C5E60F17F7
Malicious:	false
Reputation:	low
URL:	https://ig82.vip/img/FF98t_180x180.gif
Preview:	GIF89a..........!..............m..........t.......................w.....x........K..Y[`........Ip.................k....Js....4A[..0l.Q....M..Z............J2e..qkx.R.0..6.....y...f.V.......p..Fk........Md.........i.q...G3D...J.x.&Y.....Q..x...~..Tz..N..2............Y....5e.EN..,..N...1............H#......'......$.`r..g...W..r.h...11.GY............(.n..."..........k.I..\g.u.Z.!...K..}.6&...+e....'Y.,9.x....5.9...i....V{...H...a..............o.rk...3.j.HP.R..j..lW.Y...i.:.!9..........p...q\....x...W.........U........w......=k..e............e...V......>......s..Xu.m.y.l...v.'aZ...TTj.utq..O[.......:.Gw.........))A>.*...!!.9...y.................................................!........))....!).)!.)......;.......).....%..2.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 435

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, components 3
Category:	dropped
Size (bytes):	110022
Entropy (8bit):	7.830253026927394
Encrypted:	false
SSDEEP:	3072:z47v/qjSuq0Ga8atLMuvAsdKthTqmLaOm:M7v/qjSuq3a8WLTAsdKTdRm
MD5:	3811051CE225AF55E95DDE62465297D6
SHA1:	07F9807EE04472B1D4CAFCA86A73FA4B11B79758
SHA-256:	69D14E2088827F32A456D6B4D8BD368E8B7EFC00BD5C8630ABEB4090E761A44E
SHA-512:	9D8A7902825986BCB546837E2B6BBD7BE8043D3F7C413D5BB0254A049C26E4DFB19E0BC9249A9358CAA2604A5D926947BB5C2C8714ACB42BEDD908C51F1F7A78
Malicious:	false
Reputation:	low
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc......8...."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......QKE..QE..QI@..Q@.Q....o.KQ..M..c0_..S....M..%-%;....C.e>.<g..e....4D.)..).p..R..E.P..(...(....)..QE0.Z(...(.b.E..(...(...Z(....(...(....c.E...J(.P0....aE.P.KIKL....PPQE..P(.P1h..c.(...h... .....E.S.ii)h.QE..)E%(.L.S...P...M...C.).)....p..\.T..R.U.....8.e]j..XF=.Q)A.^k...;..c..%.t.....m..L#.I#h.Kr9.J..j&P*f<TdU'cF.+..g.......!....yLkT....R.!./.>..CzV.....%...+..fcI.F..-}(...aX...W.Tt..

Chrome Cache Entry: 436

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	33439
Entropy (8bit):	7.963015138816945
Encrypted:	false
SSDEEP:	384:1JYWPoBW6ge2Du/Yrz0+WTDpItsZ8iCYMNWR6EOVJLZc/UHjUEiaCIoDulVx6ios:lPqW6h2y/2zUBwQD0JyoaDulVItglx5
MD5:	40DC620CC374E244FDA40AE6D622F91C
SHA1:	38173625B91E360407169D75170259C2ED7D90A2
SHA-256:	CF028F6C0A2E8D15F33D085CC2A9809BF3BFD6D724592F90083845DD4D37D997
SHA-512:	230B467E3410F613B35E20AA3FFBCD7935377B7C8F6AEA0849C123E38F92CA872CF833E6B13914A093B04E81FE7898AD41250586A180AF964FE56C78E8C72C94
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................D......................!.1..AQ.aq.."......2B....#$3R..%b.4CSr..6d................................../......................!1..A2Qa."q.3.#B....R..............?...!.... .....T.@*.h@-..A.#.HPR...a.8...4.SS.m..M(...J.s.dq.......A.cl..5....g./8.f.0..<.....q..K..5.q./.!..8.K.:{.....-..^K..G9.........6.k.mF.<...M....e.Pu..[b....L.O~.^Cc..r\|..I+`h...E.U.?.\.+j@C.f..J....`.D..'....$......=....P.D....M..U..Zc4.YK.h....R;Q..hd.. .P. .UE......$..f.....#..;....{'m.00.d...U.J.%.0`..e....H:..,x.H#..3.M.#.n...nM..D.mi=.-t0.=..y.y....=.6O0.8.O...,.5.c.-&...g.......5R.{..F.a..H.{_..M...Iyp...I.2........b.Y....f..ey...M'.[u.WE..i.k.....'.\|.}..AoIx..k.[K.q.....~F...,l.......Wq.5...h.......+...'`>...y.-.3.s.00....$.(.0.F5:r..9.H.$.GM.o..k.<.c.6.~.Z:M\^.R..(......"......s.

Chrome Cache Entry: 437

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (860)
Category:	downloaded
Size (bytes):	24639
Entropy (8bit):	5.6173736700426335
Encrypted:	false
SSDEEP:	768:8qsM/NQu9wVClxk+yx8p0zGSX52UYYDt8H6gY4S6NzZ4RcDW:8qR/V9wVCfK8p0rX52UYiC9Nz+RcDW
MD5:	60CEF19F7C3826A7A63CFA0959EC8097
SHA1:	63586279BCEBA6AA6DEFBE943B4279D1A4922FD2
SHA-256:	6D97EE0CBBADE60B12E757F8B16C20F635119220998297370A50C6CCD017DBB5
SHA-512:	565463EF89E9FB0F9841DD3D0707EF09CB15A8F079B779525EC936B4E87C5126CB45AD0B7079A2BD1EAC00A5486F214804BD6FEC60E1A0346926B0A0C13B3B8F
Malicious:	false
Reputation:	low
URL:	https://xmad.7wzx9.com/pangda/base.js?v=9999999
Preview:	.// var onlineHref ="https://t.me/CC91AV";.var wzfby = "https://www.pdsp.tv".var worldBgImage = "./css/images/bgg.png";.var body = document.body;.var ua = navigator.userAgent.toLowerCase();.var domain = window.location.host; //...var xl1 ="";.var xl2 ="";.var xl3 ="";.var appName = "...."; //APP...var title = "........................QQ...................................................";.var appUrl = ""; //APP......var appUrl1 = "";.var updateUrl = "https://github.com/wyz7777/pangda/blob/main/README.md"; //........var emailUrl = "yy8y.email"; //"<em>g</em><span>s</span><em>et</em><span>ok</span><em>u</em><span>wb</span><em>r</em><span>qr</span><em>l</em><span>kt</span><em>@gm<span>zi</span>ai<span>mk</span>l.c<span>yq</span>om</em>";.//.......var countUrl = "";//"https://v1.cnzz.com/z_s

Chrome Cache Entry: 438

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	1399506
Entropy (8bit):	7.935177395625132
Encrypted:	false
SSDEEP:	24576:ztzEXuvzEXuvzEXuvzEP7B9vZbEcbEcbEcbt7W/ZOz+21/ZOz+21/ZOz+21/ZOr:ihhhP7B9vCpp+yO+MO+MO+M+
MD5:	C8B3D2F3119A81CC289EC5CA3AA6180D
SHA1:	B3047CF84B11DC2C460E0391684C99425C95B8B6
SHA-256:	F9399191A4A84B3EFABD647115F701BD111CDF620E657D6F800D8F20A57BE591
SHA-512:	69523F1B4A13EF6F87128E45E9BBF27FAFA7E4076E54C74547886192104DAE0A22871611AD7885FD03BFDBF7A43D08B1A58F23EC7BF3D97487A193D1FC44DDE9
Malicious:	false
Reputation:	low
URL:	https://5967.5967007.com/1300x200.gif
Preview:	GIF89a.........m.....%.a........."...cs30/xtq.....`......ll......o......EG.....G....".......<...X]..t.W)&DD3...)".!....rSLZ.....B gif]3D......0h...pw...rq.GF...E3......TNi.....%...w.nPl...Uf.2<F"".51....W..VU....UfT.....Qhn....m.1D3ZT.....:pJm....$&:.......M.:Q.#.."..0....UUUDDD"".33.UUD...............""....WCC...3".33........................3"......DUD..DDW...\BUBU["3.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 26.1 (Macintosh)" xmpMM:InstanceID="xmp.iid:AC48F303B53911EFBCD285CAE455696C" xmpMM:DocumentID="xmp.did:AC48F304B53911EFBCD285

Chrome Cache Entry: 439

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	124953
Entropy (8bit):	7.982263722335583
Encrypted:	false
SSDEEP:	3072:sDC9JCHW7W76Ksnf0UKsnf0UKsnf0nGfLkYTuGfLkYTuGfLkYTa:sDowH++psfSsfSsfhT9T9Ta
MD5:	0A98BE5BE36B9EA1CFBB3C02981318AE
SHA1:	B7DC557737F318CC2F517A140834B365F4FBE12C
SHA-256:	8E08D6E6340F6A882ABA7504F3A98A2ED12B900764B534113F1D9A7FFBB40DD2
SHA-512:	CFC439EFFB2A15946D69D03108BEE182C543433B84A6FDA0760F1B348CAD264641A882C5CEE1277303278035F5D94DFE90E1552F9B46A5DC4EC1A9E286165653
Malicious:	false
Reputation:	low
Preview:	GIF89a.........q..............iiW......k.........n............[.[.....o...r.......0..r.......gP....f...........rPb......L6....X....j.......%....U.....................5.qoT.i..G.q2$..X.'....ew...I.....i.....x..p%....qg...vG2.....0.......XE.^....................e..[...$4.....n..............................e....8(.Q.....I.......$.,..A;2..z...s-..V..l./0.Q.......`.e.u..M..k.>b..9O......J.NM.wa...%..+.......P.P.....a=&m../2.....,e....L&.Y .r..D...mf5.........(...8$...q.........f.......).........'..k......1.:.^...S..Y............\6.4....G..H..[.T.30....S..GZ7.......o...............2......C............a......a.7...v..]....^.................J..................). ....s..^....K.....................+..`=...&....2.c...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 440

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	56963
Entropy (8bit):	7.866193204186524
Encrypted:	false
SSDEEP:	1536:IAxwJK31c8AZH4GQHA/JkOwVS6Y/gvWXJNyh:/xwYFlAZHJyA6q6Y/gkA
MD5:	C4AA1483E054255E47BF4430B800240D
SHA1:	E3FC4416C875F2A4B9E67959E2A31FBF01B4C1F7
SHA-256:	DE37B7760B7C981B01136467A28AD3F98C14B5FD67B1EAA0AA21774F719EE543
SHA-512:	BCBB351151BC7B60336D0E409DEBB4DD67DC4ECFFB581AB27BD72C273C3B0F666662910F25D8744A50E566E771FC19934953C8AB251C694DB3153F2703F00989
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/10/8eceeb2a583c/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3...........................................................................!1Q.A..a.".2.qB..R..#.bsr..3....S..C.4TD.5Uc..$%.tE.....................!..1AqQ..a2..."..3..#R..b......8...."...................?..@....!.....................Q#GL.....h.f`FF.. .........F...P..h..W.@..Vj..PG..@.E9....@k.\`h..(.28.....#.o...@............d".....NE..tz.j.)5 Sp{._'...o....O.v.-....\|..<.........O.=...~.;.}...8.....^l..~o..y.........qx.....y%.....=.D.......B.rm.C.n./i......e..~.....k....;..c..^....N..x........z..8=,0.....9:#M.v[\dn..<..\|q..w..I.v..f]....4...n.Z.8:`....4...cQf.i:LV:G....k.,.uVu..p......$G.x..G....*..91......2.......2..;s.q.....p....i\|{......t....h........j.2.Ty....x.Cc.5.F.A.W.l.T...i..S ..X.H.E...L[ew....3..pc%...?.....D......kW...?N.#k...."...(.......I. iQ.hhhhB...#.@........)........`@FB.........H..(....!`...B.$...(#..d ..%....4J..."R@..@#

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	18288
Entropy (8bit):	7.8358878448650096
Encrypted:	false
SSDEEP:	384:c+6dea1Jw/oUffcsE7QJL1xVc/1KawXfiKP3oCwfBPFT:c+o1Jw/oCcOJZI/UaufHoptR
MD5:	E4A33E4103216A49A0AD6404BCA09454
SHA1:	87A2C634058971BA94B645A5F92BD557E0849414
SHA-256:	D7F84E01868DB211645EF4C36CE9CEF2B8C54EBDF0E697FF93CFA72BFAC5912E
SHA-512:	198F264DD87EE2DF4D3BC17582D8AA99A67FC68D99C6EAF70C5DC45F706F24DCEEC3D27BE7A86044062F274E5F17F5587CAAE5DDDB81614E53C0EC2DE92D83B2
Malicious:	false
Reputation:	low
Preview:	GIF89a.......q...u..'.....lS....R..G................s..2.....Q&..n.$..uNnN0....r2.5....U..L........Jj+...k......5!.........L....O*..T..............X..U+.....G..3-'.g1rfN.....g..UF1JHC..\|&k.F........t.L.G7'...................o0!..1..........rH.xW....M..eG+...E..V.b..s............va....G..k8 .......j..$......X=.s...6....S.-.......i....0U..k.u0.j:./!H..Jb.t..eXC......zA..........m..{d.\A.e..uj.sKvq`......>....tB.l...Cw.0"z...s.......u.................kR......eD..g..!x.......YDm4y\|a6.]......._..........z.......9..........;................sIo.J........yc...!8............7........aV....%=.!.....^..].................O$..]_S.........................^D!.........$~................8}.C........Q.q.................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	100244
Entropy (8bit):	7.975619711233213
Encrypted:	false
SSDEEP:	1536:DTFZBZ3uLsnXd17scojd/gXpqKl0Y++kRdBomvQV8rlwiNu2uZvUlROq:DBZ/3wsnt17Nohg5qKRv0zvQV8ryZv+
MD5:	9A7E82000864DDA0C222647F24AE7B01
SHA1:	98E9DF60C3DC5EEFFBAE5919033A219F08282B4C
SHA-256:	D8206492FF31A5482EC70BFB870620737A3A6F8613242D01930DAD7F43D34311
SHA-512:	29C7854EBBCFE10A66AFB767DD3A115968D0B243DE77E8715AB92D76D36034FC238CD2C7F82A3FA45ABBC649D8087ABA3B51DB66199FD40934D898941A826444
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/ecfa86b60f78/1.jpg
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:A68C9E41C1A411EC85A4FF256524C7BB" xmpMM:InstanceID="xmp.iid:A68C9E40C1A411EC85A4FF256524C7BB" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:055C837EA4C1EC11A7B7DAA66860BE5F" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	20305
Entropy (8bit):	7.876782068906238
Encrypted:	false
SSDEEP:	384:w9hSgFDdQBsLeBgnjWjCmkLeAuRP7ekDLcoX3hJgzkyGITGF4fs:w3SglObBWWj5k0V7ekDLcO3hmzkyGITw
MD5:	FCCA8C526A0A8C01137306D61760DD52
SHA1:	D94F8C09D2ACBE556324698FE7CD24F1547B9187
SHA-256:	5CCF611CB8725814797F70132E2516C46630FC5E096B31DBE9B629DF790A842B
SHA-512:	E83833D4F6DEDB2E65EEB34E53BE4759CDBBCB0931F481256F84A9F7B13FBC4EA2E4E145B9D2A167F44ABF3E8EEBEFB1928D9518FB94C51F5192CDEE6485266E
Malicious:	false
Reputation:	low
URL:	https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy150.js
Preview:	GIF89a..........M...u......,..qO/&...'.....or!.......Q....EA.+!..MIgN..........D6.6&.znj4+..dQ5..VG.....lE4......:3....$!.eR...\|FrYG..0'$;'..pd.....z..mU.j..............Z...q...D&........j......xg.............j3..G.....................J7........ee...........n[.....UGXu.OJK....b'........t>....UUn..zw.}lWD.....uko.B4.......NJ....:GV.........zL@......uk.I0..,.....J...LWf......g..eK@..N ......s....>.....x_<7.,1..8;Wdz...d.....5.........._Y.{C......TzZS..P3.E.79@..zdV.R.........+....s#..................dXR..pm....s.....^\.5..`..Y.d....aG....M.yS...............t"#(.zR.................o...l8.>#jOQ..`.!.LL....}........... .......(.......k__.R..U,.`M....~.zk.... ......,,,.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.0-c000 79.dabacbb, 2021/04/14-00:39:44 "> <rdf:RDF xmlns:rdf="h

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 180 x 180
Category:	dropped
Size (bytes):	476245
Entropy (8bit):	7.961351451700483
Encrypted:	false
SSDEEP:	12288:iKa7WiL9sj2ldDgtSqC5psvn4xyA38wZmziJ:9aSiL9y2rDFqCs/45s5w
MD5:	5E9BF3DDAE6EB7B634F7007B369FCCDC
SHA1:	D8FCA5D34BC816FA73D20C08033AF0314856ED61
SHA-256:	863113E6F9C1689F7BB9BB78E7668DE286B66D802EB9B5FE20F53D7F0CB840B4
SHA-512:	052707B631595726724F05E4E545A9CE3EC15F83EC56698F0A9775DE0A8DBE217324179707D2953D15A2E48D313709CBC838820D0A63FC7F972212C5E60F17F7
Malicious:	false
Reputation:	low
Preview:	GIF89a..........!..............m..........t.......................w.....x........K..Y[`........Ip.................k....Js....4A[..0l.Q....M..Z............J2e..qkx.R.0..6.....y...f.V.......p..Fk........Md.........i.q...G3D...J.x.&Y.....Q..x...~..Tz..N..2............Y....5e.EN..,..N...1............H#......'......$.`r..g...W..r.h...11.GY............(.n..."..........k.I..\g.u.Z.!...K..}.6&...+e....'Y.,9.x....5.9...i....V{...H...a..............o.rk...3.j.HP.R..j..lW.Y...i.:.!9..........p...q\....x...W.........U........w......=k..e............e...V......>......s..Xu.m.y.l...v.'aZ...TTj.utq..O[.......:.Gw.........))A>.*...!!.9...y.................................................!........))....!).)!.)......;.......).....%..2.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	46219
Entropy (8bit):	7.959240488794485
Encrypted:	false
SSDEEP:	768:Dz0Zo6fhyPcIkFrLmdMl0qDKRAe/s9kSO8WBz/ZW8ng0cNaAEGD+yXnI:DlP6rL0wDKRA195OPRZnhc0G+kI
MD5:	F31F9862FCABE9F123BB0C9198EC5EA0
SHA1:	45C5BA04F94391540833BB2386E87E84E440680E
SHA-256:	2C6EB705D09DC6FE1DF4295B09CECA01BDC8F5F4397DE015B7E829844E3559A7
SHA-512:	C5B807D97E8D83D21332AEA7AEB7CACAABF4BCEF59D12FED2C42DEAF5FC6D68DBB88F2CAC169EA43A779C16C10A55595EEC75A8014B12D07C354EAEC42A5D13B
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/umz9e7.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................@.......................!1.AQ.a.q..".....#2...B.R..3.$r%4Cb5S................................&......................!1.AQ"a2q.................?..O,a1..w.?.^.. ..8...u+av...A.}.3l.r.fN1....N........\9..X..dDs.?Z5.G.2..M...<. ..Di...$......A.-.7..V@p"cnx}....8.+....$dp.WH.....=Gz.\.oU...9L....7(s.E....(2F..?...W<..T.H....3..Cg.E..T....&.OH.....p..%"..M..L.........P...H..r8..5.(...[.2...`..4...v....7.......w.%5.#...c...wnH...0..\|.ZI...m[.z.....`.i.".?J.A..!.=\|\|..n.."...^>Ec{.>.z..Z..S.J.L........&.f..!..).Wz}f....@..we.4.Z..C...#.....s..%.....{c.N.1Ht..`..z.[.zm4....H.........U!r.x..;.>}...NY.NckI.....+.#.....@\.~...i..T...9.M...1.7...p._..@_.I..6GM.8..>]...kY..W..9D&&...m.z..jnZ....(..C...._iu..t..3..~.....I_.lg.=.jS?...6Z.Tn..Cty)..{9..=.%..[.<

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	18662
Entropy (8bit):	7.915021468449098
Encrypted:	false
SSDEEP:	384:4UdJTYFM336YMT9SKVvAjGRLQQOL2AAujNJ925rSacJR:xd5OM6RkjiQQwhjN72oacb
MD5:	5C92F0EEF450ECA943316C86E973D848
SHA1:	2A45F46DFB118787D48A405D2969FA33AC67ED94
SHA-256:	DB913EC4D9660E2FC41235C46F9A36AD8332E68F7452B1095DA660C493119B51
SHA-512:	FE83DF70A78A1F6459CC238562D1CFA2193B0D009AD26803AF26B5E12E5A27E63E1DCA12704B751F8EAE4BC35D502A1A5A8478302F142B6CB6E587288DE77520
Malicious:	false
Reputation:	low
Preview:	GIF89a.........-..9........2.....$^.T..6.......5."E..(. B....U..Nj..P.3..6....."..A..-.!D.-.+....3..8.$.....[.').p..4..0.......%.f...........)........06.X+.4.{4....t'....P.Q.....s..l>....b2..>.8'.8....:.J,..o.S1fV...;.Y>.......G;........6...1R..$..2....9U...#F..3.5..1."A.z).6.F#..<. ..5............/.X!.....0s......$..."...RE...>.8..<..(.p..J.s2..dA7...&..r..(...=ye...)....k,..$.)....\|...5.9D....=......+.....6......,..9..3......O...&...... A.........../../.....1..S................(G-.y..4..#$..##....5!.(.....:..7......"..4..+.....@..3....6>..8.a)..-.-M.&E...."B.....:.3..3..5....!C..1../..2.....6....."..7.....%..'..+.....#.....;.....,..2..)..>........1.....8."D.0-.......+C..P........:.......+..........2....)?.>;.......$G.%H......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	122363
Entropy (8bit):	7.906228965112134
Encrypted:	false
SSDEEP:	1536:5p/nr1MuPuPXjbLSRHiKsHfnS/Tu5ACI5lPkCMGBxaanS/Tu5ACI5lPkCMGBxaaJ:5JJMeeXCdsHPSrtCItSrtCItSrtCIC
MD5:	CE34A5DA9B3E38EC9AB9572F8215A7BB
SHA1:	1FBFA0C0C8FED98DE24B709F6327A912E02E2EE6
SHA-256:	F4BF88FE459A47CB8634F44A14489F8829E4096901BC41AF14CD2749B0D04B0F
SHA-512:	9B4324F3C3DB547B117701510801D758979C08FD7CCAC1E220A1010B8684F483A056787390FD2FC0714CCC3357326EA4E5E2AEC551A1F0555F7339724DE776DC
Malicious:	false
Reputation:	low
Preview:	GIF89a..........qqr.............c.......YC....$...[k...Z....1 ....Nq.R.....o_.................LKM.d..q.T.,!"$..T.Q..#.....H.......&j.....oig.!_l..........(....2T..........(+Y.C.......n#@.....m....Ol.o........Ks.q.o.J.....q........L....335...p3.....x...y.....O..2.....J......I.....o..B..........i...w..........O..I..........NR.kp.........@.........,2^........../V....4i.:...u........q.H...].&........N-......L.j..I0...sN...)...4P..(pjB.o..Z.YY]....m..3..........P.!"....n4f1.x.P.C..L..J....:...ol.....{EL...2....../D..R0.........]...o(1!..u.sM..K.....s./\|.........-8.('23......F...oH)),.H.....LL.5..{...ccd...H............V-q..............[^? .c.Jt.1...B......B.x......D6.......f..a..@.!5..9$B.53..........................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 448

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1920x1080, components 3
Category:	downloaded
Size (bytes):	49035
Entropy (8bit):	7.661077170556799
Encrypted:	false
SSDEEP:	768:Gyh+bzX9NBbk76WL0N3WctUWoUXsgjrD31r0T7D5zIX5fm6MYqrES+gh1/rhE:Gyh+HNbk76WLGntUWoUXRnDyD58LgV5m
MD5:	2962F6878C4E987FF79C45F37A59A54D
SHA1:	E6532C310AEC7C4C9CCA3D4B02109393A79F720A
SHA-256:	A6680FCB1AFACA5616E37A20ACFA909365358F8A6AF8303569BEE8DD4EC0121D
SHA-512:	921DD75320BE20142B77166F641B9D43E3787CDB3B7CD6D6048880157D9C2D88D695DCB3BD10C5329DB6DBE0C0EB29EA5D85BEE33E80C521CC18502C3039DF55
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/14/588b8dbc8bfb/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C........................................... ! ....!!###*((112<<H..............................................................................1.!AQ."....2qa.BR.rSs3..54..#..b.....6.$TcC%DE.&......................!1A..Q......8...."...................?....(.............$....H........ ..$....H..................,................@........ .."@.............s.....l.Z.....Kf%......Y..H....L.K..B...B.,..........mm......@Yd:@......Y).w..9i.!..rK..njK............8Y.-.5e..e..\.j.....UxU..awXR.`.u.. ."....."WVTk...ZA.\..\e.UYVE@.......4...............e@............................H...... ....$................@.....X......@.......T.@.. ....@..TX.$H..,.....A ......0.@........:C.....pY..n.$..J.C.xr.hAp.UUYQ.eV...M..M'@...+........t.m.n.j...K.[.T....e%.G)t. UU....(,...R..R.k5e.f......9..,.`...V..............(..;C.9C.(.8.6T..........F..K..K". .... ....@........J. .....$A. ...............@..............................@.H.............`..

Chrome Cache Entry: 449

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 960 x 160
Category:	dropped
Size (bytes):	108319
Entropy (8bit):	7.952635803991099
Encrypted:	false
SSDEEP:	3072:gLOoTxDeVtLV83aFWI7Asgfkf/8o9DTexzrs:FoFD2jmUW2gfzo9DGrs
MD5:	5451627C16677A31DBC37A3649833282
SHA1:	2CA37AC041EAD5ABBC5DE1023AB60D214758E94B
SHA-256:	711A7F567257B50DA4F95F730A171D595696026A23AD012D1BE65AFD5C2F63D4
SHA-512:	AACB93A7F7FC210CE08460FF4C3CB1E0137571A0B7BF3E430CE9B014DCF04FAE3DAC6C8A489DB873916C63EDDBDB88F797D9C0FF144FAC787474BCD862461292
Malicious:	false
Reputation:	low
Preview:	GIF89a.........q....m...s'.5.........%.....N1.LP.1(..lN.....pLL1..11.PK.B...........w.C.E..G.......W..w.m..X...$.un..F..V..p..F.....5.......W..x..F.........g...w..g..E..'..w..V.#..6.f...0..6..U..4.lG..$....n+.)...h.....6.O/.....g..#........!........Y.-(..w....W..z&....'.M.W..N/.......E.....c.-..RK..7.F..kI...p..f.3...G..S..%.R....c...%.U.......Rjp...y.)).Q2...".1..&..3....:...o..1......o.....J.r.N....y...s.$..=.1&.[r........f.d..n7..S6.%...C....ed.C..7.-?.m.5...'.<<.;...p..........1.z......[..U.[\|\<.........8.O.............@Ix<+.{.....Z...B..!.....w...:....F............)..X.....{...........1.....B.....J..9........1..).....9..!..!..B..)..:..1...........Z!.Z..9.....)..9........=..P.......)..1..@..J..1..B........).)0..6..1...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c001 79.1462899777, 2023/06/25-23:57:14 "> <rdf:RDF xmlns:rdf

Chrome Cache Entry: 450

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, baseline, precision 8, 462x259, components 3
Category:	downloaded
Size (bytes):	21142
Entropy (8bit):	7.9635438448009035
Encrypted:	false
SSDEEP:	384:ehPaeLEkYgrHiM0Q4Ci5MddU7nl9/4eUFnHvxwd2lzDTzyQlPSGZwJ2:ekewBgrHiM54Ctd67nLeHvxwOTBlPpg2
MD5:	0F492677875A89463037D8778A14B03D
SHA1:	665425BA76820FB097CC8948E5F545DB550615E2
SHA-256:	46A10B0D5B0B73437D519FC7E7016ABCC4E27CF419FD3FF70369D8A6198D68F2
SHA-512:	CBD21440E9F56956CA67FE58B09A7FD9D2AA1B9D806B2756F46982785F0AF0100EB3EC19601E0B19E52DCABF2795E011DFF7421E598DA61E7ACF3AE88908C391
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/594a71024e23/1.jpg
Preview:	......................(.....1#%.(:3=<9387@H\N@DWE78PmQW_bghg>Mqypdx\egc......./../cB8Bcccccccccccccccccccccccccccccccccccccccccccccccccc..........."........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..,... .z...[..8-(Z.g;..MaL......l.p...B..B.+.c..cG......%q...^..!......zg..Y.ct.......+...G ........_.5.\..!.Lq.8.Tbku..Kt#...kX...:.:3.2..YP.a...T.U.z....z..<.!x..........9...Mm.Mq.K.....?.@z....k...SI...>...L..cT.%D?*.T..T..O. ......\..)...j=..A......Z.N.2#.f.i...L.#..A...!...1.8._'....?vy<v..ks..FI!u$2.....KYXtfu8..yj.....SX.q..F\|.s...k{...[..ue..1B{zdT9(.....5....yT._2H..t.....

Chrome Cache Entry: 451

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	46219
Entropy (8bit):	7.959240488794485
Encrypted:	false
SSDEEP:	768:Dz0Zo6fhyPcIkFrLmdMl0qDKRAe/s9kSO8WBz/ZW8ng0cNaAEGD+yXnI:DlP6rL0wDKRA195OPRZnhc0G+kI
MD5:	F31F9862FCABE9F123BB0C9198EC5EA0
SHA1:	45C5BA04F94391540833BB2386E87E84E440680E
SHA-256:	2C6EB705D09DC6FE1DF4295B09CECA01BDC8F5F4397DE015B7E829844E3559A7
SHA-512:	C5B807D97E8D83D21332AEA7AEB7CACAABF4BCEF59D12FED2C42DEAF5FC6D68DBB88F2CAC169EA43A779C16C10A55595EEC75A8014B12D07C354EAEC42A5D13B
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................@.......................!1.AQ.a.q..".....#2...B.R..3.$r%4Cb5S................................&......................!1.AQ"a2q.................?..O,a1..w.?.^.. ..8...u+av...A.}.3l.r.fN1....N........\9..X..dDs.?Z5.G.2..M...<. ..Di...$......A.-.7..V@p"cnx}....8.+....$dp.WH.....=Gz.\.oU...9L....7(s.E....(2F..?...W<..T.H....3..Cg.E..T....&.OH.....p..%"..M..L.........P...H..r8..5.(...[.2...`..4...v....7.......w.%5.#...c...wnH...0..\|.ZI...m[.z.....`.i.".?J.A..!.=\|\|..n.."...^>Ec{.>.z..Z..S.J.L........&.f..!..).Wz}f....@..we.4.Z..C...#.....s..%.....{c.N.1Ht..`..z.[.zm4....H.........U!r.x..;.>}...NY.NckI.....+.#.....@\.~...i..T...9.M...1.7...p._..@_.I..6GM.8..>]...kY..W..9D&&...m.z..jnZ....(..C...._iu..t..3..~.....I_.lg.=.jS?...6Z.Tn..Cty)..{9..=.%..[.<

Chrome Cache Entry: 452

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	downloaded
Size (bytes):	92086
Entropy (8bit):	7.963247576869469
Encrypted:	false
SSDEEP:	1536:UDDzsxvUeJtH5+OiAeRsGZZ3BkEsCa9ZAaxkEm/VWGbtzyGr5Ul/oMZ+b8VMNrMp:SDz41fQOkRsGfzpwZb6dVWwi/nq/BMp
MD5:	37D962057871BD94714E0EDFBD580622
SHA1:	318DBC05C4297D320554D8B767D0962506C1B54C
SHA-256:	87A8DFB46F8E02EFF210E954D768156E42DC78778290D3AD4BE371F1FA3E01C9
SHA-512:	369003EA7DB6012CAAEF6DFC46C72A8422030B0074FE2D7140CA67D97F291C0EA527F5CAFEC8305722081CBD300856418626BF9AE7E639A60A6FC83F5C54B31C
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202501/01/c56b3842c616/1.jpg
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:606BF1ADD60E11EC8877F1CD09FDE98F" xmpMM:InstanceID="xmp.iid:606BF1ACD60E11EC8877F1CD09FDE98F" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:67E158590ED6EC11A14CB1D365FD3A45" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 453

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 400x600, components 3
Category:	downloaded
Size (bytes):	32633
Entropy (8bit):	7.957812866493121
Encrypted:	false
SSDEEP:	768:U1Pt/9ZhRdJVb2xenf9UCpiPfxYgRu3+wFmn:U1Pt/PXdJdEenePegK+L
MD5:	6462382D3BC425F8E74DDBB5D26F63B3
SHA1:	AFC96BD63F066E0918F5FB66CC076E35F66ADCAC
SHA-256:	7F15A842ECBC6BF719E3BE14D15F366BDD5BF34BF32B48AD08F9CC39A5A7ADAF
SHA-512:	E160BE67B229527F3DD13FB87385FA00E293CE1B5A5DEED32043755C471E053196A4FF532A5C7E7CA21F24462828EFC630A1F606F54AC671E8157330202BB517
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E9%9C%B2%E5%87%BA%E6%BF%80%E6%83%85/x2zdy8.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................D.......................!.1..AQaq.."....2......#BR.$3.4br..CS6Ec.........................................................!1A..Qaq..".2B....................?...!..B...!..B...!..B...!..B...!..B...!..B...!..B....".R..vOQ.9p.S./$...J.PHIte...Rx9..w..{.Z...+.../)..^.T....i......k.`.\. .....gc....N....rZ.".{..g.@%..".w.....reu...Bc........Z..cjl...hp2..4..{7l.q..k0.'..3 )V..vM).&.w..5>..VL..T5z....T....!.C.B...!..B...!..B...!..B.Uj.I.j....K......P......s.KK.7..=..m3......`.U..{j.J.I.qil..5...7.O...../.....(....j...u.4.v$....i>....1.,..:.\r}...L...kB....FY_......u'........!..B...!..P..R;....P{...^0...].Q.u..wC..7.X^..n;..g....Mh.Q...R.{.......\.W.Q.....A....%..\g.+.....5.M.w....T..S=1.Q.[.....,].@z+.Z......Ve....[."i8,j_.R<.}4\5...`p.R2.....e0.).4..5.....*....

Chrome Cache Entry: 454

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	221556
Entropy (8bit):	7.973070678135349
Encrypted:	false
SSDEEP:	6144:zF/mihAOdvKdmHehGzLcJPLHGDg2AJ9ST8Wxn:h/mihAGKdm+ehTL
MD5:	972490C760140B5388745A9585C22719
SHA1:	DE3F2A96A89790216EEF3B6139FB1DEB8449D37B
SHA-256:	97A7442BD27C13C4B308AA10A92FF97C41068F3134CBD8068EADE7E422B610C2
SHA-512:	9700CBEAC42142F7B69E0B56F48555F8C4578A23691E60260A70AB299CA2E2B4D98FC42B5E88F99CD9074C343B08C76919836904CCFFCAFFDE4D73952561CE7C
Malicious:	false
Reputation:	low
URL:	https://cc777img.dqsldz.com/i/2024/10/28/1300-200_1.gif
Preview:	GIF89a........ux.......DR..../?...,..4.......A.2T.Qm.l.....................uz.................(!$..................................z.............&..7..N..f................vms............\T\g_h5/6...LIV=;P........0"0T.%@m}.......Inv.....................,&......^R.B:,.P.\|.....................n<..F..n...................................A..@..M..>..B..=..L..D..B..7..L..T.....K..\..C..P..Suo%../YS...T..<..R.._.._..L..T..\..X..P..V.L..e..b........\|.................."........................................{.....F-#8%..gW..\|.................sg........\|.....~UJ.y..s...\|p.........M83......pe................hMI.....2...........{da...[CA......o84.YU.cbtYX.ml.....................................!..NETSCAPE2.0.....!...S...,........@......H......\....#J.H.....i..#..~v..I..H?&G..!...+...H..F.........;2.:...!F.".x...M.>...jS.E.~.c.._.\|...HY.h.v ..,.....;....I..IR....@..1B.H."A.'F.......~L..e.>2..a.;.

Chrome Cache Entry: 455

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 1280x720, components 3
Category:	downloaded
Size (bytes):	38421
Entropy (8bit):	7.901365446107834
Encrypted:	false
SSDEEP:	768:BsCvUJJT2fw/Ccq7c2BhvxNz/o6qQ3h/A+GIXk9kteJ1j:Bs2U+wacEc0LpbqQ5A+G8CB
MD5:	07C528F61C372E01F2F96AD03173E0C1
SHA1:	DDFD8366DB1093905DEED637F172B7D3AD3844F3
SHA-256:	E3DD0AC923B4DF23F8ED5DC87D0F817DD1AD8EAA65B70C803EC3677669255AF7
SHA-512:	36805164D7742DAB56B69940A8DC01E71D1CC65F6442E470C3E51646934B3EB34E9FA73D7F963CD2A881A4FFF4828E9B2203A05259607383F023D2FB075B131A
Malicious:	false
Reputation:	low
URL:	https://x-hweu5.rdfzsjs.com/video/m3u8/202410/17/314e2e628318/1.jpg
Preview:	......JFIF..............Lavc58.20.104....C.......................................................$$""*+33>............................................................................1..!2QA.q3".a....B.R#..rCb......4.$.S.s......................1.!.A"Qa2..q#....b....r..........."...................?...Y..L.........>.#._....3...^.....w..Z..E.h..?...._....srg..g.v.P...H.P.9.JI5d..~ ..\.S.J.G-....0N.m.Z.....H..?R..I.H.>..S.y\._.R.e..z8.6n...t...R.rY,.j1Q.+f.9U./..?B.n.i..\.v...d......N.t...._..[u..s]..c..+.J4......N.....?F..w........iQ..b...O.E'>..eif.8(.q.....6...]9.v.%...{...j..t.H...Ll..1..X.eG#...^.Z.e9)TXiv...e{]..8.q;..:}.}..)U.:.}..i..m.{}D..().C'..pI....9..C.....kk......W.......WYJYZ~.:.....]-X.m.k.Ml....9A(R..N.d...i. i.e..:...PJ.........+'G+..9Q.I..^........i..NU....q..'..~V2.R.]FRq.e....\|.%.N...RzU.vKl.f....ymz.KUZ.Xm}...4.gM....GE..5+i..6..5...R..F5g9I.....0i.46..N.YhVyzNug)E4..m..\|awr'pQ...]...FW...o..s :e.*:..E.!.6..B.K..9..........

Chrome Cache Entry: 456

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	184704
Entropy (8bit):	7.971400591380393
Encrypted:	false
SSDEEP:	3072:jzcf6z2cIVXOMVhtcrP7fI4WlaeS5/DR236UPdaq8L7S5wngPBnWRG93EE1Rym2n:jzc+bILVhtWTItan5DXqGULnWcXbZj0
MD5:	E9777506A494D0F4CAFE4D1A71F51A80
SHA1:	8A3352328B35C33FE30D5C056FB732F797A6A302
SHA-256:	1F955B37B283B5073BF7F26CD15D60D6CF5037CE86D9454A7D08CA2B42BB2F79
SHA-512:	9D08FB515DA94231EB3BBA39577169E894522D9D693DA3E49C509F80E7250ABE5A77B392E6B3159D7B810CD40083666214CB87537AA1DADDAA99410DA63B98FA
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?.......H.CS[..).w1.rI\..H...9...2.J.........J.2...z.j....)\|.;S..".).rO..W..<.. !.)..qS4G>...>*..D...zP...t'...(z.......=.SX`.Z......G.s.N..`...i=...)..T...8...=.J...V....t>.A.X.9...2q..L.).....X...rx.0..5;......Q.....)...z{g.0.M...9.#....9...C}).f("..#4l...})..v...j}....m$..1.z.h<.....&..:.P2....rD.s...s....@;z..d.5_`8..S...).IjC...j.....~4....4 D..

Chrome Cache Entry: 457

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (906), with no line terminators
Category:	downloaded
Size (bytes):	906
Entropy (8bit):	5.43803072983903
Encrypted:	false
SSDEEP:	24:cOQRWZ1rnSV9K/MedOUnRwtYQOZ+36PYW2GPR:SwzrYIDnQ25
MD5:	6DE0173D7DFB8FFFB7D42304832598B0
SHA1:	149C6988FCF4D3965CB0AA3D6D90A813CD3C84B2
SHA-256:	CE81211868C0483FA302DCFC94A949ABE7C84D79099BCD96F88D89C5DE8E2848
SHA-512:	4281C85BBAE91BC9CC41F9B27C1FD1766C08C844EBDAC572AA1052FEC9FD95020CFC38B2E22EF6F5439DF1364BCC37E2B92A3D22FDBD5A1993BD301C9C200BFF
Malicious:	false
Reputation:	low
URL:	https://c.cnzz.com/c.js?web_id=1281318611&t=z
Preview:	!function(){var _="http:"==function(){for(var _=document.getElementsByTagName("script"),t=0,e=_.length;t<e;t++){var n,i=_[t];if(i.src&&(n=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(i.src)))return n[1]}return window.location.protocol}()?"http:":"https:",t=encodeURIComponent,e="1281318611",n="",i="",o="z6.cnzz.com",c="1",r="text",a="z",s="站长统计",p=window["_CNZZDbridge_"+e].bobject,h=_+"//online.cnzz.com/o.js",f=[];if(f.push("id="+e),f.push("h="+o),f.push("on="+t(i)),f.push("s="+t(n)),h+="?"+f.join("&"),c)if(""!==i)p.createScriptIcon(h,"utf-8");else{var w,z;if(z="z"==a?"https://www.cnzz.com/stat/website.php?web_id="+e:"https://quanjing.cnzz.com","pic"===r)w="<a href='"+z+"' target=_blank title='"+s+"'><img border=0 hspace=0 vspace=0 src='"+(_+"//icon.cnzz.com/img/"+n+".gif")+"'></a>";else w="<a href='"+z+"' target=_blank title='"+s+"'>"+s+"</a>";p.createIcon([w])}}();

Chrome Cache Entry: 458

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	91488
Entropy (8bit):	7.850954885067996
Encrypted:	false
SSDEEP:	1536:Zkq6LbFDanjXp+J9w7arPJgEmUSguAkKXHCwTCozBJw7arPJgEmUSguAkKXBHNb3:Zkqap2jQRATfGywTCMATfG7mZ+u+ui
MD5:	816E33F667B33B9DC57759242FB983E0
SHA1:	A06132355F4FFFB8A9A7F82A4C161BDA8BC9023C
SHA-256:	ABDE139895EBD0E28F46A889D902EEE9CFDCE281DA7EAA0451A94017EEDE939B
SHA-512:	AB531805565EB44A19D095791BDE2E96A7FEAF161121158CAFF918C7A7BAFC090C5154840836F5644447EDB52D6E8E8BC9BDEF4CE32EA99E21C2D4CA17080B54
Malicious:	false
Reputation:	low
Preview:	GIF89a.........N....K....V.........w"...r...e........V5"...............h........8....R.X...w..#.....o.xH................q..9V4.uiJ......H.f#......hC...d9..U.........Q.6vI..`..y.nr..m...E&...tg3.u6E(.......8..ll.t#wW#..:....i....i%.flc..5TD&..f.d!NJD..1-.....yR......W3...A.z..v.x"...dR$j..wG..t..n..C..d.v.....y.5.%...pom.OP.XTD..i4...hW5F1.....NN..CjC..{/.T.O...V.g..WG...u%..f...ll..R..X.MO.6..0hI.0* ..w..].{.H7".y'.D..C.......B...L.}R..w5.i.z0......4.{,G3....N..)1.'..(.aYNT'.....v......k-.((vY6.".x_..wJ".......H#.......X.%*.e.;..9.{G.....V.".t!.E..e.BB.!)...3..#...........tgS..e\M4+....B..c........J..k.................J.................k........B..a...R).........A..L..]..P..k..p.......k...Z.k1??>.Z.....V>;.........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.eda2b3fac, 2021/11/17-17:23:19 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 459

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 240
Category:	dropped
Size (bytes):	139280
Entropy (8bit):	7.943840822885064
Encrypted:	false
SSDEEP:	3072:MOzm2+OOnGX9I55k8F/6ZqtgHbl1Bmpcw9Me/eU4:N3+1nG45JF/htABi9P/e1
MD5:	20CE2316DE3C309C60BDFEA5C75B26A8
SHA1:	1E00512EAF0B42B3B20650E8B331AD86D98475B8
SHA-256:	F2579E5BE716739CAFB7DF1C3D33F34463E2216C2FA267A0C7B48BAC5BCA226A
SHA-512:	5D4A2E5B6B8A673B2B741798E04B443975A94D77F13DF546FB9C0EFEBA5FE8572435E883B8303BA520DFD7471C01892D51484DFFB62F6A518CB3E6175C99F6A8
Malicious:	false
Reputation:	low
Preview:	GIF89a.....?......U......................M....S..c........P...........H..T...p[....a...`.\.....q.....[....@.......#EPD.U......V........./....\ncew..\....\[..c......j..........,......f....0.....!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:36E5E37EC38111EFAC33B1D89A333FB3" xmpMM:InstanceID="xmp.iid:36E5E37DC38111EFAC33B1D89A333FB3" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:a079f286-73fe-2242-b74c-cb35473c8695" stRef:documentID="adobe:docid

Chrome Cache Entry: 460

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 800x450, components 3
Category:	dropped
Size (bytes):	92086
Entropy (8bit):	7.963247576869469
Encrypted:	false
SSDEEP:	1536:UDDzsxvUeJtH5+OiAeRsGZZ3BkEsCa9ZAaxkEm/VWGbtzyGr5Ul/oMZ+b8VMNrMp:SDz41fQOkRsGfzpwZb6dVWwi/nq/BMp
MD5:	37D962057871BD94714E0EDFBD580622
SHA1:	318DBC05C4297D320554D8B767D0962506C1B54C
SHA-256:	87A8DFB46F8E02EFF210E954D768156E42DC78778290D3AD4BE371F1FA3E01C9
SHA-512:	369003EA7DB6012CAAEF6DFC46C72A8422030B0074FE2D7140CA67D97F291C0EA527F5CAFEC8305722081CBD300856418626BF9AE7E639A60A6FC83F5C54B31C
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......F.....mhttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801" xmpMM:DocumentID="xmp.did:606BF1ADD60E11EC8877F1CD09FDE98F" xmpMM:InstanceID="xmp.iid:606BF1ACD60E11EC8877F1CD09FDE98F" xmp:CreatorTool="Adobe Photoshop CS5 Windows"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:67E158590ED6EC11A14CB1D365FD3A45" stRef:documentID="xmp.did:BF08DF74AF1FE3118965ADF089CD9801"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...............................................................

Chrome Cache Entry: 461

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 200 x 200
Category:	dropped
Size (bytes):	189139
Entropy (8bit):	7.975159562817782
Encrypted:	false
SSDEEP:	3072:+p6a6a6a6a7PSlfKY+PSlfKY+PSlfKY+PSlfKY+PSlfKYLI0q0q0q0qA:BlllSaB+aB+aB+aB+aBLI0q0q0q0qA
MD5:	ABE6C7FDCB7234DA7723574BD58C9C16
SHA1:	150BE0E0770224585ADDACDBEB31386B520A4E93
SHA-256:	CF1CE7E6E3A4D91CCF52F813C1FE3B2E5AEFA10DF4D4B4A09E540F641F62E8B7
SHA-512:	DF6DC6E2AAE32E7367A90039B0FE9225D009AB5BC0942F9FD7BD9A8FCC38016A23461B6F6E11BA7A6CD57F45B6B71CF7B9EAE2B86E27184892B6D7CF3B6DC514
Malicious:	false
Reputation:	low
Preview:	GIF89a........1.................Q.....w...tpp....\|..g..=..}......OMA....S.\.........R.Nq....................D.~&..VU....#.L...u..,...}.......1.y.........O.........,......+........_..jH..._A......._...!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0cbe3f86-c6db-bb46-873c-623c5adf3ff0" xmpMM:DocumentID="xmp.did:2FA929E0C44311EF9B16C59026E582A2" xmpMM:InstanceID="xmp.iid:2FA929DFC44311EF9B16C59026E582A2" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:c0bf165a-b239-1246-a657-a54a2bb39f82" stRef:documentID="adobe:docid

Chrome Cache Entry: 462

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	dropped
Size (bytes):	18264
Entropy (8bit):	7.872068184441072
Encrypted:	false
SSDEEP:	384:TUPOLSIksxCgVi1217Lm6VEWJOT2h7wsEGQV/nlBPyu8gT:0i9h/K27XYlB6ujT
MD5:	AB0DCF746525E1DCF969121F17AEBB69
SHA1:	8D2B463BAA66BFAF1B1A70FDAC55E44A3EC92E84
SHA-256:	7C1CB48E97E20EA22EA070395F334019256C568879F0D6D5C9C231CBBB9DE961
SHA-512:	BE9C7C92E88BEE827EB27B3875B85FB684327901B0A4957292BCED26E4E58FBE209E0FAE6D95F5AEDC689433BA756C31FA24AAD8754AAAF187A2193E4A1DAC42
Malicious:	false
Reputation:	low
Preview:	GIF89a...........oQE67$....................).,++......_..yaD....GEB......h&..`.L$......:::..\|yy......!! F7%...XWV'...................hgf...555....c.....^"F=3..........:1(..........#35+#gVI...xdR.Y..V....F%%....C..............~..rL...0.RI@...7........)..///..........J...lB...0?..%Nt...ZQB...........wia...H...........[.lE9..E.!.F...=83....P.........tN8...:50}sfQ:5...+.n.)............l\`%3;...3..#...........X..........O&'...d;-..................("t'....G,.(-0.Z.&5#...1.......... !#..........OB".^....(((442............Ej_......T.............2DA.........Q.0.....!...^.5..#$%..2:=LNG...55851-..........68/.e ..8..965MKK......`_]&&&...623ROL(%%222067...RRP........I(........4-+..............pon............-61.....888<<<............!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 463

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	975329
Entropy (8bit):	7.894171300294655
Encrypted:	false
SSDEEP:	12288:PME5XxAY2DedG03FpKLWkFAN62yjfjk5q0gR5q595I78fyhAfNc89Apne0dWETs6:+DedG01pK0OaggI7I19gv4mZH
MD5:	C935AD6DDE4CF98F305EAF0D69F195CC
SHA1:	0F8C55CEE7BC26C54D310A41409F3C7756B77753
SHA-256:	D67ED1D0C15DE75079D8758B73BA0F6575A28806368C3F44F7CF35C64BD43B9D
SHA-512:	EC8A9010C88321614FD5770C7F035C54231FE8ACB2461227FF03D3BBE8116A550D1E18A9DC934AC944A45E6B401F2617C6F594127F8A14D12FC3C25BE33FC802
Malicious:	false
Reputation:	low
Preview:	GIF89a.........gD2.s.P.._....uoh..r.fP.+&'.........a.......rTF#..b.........L2+..OHG.wj.pL.q..P......u.........gdYv....&.......b.TI... X........"..........%,O......m..q..kf[+Hh.p."..m..,".N-F.uE#.....w.r..T..]..O..m1)%.&........(R...#'...r.Ojq....h...lPT].K..........KDo.....T.s.$b....5.kShb1......./.....i....T.0..M...."w....NmLfNCp.H.2.....Q...."...*...=D7.I......o.N..#......Ro.8.3..3........0....3D......................w.........w...................wc...............................w\|..............we....................................ww.................f.....w.ff.ff...............e.............................w..........................................f.f}.]...d~........w..........B.......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 464

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	241438
Entropy (8bit):	7.914672772752952
Encrypted:	false
SSDEEP:	6144:d0et+/9vEqh1KXHgzRfX+7l30O6h53/xz/xd1HRT2Qe0bg:9teyI1K2fXOl3m75rTTs
MD5:	F115A2082833B7ADFFC3A83DA77799E0
SHA1:	4F4A50C637431B97B81213C8C1A5769E7D21B93D
SHA-256:	CF47E61FDDF49DD53F0780BD69060C61C61AC2D57D5CF97E7C2AB1F25ECF27D0
SHA-512:	9CB85D1156DF68CB32F12D8B25FC0766EBDADB0A33019DE3BE028D0323F53C8F3DB48DB43D786BCBD513CDDB9F83C0ED2C2539BA7C91CE83AD083873376776ED
Malicious:	false
Reputation:	low
Preview:	GIF89a.......S#,.oG..\"V...S.....pV].n..P....P./.l.R......]F.J..h....6x.2.........T...v1.......%w%......X...wG#...R...#&...R%............E........F#.3.....-.3.v#....V.`.#.....!....n....d..6e)G7.........E..D...#..<........uH....4...a.....^..............l.......6x...h..j..<..p..........i.......(+.p...f......2......B.......c..X.>...+.i...f.t.......h.N..F........Y..q.;..4"..............0...r......b....UD0...u.5........B.........p`../..bRF.........* d........Y....2.ar.}......\|vyf............yf ......y...Z..I...n..Q............M..T..2....`..Z.....M...j.......L/./.@s:..........A>q....`..........$U.s.....w..m.*/b..w.b..............P9...%.".}.8.#&. 8.5..s9.#........>...%.5.....[.....t9.7..E..\..`.....@..w..................................x..@..a......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.a6a63968a, 2024/03/06-11:52:05 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 465

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 1200x675, components 3
Category:	dropped
Size (bytes):	165643
Entropy (8bit):	7.965256412522482
Encrypted:	false
SSDEEP:	3072:N5bTVwk0YMsnMIWAKPh5ltqzjo2mobKJIc10cwx6SfW75N6Q9J:bpwkzMog7hu8SOFFw5s5jJ
MD5:	C11B60A06F2B931E050764F1B1AC196C
SHA1:	60B029A1725CC1E79EC58208423CCCB9C58CBAD5
SHA-256:	A66246629527D69692DB494722278DC1FB0A977D14E9E9D840B7D6DB4113B068
SHA-512:	882F7AAC55945D44C9269B74538EA5420E2EC63793D4A3B2AF0A20266D2760B721A6FDDF0FD0DCBDBDB5722ECDE437C8F49151FB2586E47840ABC1616116AC36
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..n\|..(...9...x.*d`.#..J............w..g.....7>.......6...}zVn..d+..Q^.C.%....P:t..I .4...S.....y...).F(..........s.....5H..L.0jJ.K......&..O&.:t....8.P..:n8...v.C.?.N...H.-H:~5...../z;Q..J.E..Q.Gn....<...N...MI...~."t..V..m+.i.."..:......F\.u.....g.'.;. .^g...n..;..z...")[x;.'a..q........../>..^,s.&.U#.............;...H>.D...1.......E..z.<.........e..+.../8...q.

Chrome Cache Entry: 466

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	117813
Entropy (8bit):	7.9655787158207625
Encrypted:	false
SSDEEP:	3072:OrnwPeL7pykbMY8e1CvGuSPqJoSisK5HE:Or79hMY8e1u4quSisK5HE
MD5:	845F0EEFEFB08D7B9772C14D0E306446
SHA1:	3EDA7362FD713C4B7D1C6F3054891A64E1AE2836
SHA-256:	BAA57EF07FD8462B772266F323180BEC957B2F66C6EE0D0266280F4C94A46740
SHA-512:	E6390B1F66833923E6C511F83484E2CA3410D610CABC3CAFDDFFD92E63353F5334AD37BA079A8386480695DA67AD6EFE9106ED36B63EBF26863A0FD97D1AC641
Malicious:	false
Reputation:	low
URL:	https://x-hweu2.hccoeutg.com/video/m3u8/202401/30/a2146fa33ff3/cy1300.js
Preview:	GIF89a.........A...NO..oU..u.........H0...bF2.yg.Ui...-Q....sY....u.\|...:...N4(\X.....O....Ep.gT.m;...... 0[.y.1$%.sh....i.u.uVC.w.fu.W`.8"s+K'., .....y....we.$. .............. ............1.QMi.T?......u.{.jU.:-....p..b.....%...ET.$.........}..bW.......:...6.....WB..rW......r-..:....tgWg.Xq.$..w...........!1.D:......}4?j.dK.<Fd/...5...I.......A..."......eJ.......v.....#G..l8.........zi...f...>e.q...$.y...u{aS..........A.........Um..........6..{_b...(...y..B..........7\....H.zi.....~bY.........(....... ;M:>... .VE=.q\...f...6.y..s...?#....i]...].;...z.s..........EO~.......u.../+..aU..}...".%....................8x.N..]Z........!..-...@..(......aU.fU..............................^Q....}...h..................n^.......!..NETSCAPE2.0.....!...d...,............G..H......\....#J.H....3j....H.B..I...(S.\.....0......_8k.......8....T.H.]...P.J.J...X.j....`.5y....h.]...p..K...x...............+^....#CF......^dvq.B7g

Chrome Cache Entry: 467

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	18662
Entropy (8bit):	7.915021468449098
Encrypted:	false
SSDEEP:	384:4UdJTYFM336YMT9SKVvAjGRLQQOL2AAujNJ925rSacJR:xd5OM6RkjiQQwhjN72oacb
MD5:	5C92F0EEF450ECA943316C86E973D848
SHA1:	2A45F46DFB118787D48A405D2969FA33AC67ED94
SHA-256:	DB913EC4D9660E2FC41235C46F9A36AD8332E68F7452B1095DA660C493119B51
SHA-512:	FE83DF70A78A1F6459CC238562D1CFA2193B0D009AD26803AF26B5E12E5A27E63E1DCA12704B751F8EAE4BC35D502A1A5A8478302F142B6CB6E587288DE77520
Malicious:	false
Reputation:	low
URL:	https://5967.5967007.com/11.gif
Preview:	GIF89a.........-..9........2.....$^.T..6.......5."E..(. B....U..Nj..P.3..6....."..A..-.!D.-.+....3..8.$.....[.').p..4..0.......%.f...........)........06.X+.4.{4....t'....P.Q.....s..l>....b2..>.8'.8....:.J,..o.S1fV...;.Y>.......G;........6...1R..$..2....9U...#F..3.5..1."A.z).6.F#..<. ..5............/.X!.....0s......$..."...RE...>.8..<..(.p..J.s2..dA7...&..r..(...=ye...)....k,..$.)....\|...5.9D....=......+.....6......,..9..3......O...&...... A.........../../.....1..S................(G-.y..4..#$..##....5!.(.....:..7......"..4..+.....@..3....6>..8.a)..-.-M.&E...."B.....:.3..3..5....!C..1../..2.....6....."..7.....%..'..+.....#.....;.....,..2..)..>........1.....8."D.0-.......+C..P........:.......+..........2....)?.>;.......$G.%H......!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.1-c002 79.b7c64ccf9, 2024/07/16-12:39:04 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 468

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	47944
Entropy (8bit):	7.969618468151182
Encrypted:	false
SSDEEP:	768:mEIZpat8dwYevpaf1gdBBlwlxfeSvRCUEZ8qNoGdrsm0XQ3+7wG7nT3kj/tZBjNx:mlUm3evp+8NqRC9BNoGNsmWE+t7nTqtT
MD5:	C2CEDC4301693F7775D92091A77D677D
SHA1:	0670FE90D6E7C10AB49293A5898DE6596E665646
SHA-256:	DE3DA919EDCCA01867019DDF413C9FC0AE04DE7DE8F59C6086C1DACFFF52ED7D
SHA-512:	3AB4962F897C271AE0866D1688D846939A17EA0BC6A0A995707DBB522345D52E9CBEDF5FB938CEB9B1CF1C7438759D134B0C830FF8C8FE4E6984CE4D287B7D95
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/un9cdm.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................=.......................!1.A.Qaq..".......2.#B...R.$3%C.bSc.................................0......................!1..AQa.."q..2...#...3..............?.....cm..qq..v.&.]Y.0.'.>.`M.L.Z......G.o...3.1...%.@g.;......0...U...@..Q..z.Qs.......z..ppv....E.n......qb..../;.V.p....r,gm.].v..<.q.%'...{.u..VCr.8...=...&.gy...)._..WgSnX.nd.<.>...K.2.....%..s...m.7..._.r.l......[...$l.$.....[&q...O./^......./..};..j.F...[v....YZ..x.*.p.e{.C...].V...6.7..H...3..qv.m..+..\.U(..S.-m..../VN}O....'...Q...3....k.....m.pI....Y_.<>F..6%."&^.g.g..I...j.0.Tx."#..z&.W.o.Y...........J=.C..s...k.v.iX..T#l....u......PO>^.W\...#.vH......]..w.4...\.=....hz..Q3......`......l.....!;....Ey6.oEGE..>.[....R9......Y.i..f&\`"w..._...:.(.a.<..j....n.zCJ.K..6.2..Z..

Chrome Cache Entry: 469

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	438719
Entropy (8bit):	7.976679828003753
Encrypted:	false
SSDEEP:	6144:vKmsJvfMN2cN1kV+VetTTTnPHPK44f4f4f4f4f4fu:imnNc6e1/PK4kkkkkku
MD5:	D7D290C4A054E428465FACD44562F3B4
SHA1:	863654159F687BB0277D2FBC52F837EEADA8CFF6
SHA-256:	C00A957F41306D204CB5C9CED826128D93633649C3F4C367CCB59C7839A0F8AC
SHA-512:	331DE95FC0F1CDC350C05CFAA51B9D1A529C1BB4F651339801042885287A38DBB64367413200D80D3A83219605C63F185C151E84F86459D5287A1CDB46D1105E
Malicious:	false
Reputation:	low
URL:	https://we.zz17377.com/655358e6aaad94a5e9fe6a141b3bc5ef.gif
Preview:	GIF89a.......C3&....%.......-".........p#........./""nkj.*t.N$...........Pj..(`....N.....SD/.....s.,.a.....m..n..qiD2.g.....F....b......jUB.p#.rL....."..#.lN.s.l(PJI.....oQr.........N.E.F'.....m.......sN.rhN...uo..q....!..L.of.q.q..(.R.pa.....li.+........"..(..M....-+.pO.M...s..u..MM.P.....s&.p..Q.nj..n...r.K._.i.3"...vh.._c.........'.q,..O-.km..............mLMJ...h.)L..P..w...t../p..M)....D.....UF.p)...qj,.CP...F.....s1'R..Z%^.A.y.......(.NNH..FQl.OK..+2....M.K(....o..Iy..Q....z.o.8.....+:...poN{0j.....tRrq.Pq..j.....$.Bv&.(..U.......:Kh..2.+.4KiR:@.O.,-B.&./.i..,..$2{.53..C{3.+........................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf=

Chrome Cache Entry: 470

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 1x1, segment length 16, comment: "Lavc58.20.104", baseline, precision 8, 404x720, components 3
Category:	dropped
Size (bytes):	19748
Entropy (8bit):	7.957446465901979
Encrypted:	false
SSDEEP:	384:qK5jYu7Gjuio0WGYzYOS35x7T5yawW6hi1NdMYSEcYa3KrM/kXJ:qKv7GjuI8z5rsMYjfRXJ
MD5:	F09526D9F92FDD4561DD751A76A5DD1D
SHA1:	4727DAB51EC1AE6844991573D17A7A688D629CC8
SHA-256:	27EFB577C2DB6481E9714A5503D09DDB9F155B2D6FE66A8944B320522C01C074
SHA-512:	F98221F193C523CB65BD6E7D46B4F2B225044B8A1F4E2D3E1D2BC47F2FD70128D34A7A430A9B900DDF41E57306A62115D188BC735AACE1245EE94CFE9710E4D8
Malicious:	false
Reputation:	low
Preview:	......JFIF..............Lavc58.20.104....C...........................................................##$++3............................................................................!.A1Q.qa"2.......r..Rb3#.B...S.T4C.c$..s.d%.5.......................1.!QAa.q2.."...B............"...................?.<...t...]..<.............p.i7.WO.=WO......\|..\|...F.........".7.WO.....C........T/U...p.zI..\|..\|....7.WO..WO...h..U../U..8@.................]>..]>..A.7.WO..WO.....o....z....a....\|..\|...D.z...z.... .p=WO..WO...h8....^...pXV....t...t....4...)....:.Nf95...m>._.....,.f........;...........v....u>..t8...q=]O....vy..:...g.Qm.".K...3......#.......h.... ...!..B..."....@A....2..@@!.d............. .aX"...@.B.......2.L.6..2.fK@.i.dB.@....GSq).N..6jw..FIS....3...........z..M@..,.B...!..B..."......."....$...p$.1sW...!.....!... .....!.!...A..,.".*H.6..2.fK@.m..@!...F..DU;....u..5;...~]&..W.Q.......z..M.A........".....B..!.....e....a.3.E9bR.R.W......g&.%....k..<..I.i...%.k.#Q2d.3(s...

Chrome Cache Entry: 471

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 150 x 150
Category:	downloaded
Size (bytes):	507238
Entropy (8bit):	7.922334306681101
Encrypted:	false
SSDEEP:	12288:frxDfFZqS0ACM3l3oauIVfYq2/zF9Oh1xJiLmjVYD:frxDfPeh83oaoq2cgma
MD5:	163CD4C2FC934E50744498166601AFFA
SHA1:	5AC022B06A53B29A6D1BF072C26527FEC8375089
SHA-256:	DB3D90F6AB8B811928FCFBF072D60EB199AD1FDE3B05C54F12EB0A8D96066C26
SHA-512:	60B053984D6A259C5BC9DCAEA85CE0FCA97EA593C9A4B53F73CCFB826CDA4B970388D260189FD9F49203EABD750B4AFF9889E2842A24875A365A24A5C13EA4D9
Malicious:	false
Reputation:	low
URL:	https://ig23.vip/img/1KKky_150x150.gif
Preview:	GIF89a..............K.....I'..s......la.J.........u....s...!......kK..[.....[P........3."......Ri\S....gML...D+....o.q,....f.1...s...k+.vc.RG/...=.3".wa...T?.3#.....f.l......1"R........w...u$.....U<-(%..J..'V..(..,%.../..o.w~.R....."....Pex.S..........K.d.........&..."..........K....5B.,&..)......vW..I:?.".(.#.".,..f........H.+.BC.....(.*..r...."....."...".....D.3....."........"..3...D...."..3....."......".....................................4..................................3..........................................X.3............._.3..D...4.....UW...........................................................................................................................................................................!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="ht

Chrome Cache Entry: 472

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	downloaded
Size (bytes):	309347
Entropy (8bit):	7.974320549058613
Encrypted:	false
SSDEEP:	6144:9Aif7I6mXVrAyGW12o3iEVGO7QAhuPI83IPKRwhACAsxYbr:9Aif7I6mXiNWriEVGOcA18cv2O4
MD5:	051AD896596DBB87DFE6B82EAFF2DFF5
SHA1:	DD5E76A2E6F8D55B69C62BAE901844DE2992CF4E
SHA-256:	EADE9FD1CF4E255BBD0DD0E990833A3AC8B1B667DE2A1AFDDD75FB48E6661483
SHA-512:	873805075F4B2E62E595E2F8638FD719F9DA36AB5510A82F9B03449C79531BE86DF01A981793FB04B019DDF1BB210DA2B05A8D13C5C073A01C9193B8D2892DF8
Malicious:	false
Reputation:	low
URL:	https://vns3.ezrent.hk/cdbcb1b08e2d9dc97758d1ca7b53357b.gif
Preview:	GIF89a..........1[.....g_.O.................g....n.................q!o.......XD...j...................U.........j..3......#....'..I....!.......')ihe.B....m.`U...N).!.........h.m...........Q.....^`.....s.]g..R..........6P..5V.k.l...........\C)........k..4..'&...9.....N.".... .B>...0..l..R.#:..6...]...{...........;.sB...+x....,1..?....(..Z...I.......;...........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:C5E130E50AEF11EF9EB7E92EFD62D297" xmpMM:DocumentID="xmp.did:C5E130E60AEF11EF9EB7E92EFD6

Chrome Cache Entry: 473

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	dropped
Size (bytes):	34821
Entropy (8bit):	7.959886152989542
Encrypted:	false
SSDEEP:	768:VCWhDMztrIKN6gZxxXlKxVIGb4A6pP4A2SJprXOlrvKpoX/:VfM5rt3zplCTXPDSHHoX/
MD5:	4AC77312038C071E9C5552E2EAFA305F
SHA1:	B4E9EB802178B558836DB1AA0E3E10F9545E0E22
SHA-256:	E4329D2E45385CC20BB40FADE56F720D8D5F538A0A2CE4ECC33C0D9A6566F6F0
SHA-512:	A9DEFBFBF99658EE216B7530EFD6D16E431CD85BB847841A63FFD4D982A5D7188856067703E9FD31141AC488E47F9B40D01922B7A531237BCE80B1563B638204
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................H.......................!..1A.Qaq."......#2...BR..b$3r....4S.&Ccs..6D................................'......................!1.AQ..a"2#..q.............?...(....(.(....(.(....(.(....(.(....(.(....(.(....(.(.o....2.:....MX.G....8^.......P..5.b.......c.8g..p......N..U7...'..k...'9Iw-t...=..#j.!.1..`).RM..(..j..E9mD:s.....\.l..2S.P:S.j6o.Zc=...h.d....k-.C..)..M\.U......U.U.Znh......&h.4...5h...]..U....j.V.U._ZE..A..E..QE...Q@QE...Q@QE...Q@QE...Q@QE...Q@QE...Q@QM..n.."0...+.S.......B[.n&6.<.^..-...A._........Z..\|^..7.Z..g......7.Y....._...>....;.{ZkE.0!...jJ(..(......9.n.B....Q.....Sq.P,..L..gQ..E...........j...M\.-5j.ZFT.MZ........R.i.P.H....j..h]....i........;.(...(....(.(....(.(....(.(....(.(....(.(.@W.n.B..Z.#cA..f. u..Tu<^wn...c..;3.C...&..F.

Chrome Cache Entry: 474

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 480x600, components 3
Category:	downloaded
Size (bytes):	33439
Entropy (8bit):	7.963015138816945
Encrypted:	false
SSDEEP:	384:1JYWPoBW6ge2Du/Yrz0+WTDpItsZ8iCYMNWR6EOVJLZc/UHjUEiaCIoDulVx6ios:lPqW6h2y/2zUBwQD0JyoaDulVItglx5
MD5:	40DC620CC374E244FDA40AE6D622F91C
SHA1:	38173625B91E360407169D75170259C2ED7D90A2
SHA-256:	CF028F6C0A2E8D15F33D085CC2A9809BF3BFD6D724592F90083845DD4D37D997
SHA-512:	230B467E3410F613B35E20AA3FFBCD7935377B7C8F6AEA0849C123E38F92CA872CF833E6B13914A093B04E81FE7898AD41250586A180AF964FE56C78E8C72C94
Malicious:	false
Reputation:	low
URL:	https://mtu.slinpic.com/%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unbndf.jpg
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222......X...."........................................D......................!.1..AQ.aq.."......2B....#$3R..%b.4CSr..6d................................../......................!1..A2Qa."q.3.#B....R..............?...!.... .....T.@*.h@-..A.#.HPR...a.8...4.SS.m..M(...J.s.dq.......A.cl..5....g./8.f.0..<.....q..K..5.q./.!..8.K.:{.....-..^K..G9.........6.k.mF.<...M....e.Pu..[b....L.O~.^Cc..r\|..I+`h...E.U.?.\.+j@C.f..J....`.D..'....$......=....P.D....M..U..Zc4.YK.h....R;Q..hd.. .P. .UE......$..f.....#..;....{'m.00.d...U.J.%.0`..e....H:..,x.H#..3.M.#.n...nM..D.mi=.-t0.=..y.y....=.6O0.8.O...,.5.c.-&...g.......5R.{..F.a..H.{_..M...Iyp...I.2........b.Y....f..ey...M'.[u.WE..i.k.....'.\|.}..AoIx..k.[K.q.....~F...,l.......Wq.5...h.......+...'`>...y.-.3.s.00....$.(.0.F5:r..9.H.$.GM.o..k.<.c.6.~.Z:M\^.R..(......"......s.

Chrome Cache Entry: 475

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1300 x 200
Category:	dropped
Size (bytes):	535999
Entropy (8bit):	7.953741557017833
Encrypted:	false
SSDEEP:	12288:10LnQpUXbEPMh/aKiRUxAYY669nGhU/Zuep1S6N4aj:knQSXbSMAVCYxhLpE6N4aj
MD5:	75B50F3EE72767D085E865D0845D01AE
SHA1:	8639A9BAA0C635EAD47420D1EA504446BE811D9C
SHA-256:	4C092E1BDC0EDBD9363A66E95CF5938AF85B0B2725EF34B42B70D70A6EFC4FEF
SHA-512:	61BCEBD58778D63BF50807B61727C4D4F60F8E63913D8BD7176564C15CB31346E1D7A8D6C3A3A0D7AB96BF719FC82A8B8786FF675C761370308E24F1A8B705AE
Malicious:	false
Reputation:	low
Preview:	GIF89a........b..pZ.....&......f.d..n...kYUT.I.....y.....S,..S.Z)..T.......E.K..6..f....cF.m........................hp.....K..^hP...j...............ML........e.....`.....%\....!".Nn....Q.%I.p..............p.....L_..5+.wK..J/.j.V,U..+li..............^pM..(.MK....}..qq....L..$N_.....p........i!....N.....,...,.......TI..rI*"..e.....v..........n..nN..........s,n1.....}m..a.)..3Y.......J-.........)/...&.5.28..M.1........{........"qMw.,r.My.w.n.L...:..w.5.+./.&1..............(.....4F..2............w..f.B......w.............b..w............w..<.............f..............Q2..8...w.E..4.3U.Kp.2f.........-......<..}.."...v..K.......".........s...f.....w......SI..w..c...s.f..Q..v&....DD.%.F0.1..f..w..f..-...K.....f..w....w........!..NETSCAPE2.0.....!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.2-c000 79.1b65a79b4, 2022/06/13-22:01:01 "> <rdf:RDF xmlns:rdf=

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 2, 2025 06:12:25.854137897 CET	192.168.2.4	1.1.1.1	0xeef6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:25.854454041 CET	192.168.2.4	1.1.1.1	0x17f4	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:27.129375935 CET	192.168.2.4	1.1.1.1	0xa63	Standard query (0)	www.rr8844.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:27.129977942 CET	192.168.2.4	1.1.1.1	0xf017	Standard query (0)	www.rr8844.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:28.154031992 CET	192.168.2.4	1.1.1.1	0x6fbd	Standard query (0)	www.rr8844.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:28.154376984 CET	192.168.2.4	1.1.1.1	0x7e58	Standard query (0)	www.rr8844.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:29.213674068 CET	192.168.2.4	1.1.1.1	0x9a10	Standard query (0)	www.rr8844.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:29.213838100 CET	192.168.2.4	1.1.1.1	0x498a	Standard query (0)	www.rr8844.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:30.182157040 CET	192.168.2.4	1.1.1.1	0x7afc	Standard query (0)	xmad.7wzx9.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:30.182300091 CET	192.168.2.4	1.1.1.1	0x69e0	Standard query (0)	xmad.7wzx9.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:31.314928055 CET	192.168.2.4	1.1.1.1	0x640	Standard query (0)	www.rr8844.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:31.315114021 CET	192.168.2.4	1.1.1.1	0x636a	Standard query (0)	www.rr8844.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:32.330717087 CET	192.168.2.4	1.1.1.1	0x720d	Standard query (0)	www.rr8844.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:32.330851078 CET	192.168.2.4	1.1.1.1	0x7b8b	Standard query (0)	www.rr8844.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.214646101 CET	192.168.2.4	1.1.1.1	0x898c	Standard query (0)	data.7wzx9.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.215570927 CET	192.168.2.4	1.1.1.1	0x9d15	Standard query (0)	data.7wzx9.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.283359051 CET	192.168.2.4	1.1.1.1	0xb7e5	Standard query (0)	v1.cnzz.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.283902884 CET	192.168.2.4	1.1.1.1	0x5a58	Standard query (0)	v1.cnzz.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.666522026 CET	192.168.2.4	1.1.1.1	0x6a27	Standard query (0)	cc777img.dqsldz.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.671423912 CET	192.168.2.4	1.1.1.1	0x45fe	Standard query (0)	cc777img.dqsldz.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.671977997 CET	192.168.2.4	1.1.1.1	0x517	Standard query (0)	x-hweu2.hccoeutg.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.672333002 CET	192.168.2.4	1.1.1.1	0xac6f	Standard query (0)	x-hweu2.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.672961950 CET	192.168.2.4	1.1.1.1	0x48f2	Standard query (0)	yh88812345qwerasdf.lzaotw.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.673115969 CET	192.168.2.4	1.1.1.1	0x15b5	Standard query (0)	yh88812345qwerasdf.lzaotw.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.673536062 CET	192.168.2.4	1.1.1.1	0xbc54	Standard query (0)	69vvnstttaaa888.dzlndygh.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.673672915 CET	192.168.2.4	1.1.1.1	0x58e3	Standard query (0)	69vvnstttaaa888.dzlndygh.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.675133944 CET	192.168.2.4	1.1.1.1	0xd9ce	Standard query (0)	amjs.hccoeutg.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.675379992 CET	192.168.2.4	1.1.1.1	0xbad5	Standard query (0)	amjs.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.676327944 CET	192.168.2.4	1.1.1.1	0xf003	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.676793098 CET	192.168.2.4	1.1.1.1	0x2477	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.695228100 CET	192.168.2.4	1.1.1.1	0xd06	Standard query (0)	hongniu.getehu.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.695415020 CET	192.168.2.4	1.1.1.1	0x423d	Standard query (0)	hongniu.getehu.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.695849895 CET	192.168.2.4	1.1.1.1	0xd1f9	Standard query (0)	img.qxwoiv.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.696111917 CET	192.168.2.4	1.1.1.1	0x8f9f	Standard query (0)	img.qxwoiv.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.696505070 CET	192.168.2.4	1.1.1.1	0x84f6	Standard query (0)	sz.ggshezhantc.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.696635008 CET	192.168.2.4	1.1.1.1	0xce67	Standard query (0)	_8686._https.sz.ggshezhantc.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.697459936 CET	192.168.2.4	1.1.1.1	0x260c	Standard query (0)	5967.5967007.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.697580099 CET	192.168.2.4	1.1.1.1	0x5576	Standard query (0)	5967.5967007.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.697907925 CET	192.168.2.4	1.1.1.1	0xfa48	Standard query (0)	ig23.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.698156118 CET	192.168.2.4	1.1.1.1	0xd57e	Standard query (0)	ig23.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.698579073 CET	192.168.2.4	1.1.1.1	0x5c48	Standard query (0)	ig38.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.699184895 CET	192.168.2.4	1.1.1.1	0x92d2	Standard query (0)	ig38.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.699568033 CET	192.168.2.4	1.1.1.1	0x140c	Standard query (0)	ig72.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.700212955 CET	192.168.2.4	1.1.1.1	0x7e7d	Standard query (0)	ig72.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.701272964 CET	192.168.2.4	1.1.1.1	0xc1ad	Standard query (0)	w0083.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.701428890 CET	192.168.2.4	1.1.1.1	0xdd05	Standard query (0)	_33236._https.w0083.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.702215910 CET	192.168.2.4	1.1.1.1	0x8a51	Standard query (0)	we.zz17377.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.702389002 CET	192.168.2.4	1.1.1.1	0xb29	Standard query (0)	we.zz17377.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.702792883 CET	192.168.2.4	1.1.1.1	0xf928	Standard query (0)	sezhang.s3.ap-southeast-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.702919960 CET	192.168.2.4	1.1.1.1	0xca58	Standard query (0)	sezhang.s3.ap-southeast-1.amazonaws.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.703488111 CET	192.168.2.4	1.1.1.1	0xb19d	Standard query (0)	2024hwus1.heibanwa.mobi	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.703824043 CET	192.168.2.4	1.1.1.1	0xe31f	Standard query (0)	2024hwus1.heibanwa.mobi	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.704242945 CET	192.168.2.4	1.1.1.1	0xe7c7	Standard query (0)	555ww666yy.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.704372883 CET	192.168.2.4	1.1.1.1	0xd5a7	Standard query (0)	555ww666yy.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.705323935 CET	192.168.2.4	1.1.1.1	0xb1a2	Standard query (0)	www12.pengxunfei.site	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.705456018 CET	192.168.2.4	1.1.1.1	0xd76d	Standard query (0)	www12.pengxunfei.site	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.706027985 CET	192.168.2.4	1.1.1.1	0x5f1	Standard query (0)	vnsimg.hfzkgw.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.706283092 CET	192.168.2.4	1.1.1.1	0xaf47	Standard query (0)	vnsimg.hfzkgw.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.706667900 CET	192.168.2.4	1.1.1.1	0x470b	Standard query (0)	ig32.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.706955910 CET	192.168.2.4	1.1.1.1	0x9d74	Standard query (0)	ig32.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.708558083 CET	192.168.2.4	1.1.1.1	0x7b84	Standard query (0)	go.imgmimi.xyz	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.708872080 CET	192.168.2.4	1.1.1.1	0x839c	Standard query (0)	go.imgmimi.xyz	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.709557056 CET	192.168.2.4	1.1.1.1	0xb8b2	Standard query (0)	tycjb777.hccoeutg.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.709697008 CET	192.168.2.4	1.1.1.1	0x30af	Standard query (0)	tycjb777.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.710311890 CET	192.168.2.4	1.1.1.1	0x61b4	Standard query (0)	www.xtpag.top	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.710659981 CET	192.168.2.4	1.1.1.1	0xfc81	Standard query (0)	_2087._https.www.xtpag.top	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.711261988 CET	192.168.2.4	1.1.1.1	0xd549	Standard query (0)	monkey.p2ld58.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.711565018 CET	192.168.2.4	1.1.1.1	0x4dac	Standard query (0)	monkey.p2ld58.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.860721111 CET	192.168.2.4	1.1.1.1	0xb3d	Standard query (0)	xmad.7wzx9.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.860903978 CET	192.168.2.4	1.1.1.1	0x35ad	Standard query (0)	xmad.7wzx9.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.965569973 CET	192.168.2.4	1.1.1.1	0x89a0	Standard query (0)	5967.5967007.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.204998970 CET	192.168.2.4	1.1.1.1	0x21f5	Standard query (0)	ig79.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.205262899 CET	192.168.2.4	1.1.1.1	0xbea2	Standard query (0)	ig79.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.205652952 CET	192.168.2.4	1.1.1.1	0x2267	Standard query (0)	ig55.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.205867052 CET	192.168.2.4	1.1.1.1	0xc710	Standard query (0)	ig55.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.208349943 CET	192.168.2.4	1.1.1.1	0xc32e	Standard query (0)	w0082.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.208537102 CET	192.168.2.4	1.1.1.1	0x464	Standard query (0)	_33236._https.w0082.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.208944082 CET	192.168.2.4	1.1.1.1	0xe9e1	Standard query (0)	vns2.ezrent.hk	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.209052086 CET	192.168.2.4	1.1.1.1	0xa5d9	Standard query (0)	vns2.ezrent.hk	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.212266922 CET	192.168.2.4	1.1.1.1	0x78fc	Standard query (0)	ig82.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.212718010 CET	192.168.2.4	1.1.1.1	0x3e8e	Standard query (0)	ig82.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.252275944 CET	192.168.2.4	1.1.1.1	0x6554	Standard query (0)	_8686._https.sz.ggshezhantc.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.038855076 CET	192.168.2.4	1.1.1.1	0x336f	Standard query (0)	static.wixstatic.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.038995028 CET	192.168.2.4	1.1.1.1	0x11b4	Standard query (0)	static.wixstatic.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.041119099 CET	192.168.2.4	1.1.1.1	0x2f64	Standard query (0)	ig72.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.041249037 CET	192.168.2.4	1.1.1.1	0x346d	Standard query (0)	ig72.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.100179911 CET	192.168.2.4	1.1.1.1	0xc31f	Standard query (0)	ig23.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.100208998 CET	192.168.2.4	1.1.1.1	0xa708	Standard query (0)	ig23.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.101197958 CET	192.168.2.4	1.1.1.1	0x61a6	Standard query (0)	x-hweu2.hccoeutg.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.101613045 CET	192.168.2.4	1.1.1.1	0xb73c	Standard query (0)	x-hweu2.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.125175953 CET	192.168.2.4	1.1.1.1	0xd24e	Standard query (0)	img.qxwoiv.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.132260084 CET	192.168.2.4	1.1.1.1	0x8b33	Standard query (0)	w0083.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.133153915 CET	192.168.2.4	1.1.1.1	0xa8ab	Standard query (0)	2024hwus1.heibanwa.mobi	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.133363008 CET	192.168.2.4	1.1.1.1	0xf8b8	Standard query (0)	2024hwus1.heibanwa.mobi	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.174495935 CET	192.168.2.4	1.1.1.1	0xdc1	Standard query (0)	www.xtpag.top	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.174670935 CET	192.168.2.4	1.1.1.1	0xa390	Standard query (0)	_2087._https.www.xtpag.top	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.262348890 CET	192.168.2.4	1.1.1.1	0xfb25	Standard query (0)	ig32.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.262876034 CET	192.168.2.4	1.1.1.1	0x7f3d	Standard query (0)	ig32.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.263576031 CET	192.168.2.4	1.1.1.1	0xdacc	Standard query (0)	ig38.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.263794899 CET	192.168.2.4	1.1.1.1	0x39ec	Standard query (0)	ig38.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.418148041 CET	192.168.2.4	1.1.1.1	0x991e	Standard query (0)	5967.5967007.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.418365002 CET	192.168.2.4	1.1.1.1	0xc39b	Standard query (0)	5967.5967007.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.515100956 CET	192.168.2.4	1.1.1.1	0x9a14	Standard query (0)	go.imgmimi.xyz	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.515588999 CET	192.168.2.4	1.1.1.1	0xb782	Standard query (0)	go.imgmimi.xyz	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.548033953 CET	192.168.2.4	1.1.1.1	0x7f83	Standard query (0)	amjs.hccoeutg.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.548297882 CET	192.168.2.4	1.1.1.1	0x51fc	Standard query (0)	amjs.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.614411116 CET	192.168.2.4	1.1.1.1	0x79b	Standard query (0)	we.zz17377.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.614608049 CET	192.168.2.4	1.1.1.1	0xf96	Standard query (0)	we.zz17377.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.643098116 CET	192.168.2.4	1.1.1.1	0x64bf	Standard query (0)	w0082.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.658669949 CET	192.168.2.4	1.1.1.1	0xc8a8	Standard query (0)	ig82.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.658896923 CET	192.168.2.4	1.1.1.1	0xca25	Standard query (0)	ig82.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.664172888 CET	192.168.2.4	1.1.1.1	0xdaf5	Standard query (0)	ig55.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.664431095 CET	192.168.2.4	1.1.1.1	0x152b	Standard query (0)	ig55.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:36.705678940 CET	192.168.2.4	1.1.1.1	0xdf88	Standard query (0)	vns3.ezrent.hk	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.705881119 CET	192.168.2.4	1.1.1.1	0xca59	Standard query (0)	vns3.ezrent.hk	65	IN (0x0001)	false
Jan 2, 2025 06:12:36.720429897 CET	192.168.2.4	1.1.1.1	0xa3d	Standard query (0)	ylg1.duyunfk.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.720871925 CET	192.168.2.4	1.1.1.1	0x30df	Standard query (0)	ylg1.duyunfk.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.559618950 CET	192.168.2.4	1.1.1.1	0xc0a8	Standard query (0)	ig79.vip	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.559998989 CET	192.168.2.4	1.1.1.1	0xece5	Standard query (0)	ig79.vip	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.576831102 CET	192.168.2.4	1.1.1.1	0x4826	Standard query (0)	v1.cnzz.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.577112913 CET	192.168.2.4	1.1.1.1	0x1e40	Standard query (0)	v1.cnzz.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.867892981 CET	192.168.2.4	1.1.1.1	0xc056	Standard query (0)	hongniu.getehu.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.868184090 CET	192.168.2.4	1.1.1.1	0x7202	Standard query (0)	hongniu.getehu.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.871404886 CET	192.168.2.4	1.1.1.1	0x44e6	Standard query (0)	555ww666yy.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.871764898 CET	192.168.2.4	1.1.1.1	0xf4e7	Standard query (0)	555ww666yy.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.878160954 CET	192.168.2.4	1.1.1.1	0x823c	Standard query (0)	cc777img.dqsldz.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.878324032 CET	192.168.2.4	1.1.1.1	0x7119	Standard query (0)	cc777img.dqsldz.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.879853010 CET	192.168.2.4	1.1.1.1	0x6915	Standard query (0)	tycjb777.hccoeutg.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.880008936 CET	192.168.2.4	1.1.1.1	0x48d6	Standard query (0)	tycjb777.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.882178068 CET	192.168.2.4	1.1.1.1	0x5548	Standard query (0)	69vvnstttaaa888.dzlndygh.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.882364035 CET	192.168.2.4	1.1.1.1	0x8af1	Standard query (0)	69vvnstttaaa888.dzlndygh.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.894181967 CET	192.168.2.4	1.1.1.1	0x3aa2	Standard query (0)	sz.ggshezhantc.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.894431114 CET	192.168.2.4	1.1.1.1	0xcf83	Standard query (0)	_8686._https.sz.ggshezhantc.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.897922993 CET	192.168.2.4	1.1.1.1	0x97c6	Standard query (0)	www12.pengxunfei.site	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.898085117 CET	192.168.2.4	1.1.1.1	0x91ad	Standard query (0)	www12.pengxunfei.site	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.903903961 CET	192.168.2.4	1.1.1.1	0x8be6	Standard query (0)	sezhang.s3.ap-southeast-1.amazonaws.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.904165030 CET	192.168.2.4	1.1.1.1	0xd43e	Standard query (0)	sezhang.s3.ap-southeast-1.amazonaws.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.969305038 CET	192.168.2.4	1.1.1.1	0xc442	Standard query (0)	2024hwus1.heibanwa.mobi	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.969475031 CET	192.168.2.4	1.1.1.1	0xdab2	Standard query (0)	2024hwus1.heibanwa.mobi	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.971616030 CET	192.168.2.4	1.1.1.1	0xcde	Standard query (0)	monkey.p2ld58.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.971749067 CET	192.168.2.4	1.1.1.1	0xad1d	Standard query (0)	monkey.p2ld58.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.974863052 CET	192.168.2.4	1.1.1.1	0x96b1	Standard query (0)	x-hweu2.hccoeutg.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.975047112 CET	192.168.2.4	1.1.1.1	0xad70	Standard query (0)	x-hweu2.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.978296995 CET	192.168.2.4	1.1.1.1	0xf7f3	Standard query (0)	w0083.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.978499889 CET	192.168.2.4	1.1.1.1	0x1eda	Standard query (0)	_33236._https.w0083.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.990029097 CET	192.168.2.4	1.1.1.1	0x93ca	Standard query (0)	yh88812345qwerasdf.lzaotw.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.990267992 CET	192.168.2.4	1.1.1.1	0x74d6	Standard query (0)	yh88812345qwerasdf.lzaotw.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.992069006 CET	192.168.2.4	1.1.1.1	0x760c	Standard query (0)	vns2.ezrent.hk	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.992221117 CET	192.168.2.4	1.1.1.1	0x7eac	Standard query (0)	vns2.ezrent.hk	65	IN (0x0001)	false
Jan 2, 2025 06:12:38.000473022 CET	192.168.2.4	1.1.1.1	0xcf	Standard query (0)	w0082.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.000639915 CET	192.168.2.4	1.1.1.1	0xfb04	Standard query (0)	_33236._https.w0082.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:38.193305016 CET	192.168.2.4	1.1.1.1	0x152	Standard query (0)	_8686._https.sz.ggshezhantc.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:39.613662004 CET	192.168.2.4	1.1.1.1	0x985b	Standard query (0)	2024hwus1.heibanwa.mobi	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.613851070 CET	192.168.2.4	1.1.1.1	0x903	Standard query (0)	2024hwus1.heibanwa.mobi	65	IN (0x0001)	false
Jan 2, 2025 06:12:39.613982916 CET	192.168.2.4	1.1.1.1	0x2f5a	Standard query (0)	x-hweu2.hccoeutg.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:39.614312887 CET	192.168.2.4	1.1.1.1	0x40a9	Standard query (0)	w0083.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.614443064 CET	192.168.2.4	1.1.1.1	0x7ffd	Standard query (0)	yh88812345qwerasdf.lzaotw.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.614543915 CET	192.168.2.4	1.1.1.1	0x47be	Standard query (0)	www12.pengxunfei.site	65	IN (0x0001)	false
Jan 2, 2025 06:12:40.611413956 CET	192.168.2.4	1.1.1.1	0xf772	Standard query (0)	ylg1.duyunfk.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.611567974 CET	192.168.2.4	1.1.1.1	0x366	Standard query (0)	ylg1.duyunfk.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:44.006705046 CET	192.168.2.4	1.1.1.1	0x7691	Standard query (0)	z6.cnzz.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:44.006841898 CET	192.168.2.4	1.1.1.1	0x751f	Standard query (0)	z6.cnzz.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:44.009984016 CET	192.168.2.4	1.1.1.1	0xf47b	Standard query (0)	c.cnzz.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:44.010368109 CET	192.168.2.4	1.1.1.1	0x717c	Standard query (0)	c.cnzz.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:44.017103910 CET	192.168.2.4	1.1.1.1	0xaad	Standard query (0)	vns3.ezrent.hk	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:44.017333031 CET	192.168.2.4	1.1.1.1	0x2660	Standard query (0)	vns3.ezrent.hk	65	IN (0x0001)	false
Jan 2, 2025 06:12:46.164554119 CET	192.168.2.4	1.1.1.1	0xb73d	Standard query (0)	c.cnzz.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:46.165004969 CET	192.168.2.4	1.1.1.1	0xba36	Standard query (0)	c.cnzz.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:54.709031105 CET	192.168.2.4	1.1.1.1	0x841e	Standard query (0)	data.7wzx9.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:54.709168911 CET	192.168.2.4	1.1.1.1	0x327f	Standard query (0)	data.7wzx9.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:56.788198948 CET	192.168.2.4	1.1.1.1	0x52c6	Standard query (0)	x-hweu5.rdfzsjs.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:56.788325071 CET	192.168.2.4	1.1.1.1	0xecb0	Standard query (0)	x-hweu5.rdfzsjs.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:56.789426088 CET	192.168.2.4	1.1.1.1	0x1c83	Standard query (0)	mtu.slinpic.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:56.789557934 CET	192.168.2.4	1.1.1.1	0xce8e	Standard query (0)	mtu.slinpic.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:57.860476971 CET	192.168.2.4	1.1.1.1	0x218d	Standard query (0)	mtu.slinpic.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:57.860630989 CET	192.168.2.4	1.1.1.1	0x9960	Standard query (0)	mtu.slinpic.com	65	IN (0x0001)	false
Jan 2, 2025 06:12:58.565326929 CET	192.168.2.4	1.1.1.1	0x1c82	Standard query (0)	x-hweu5.rdfzsjs.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:58.565454960 CET	192.168.2.4	1.1.1.1	0xbc53	Standard query (0)	x-hweu5.rdfzsjs.com	65	IN (0x0001)	false
Jan 2, 2025 06:13:01.017761946 CET	192.168.2.4	1.1.1.1	0xd82b	Standard query (0)	x-hweu5.rdfzsjs.com	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:13:01.017910004 CET	192.168.2.4	1.1.1.1	0x2eb	Standard query (0)	x-hweu5.rdfzsjs.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 2, 2025 06:12:25.861454010 CET	1.1.1.1	192.168.2.4	0x17f4	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 2, 2025 06:12:25.861881971 CET	1.1.1.1	192.168.2.4	0xeef6	No error (0)	www.google.com		142.250.186.68	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:28.517896891 CET	1.1.1.1	192.168.2.4	0xa63	No error (0)	www.rr8844.com	rr8844.ddcc77.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:28.517896891 CET	1.1.1.1	192.168.2.4	0xa63	No error (0)	rr8844.ddcc77.com	j3cbf9gs.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:28.517896891 CET	1.1.1.1	192.168.2.4	0xa63	No error (0)	j3cbf9gs.xiaohongshu-mycdn.com	aztsdjeg.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:28.517896891 CET	1.1.1.1	192.168.2.4	0xa63	No error (0)	aztsdjeg.xiaohongshu-mycdn.com		194.147.100.102	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:29.101146936 CET	1.1.1.1	192.168.2.4	0x6fbd	No error (0)	www.rr8844.com	rr8844.ddcc77.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:29.101146936 CET	1.1.1.1	192.168.2.4	0x6fbd	No error (0)	rr8844.ddcc77.com	j3cbf9gs.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:29.101146936 CET	1.1.1.1	192.168.2.4	0x6fbd	No error (0)	j3cbf9gs.xiaohongshu-mycdn.com	aztsdjeg.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:29.101146936 CET	1.1.1.1	192.168.2.4	0x6fbd	No error (0)	aztsdjeg.xiaohongshu-mycdn.com		194.147.100.102	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:29.220582008 CET	1.1.1.1	192.168.2.4	0x9a10	No error (0)	www.rr8844.com	rr8844.ddcc77.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:29.220582008 CET	1.1.1.1	192.168.2.4	0x9a10	No error (0)	rr8844.ddcc77.com	j3cbf9gs.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:29.220582008 CET	1.1.1.1	192.168.2.4	0x9a10	No error (0)	j3cbf9gs.xiaohongshu-mycdn.com	aztsdjeg.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:29.220582008 CET	1.1.1.1	192.168.2.4	0x9a10	No error (0)	aztsdjeg.xiaohongshu-mycdn.com		194.147.100.102	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:30.189157009 CET	1.1.1.1	192.168.2.4	0x7afc	No error (0)	xmad.7wzx9.com	jn32wh4s.tyccdn888.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:30.189157009 CET	1.1.1.1	192.168.2.4	0x7afc	No error (0)	jn32wh4s.tyccdn888.com	kcxgm62j.tyccdn888.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:30.189157009 CET	1.1.1.1	192.168.2.4	0x7afc	No error (0)	kcxgm62j.tyccdn888.com		194.147.100.10	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:30.189157009 CET	1.1.1.1	192.168.2.4	0x7afc	No error (0)	kcxgm62j.tyccdn888.com		194.147.100.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:31.345676899 CET	1.1.1.1	192.168.2.4	0xf017	Server failure (2)	www.rr8844.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:32.164400101 CET	1.1.1.1	192.168.2.4	0x7e58	Server failure (2)	www.rr8844.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:32.754142046 CET	1.1.1.1	192.168.2.4	0x640	No error (0)	www.rr8844.com	rr8844.ddcc77.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:32.754142046 CET	1.1.1.1	192.168.2.4	0x640	No error (0)	rr8844.ddcc77.com	j3cbf9gs.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:32.754142046 CET	1.1.1.1	192.168.2.4	0x640	No error (0)	j3cbf9gs.xiaohongshu-mycdn.com	aztsdjeg.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:32.754142046 CET	1.1.1.1	192.168.2.4	0x640	No error (0)	aztsdjeg.xiaohongshu-mycdn.com		194.147.100.102	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.346419096 CET	1.1.1.1	192.168.2.4	0x720d	No error (0)	www.rr8844.com	rr8844.ddcc77.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.346419096 CET	1.1.1.1	192.168.2.4	0x720d	No error (0)	rr8844.ddcc77.com	j3cbf9gs.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.346419096 CET	1.1.1.1	192.168.2.4	0x720d	No error (0)	j3cbf9gs.xiaohongshu-mycdn.com	aztsdjeg.xiaohongshu-mycdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.346419096 CET	1.1.1.1	192.168.2.4	0x720d	No error (0)	aztsdjeg.xiaohongshu-mycdn.com		194.147.100.102	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.444202900 CET	1.1.1.1	192.168.2.4	0x498a	Server failure (2)	www.rr8844.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.618638039 CET	1.1.1.1	192.168.2.4	0x898c	No error (0)	data.7wzx9.com	n3fc84b9-u.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.618638039 CET	1.1.1.1	192.168.2.4	0x898c	No error (0)	n3fc84b9-u.cccdn88.top	n97sevw8.n.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.618638039 CET	1.1.1.1	192.168.2.4	0x898c	No error (0)	n97sevw8.n.cccdn88.top		23.145.136.94	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.618638039 CET	1.1.1.1	192.168.2.4	0x898c	No error (0)	n97sevw8.n.cccdn88.top		23.145.136.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.667522907 CET	1.1.1.1	192.168.2.4	0x5a58	No error (0)	v1.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.667522907 CET	1.1.1.1	192.168.2.4	0x5a58	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.683423042 CET	1.1.1.1	192.168.2.4	0xf003	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.683423042 CET	1.1.1.1	192.168.2.4	0xf003	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.79	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.683423042 CET	1.1.1.1	192.168.2.4	0xf003	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.105	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.683423042 CET	1.1.1.1	192.168.2.4	0xf003	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.90	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.683423042 CET	1.1.1.1	192.168.2.4	0xf003	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.125	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.683511972 CET	1.1.1.1	192.168.2.4	0x2477	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.706043959 CET	1.1.1.1	192.168.2.4	0xfa48	No error (0)	ig23.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.706043959 CET	1.1.1.1	192.168.2.4	0xfa48	No error (0)	ig23.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.706043959 CET	1.1.1.1	192.168.2.4	0xfa48	No error (0)	ig23.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.709861994 CET	1.1.1.1	192.168.2.4	0x5c48	No error (0)	ig38.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.709861994 CET	1.1.1.1	192.168.2.4	0x5c48	No error (0)	ig38.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.709861994 CET	1.1.1.1	192.168.2.4	0x5c48	No error (0)	ig38.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.711751938 CET	1.1.1.1	192.168.2.4	0x140c	No error (0)	ig72.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.711751938 CET	1.1.1.1	192.168.2.4	0x140c	No error (0)	ig72.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.711751938 CET	1.1.1.1	192.168.2.4	0x140c	No error (0)	ig72.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.716267109 CET	1.1.1.1	192.168.2.4	0x470b	No error (0)	ig32.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.716267109 CET	1.1.1.1	192.168.2.4	0x470b	No error (0)	ig32.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.716267109 CET	1.1.1.1	192.168.2.4	0x470b	No error (0)	ig32.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	sezhang.s3.ap-southeast-1.amazonaws.com	s3-r-w.ap-southeast-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		3.5.146.228	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		3.5.151.143	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		3.5.146.126	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.128.99	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.41.3	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.129.82	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.164.202	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.717609882 CET	1.1.1.1	192.168.2.4	0xf928	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.124.27	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.720555067 CET	1.1.1.1	192.168.2.4	0xca58	No error (0)	sezhang.s3.ap-southeast-1.amazonaws.com	s3-r-w.ap-southeast-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.725109100 CET	1.1.1.1	192.168.2.4	0x839c	No error (0)	go.imgmimi.xyz			65	IN (0x0001)	false
Jan 2, 2025 06:12:33.730891943 CET	1.1.1.1	192.168.2.4	0x7b84	No error (0)	go.imgmimi.xyz		172.67.148.80	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.730891943 CET	1.1.1.1	192.168.2.4	0x7b84	No error (0)	go.imgmimi.xyz		104.21.29.28	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.736120939 CET	1.1.1.1	192.168.2.4	0x9d15	No error (0)	data.7wzx9.com	n3fc84b9-u.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.736120939 CET	1.1.1.1	192.168.2.4	0x9d15	No error (0)	n3fc84b9-u.cccdn88.top	n97sevw8.n.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.868393898 CET	1.1.1.1	192.168.2.4	0xb3d	No error (0)	xmad.7wzx9.com	jn32wh4s.tyccdn888.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.868393898 CET	1.1.1.1	192.168.2.4	0xb3d	No error (0)	jn32wh4s.tyccdn888.com	kcxgm62j.tyccdn888.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.868393898 CET	1.1.1.1	192.168.2.4	0xb3d	No error (0)	kcxgm62j.tyccdn888.com		194.147.100.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.868393898 CET	1.1.1.1	192.168.2.4	0xb3d	No error (0)	kcxgm62j.tyccdn888.com		194.147.100.10	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:33.948268890 CET	1.1.1.1	192.168.2.4	0x5576	Server failure (2)	5967.5967007.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:33.980029106 CET	1.1.1.1	192.168.2.4	0x4dac	No error (0)	monkey.p2ld58.com	monkey.p2ld58.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.995147943 CET	1.1.1.1	192.168.2.4	0x35ad	No error (0)	xmad.7wzx9.com	jn32wh4s.tyccdn888.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.995147943 CET	1.1.1.1	192.168.2.4	0x35ad	No error (0)	jn32wh4s.tyccdn888.com	kcxgm62j.tyccdn888.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:33.999596119 CET	1.1.1.1	192.168.2.4	0x45fe	No error (0)	cc777img.dqsldz.com	cc777img.dqsldz.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com	tycjb777.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.004653931 CET	1.1.1.1	192.168.2.4	0xb8b2	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com	cc777img.dqsldz.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.009454012 CET	1.1.1.1	192.168.2.4	0x6a27	No error (0)	cc777img.dqsldz.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.023124933 CET	1.1.1.1	192.168.2.4	0xbad5	No error (0)	amjs.hccoeutg.com	amjs.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.044631958 CET	1.1.1.1	192.168.2.4	0xb7e5	No error (0)	v1.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.044631958 CET	1.1.1.1	192.168.2.4	0xb7e5	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.044631958 CET	1.1.1.1	192.168.2.4	0xb7e5	No error (0)	all.cnzz.com.danuoyi.tbcache.com		106.225.241.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.054681063 CET	1.1.1.1	192.168.2.4	0x30af	No error (0)	tycjb777.hccoeutg.com	tycjb777.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.109299898 CET	1.1.1.1	192.168.2.4	0x58e3	No error (0)	69vvnstttaaa888.dzlndygh.com	69vvnstttaaa888.dzlndygh.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.140641928 CET	1.1.1.1	192.168.2.4	0xfc81	Name error (3)	_2087._https.www.xtpag.top	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.154942036 CET	1.1.1.1	192.168.2.4	0x260c	No error (0)	5967.5967007.com	ssh02.cdn.youziyundns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.154942036 CET	1.1.1.1	192.168.2.4	0x260c	No error (0)	ssh02.cdn.youziyundns.com		149.104.32.188	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.154942036 CET	1.1.1.1	192.168.2.4	0x260c	No error (0)	ssh02.cdn.youziyundns.com		149.104.32.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	yh88812345qwerasdf.lzaotw.com	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com	hcdnw101.v3.cdnhwcprh113.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		61.54.86.170	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		115.223.9.115	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		115.223.9.118	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		118.123.207.180	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		118.123.207.182	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		218.60.100.165	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		218.60.100.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		221.194.141.165	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.156953096 CET	1.1.1.1	192.168.2.4	0x48f2	No error (0)	hcdnw101.v3.cdnhwcprh113.com		61.54.86.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.167593002 CET	1.1.1.1	192.168.2.4	0x15b5	No error (0)	yh88812345qwerasdf.lzaotw.com	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.167593002 CET	1.1.1.1	192.168.2.4	0x15b5	No error (0)	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com	hcdnw101.v3.cdnhwcprh113.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com	69vvnstttaaa888.dzlndygh.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.179399967 CET	1.1.1.1	192.168.2.4	0xbc54	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.214612961 CET	1.1.1.1	192.168.2.4	0x21f5	No error (0)	ig79.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.214612961 CET	1.1.1.1	192.168.2.4	0x21f5	No error (0)	ig79.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.214612961 CET	1.1.1.1	192.168.2.4	0x21f5	No error (0)	ig79.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.215858936 CET	1.1.1.1	192.168.2.4	0x89a0	Server failure (2)	5967.5967007.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.222342968 CET	1.1.1.1	192.168.2.4	0x78fc	No error (0)	ig82.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.222342968 CET	1.1.1.1	192.168.2.4	0x78fc	No error (0)	ig82.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.222342968 CET	1.1.1.1	192.168.2.4	0x78fc	No error (0)	ig82.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.228379011 CET	1.1.1.1	192.168.2.4	0xd9ce	No error (0)	amjs.hccoeutg.com	amjs.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.228379011 CET	1.1.1.1	192.168.2.4	0xd9ce	No error (0)	amjs.hccoeutg.com.bplslb.com		147.160.191.176	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com	monkey.p2ld58.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251142025 CET	1.1.1.1	192.168.2.4	0xd549	No error (0)	monkey.p2ld58.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.251154900 CET	1.1.1.1	192.168.2.4	0xce67	Server failure (2)	_8686._https.sz.ggshezhantc.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.259264946 CET	1.1.1.1	192.168.2.4	0xd06	No error (0)	hongniu.getehu.com	hongniu.getehu.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.259264946 CET	1.1.1.1	192.168.2.4	0xd06	No error (0)	hongniu.getehu.com.bplslb.com		147.160.191.176	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.303057909 CET	1.1.1.1	192.168.2.4	0x2267	No error (0)	ig55.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.303057909 CET	1.1.1.1	192.168.2.4	0x2267	No error (0)	ig55.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.303057909 CET	1.1.1.1	192.168.2.4	0x2267	No error (0)	ig55.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.354182959 CET	1.1.1.1	192.168.2.4	0xd5a7	No error (0)	555ww666yy.com	kegymmtv.jixingcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.362020969 CET	1.1.1.1	192.168.2.4	0xe7c7	No error (0)	555ww666yy.com	kegymmtv.jixingcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.362020969 CET	1.1.1.1	192.168.2.4	0xe7c7	No error (0)	kegymmtv.jixingcdn.com		104.160.179.210	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.441929102 CET	1.1.1.1	192.168.2.4	0x61b4	No error (0)	www.xtpag.top	catu.imgapp.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.441929102 CET	1.1.1.1	192.168.2.4	0x61b4	No error (0)	catu.imgapp.top		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.441929102 CET	1.1.1.1	192.168.2.4	0x61b4	No error (0)	catu.imgapp.top		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.446719885 CET	1.1.1.1	192.168.2.4	0x8a51	No error (0)	we.zz17377.com	e9995f59.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.446719885 CET	1.1.1.1	192.168.2.4	0x8a51	No error (0)	e9995f59.hii-go.com	ns3.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.446719885 CET	1.1.1.1	192.168.2.4	0x8a51	No error (0)	ns3.hii-go.com		88.99.67.51	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.466597080 CET	1.1.1.1	192.168.2.4	0xa5d9	No error (0)	vns2.ezrent.hk	vns2.ezrent.hk.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.534523964 CET	1.1.1.1	192.168.2.4	0x6554	Server failure (2)	_8686._https.sz.ggshezhantc.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:34.559001923 CET	1.1.1.1	192.168.2.4	0x8f9f	No error (0)	img.qxwoiv.com	79rvc2.g.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.575509071 CET	1.1.1.1	192.168.2.4	0x5f1	No error (0)	vnsimg.hfzkgw.com	zpnzdh.g.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.575509071 CET	1.1.1.1	192.168.2.4	0x5f1	No error (0)	zpnzdh.g.1112dns.com		154.91.91.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.575509071 CET	1.1.1.1	192.168.2.4	0x5f1	No error (0)	zpnzdh.g.1112dns.com		154.91.91.58	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.575509071 CET	1.1.1.1	192.168.2.4	0x5f1	No error (0)	zpnzdh.g.1112dns.com		154.91.91.29	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.575509071 CET	1.1.1.1	192.168.2.4	0x5f1	No error (0)	zpnzdh.g.1112dns.com		154.91.91.13	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.613791943 CET	1.1.1.1	192.168.2.4	0x84f6	No error (0)	sz.ggshezhantc.com	pdxcn777.u.jhydns01.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.613791943 CET	1.1.1.1	192.168.2.4	0x84f6	No error (0)	pdxcn777.u.jhydns01.com	g9cf36a.cn88.jhydns01.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.613791943 CET	1.1.1.1	192.168.2.4	0x84f6	No error (0)	g9cf36a.cn88.jhydns01.com		185.200.64.142	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.648972034 CET	1.1.1.1	192.168.2.4	0xb29	No error (0)	we.zz17377.com	e9995f59.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.648972034 CET	1.1.1.1	192.168.2.4	0xb29	No error (0)	e9995f59.hii-go.com	ns3.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site	tyctc.wyzforecdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	tyctc.wyzforecdn.com	www12.pengxunfei.site.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.664366961 CET	1.1.1.1	192.168.2.4	0xb1a2	No error (0)	www12.pengxunfei.site.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk	vns2.ezrent.hk.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.208	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.209	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.210	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.211	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.212	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.215	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.216	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.832705975 CET	1.1.1.1	192.168.2.4	0xe9e1	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.217	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:34.886327028 CET	1.1.1.1	192.168.2.4	0x423d	No error (0)	hongniu.getehu.com	hongniu.getehu.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:34.951323032 CET	1.1.1.1	192.168.2.4	0xaf47	No error (0)	vnsimg.hfzkgw.com	zpnzdh.g.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.045919895 CET	1.1.1.1	192.168.2.4	0x11b4	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.048815966 CET	1.1.1.1	192.168.2.4	0x336f	No error (0)	static.wixstatic.com	d1cq301dpr7fww.cloudfront.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.048815966 CET	1.1.1.1	192.168.2.4	0x336f	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.105	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.048815966 CET	1.1.1.1	192.168.2.4	0x336f	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.125	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.048815966 CET	1.1.1.1	192.168.2.4	0x336f	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.79	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.048815966 CET	1.1.1.1	192.168.2.4	0x336f	No error (0)	d1cq301dpr7fww.cloudfront.net		99.86.4.90	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.052753925 CET	1.1.1.1	192.168.2.4	0x2f64	No error (0)	ig72.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.052753925 CET	1.1.1.1	192.168.2.4	0x2f64	No error (0)	ig72.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.052753925 CET	1.1.1.1	192.168.2.4	0x2f64	No error (0)	ig72.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.111543894 CET	1.1.1.1	192.168.2.4	0xc31f	No error (0)	ig23.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.111543894 CET	1.1.1.1	192.168.2.4	0xc31f	No error (0)	ig23.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.111543894 CET	1.1.1.1	192.168.2.4	0xc31f	No error (0)	ig23.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.126120090 CET	1.1.1.1	192.168.2.4	0xd1f9	No error (0)	img.qxwoiv.com	79rvc2.g.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.126120090 CET	1.1.1.1	192.168.2.4	0xd1f9	No error (0)	79rvc2.g.1112dns.com		154.91.91.54	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.126120090 CET	1.1.1.1	192.168.2.4	0xd1f9	No error (0)	79rvc2.g.1112dns.com		154.91.91.44	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.126120090 CET	1.1.1.1	192.168.2.4	0xd1f9	No error (0)	79rvc2.g.1112dns.com		154.91.91.34	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.126120090 CET	1.1.1.1	192.168.2.4	0xd1f9	No error (0)	79rvc2.g.1112dns.com		154.91.91.11	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	x-hweu2.hccoeutg.com	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		221.194.141.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.42.77.151	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.99.2.62	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		118.123.207.189	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		120.233.179.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.141213894 CET	1.1.1.1	192.168.2.4	0x517	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		183.223.14.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.150726080 CET	1.1.1.1	192.168.2.4	0xac6f	No error (0)	x-hweu2.hccoeutg.com	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.150726080 CET	1.1.1.1	192.168.2.4	0xac6f	No error (0)	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	2024hwus1.heibanwa.mobi	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.42.77.151	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.99.2.62	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		118.123.207.189	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		120.233.179.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		183.223.14.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.157732964 CET	1.1.1.1	192.168.2.4	0xb19d	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		221.194.141.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.189905882 CET	1.1.1.1	192.168.2.4	0xa390	Name error (3)	_2087._https.www.xtpag.top	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.190522909 CET	1.1.1.1	192.168.2.4	0xdc1	No error (0)	www.xtpag.top	catu.imgapp.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.190522909 CET	1.1.1.1	192.168.2.4	0xdc1	No error (0)	catu.imgapp.top		188.114.96.3	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.190522909 CET	1.1.1.1	192.168.2.4	0xdc1	No error (0)	catu.imgapp.top		188.114.97.3	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.273590088 CET	1.1.1.1	192.168.2.4	0xfb25	No error (0)	ig32.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.273590088 CET	1.1.1.1	192.168.2.4	0xfb25	No error (0)	ig32.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.273590088 CET	1.1.1.1	192.168.2.4	0xfb25	No error (0)	ig32.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.274852037 CET	1.1.1.1	192.168.2.4	0xdacc	No error (0)	ig38.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.274852037 CET	1.1.1.1	192.168.2.4	0xdacc	No error (0)	ig38.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.274852037 CET	1.1.1.1	192.168.2.4	0xdacc	No error (0)	ig38.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.529267073 CET	1.1.1.1	192.168.2.4	0x9a14	No error (0)	go.imgmimi.xyz		172.67.148.80	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.529267073 CET	1.1.1.1	192.168.2.4	0x9a14	No error (0)	go.imgmimi.xyz		104.21.29.28	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.542926073 CET	1.1.1.1	192.168.2.4	0xb782	No error (0)	go.imgmimi.xyz			65	IN (0x0001)	false
Jan 2, 2025 06:12:35.558229923 CET	1.1.1.1	192.168.2.4	0x991e	No error (0)	5967.5967007.com	ssh02.cdn.youziyundns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.558229923 CET	1.1.1.1	192.168.2.4	0x991e	No error (0)	ssh02.cdn.youziyundns.com		149.104.32.188	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.558229923 CET	1.1.1.1	192.168.2.4	0x991e	No error (0)	ssh02.cdn.youziyundns.com		149.104.32.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.648778915 CET	1.1.1.1	192.168.2.4	0x7f83	No error (0)	amjs.hccoeutg.com	amjs.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.648778915 CET	1.1.1.1	192.168.2.4	0x7f83	No error (0)	amjs.hccoeutg.com.bplslb.com		147.160.191.176	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.672180891 CET	1.1.1.1	192.168.2.4	0xc8a8	No error (0)	ig82.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.672180891 CET	1.1.1.1	192.168.2.4	0xc8a8	No error (0)	ig82.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.672180891 CET	1.1.1.1	192.168.2.4	0xc8a8	No error (0)	ig82.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.676511049 CET	1.1.1.1	192.168.2.4	0xdaf5	No error (0)	ig55.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.676511049 CET	1.1.1.1	192.168.2.4	0xdaf5	No error (0)	ig55.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.676511049 CET	1.1.1.1	192.168.2.4	0xdaf5	No error (0)	ig55.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.677145004 CET	1.1.1.1	192.168.2.4	0xc39b	Server failure (2)	5967.5967007.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	w0082.com	my109-site-01.cdn-ng.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		43.251.59.146	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		43.251.59.156	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		43.251.59.166	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		103.170.14.190	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		103.170.14.197	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		103.170.14.206	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		43.251.59.126	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.791004896 CET	1.1.1.1	192.168.2.4	0xc32e	No error (0)	my109-site-01.cdn-ng.net		43.251.59.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.847904921 CET	1.1.1.1	192.168.2.4	0xd24e	No error (0)	img.qxwoiv.com	79rvc2.g.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.847904921 CET	1.1.1.1	192.168.2.4	0xd24e	No error (0)	79rvc2.g.1112dns.com		154.91.91.47	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.847904921 CET	1.1.1.1	192.168.2.4	0xd24e	No error (0)	79rvc2.g.1112dns.com		154.91.91.30	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.847904921 CET	1.1.1.1	192.168.2.4	0xd24e	No error (0)	79rvc2.g.1112dns.com		154.91.91.52	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.847904921 CET	1.1.1.1	192.168.2.4	0xd24e	No error (0)	79rvc2.g.1112dns.com		154.91.91.28	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	w0083.com	my109-site-01.cdn-ng.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		103.170.14.197	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		103.170.14.206	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		43.251.59.126	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		43.251.59.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		43.251.59.146	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		43.251.59.156	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		43.251.59.166	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:35.954019070 CET	1.1.1.1	192.168.2.4	0xc1ad	No error (0)	my109-site-01.cdn-ng.net		103.170.14.190	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.018790007 CET	1.1.1.1	192.168.2.4	0x51fc	No error (0)	amjs.hccoeutg.com	amjs.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	x-hweu2.hccoeutg.com	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.99.2.62	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		118.123.207.189	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		120.233.179.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		183.223.14.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		221.194.141.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.284497976 CET	1.1.1.1	192.168.2.4	0x61a6	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.42.77.151	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.341147900 CET	1.1.1.1	192.168.2.4	0x7b8b	Server failure (2)	www.rr8844.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:36.384979010 CET	1.1.1.1	192.168.2.4	0xb73c	No error (0)	x-hweu2.hccoeutg.com	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.384979010 CET	1.1.1.1	192.168.2.4	0xb73c	No error (0)	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.459953070 CET	1.1.1.1	192.168.2.4	0xf96	No error (0)	we.zz17377.com	e9995f59.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.459953070 CET	1.1.1.1	192.168.2.4	0xf96	No error (0)	e9995f59.hii-go.com	ns3.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.546781063 CET	1.1.1.1	192.168.2.4	0x79b	No error (0)	we.zz17377.com	e9995f59.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.546781063 CET	1.1.1.1	192.168.2.4	0x79b	No error (0)	e9995f59.hii-go.com	ns3.hii-go.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.546781063 CET	1.1.1.1	192.168.2.4	0x79b	No error (0)	ns3.hii-go.com		142.132.201.10	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	2024hwus1.heibanwa.mobi	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		221.194.141.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.42.77.151	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.99.2.62	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		118.123.207.189	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		120.233.179.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:36.810564041 CET	1.1.1.1	192.168.2.4	0xa8ab	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		183.223.14.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	w0083.com	my109-site-01.cdn-ng.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		103.170.14.197	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		103.170.14.206	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		43.251.59.126	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		43.251.59.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		43.251.59.146	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		43.251.59.156	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		43.251.59.166	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.015187025 CET	1.1.1.1	192.168.2.4	0x8b33	No error (0)	my109-site-01.cdn-ng.net		103.170.14.190	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.422089100 CET	1.1.1.1	192.168.2.4	0x636a	Server failure (2)	www.rr8844.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.498187065 CET	1.1.1.1	192.168.2.4	0xa3d	No error (0)	ylg1.duyunfk.com	5or0d1.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.498187065 CET	1.1.1.1	192.168.2.4	0xa3d	No error (0)	5or0d1.c.1112dns.com		123.6.18.17	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.498187065 CET	1.1.1.1	192.168.2.4	0xa3d	No error (0)	5or0d1.c.1112dns.com		123.6.18.111	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.498187065 CET	1.1.1.1	192.168.2.4	0xa3d	No error (0)	5or0d1.c.1112dns.com		123.6.18.88	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.498187065 CET	1.1.1.1	192.168.2.4	0xa3d	No error (0)	5or0d1.c.1112dns.com		123.6.18.48	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.542726994 CET	1.1.1.1	192.168.2.4	0x30df	No error (0)	ylg1.duyunfk.com	5or0d1.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.567405939 CET	1.1.1.1	192.168.2.4	0xc0a8	No error (0)	ig79.vip		216.180.236.138	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.567405939 CET	1.1.1.1	192.168.2.4	0xc0a8	No error (0)	ig79.vip		23.224.82.187	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.567405939 CET	1.1.1.1	192.168.2.4	0xc0a8	No error (0)	ig79.vip		216.180.227.131	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	w0082.com	my109-site-01.cdn-ng.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		103.170.14.190	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		103.170.14.197	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		103.170.14.206	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.126	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.146	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.156	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.598269939 CET	1.1.1.1	192.168.2.4	0x64bf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.166	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.784553051 CET	1.1.1.1	192.168.2.4	0x4826	No error (0)	v1.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.784553051 CET	1.1.1.1	192.168.2.4	0x4826	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.784553051 CET	1.1.1.1	192.168.2.4	0x4826	No error (0)	all.cnzz.com.danuoyi.tbcache.com		106.225.241.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.809501886 CET	1.1.1.1	192.168.2.4	0xca59	No error (0)	vns3.ezrent.hk	h02wph.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com	cc777img.dqsldz.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.885195017 CET	1.1.1.1	192.168.2.4	0x823c	No error (0)	cc777img.dqsldz.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	sezhang.s3.ap-southeast-1.amazonaws.com	s3-r-w.ap-southeast-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.132.71	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.128.175	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.128.223	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		3.5.149.132	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		3.5.148.233	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		52.219.184.26	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		3.5.146.51	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.922204018 CET	1.1.1.1	192.168.2.4	0x8be6	No error (0)	s3-r-w.ap-southeast-1.amazonaws.com		3.5.146.7	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.926626921 CET	1.1.1.1	192.168.2.4	0xd43e	No error (0)	sezhang.s3.ap-southeast-1.amazonaws.com	s3-r-w.ap-southeast-1.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.944922924 CET	1.1.1.1	192.168.2.4	0xd76d	Server failure (2)	www12.pengxunfei.site	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.953640938 CET	1.1.1.1	192.168.2.4	0xe31f	Server failure (2)	2024hwus1.heibanwa.mobi	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:37.970463991 CET	1.1.1.1	192.168.2.4	0xdf88	No error (0)	vns3.ezrent.hk	h02wph.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:37.970463991 CET	1.1.1.1	192.168.2.4	0xdf88	No error (0)	h02wph.c.1112dns.com		123.6.18.115	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.970463991 CET	1.1.1.1	192.168.2.4	0xdf88	No error (0)	h02wph.c.1112dns.com		123.6.18.17	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.970463991 CET	1.1.1.1	192.168.2.4	0xdf88	No error (0)	h02wph.c.1112dns.com		123.6.18.107	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:37.970463991 CET	1.1.1.1	192.168.2.4	0xdf88	No error (0)	h02wph.c.1112dns.com		123.6.18.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com	monkey.p2ld58.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.071737051 CET	1.1.1.1	192.168.2.4	0xcde	No error (0)	monkey.p2ld58.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.102761984 CET	1.1.1.1	192.168.2.4	0x1e40	No error (0)	v1.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.102761984 CET	1.1.1.1	192.168.2.4	0x1e40	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.137973070 CET	1.1.1.1	192.168.2.4	0x7202	No error (0)	hongniu.getehu.com	hongniu.getehu.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.150970936 CET	1.1.1.1	192.168.2.4	0x7119	No error (0)	cc777img.dqsldz.com	cc777img.dqsldz.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com	tycjb777.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.180982113 CET	1.1.1.1	192.168.2.4	0x6915	No error (0)	tycjb777.hccoeutg.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.192574024 CET	1.1.1.1	192.168.2.4	0xcf83	Server failure (2)	_8686._https.sz.ggshezhantc.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:38.237009048 CET	1.1.1.1	192.168.2.4	0x48d6	No error (0)	tycjb777.hccoeutg.com	tycjb777.hccoeutg.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.267199039 CET	1.1.1.1	192.168.2.4	0x44e6	No error (0)	555ww666yy.com	kegymmtv.jixingcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.267199039 CET	1.1.1.1	192.168.2.4	0x44e6	No error (0)	kegymmtv.jixingcdn.com		104.160.179.196	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.301852942 CET	1.1.1.1	192.168.2.4	0xf4e7	No error (0)	555ww666yy.com	kegymmtv.jixingcdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.340394020 CET	1.1.1.1	192.168.2.4	0xc056	No error (0)	hongniu.getehu.com	hongniu.getehu.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.340394020 CET	1.1.1.1	192.168.2.4	0xc056	No error (0)	hongniu.getehu.com.bplslb.com		147.160.191.176	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.437135935 CET	1.1.1.1	192.168.2.4	0x3aa2	No error (0)	sz.ggshezhantc.com	pdxcn777.u.jhydns01.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.437135935 CET	1.1.1.1	192.168.2.4	0x3aa2	No error (0)	pdxcn777.u.jhydns01.com	g9cf36a.cn88.jhydns01.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.437135935 CET	1.1.1.1	192.168.2.4	0x3aa2	No error (0)	g9cf36a.cn88.jhydns01.com		185.200.64.142	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.455310106 CET	1.1.1.1	192.168.2.4	0x7eac	No error (0)	vns2.ezrent.hk	vns2.ezrent.hk.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.457566023 CET	1.1.1.1	192.168.2.4	0xad1d	No error (0)	monkey.p2ld58.com	monkey.p2ld58.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.457612991 CET	1.1.1.1	192.168.2.4	0x8af1	No error (0)	69vvnstttaaa888.dzlndygh.com	69vvnstttaaa888.dzlndygh.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com	69vvnstttaaa888.dzlndygh.com.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.584418058 CET	1.1.1.1	192.168.2.4	0x5548	No error (0)	69vvnstttaaa888.dzlndygh.com.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk	vns2.ezrent.hk.w.cdngslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.209	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.212	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.216	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.210	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.217	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.211	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.215	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:38.662544966 CET	1.1.1.1	192.168.2.4	0x760c	No error (0)	vns2.ezrent.hk.w.cdngslb.com		163.181.131.208	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.017682076 CET	1.1.1.1	192.168.2.4	0x152	Server failure (2)	_8686._https.sz.ggshezhantc.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:39.138928890 CET	1.1.1.1	192.168.2.4	0x74d6	No error (0)	yh88812345qwerasdf.lzaotw.com	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.138928890 CET	1.1.1.1	192.168.2.4	0x74d6	No error (0)	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com	hcdnw101.v3.cdnhwcprh113.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.142596006 CET	1.1.1.1	192.168.2.4	0xf8b8	Server failure (2)	2024hwus1.heibanwa.mobi	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site	tyctc.wyzforecdn.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	tyctc.wyzforecdn.com	www12.pengxunfei.site.bplslb.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		175.6.201.25	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		183.204.210.219	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		111.6.17.145	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		111.6.203.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		111.7.66.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		111.174.12.113	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		113.219.144.65	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		116.162.210.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		119.36.124.159	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.243041039 CET	1.1.1.1	192.168.2.4	0x97c6	No error (0)	www12.pengxunfei.site.bplslb.com		123.6.65.56	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	w0082.com	my109-site-01.cdn-ng.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.126	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.146	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.156	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		43.251.59.166	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		103.170.14.190	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		103.170.14.197	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.250925064 CET	1.1.1.1	192.168.2.4	0xcf	No error (0)	my109-site-01.cdn-ng.net		103.170.14.206	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	x-hweu2.hccoeutg.com	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.99.2.62	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		118.123.207.189	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		120.233.179.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		183.223.14.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		221.194.141.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.270257950 CET	1.1.1.1	192.168.2.4	0x96b1	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.42.77.151	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.416424990 CET	1.1.1.1	192.168.2.4	0xad70	No error (0)	x-hweu2.hccoeutg.com	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.416424990 CET	1.1.1.1	192.168.2.4	0xad70	No error (0)	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	yh88812345qwerasdf.lzaotw.com	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com	hcdnw101.v3.cdnhwcprh113.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		218.60.100.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		221.194.141.165	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		61.54.86.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		61.54.86.170	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		115.223.9.115	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		115.223.9.118	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		118.123.207.180	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		118.123.207.182	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.480933905 CET	1.1.1.1	192.168.2.4	0x93ca	No error (0)	hcdnw101.v3.cdnhwcprh113.com		218.60.100.165	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	w0083.com	my109-site-01.cdn-ng.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		43.251.59.126	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		43.251.59.136	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		43.251.59.146	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		43.251.59.156	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		43.251.59.166	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		103.170.14.190	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		103.170.14.197	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.496090889 CET	1.1.1.1	192.168.2.4	0xf7f3	No error (0)	my109-site-01.cdn-ng.net		103.170.14.206	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:39.621232986 CET	1.1.1.1	192.168.2.4	0x903	Server failure (2)	2024hwus1.heibanwa.mobi	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:40.108845949 CET	1.1.1.1	192.168.2.4	0x2f5a	No error (0)	x-hweu2.hccoeutg.com	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.108845949 CET	1.1.1.1	192.168.2.4	0x2f5a	No error (0)	x-hweu2.hccoeutg.com.6fa00be7.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	yh88812345qwerasdf.lzaotw.com	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	yh88812345qwerasdf.lzaotw.com.31004af7.cdnhwcpsd13.com	hcdnw101.v3.cdnhwcprh113.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		115.223.9.118	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		118.123.207.180	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		118.123.207.182	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		218.60.100.165	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		218.60.100.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		221.194.141.165	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		61.54.86.168	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		61.54.86.170	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.739053965 CET	1.1.1.1	192.168.2.4	0x7ffd	No error (0)	hcdnw101.v3.cdnhwcprh113.com		115.223.9.115	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	2024hwus1.heibanwa.mobi	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		120.233.179.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		183.223.14.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		221.194.141.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.42.77.151	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.99.2.62	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.798661947 CET	1.1.1.1	192.168.2.4	0xc442	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		118.123.207.189	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	2024hwus1.heibanwa.mobi	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	2024hwus1.heibanwa.mobi.38363177.cdnhwcggk22.com	hcdnd101.sme.cdnhwcaip122.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		221.194.141.150	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.42.77.151	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		36.99.2.62	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		118.123.207.189	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		120.233.179.91	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:40.989535093 CET	1.1.1.1	192.168.2.4	0x985b	No error (0)	hcdnd101.sme.cdnhwcaip122.cn		183.223.14.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.122324944 CET	1.1.1.1	192.168.2.4	0x366	No error (0)	ylg1.duyunfk.com	5or0d1.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	w0083.com	my109-site-01.cdn-ng.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		103.170.14.191	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		103.170.14.209	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		43.251.59.127	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		43.251.59.137	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		43.251.59.147	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		43.251.59.157	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		43.251.59.167	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.467642069 CET	1.1.1.1	192.168.2.4	0x40a9	No error (0)	my109-site-01.cdn-ng.net		103.170.14.182	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.599611044 CET	1.1.1.1	192.168.2.4	0xf772	No error (0)	ylg1.duyunfk.com	5or0d1.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:41.599611044 CET	1.1.1.1	192.168.2.4	0xf772	No error (0)	5or0d1.c.1112dns.com		123.6.18.47	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.599611044 CET	1.1.1.1	192.168.2.4	0xf772	No error (0)	5or0d1.c.1112dns.com		123.6.18.41	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.599611044 CET	1.1.1.1	192.168.2.4	0xf772	No error (0)	5or0d1.c.1112dns.com		123.6.18.23	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.599611044 CET	1.1.1.1	192.168.2.4	0xf772	No error (0)	5or0d1.c.1112dns.com		123.6.18.17	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:41.929014921 CET	1.1.1.1	192.168.2.4	0xdab2	Server failure (2)	2024hwus1.heibanwa.mobi	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:42.618436098 CET	1.1.1.1	192.168.2.4	0x91ad	Server failure (2)	www12.pengxunfei.site	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:43.866833925 CET	1.1.1.1	192.168.2.4	0x47be	Server failure (2)	www12.pengxunfei.site	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:12:44.017657042 CET	1.1.1.1	192.168.2.4	0xf47b	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:44.017657042 CET	1.1.1.1	192.168.2.4	0xf47b	No error (0)	all.cnzz.com.danuoyi.tbcache.com		106.225.241.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:44.439860106 CET	1.1.1.1	192.168.2.4	0x717c	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:44.598562002 CET	1.1.1.1	192.168.2.4	0x751f	No error (0)	z6.cnzz.com	z.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:44.598562002 CET	1.1.1.1	192.168.2.4	0x751f	No error (0)	z.cnzz.com	z.gds.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:44.713922977 CET	1.1.1.1	192.168.2.4	0x7691	No error (0)	z6.cnzz.com	z.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:44.713922977 CET	1.1.1.1	192.168.2.4	0x7691	No error (0)	z.cnzz.com	z.gds.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:44.713922977 CET	1.1.1.1	192.168.2.4	0x7691	No error (0)	z.gds.cnzz.com		223.109.148.174	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:44.878083944 CET	1.1.1.1	192.168.2.4	0x2660	No error (0)	vns3.ezrent.hk	h02wph.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:45.028573036 CET	1.1.1.1	192.168.2.4	0xaad	No error (0)	vns3.ezrent.hk	h02wph.c.1112dns.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:45.028573036 CET	1.1.1.1	192.168.2.4	0xaad	No error (0)	h02wph.c.1112dns.com		123.6.18.89	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:45.028573036 CET	1.1.1.1	192.168.2.4	0xaad	No error (0)	h02wph.c.1112dns.com		123.6.18.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:45.028573036 CET	1.1.1.1	192.168.2.4	0xaad	No error (0)	h02wph.c.1112dns.com		123.6.18.47	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:45.028573036 CET	1.1.1.1	192.168.2.4	0xaad	No error (0)	h02wph.c.1112dns.com		123.6.18.24	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:46.407320976 CET	1.1.1.1	192.168.2.4	0xb73d	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:46.407320976 CET	1.1.1.1	192.168.2.4	0xb73d	No error (0)	all.cnzz.com.danuoyi.tbcache.com		106.225.241.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:46.628627062 CET	1.1.1.1	192.168.2.4	0xba36	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:55.240830898 CET	1.1.1.1	192.168.2.4	0x841e	No error (0)	data.7wzx9.com	n3fc84b9-u.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:55.240830898 CET	1.1.1.1	192.168.2.4	0x841e	No error (0)	n3fc84b9-u.cccdn88.top	n97sevw8.n.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:55.240830898 CET	1.1.1.1	192.168.2.4	0x841e	No error (0)	n97sevw8.n.cccdn88.top		23.145.136.95	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:55.240830898 CET	1.1.1.1	192.168.2.4	0x841e	No error (0)	n97sevw8.n.cccdn88.top		23.145.136.94	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:55.383352995 CET	1.1.1.1	192.168.2.4	0x327f	No error (0)	data.7wzx9.com	n3fc84b9-u.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:55.383352995 CET	1.1.1.1	192.168.2.4	0x327f	No error (0)	n3fc84b9-u.cccdn88.top	n97sevw8.n.cccdn88.top		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:56.798832893 CET	1.1.1.1	192.168.2.4	0x1c83	No error (0)	mtu.slinpic.com		104.26.10.58	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:56.798832893 CET	1.1.1.1	192.168.2.4	0x1c83	No error (0)	mtu.slinpic.com		172.67.69.202	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:56.798832893 CET	1.1.1.1	192.168.2.4	0x1c83	No error (0)	mtu.slinpic.com		104.26.11.58	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:56.844758987 CET	1.1.1.1	192.168.2.4	0xce8e	No error (0)	mtu.slinpic.com			65	IN (0x0001)	false
Jan 2, 2025 06:12:57.870812893 CET	1.1.1.1	192.168.2.4	0x218d	No error (0)	mtu.slinpic.com		104.26.11.58	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:57.870812893 CET	1.1.1.1	192.168.2.4	0x218d	No error (0)	mtu.slinpic.com		172.67.69.202	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:57.870812893 CET	1.1.1.1	192.168.2.4	0x218d	No error (0)	mtu.slinpic.com		104.26.10.58	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:58.017347097 CET	1.1.1.1	192.168.2.4	0x9960	No error (0)	mtu.slinpic.com			65	IN (0x0001)	false
Jan 2, 2025 06:12:58.686296940 CET	1.1.1.1	192.168.2.4	0x52c6	No error (0)	x-hweu5.rdfzsjs.com	x-hweu5.rdfzsjs.com.290e11e2.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:58.686296940 CET	1.1.1.1	192.168.2.4	0x52c6	No error (0)	x-hweu5.rdfzsjs.com.290e11e2.cdnhwcpsd13.com	hcdnw122.maoyun.cdnhwcibv122.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:12:58.686296940 CET	1.1.1.1	192.168.2.4	0x52c6	No error (0)	hcdnw122.maoyun.cdnhwcibv122.com		221.194.141.162	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:12:58.686296940 CET	1.1.1.1	192.168.2.4	0x52c6	No error (0)	hcdnw122.maoyun.cdnhwcibv122.com		218.12.76.163	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:13:01.044102907 CET	1.1.1.1	192.168.2.4	0xecb0	Server failure (2)	x-hweu5.rdfzsjs.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:13:01.902760029 CET	1.1.1.1	192.168.2.4	0x1c82	No error (0)	x-hweu5.rdfzsjs.com	x-hweu5.rdfzsjs.com.290e11e2.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:13:01.902760029 CET	1.1.1.1	192.168.2.4	0x1c82	No error (0)	x-hweu5.rdfzsjs.com.290e11e2.cdnhwcpsd13.com	hcdnw122.maoyun.cdnhwcibv122.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:13:01.902760029 CET	1.1.1.1	192.168.2.4	0x1c82	No error (0)	hcdnw122.maoyun.cdnhwcibv122.com		218.12.76.163	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:13:01.902760029 CET	1.1.1.1	192.168.2.4	0x1c82	No error (0)	hcdnw122.maoyun.cdnhwcibv122.com		221.194.141.162	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:13:02.500607014 CET	1.1.1.1	192.168.2.4	0xd82b	No error (0)	x-hweu5.rdfzsjs.com	x-hweu5.rdfzsjs.com.290e11e2.cdnhwcpsd13.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:13:02.500607014 CET	1.1.1.1	192.168.2.4	0xd82b	No error (0)	x-hweu5.rdfzsjs.com.290e11e2.cdnhwcpsd13.com	hcdnw122.maoyun.cdnhwcibv122.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 2, 2025 06:13:02.500607014 CET	1.1.1.1	192.168.2.4	0xd82b	No error (0)	hcdnw122.maoyun.cdnhwcibv122.com		218.12.76.163	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:13:02.500607014 CET	1.1.1.1	192.168.2.4	0xd82b	No error (0)	hcdnw122.maoyun.cdnhwcibv122.com		221.194.141.162	A (IP address)	IN (0x0001)	false
Jan 2, 2025 06:13:02.837416887 CET	1.1.1.1	192.168.2.4	0xbc53	Server failure (2)	x-hweu5.rdfzsjs.com	none	none	65	IN (0x0001)	false
Jan 2, 2025 06:13:02.837515116 CET	1.1.1.1	192.168.2.4	0x2eb	Server failure (2)	x-hweu5.rdfzsjs.com	none	none	65	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49740	194.147.100.102	80	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 06:12:28.602010012 CET	429	OUT	GET / HTTP/1.1 Host: www.rr8844.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 2, 2025 06:12:29.211291075 CET	357	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 02 Jan 2025 05:12:29 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive Location: https://www.rr8844.com/ Server: nginx Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>openresty</center></body></html>
Jan 2, 2025 06:13:14.216398954 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49741	194.147.100.102	80	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 2, 2025 06:13:13.605794907 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49742	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:29 UTC	657	OUT	GET / HTTP/1.1 Host: www.rr8844.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:30 UTC	334	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:30 GMT Content-Type: text/html Content-Length: 3124 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Sat, 02 Mar 2024 11:41:54 GMT ETag: "c34-612abfaa3a480" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:30 UTC	3124	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 0a 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 38 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 0a 09 09 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 0a 09 3c 74 69 74 6c 65 3e e6 9c 80 e6 96 b0 e7 83 ad e9 97 a8 e7 94 b5 e5 bd b1 e5 9c a8 e7 ba bf e8 a7 82 e7 9c 8b ef bd 9c e5 85 8d e8 b4 b9 e9 ab 98 e6 b8 85 e7 94 b5 e5 bd b1 e8 b5 84 e6 ba 90 ef bd Data Ascii: <html lang="zh-CN"><head><meta charset="utf8"><meta http-equiv="Content-type" name="viewport"content="initial-scale=1.0, maximum-scale=1.0, user-scalable=no, width=device-width"><title>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49744	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:30 UTC	545	OUT	GET /css/style.css?v=19 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:31 UTC	335	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:31 GMT Content-Type: text/css Content-Length: 42149 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Fri, 05 Apr 2024 17:24:13 GMT ETag: "a4a5-6155cb976a940" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:31 UTC	16049	IN	Data Raw: ef bb bf 2f 2a 20 e5 85 a8 e5 b1 80 20 2a 2f 68 74 6d 6c 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 30 30 70 78 3b 7d 0a 68 74 6d 6c 2c 62 6f 64 79 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 7d 0a 68 74 6d 6c 2c 62 6f 64 79 2c 64 69 76 2c 68 31 2c 68 32 2c 68 33 2c 68 34 2c 68 35 2c 68 36 2c 70 2c 73 70 61 6e 2c 65 6d 2c 61 2c 69 6d 67 2c 75 6c 2c 6c 69 2c 6f 6c 2c 66 6f 72 6d 2c 62 75 74 74 6f 6e 2c 69 6e 70 75 74 2c 74 65 78 74 61 72 65 61 2c 64 6c 2c 64 74 2c 64 64 2c 69 66 72 61 6d 65 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 3b 7d 0a 62 6f 64 79 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 65 65 65 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 66 6f 6e 74 3a 31 34 70 78 2f 31 2e 35 20 4d 69 63 72 6f 73 6f 66 74 20 59 61 68 65 69 2c 41 76 65 6e 69 Data Ascii: /* */html{font-size:100px;}html,body{height:100%;}html,body,div,h1,h2,h3,h4,h5,h6,p,span,em,a,img,ul,li,ol,form,button,input,textarea,dl,dt,dd,iframe{margin:0;padding:0;}body{background:#eee;text-align:left;font:14px/1.5 Microsoft Yahei,Aveni
2025-01-02 05:12:31 UTC	16384	IN	Data Raw: 34 30 70 78 3b 7d 0a 2e 6d 6f 64 20 2e 63 6f 6c 35 20 64 74 20 61 3a 68 6f 76 65 72 3a 62 65 66 6f 72 65 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 69 6d 61 67 65 73 2f 70 6c 61 79 2e 70 6e 67 29 20 63 65 6e 74 65 72 20 6e 6f 2d 72 65 70 65 61 74 3b 7d 0a 2e 6d 6f 64 20 2e 63 6f 6c 35 20 64 74 20 69 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 72 69 67 68 74 3a 30 3b 62 6f 74 74 6f 6d 3a 30 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 61 75 74 6f 3b 68 65 69 67 68 74 3a 32 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 31 30 70 78 20 34 70 78 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 6c 69 6e 65 61 72 2d 67 72 61 64 69 65 6e 74 28 30 64 65 67 2c 23 30 30 30 2c 23 30 30 30 20 32 35 2e 35 25 2c 23 Data Ascii: 40px;}.mod .col5 dt a:hover:before{background:url(images/play.png) center no-repeat;}.mod .col5 dt i{position:absolute;right:0;bottom:0;left:0;width:auto;height:20px;padding:10px 10px 4px;overflow:hidden;background:linear-gradient(0deg,#000,#000 25.5%,#
2025-01-02 05:12:31 UTC	9716	IN	Data Raw: 6e 3a 20 63 65 6e 74 65 72 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 20 31 30 70 78 20 31 30 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 69 6d 61 67 65 73 2f 74 6f 75 63 68 5f 61 70 70 2e 70 6e 67 29 3b 0a 09 6d 61 72 67 69 6e 2d 74 6f 70 3a 20 35 70 78 3b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 35 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 72 65 70 65 61 74 3a 20 6e 6f 2d 72 65 70 65 61 74 3b 0a 7d 0a 2e 63 68 61 6e 67 65 50 61 67 65 4f 70 74 69 6f 6e 73 7b 0a 09 68 65 69 67 68 74 3a 34 34 70 78 3b 0a 09 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 31 30 70 78 3b 0a 7d 0a 0a 40 6d 65 64 69 61 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 34 31 34 70 78 29 7b 0a 2e 70 61 67 69 6e 61 74 69 6f 6e 20 61 7b 6d 61 Data Ascii: n: center;background-size: 10px 10px;background-image: url(images/touch_app.png);margin-top: 5px;margin-left: 5px;background-repeat: no-repeat;}.changePageOptions{height:44px;margin-left:10px;}@media (max-width: 414px){.pagination a{ma

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49743	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:30 UTC	533	OUT	GET /static/jquery.min.js HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:31 UTC	350	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:31 GMT Content-Type: application/javascript Content-Length: 89476 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Mon, 04 May 2020 23:01:38 GMT ETag: "15d84-5a4da8367d880" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:31 UTC	16034	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2025-01-02 05:12:31 UTC	16384	IN	Data Raw: 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 75 3d 5b 6d 3f 63 2e 66 69 72 73 74 43 68 69 6c 64 3a 63 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 6d 26 26 70 29 7b 64 3d 28 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 63 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 26 26 72 5b 32 5d 2c 61 3d 73 26 26 63 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 73 5d 3b 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c Data Ascii: ase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibling"}return!0}if(u=[m?c.firstChild:c.lastChild],m&&p){d=(s=(r=(i=(o=(a=c)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1])&&r[2],a=s&&c.childNodes[s];while(a=++s&&a&&a[l]\|
2025-01-02 05:12:31 UTC	16384	IN	Data Raw: 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 69 3d 21 30 2c 6d 28 72 29 7c 7c 28 61 3d 21 30 29 2c 6c 26 26 28 61 3f 28 74 2e 63 61 6c 6c 28 65 2c 72 29 2c 74 3d 6e 75 6c 6c 29 3a 28 6c 3d 74 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6c 2e 63 61 6c 6c 28 53 28 65 29 2c 6e 29 7d 29 29 2c 74 29 29 66 6f 72 28 3b 73 3c 75 3b 73 2b 2b 29 74 28 65 5b 73 5d 2c 6e 2c 61 3f 72 3a 72 2e 63 61 6c 6c 28 65 5b 73 5d 2c 73 2c 74 28 65 5b 73 5d 2c 6e 29 29 29 3b 72 65 74 75 72 6e 20 69 3f 65 3a 6c 3f 74 2e 63 61 6c 6c 28 65 29 3a 75 3f 74 28 65 5b 30 5d 2c 6e 29 3a 6f 7d 2c 5f 3d 2f 5e 2d 6d 73 2d 2f 2c 7a 3d 2f 2d 28 5b 61 2d 7a 5d 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 55 28 65 2c 74 Data Ascii: ],!0,o,a);else if(void 0!==r&&(i=!0,m(r)\|\|(a=!0),l&&(a?(t.call(e,r),t=null):(l=t,t=function(e,t,n){return l.call(S(e),n)})),t))for(;s<u;s++)t(e[s],n,a?r:r.call(e[s],s,t(e[s],n)));return i?e:l?t.call(e):u?t(e[0],n):o},_=/^-ms-/,z=/-([a-z])/g;function U(e,t
2025-01-02 05:12:31 UTC	16384	IN	Data Raw: 65 28 76 65 28 72 2c 22 73 63 72 69 70 74 22 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 72 29 29 3b 72 65 74 75 72 6e 20 65 7d 53 2e 65 78 74 65 6e 64 28 7b 68 74 6d 6c 50 72 65 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 21 30 29 2c 66 3d 69 65 28 65 29 3b 69 66 28 21 28 79 2e 6e 6f 43 6c 6f 6e 65 43 68 65 63 6b 65 64 7c 7c 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 29 29 66 6f 72 28 61 3d 76 65 28 63 29 2c 72 3d 30 2c Data Ascii: e(ve(r,"script")),r.parentNode.removeChild(r));return e}S.extend({htmlPrefilter:function(e){return e},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=ie(e);if(!(y.noCloneChecked\|\|1!==e.nodeType&&11!==e.nodeType\|\|S.isXMLDoc(e)))for(a=ve(c),r=0,
2025-01-02 05:12:31 UTC	16384	IN	Data Raw: 74 69 6f 6e 22 29 29 2c 72 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 65 63 6b 4f 6e 3d 22 22 21 3d 3d 72 74 2e 76 61 6c 75 65 2c 79 2e 6f 70 74 53 65 6c 65 63 74 65 64 3d 69 74 2e 73 65 6c 65 63 74 65 64 2c 28 72 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 76 61 6c 75 65 3d 22 74 22 2c 72 74 2e 74 79 70 65 3d 22 72 61 64 69 6f 22 2c 79 2e 72 61 64 69 6f 56 61 6c 75 65 3d 22 74 22 3d 3d 3d 72 74 2e 76 61 6c 75 65 3b 76 61 72 20 70 74 2c 64 74 3d 53 2e 65 78 70 72 2e 61 74 74 72 48 61 6e 64 6c 65 3b 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 24 28 74 68 69 73 2c 53 2e 61 74 74 72 2c 65 2c 74 2c 31 3c 61 72 67 75 6d 65 6e Data Ascii: tion")),rt.type="checkbox",y.checkOn=""!==rt.value,y.optSelected=it.selected,(rt=E.createElement("input")).value="t",rt.type="radio",y.radioValue="t"===rt.value;var pt,dt=S.expr.attrHandle;S.fn.extend({attr:function(e,t){return $(this,S.attr,e,t,1<argumen
2025-01-02 05:12:31 UTC	7906	IN	Data Raw: 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 65 77 20 43 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 3b 76 61 72 20 5f 74 3d 7b 30 3a 32 30 30 2c 31 32 32 33 3a 32 30 34 7d 2c 7a 74 3d 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 28 29 3b 79 2e 63 6f 72 73 3d 21 21 7a 74 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 7a 74 2c 79 2e 61 6a 61 78 3d 7a 74 3d 21 21 7a 74 2c 53 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 6f 2c 61 3b 69 66 28 79 2e 63 6f 72 73 7c 7c 7a 74 26 26 21 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 29 72 65 74 75 72 6e 7b 73 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: xSettings.xhr=function(){try{return new C.XMLHttpRequest}catch(e){}};var _t={0:200,1223:204},zt=S.ajaxSettings.xhr();y.cors=!!zt&&"withCredentials"in zt,y.ajax=zt=!!zt,S.ajaxTransport(function(i){var o,a;if(y.cors\|\|zt&&!i.crossDomain)return{send:function(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49745	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:30 UTC	543	OUT	GET /static/common15.js?v=100087799 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:31 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:31 GMT Content-Type: application/javascript Content-Length: 64745 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 14 May 2024 17:34:12 GMT ETag: "fce9-6186d68fe59e2" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:31 UTC	16035	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 69 6e 69 74 28 29 7b 0a 09 76 61 72 20 64 61 74 61 20 3d 20 7b 6e 61 6d 65 3a 20 22 4a 6f 68 6e 22 2c 20 61 67 65 3a 20 33 31 2c 20 63 69 74 79 3a 20 22 4e 65 77 20 59 6f 72 6b 22 7d 3b 0a 09 76 61 72 20 6a 73 6f 6e 20 3d 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 64 61 74 61 29 3b 0a 0a 09 76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 28 29 3b 0a 09 78 68 72 2e 6f 70 65 6e 28 22 50 4f 53 54 22 2c 20 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 2e 37 77 7a 78 39 2e 63 6f 6d 2f 67 65 74 44 61 74 61 49 6e 69 74 22 2c 20 74 72 75 65 29 3b 0a 09 78 68 72 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a Data Ascii: function init(){var data = {name: "John", age: 31, city: "New York"};var json = JSON.stringify(data);var xhr = new XMLHttpRequest();xhr.open("POST", "https://data.7wzx9.com/getDataInit", true);xhr.setRequestHeader("Content-type", "application/j
2025-01-02 05:12:31 UTC	16384	IN	Data Raw: 88 92 45 50 39 41 56 e7 af 87 2e e8 a2 81 e5 ad 90 e4 bb aa e6 9d a8 e6 9f b3 2e e6 ac b2 e7 81 ab e9 9a be e8 80 90 e9 80 86 e6 8e a8 e6 91 84 e5 bd b1 e5 b8 88 22 20 73 74 79 6c 65 3d 22 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 31 73 20 65 61 73 65 20 30 73 3b 20 6f 70 61 63 69 74 79 3a 20 31 3b 22 3e 3c 69 3e 3c 2f 69 3e 3c 2f 61 3e 3c 2f 64 74 3e 0a 09 09 09 09 09 09 2f 2f 20 3c 64 64 3e 3c 61 20 68 72 65 66 3d 22 2e 2f 76 69 64 65 6f 2f 73 68 69 70 69 6e 2f 31 31 31 35 33 33 2e 68 74 6d 6c 22 3e 3c 68 33 3e e7 aa 81 e8 a2 ad e5 a5 b3 e4 bc 98 e8 ae a1 e5 88 92 45 50 39 41 56 e7 af 87 2e e8 a2 81 e5 ad 90 e4 bb aa e6 9d a8 e6 9f b3 2e e6 ac b2 e7 81 ab e9 9a be e8 80 90 e9 80 86 e6 8e a8 e6 91 84 e5 bd b1 e5 b8 88 3c 2f 68 33 3e 3c 2f 61 3e 3c Data Ascii: EP9AV.." style="transition: all 1s ease 0s; opacity: 1;"><i></i></a></dt>// <dd><a href="./video/shipin/111533.html"><h3>EP9AV..</h3></a><
2025-01-02 05:12:31 UTC	16384	IN	Data Raw: 28 6e 6f 77 50 61 67 65 2d 6b 29 3e 30 29 7b 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 61 64 64 2b 2b 3b 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 73 75 62 4d 65 6e 75 32 20 2b 3d 27 3c 61 20 63 6c 61 73 73 3d 22 61 62 69 61 6f 71 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 2b 67 65 79 50 61 67 65 50 68 6f 74 6f 32 28 27 2b 28 4e 75 6d 62 65 72 28 6e 6f 77 50 61 67 65 2b 61 64 64 29 29 2b 27 2c 32 30 2c 27 2b 74 79 70 65 49 64 2b 27 2c 27 2b 74 79 70 65 4d 69 64 2b 27 2c 27 2b 28 4e 75 6d 62 65 72 28 6e 6f 77 50 61 67 65 2b 61 64 64 29 29 2b 27 2c 5c 27 27 2b 64 65 63 6f 64 65 55 52 49 28 63 6f 6e 74 65 6e 74 29 2b 27 5c 27 2c 27 2b 74 79 70 65 2b 27 29 22 3e 27 2b 28 4e 75 6d 62 65 72 28 6e 6f 77 50 61 67 65 2b 61 64 64 29 29 2b 27 3c 2f 61 3e 27 3b 0a 09 Data Ascii: (nowPage-k)>0){add++;subMenu2 +='<a class="abiaoqian" onclick="+geyPagePhoto2('+(Number(nowPage+add))+',20,'+typeId+','+typeMid+','+(Number(nowPage+add))+',\''+decodeURI(content)+'\','+type+')">'+(Number(nowPage+add))+'</a>';
2025-01-02 05:12:31 UTC	15942	IN	Data Raw: 20 20 20 20 20 20 20 69 6f 73 4e 61 74 69 76 65 3a 20 74 72 75 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 09 09 09 0a 09 09 09 09 09 7d 29 3b 7d 65 6c 73 65 7b 0a 09 09 09 09 09 76 61 72 20 70 6c 61 79 65 72 20 3d 20 6e 65 77 20 50 6c 79 72 28 76 69 64 65 6f 2c 20 7b 0a 09 09 09 09 09 09 63 61 70 74 69 6f 6e 73 3a 20 7b 61 63 74 69 76 65 3a 20 74 72 75 65 2c 20 75 70 64 61 74 65 3a 20 74 72 75 65 2c 20 6c 61 6e 67 75 61 67 65 3a 20 27 61 75 74 6f 27 7d 2c 0a 09 09 09 09 09 09 63 6f 6e 74 72 6f 6c 73 3a 20 5b 0a 09 09 09 09 09 09 20 20 27 70 6c 61 79 2d 6c 61 72 67 65 27 2c 20 2f 2f 20 54 68 65 20 6c 61 72 67 65 20 70 6c 61 79 20 62 75 74 74 6f 6e 20 69 6e 20 74 68 65 20 63 65 6e 74 65 72 0a 09 09 09 09 09 09 Data Ascii: iosNative: true }});}else{var player = new Plyr(video, {captions: {active: true, update: true, language: 'auto'},controls: [ 'play-large', // The large play button in the center

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:31 UTC	583	OUT	GET /header.html?v=9999999 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: text/html, /; q=0.01 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:32 UTC	335	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:32 GMT Content-Type: text/html Content-Length: 6098 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Thu, 27 Jun 2024 13:54:20 GMT ETag: "17d2-61bdf77b59c2f" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:32 UTC	6098	IN	Data Raw: 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 76 3d 31 39 22 3e 0a 3c 73 74 79 6c 65 3e 2e 61 62 6b 2d 69 74 65 6d 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 61 62 6b 2d 69 74 65 6d 20 2e 61 62 6b 2d 69 6d 61 67 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 61 62 6b 2d 69 74 65 6d 20 2e 61 62 6b 2d 69 6d 61 67 65 20 69 6d 67 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 61 62 6b 2d Data Ascii: <link rel="stylesheet" href="./css/style.css?v=19"><style>.abk-item{width:100%;display:block;overflow:hidden;position:relative}.abk-item .abk-image{width:100%;height:100%;overflow:hidden}.abk-item .abk-image img{width:100%;height:100%;display:block}.abk-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:31 UTC	583	OUT	GET /footer.html?v=9999999 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: text/html, /; q=0.01 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:32 UTC	310	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:32 GMT Content-Type: text/html Content-Length: 876 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Sat, 02 Mar 2024 11:41:53 GMT ETag: "36c-612abfa946240" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:32 UTC	876	IN	Data Raw: 0a 09 0a 0a 09 3c 64 69 76 20 69 64 3d 22 62 74 6d 42 6f 78 22 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 75 70 6c 65 74 22 3e 0a 09 09 0a 09 3c 2f 64 69 76 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e e8 ad a6 e5 91 8a ef b8 b0 e6 9c ac e7 b6 b2 e7 ab 99 e5 8f aa e9 80 99 e5 90 88 e5 8d 81 e5 85 ab e6 ad b2 e6 88 96 e4 bb a5 e4 b8 8a e4 ba ba e5 a3 ab e8 a7 80 e7 9c 8b e3 80 82 e5 85 a7 e5 ae b9 e5 8f af e8 83 bd e4 bb a4 e4 ba ba e5 8f 8d e6 84 9f ef bc 9b e4 b8 8d e5 8f af e5 b0 87 e6 9c ac e7 b6 b2 e7 ab 99 e7 9a 84 e5 85 a7 e5 ae b9 e6 b4 be e7 99 bc e3 80 81 e5 82 b3 e9 96 b1 e3 80 81 e5 87 ba e5 94 ae e3 80 81 e5 87 ba e7 a7 9f Data Ascii: <div id="btmBox"></div> <div id="couplet"></div><div class="footer"><div class="wrap">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49752	194.147.100.10	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:32 UTC	536	OUT	GET /pangda/base.js?v=9999999 HTTP/1.1 Host: xmad.7wzx9.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:33 UTC	556	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:33 GMT Content-Type: application/javascript Content-Length: 24639 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Wed, 01 Jan 2025 17:12:33 GMT ETag: W/"603f-62ab304f4024a" Server: nginx X-Cache-Status: HIT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: * Access-Control-Allow-Headers: * Access-Control-Expose-Headers: * Access-Control-Allow-Credentials: true Access-Control-Max-Age: 1728000 Accept-Ranges: bytes
2025-01-02 05:12:33 UTC	15828	IN	Data Raw: 0a 2f 2f 20 76 61 72 20 6f 6e 6c 69 6e 65 48 72 65 66 20 3d 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 43 43 39 31 41 56 22 3b 0a 76 61 72 20 77 7a 66 62 79 20 3d 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 64 73 70 2e 74 76 22 0a 76 61 72 20 77 6f 72 6c 64 42 67 49 6d 61 67 65 20 3d 20 22 2e 2f 63 73 73 2f 69 6d 61 67 65 73 2f 62 67 67 2e 70 6e 67 22 3b 0a 76 61 72 20 62 6f 64 79 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 0a 76 61 72 20 75 61 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0a 76 61 72 20 64 6f 6d 61 69 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 3b 20 2f 2f e5 9f 9f e5 90 8d 0a 76 61 72 20 78 6c 31 20 3d 22 22 3b 0a 76 61 72 20 78 6c 32 20 Data Ascii: // var onlineHref ="https://t.me/CC91AV";var wzfby = "https://www.pdsp.tv"var worldBgImage = "./css/images/bgg.png";var body = document.body;var ua = navigator.userAgent.toLowerCase();var domain = window.location.host; //var xl1 ="";var xl2
2025-01-02 05:12:33 UTC	8811	IN	Data Raw: 65 6d 6f 76 65 43 68 69 6c 64 28 6d 61 73 6b 42 6f 78 29 3b 0a 20 20 20 20 70 6f 70 42 6f 78 20 3d 20 67 65 74 49 64 28 27 70 6f 70 42 6f 78 27 29 3b 0a 20 20 20 20 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 70 6f 70 42 6f 78 29 3b 0a 20 20 20 20 62 6f 64 79 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 20 3d 20 22 6f 76 65 72 66 6c 6f 77 2d 78 3a 20 68 69 64 64 65 6e 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 20 70 61 6e 2d 79 3b 22 3b 0a 20 20 20 20 2f 2f 20 73 65 74 43 6f 6f 6b 69 65 28 22 6e 65 77 75 72 6c 22 2c 20 22 30 22 2c 20 22 37 32 22 29 3b 0a 7d 0a 66 75 6e 63 74 69 6f 6e 20 73 65 74 43 6f 6f 6b 69 65 28 63 6e 61 6d 65 2c 20 63 76 61 6c 75 65 2c 20 65 78 68 6f 75 72 73 29 20 7b 0a 20 20 20 20 76 61 72 20 65 78 70 20 3d 20 6e 65 77 20 44 61 Data Ascii: emoveChild(maskBox); popBox = getId('popBox'); body.removeChild(popBox); body.style.cssText = "overflow-x: hidden;touch-action: pan-y;"; // setCookie("newurl", "0", "72");}function setCookie(cname, cvalue, exhours) { var exp = new Da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:32 UTC	659	OUT	GET /static/search2.js HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, /; q=0.01 X-Requested-With: XMLHttpRequest sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:33 UTC	347	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:33 GMT Content-Type: application/javascript Content-Length: 3341 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 28 Nov 2023 09:27:22 GMT ETag: "d0d-60b3306961280" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:33 UTC	3341	IN	Data Raw: 76 61 72 20 75 61 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0d 0a 0d 0a 76 61 72 20 69 73 53 61 66 61 72 69 20 3d 20 2f 56 65 72 73 69 6f 6e 5b 7c 5c 2f 5d 28 5b 30 2d 39 2e 5d 2b 29 28 5b 5e 30 2d 39 61 2d 7a 41 2d 5a 5d 2b 29 4d 6f 62 69 6c 65 5b 7c 5c 2f 5d 28 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 2b 29 28 5b 5e 30 2d 39 61 2d 7a 41 2d 5a 5d 2b 29 53 61 66 61 72 69 5b 7c 5c 2f 5d 28 5b 30 2d 39 2e 5d 2b 29 24 2f 69 2e 74 65 73 74 28 75 61 29 3b 0d 0a 76 61 72 20 69 73 4d 6f 62 69 6c 65 20 3d 20 75 61 2e 69 6e 64 65 78 4f 66 28 22 77 69 6e 64 6f 77 73 20 6e 74 22 29 20 3d 3d 20 2d 31 20 26 26 20 75 61 2e 69 6e 64 65 78 4f 66 28 22 6d 61 63 69 6e 74 6f 73 68 22 29 20 3d 3d 20 2d 31 20 26 26 Data Ascii: var ua = navigator.userAgent.toLowerCase();var isSafari = /Version[\|\/]([0-9.]+)([^0-9a-zA-Z]+)Mobile[\|\/]([0-9a-zA-Z]+)([^0-9a-zA-Z]+)Safari[\|\/]([0-9.]+)$/i.test(ua);var isMobile = ua.indexOf("windows nt") == -1 && ua.indexOf("macintosh") == -1 &&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49757	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:33 UTC	358	OUT	GET /static/jquery.min.js HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:33 UTC	350	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:33 GMT Content-Type: application/javascript Content-Length: 89476 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Mon, 04 May 2020 23:01:38 GMT ETag: "15d84-5a4da8367d880" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:33 UTC	16034	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 35 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0a 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 Data Ascii: /! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery
2025-01-02 05:12:33 UTC	16384	IN	Data Raw: 61 73 65 28 29 3d 3d 3d 66 3a 31 3d 3d 3d 61 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 21 31 3b 75 3d 6c 3d 22 6f 6e 6c 79 22 3d 3d 3d 68 26 26 21 75 26 26 22 6e 65 78 74 53 69 62 6c 69 6e 67 22 7d 72 65 74 75 72 6e 21 30 7d 69 66 28 75 3d 5b 6d 3f 63 2e 66 69 72 73 74 43 68 69 6c 64 3a 63 2e 6c 61 73 74 43 68 69 6c 64 5d 2c 6d 26 26 70 29 7b 64 3d 28 73 3d 28 72 3d 28 69 3d 28 6f 3d 28 61 3d 63 29 5b 53 5d 7c 7c 28 61 5b 53 5d 3d 7b 7d 29 29 5b 61 2e 75 6e 69 71 75 65 49 44 5d 7c 7c 28 6f 5b 61 2e 75 6e 69 71 75 65 49 44 5d 3d 7b 7d 29 29 5b 68 5d 7c 7c 5b 5d 29 5b 30 5d 3d 3d 3d 6b 26 26 72 5b 31 5d 29 26 26 72 5b 32 5d 2c 61 3d 73 26 26 63 2e 63 68 69 6c 64 4e 6f 64 65 73 5b 73 5d 3b 77 68 69 6c 65 28 61 3d 2b 2b 73 26 26 61 26 26 61 5b 6c 5d 7c Data Ascii: ase()===f:1===a.nodeType)return!1;u=l="only"===h&&!u&&"nextSibling"}return!0}if(u=[m?c.firstChild:c.lastChild],m&&p){d=(s=(r=(i=(o=(a=c)[S]\|\|(a[S]={}))[a.uniqueID]\|\|(o[a.uniqueID]={}))[h]\|\|[])[0]===k&&r[1])&&r[2],a=s&&c.childNodes[s];while(a=++s&&a&&a[l]\|
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 5d 2c 21 30 2c 6f 2c 61 29 3b 65 6c 73 65 20 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 26 26 28 69 3d 21 30 2c 6d 28 72 29 7c 7c 28 61 3d 21 30 29 2c 6c 26 26 28 61 3f 28 74 2e 63 61 6c 6c 28 65 2c 72 29 2c 74 3d 6e 75 6c 6c 29 3a 28 6c 3d 74 2c 74 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 72 65 74 75 72 6e 20 6c 2e 63 61 6c 6c 28 53 28 65 29 2c 6e 29 7d 29 29 2c 74 29 29 66 6f 72 28 3b 73 3c 75 3b 73 2b 2b 29 74 28 65 5b 73 5d 2c 6e 2c 61 3f 72 3a 72 2e 63 61 6c 6c 28 65 5b 73 5d 2c 73 2c 74 28 65 5b 73 5d 2c 6e 29 29 29 3b 72 65 74 75 72 6e 20 69 3f 65 3a 6c 3f 74 2e 63 61 6c 6c 28 65 29 3a 75 3f 74 28 65 5b 30 5d 2c 6e 29 3a 6f 7d 2c 5f 3d 2f 5e 2d 6d 73 2d 2f 2c 7a 3d 2f 2d 28 5b 61 2d 7a 5d 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 55 28 65 2c 74 Data Ascii: ],!0,o,a);else if(void 0!==r&&(i=!0,m(r)\|\|(a=!0),l&&(a?(t.call(e,r),t=null):(l=t,t=function(e,t,n){return l.call(S(e),n)})),t))for(;s<u;s++)t(e[s],n,a?r:r.call(e[s],s,t(e[s],n)));return i?e:l?t.call(e):u?t(e[0],n):o},_=/^-ms-/,z=/-([a-z])/g;function U(e,t
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 65 28 76 65 28 72 2c 22 73 63 72 69 70 74 22 29 29 2c 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 72 29 29 3b 72 65 74 75 72 6e 20 65 7d 53 2e 65 78 74 65 6e 64 28 7b 68 74 6d 6c 50 72 65 66 69 6c 74 65 72 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 7d 2c 63 6c 6f 6e 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6e 29 7b 76 61 72 20 72 2c 69 2c 6f 2c 61 2c 73 2c 75 2c 6c 2c 63 3d 65 2e 63 6c 6f 6e 65 4e 6f 64 65 28 21 30 29 2c 66 3d 69 65 28 65 29 3b 69 66 28 21 28 79 2e 6e 6f 43 6c 6f 6e 65 43 68 65 63 6b 65 64 7c 7c 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 31 21 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 7c 7c 53 2e 69 73 58 4d 4c 44 6f 63 28 65 29 29 29 66 6f 72 28 61 3d 76 65 28 63 29 2c 72 3d 30 2c Data Ascii: e(ve(r,"script")),r.parentNode.removeChild(r));return e}S.extend({htmlPrefilter:function(e){return e},clone:function(e,t,n){var r,i,o,a,s,u,l,c=e.cloneNode(!0),f=ie(e);if(!(y.noCloneChecked\|\|1!==e.nodeType&&11!==e.nodeType\|\|S.isXMLDoc(e)))for(a=ve(c),r=0,
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 74 69 6f 6e 22 29 29 2c 72 74 2e 74 79 70 65 3d 22 63 68 65 63 6b 62 6f 78 22 2c 79 2e 63 68 65 63 6b 4f 6e 3d 22 22 21 3d 3d 72 74 2e 76 61 6c 75 65 2c 79 2e 6f 70 74 53 65 6c 65 63 74 65 64 3d 69 74 2e 73 65 6c 65 63 74 65 64 2c 28 72 74 3d 45 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 69 6e 70 75 74 22 29 29 2e 76 61 6c 75 65 3d 22 74 22 2c 72 74 2e 74 79 70 65 3d 22 72 61 64 69 6f 22 2c 79 2e 72 61 64 69 6f 56 61 6c 75 65 3d 22 74 22 3d 3d 3d 72 74 2e 76 61 6c 75 65 3b 76 61 72 20 70 74 2c 64 74 3d 53 2e 65 78 70 72 2e 61 74 74 72 48 61 6e 64 6c 65 3b 53 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 61 74 74 72 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 24 28 74 68 69 73 2c 53 2e 61 74 74 72 2c 65 2c 74 2c 31 3c 61 72 67 75 6d 65 6e Data Ascii: tion")),rt.type="checkbox",y.checkOn=""!==rt.value,y.optSelected=it.selected,(rt=E.createElement("input")).value="t",rt.type="radio",y.radioValue="t"===rt.value;var pt,dt=S.expr.attrHandle;S.fn.extend({attr:function(e,t){return $(this,S.attr,e,t,1<argumen
2025-01-02 05:12:34 UTC	7906	IN	Data Raw: 78 53 65 74 74 69 6e 67 73 2e 78 68 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 6e 65 77 20 43 2e 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 7d 63 61 74 63 68 28 65 29 7b 7d 7d 3b 76 61 72 20 5f 74 3d 7b 30 3a 32 30 30 2c 31 32 32 33 3a 32 30 34 7d 2c 7a 74 3d 53 2e 61 6a 61 78 53 65 74 74 69 6e 67 73 2e 78 68 72 28 29 3b 79 2e 63 6f 72 73 3d 21 21 7a 74 26 26 22 77 69 74 68 43 72 65 64 65 6e 74 69 61 6c 73 22 69 6e 20 7a 74 2c 79 2e 61 6a 61 78 3d 7a 74 3d 21 21 7a 74 2c 53 2e 61 6a 61 78 54 72 61 6e 73 70 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 69 29 7b 76 61 72 20 6f 2c 61 3b 69 66 28 79 2e 63 6f 72 73 7c 7c 7a 74 26 26 21 69 2e 63 72 6f 73 73 44 6f 6d 61 69 6e 29 72 65 74 75 72 6e 7b 73 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 Data Ascii: xSettings.xhr=function(){try{return new C.XMLHttpRequest}catch(e){}};var _t={0:200,1223:204},zt=S.ajaxSettings.xhr();y.cors=!!zt&&"withCredentials"in zt,y.ajax=zt=!!zt,S.ajaxTransport(function(i){var o,a;if(y.cors\|\|zt&&!i.crossDomain)return{send:function(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:33 UTC	368	OUT	GET /static/common15.js?v=100087799 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:33 UTC	349	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:33 GMT Content-Type: application/javascript Content-Length: 64745 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 14 May 2024 17:34:12 GMT ETag: "fce9-6186d68fe59e2" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:33 UTC	16035	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 69 6e 69 74 28 29 7b 0a 09 76 61 72 20 64 61 74 61 20 3d 20 7b 6e 61 6d 65 3a 20 22 4a 6f 68 6e 22 2c 20 61 67 65 3a 20 33 31 2c 20 63 69 74 79 3a 20 22 4e 65 77 20 59 6f 72 6b 22 7d 3b 0a 09 76 61 72 20 6a 73 6f 6e 20 3d 20 4a 53 4f 4e 2e 73 74 72 69 6e 67 69 66 79 28 64 61 74 61 29 3b 0a 0a 09 76 61 72 20 78 68 72 20 3d 20 6e 65 77 20 58 4d 4c 48 74 74 70 52 65 71 75 65 73 74 28 29 3b 0a 09 78 68 72 2e 6f 70 65 6e 28 22 50 4f 53 54 22 2c 20 22 68 74 74 70 73 3a 2f 2f 64 61 74 61 2e 37 77 7a 78 39 2e 63 6f 6d 2f 67 65 74 44 61 74 61 49 6e 69 74 22 2c 20 74 72 75 65 29 3b 0a 09 78 68 72 2e 73 65 74 52 65 71 75 65 73 74 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 74 79 70 65 22 2c 20 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a Data Ascii: function init(){var data = {name: "John", age: 31, city: "New York"};var json = JSON.stringify(data);var xhr = new XMLHttpRequest();xhr.open("POST", "https://data.7wzx9.com/getDataInit", true);xhr.setRequestHeader("Content-type", "application/j
2025-01-02 05:12:33 UTC	16384	IN	Data Raw: 88 92 45 50 39 41 56 e7 af 87 2e e8 a2 81 e5 ad 90 e4 bb aa e6 9d a8 e6 9f b3 2e e6 ac b2 e7 81 ab e9 9a be e8 80 90 e9 80 86 e6 8e a8 e6 91 84 e5 bd b1 e5 b8 88 22 20 73 74 79 6c 65 3d 22 74 72 61 6e 73 69 74 69 6f 6e 3a 20 61 6c 6c 20 31 73 20 65 61 73 65 20 30 73 3b 20 6f 70 61 63 69 74 79 3a 20 31 3b 22 3e 3c 69 3e 3c 2f 69 3e 3c 2f 61 3e 3c 2f 64 74 3e 0a 09 09 09 09 09 09 2f 2f 20 3c 64 64 3e 3c 61 20 68 72 65 66 3d 22 2e 2f 76 69 64 65 6f 2f 73 68 69 70 69 6e 2f 31 31 31 35 33 33 2e 68 74 6d 6c 22 3e 3c 68 33 3e e7 aa 81 e8 a2 ad e5 a5 b3 e4 bc 98 e8 ae a1 e5 88 92 45 50 39 41 56 e7 af 87 2e e8 a2 81 e5 ad 90 e4 bb aa e6 9d a8 e6 9f b3 2e e6 ac b2 e7 81 ab e9 9a be e8 80 90 e9 80 86 e6 8e a8 e6 91 84 e5 bd b1 e5 b8 88 3c 2f 68 33 3e 3c 2f 61 3e 3c Data Ascii: EP9AV.." style="transition: all 1s ease 0s; opacity: 1;"><i></i></a></dt>// <dd><a href="./video/shipin/111533.html"><h3>EP9AV..</h3></a><
2025-01-02 05:12:33 UTC	16384	IN	Data Raw: 28 6e 6f 77 50 61 67 65 2d 6b 29 3e 30 29 7b 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 61 64 64 2b 2b 3b 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 73 75 62 4d 65 6e 75 32 20 2b 3d 27 3c 61 20 63 6c 61 73 73 3d 22 61 62 69 61 6f 71 69 61 6e 22 20 6f 6e 63 6c 69 63 6b 3d 22 2b 67 65 79 50 61 67 65 50 68 6f 74 6f 32 28 27 2b 28 4e 75 6d 62 65 72 28 6e 6f 77 50 61 67 65 2b 61 64 64 29 29 2b 27 2c 32 30 2c 27 2b 74 79 70 65 49 64 2b 27 2c 27 2b 74 79 70 65 4d 69 64 2b 27 2c 27 2b 28 4e 75 6d 62 65 72 28 6e 6f 77 50 61 67 65 2b 61 64 64 29 29 2b 27 2c 5c 27 27 2b 64 65 63 6f 64 65 55 52 49 28 63 6f 6e 74 65 6e 74 29 2b 27 5c 27 2c 27 2b 74 79 70 65 2b 27 29 22 3e 27 2b 28 4e 75 6d 62 65 72 28 6e 6f 77 50 61 67 65 2b 61 64 64 29 29 2b 27 3c 2f 61 3e 27 3b 0a 09 Data Ascii: (nowPage-k)>0){add++;subMenu2 +='<a class="abiaoqian" onclick="+geyPagePhoto2('+(Number(nowPage+add))+',20,'+typeId+','+typeMid+','+(Number(nowPage+add))+',\''+decodeURI(content)+'\','+type+')">'+(Number(nowPage+add))+'</a>';
2025-01-02 05:12:34 UTC	15942	IN	Data Raw: 20 20 20 20 20 20 20 69 6f 73 4e 61 74 69 76 65 3a 20 74 72 75 65 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 09 09 09 0a 09 09 09 09 09 7d 29 3b 7d 65 6c 73 65 7b 0a 09 09 09 09 09 76 61 72 20 70 6c 61 79 65 72 20 3d 20 6e 65 77 20 50 6c 79 72 28 76 69 64 65 6f 2c 20 7b 0a 09 09 09 09 09 09 63 61 70 74 69 6f 6e 73 3a 20 7b 61 63 74 69 76 65 3a 20 74 72 75 65 2c 20 75 70 64 61 74 65 3a 20 74 72 75 65 2c 20 6c 61 6e 67 75 61 67 65 3a 20 27 61 75 74 6f 27 7d 2c 0a 09 09 09 09 09 09 63 6f 6e 74 72 6f 6c 73 3a 20 5b 0a 09 09 09 09 09 09 20 20 27 70 6c 61 79 2d 6c 61 72 67 65 27 2c 20 2f 2f 20 54 68 65 20 6c 61 72 67 65 20 70 6c 61 79 20 62 75 74 74 6f 6e 20 69 6e 20 74 68 65 20 63 65 6e 74 65 72 0a 09 09 09 09 09 09 Data Ascii: iosNative: true }});}else{var player = new Plyr(video, {captions: {active: true, update: true, language: 'auto'},controls: [ 'play-large', // The large play button in the center

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49756	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:33 UTC	359	OUT	GET /header.html?v=9999999 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:33 UTC	335	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:33 GMT Content-Type: text/html Content-Length: 6098 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Thu, 27 Jun 2024 13:54:20 GMT ETag: "17d2-61bdf77b59c2f" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:33 UTC	6098	IN	Data Raw: 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 2e 2f 63 73 73 2f 73 74 79 6c 65 2e 63 73 73 3f 76 3d 31 39 22 3e 0a 3c 73 74 79 6c 65 3e 2e 61 62 6b 2d 69 74 65 6d 7b 77 69 64 74 68 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 61 62 6b 2d 69 74 65 6d 20 2e 61 62 6b 2d 69 6d 61 67 65 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 7d 2e 61 62 6b 2d 69 74 65 6d 20 2e 61 62 6b 2d 69 6d 61 67 65 20 69 6d 67 7b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d 2e 61 62 6b 2d Data Ascii: <link rel="stylesheet" href="./css/style.css?v=19"><style>.abk-item{width:100%;display:block;overflow:hidden;position:relative}.abk-item .abk-image{width:100%;height:100%;overflow:hidden}.abk-item .abk-image img{width:100%;height:100%;display:block}.abk-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49754	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:33 UTC	359	OUT	GET /footer.html?v=9999999 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:33 UTC	310	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:33 GMT Content-Type: text/html Content-Length: 876 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Sat, 02 Mar 2024 11:41:53 GMT ETag: "36c-612abfa946240" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:33 UTC	876	IN	Data Raw: 0a 09 0a 0a 09 3c 64 69 76 20 69 64 3d 22 62 74 6d 42 6f 78 22 3e 0a 09 3c 2f 64 69 76 3e 0a 0a 20 20 20 20 3c 64 69 76 20 69 64 3d 22 63 6f 75 70 6c 65 74 22 3e 0a 09 09 0a 09 3c 2f 64 69 76 3e 0a 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 66 6f 6f 74 65 72 22 3e 0a 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 77 72 61 70 22 3e e8 ad a6 e5 91 8a ef b8 b0 e6 9c ac e7 b6 b2 e7 ab 99 e5 8f aa e9 80 99 e5 90 88 e5 8d 81 e5 85 ab e6 ad b2 e6 88 96 e4 bb a5 e4 b8 8a e4 ba ba e5 a3 ab e8 a7 80 e7 9c 8b e3 80 82 e5 85 a7 e5 ae b9 e5 8f af e8 83 bd e4 bb a4 e4 ba ba e5 8f 8d e6 84 9f ef bc 9b e4 b8 8d e5 8f af e5 b0 87 e6 9c ac e7 b6 b2 e7 ab 99 e7 9a 84 e5 85 a7 e5 ae b9 e6 b4 be e7 99 bc e3 80 81 e5 82 b3 e9 96 b1 e3 80 81 e5 87 ba e5 94 ae e3 80 81 e5 87 ba e7 a7 9f Data Ascii: <div id="btmBox"></div> <div id="couplet"></div><div class="footer"><div class="wrap">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49747	194.147.100.10	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:33 UTC	526	OUT	GET /pangda/tbad.js HTTP/1.1 Host: xmad.7wzx9.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	555	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:34 GMT Content-Type: application/javascript Content-Length: 7051 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Wed, 01 Jan 2025 17:12:33 GMT ETag: W/"1b8b-62ab304f3fe64" Server: nginx X-Cache-Status: HIT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: * Access-Control-Allow-Headers: * Access-Control-Expose-Headers: * Access-Control-Allow-Credentials: true Access-Control-Max-Age: 1728000 Accept-Ranges: bytes
2025-01-02 05:12:34 UTC	7051	IN	Data Raw: 76 61 72 20 61 70 70 41 62 6b 44 69 76 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 62 61 64 27 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 43 6f 6e 74 65 6e 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 e5 88 9b e5 bb ba e4 b8 80 e4 b8 aa e6 95 b0 e7 bb 84 e6 9d a5 e5 ad 98 e5 82 a8 e9 93 be e6 8e a5 e3 80 81 e5 9b be e7 89 87 e9 93 be e6 8e a5 e5 92 8c e5 90 8d e7 a7 b0 0a 20 20 20 20 76 61 72 20 69 74 65 6d 73 20 3d 20 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 6b 3a 20 22 68 74 74 70 73 3a 2f 2f 76 75 79 38 31 2e 74 6f 70 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6d 61 67 65 3a 20 22 68 74 74 70 73 3a 2f 2f 63 63 37 37 37 69 6d 67 2e 64 71 73 6c 64 7a 2e 63 6f 6d 2f 69 Data Ascii: var appAbkDiv = document.getElementById('tbad');function loadContent() { // var items = [ { link: "https://vuy81.top", image: "https://cc777img.dqsldz.com/i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49758	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	591	OUT	GET /css/images/bgg.png HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	312	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:34 GMT Content-Type: image/png Content-Length: 7395 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 22 Aug 2023 23:57:32 GMT ETag: "1ce3-6038bc218b300" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:34 UTC	7395	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 40 00 00 01 94 08 03 00 00 00 73 e1 0b a1 00 00 03 00 50 4c 54 45 00 00 00 0c 34 88 17 49 a9 16 4a ab 3b 6a c8 3c 6d cd 40 a7 e8 42 ac eb bb 5f 7e 2e 5d bc cd 48 46 26 58 b9 dc 83 6b 33 63 c4 0d 41 a1 57 71 a4 0e 4a b5 3f a5 e9 ce 62 72 fc 94 3c 1a 2d 6c eb 5c 63 31 2f 62 c6 59 69 0b 47 b4 43 b3 ec 0c 47 b5 3c 9e e7 e1 62 2a c8 4b 25 b3 45 2f ad 3f 2c 0b 2e 7b 0b 43 aa 43 b1 eb cd 62 72 fc 93 3b 0b 47 b4 e6 5e 6a 41 ad eb ad 53 50 ee 85 46 e4 76 35 54 7e b0 73 6b a4 47 7f ef 19 55 c6 1d 58 c9 20 5b cd 15 51 c2 0e 4b bb 11 4e be 42 7a ea 3e a9 eb 27 61 d2 0b 48 b9 f8 5b 5d 3c 74 e5 23 5e cf 3f 77 e8 e9 3d 27 32 6c dc 45 7d ee 36 6f df fc 93 3c 2a 64 d5 fe 88 52 38 71 e2 ff ff ff 2f 69 da 2c 66 d7 1d Data Ascii: PNGIHDR@sPLTE4IJ;j<m@B_~.]HF&Xk3cAWqJ?br<-l\c1/bYiGCG<bK%E/?,.{CCbr;G^jASPFv5T~skGUX [QKNBz>'aH[]<t#^?w='2lE}6o<dR8q/i,f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49759	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	592	OUT	GET /css/images/logo.jpg HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	314	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:34 GMT Content-Type: image/jpeg Content-Length: 13298 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Sat, 19 Aug 2023 09:13:50 GMT ETag: "33f2-6034310370f80" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:34 UTC	13298	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 de 01 39 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC9"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49765	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	583	OUT	GET /css/fonts/iconfont1.woff2 HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://www.rr8844.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: font Referer: https://www.rr8844.com/css/style.css?v=19 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	313	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:34 GMT Content-Type: font/woff2 Content-Length: 6448 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Wed, 02 Aug 2023 00:55:02 GMT ETag: "1930-601e61d10a580" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:34 UTC	6448	IN	Data Raw: 77 4f 46 32 00 01 00 00 00 00 19 30 00 0b 00 00 00 00 2f e8 00 00 18 e1 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1c 54 06 60 00 89 44 0a c6 60 b9 66 01 36 02 24 03 81 40 0b 62 00 04 20 05 84 67 07 84 4c 1b 4a 28 45 a4 d5 ac 96 5b 64 ff 5f 12 b8 31 14 ab a1 d6 af 04 e1 b0 a3 90 42 5b 9c 58 68 ad b0 61 c3 5c a9 95 5a 99 ec d9 87 74 3c 41 38 b7 96 61 17 ed f4 92 42 3e fd 65 ef 4e 25 7f 90 c1 31 43 29 a1 7f 5a ba f9 bb 7b 77 69 a5 ab 28 24 1a 21 51 b2 6b 10 42 a0 5f 12 a3 18 a2 39 6b 36 bb 11 23 e6 10 21 41 12 48 48 08 9a 52 24 48 12 3c 09 04 d3 60 3d 28 d4 e9 41 f0 a4 2a 5c c5 14 2a 0a 77 a5 f7 c5 ce bc a6 7f 3d 31 42 00 5c ee fe bf bd 10 be 28 2c 8a d6 a6 36 a5 01 c9 9e f7 9d 9a b4 b1 d5 6e 07 86 d2 80 d2 f6 08 d0 50 84 43 ce Data Ascii: wOF20/T`D`f6$@b gLJ(E[d_1B[Xha\Zt<A8aB>eN%1C)Z{wi($!QkB_9k6#!AHHR$H<`=(A\w=1B\(,6nPC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49768	216.180.227.131	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	588	OUT	GET /img/1kkky_1300x240.gif HTTP/1.1 Host: ig23.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	1088	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 5850 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83de2af2b7eb4-LAX Content-Length: 377690 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:10:16 GMT Etag: "676a9c4a-5c35a" Expires: Sat, 01 Feb 2025 03:32:46 GMT Last-Modified: Thu, 02 Jan 2025 05:10:35 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DYG4Z6rile2nk658yV5TDY86%2F99OTiEZmp6OYiYCMIrh9ZhSHlstmCFoilnLoCjl4io1ir2oPEhEoXEVQNWSxvHYqP2NMA9spDqCxYf5nZ2bnam2Y3BHqpJrEs6RkjkVgQ%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=2814&min_rtt=720&rtt_var=4084&sent=1611&recv=178&lost=0&retrans=0&sent_bytes=2192381&recv_bytes=14383&delivery_rate=436187654&cwnd=761&unsent_bytes=0&cid=26331da790d17365&ts=38193&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:34 UTC	98	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 00 00 6a bb bb 9e 1d 0f 4d 33 fb ff fc b2 ff fc 92 ff 76 11 a6 ab e3 fc b0 93 32 33 fd fc b8 ae 75 bb cc ff da 50 ae 48 10 f8 94 8d f3 71 6e 77 cc d6 24 a2 da cc d5 d5 2a 19 10 64 56 54 9d cc bb fe d9 8e f7 6d 50 9d 5c aa f7 8f 72 f8 22 11 ba fe ff 0c 70 b0 d4 Data Ascii: GIF89ajM3v23uPHqnw$*dVTmP\r"p
2025-01-02 05:12:34 UTC	2372	IN	Data Raw: d8 f2 96 62 e1 b5 cf d1 dc 10 07 db ab ea 6d cc bc 53 23 b3 68 56 df b0 96 66 f7 92 28 f4 50 49 fe d5 6e 60 52 ac 91 ee d9 f7 93 0c 4d 2c d5 db 31 29 17 8e b8 1e e1 e9 af b8 b9 4a 2d 25 8e b7 b9 6e 22 d6 ff ee 32 d6 b6 b3 da 74 74 6e 45 36 fe b8 4d f7 4b 2e db 45 2e d4 94 8e f4 71 8e 29 24 ac 8f 4f 44 b0 72 6f f2 4d 10 d7 4c 0e fc b1 71 db 6b 0c f1 32 2d d7 b0 95 d8 4f 46 d5 70 26 fa 90 4c d5 cd b4 fa 71 29 6e 31 29 d4 8e 71 d3 89 0f 3d 98 4a 29 31 d4 f2 50 70 0c 21 53 ff ef 11 b7 8b 87 73 d9 f3 f8 da f2 4b f8 f4 db b0 4a 89 dd f0 30 5c df 14 4e 77 b1 ee de d5 6c 52 8e 6e 6d 43 c7 f7 7a 29 0a 52 b9 be 91 69 4f b1 6b 50 46 d0 d7 4a 22 10 6e fa fa ed 32 4a 91 fc fd b3 b1 8a 4e 34 61 da 8c 28 d6 8e 4d bc c6 f3 b3 4f 45 d3 ee db 8e 89 90 8f 92 c3 d6 cd 93 d4 Data Ascii: bmS#hVf(PIn`RM,1)J-%n"2ttnE6MK.E.q)$ODroMLqk2-OFp&Lq)n1)q=J)1Pp!SsKJ0\NwlRnmCz)RiOkPFJ"n2JN4a(MOE
2025-01-02 05:12:34 UTC	538	IN	Data Raw: e5 68 a3 46 8d 73 c6 09 37 9c 50 41 29 fe 2c a0 42 34 54 59 15 4d 34 15 94 4a 4a 3a 64 79 01 84 58 f7 30 a0 c7 aa 40 30 ff f0 83 5a 3f 78 72 41 5d 6e e5 4a 17 a5 93 ca 05 97 ae 71 c1 d5 81 01 1c 50 e5 cc 0b 74 f4 55 d8 b2 cc 16 b6 d8 b3 8f 41 26 2d b4 d1 4a 3b 6d b5 8e 5d 8b d9 65 dc 62 36 82 64 7e 1d 16 ae 28 e3 96 0b 59 b8 e8 32 96 ee 29 eb 7e eb 99 bb ec 7e 06 ef bc f2 d6 fb ae bd f1 de 9b af bb fc ea db ef be fe 06 0c 30 bb b1 f1 5b f0 c1 04 27 3c 02 c2 0b 2b cc f0 c3 0e 47 dc f0 c4 02 2c 6c 71 c5 18 5f ac 71 c6 1c 6f ec 71 c7 20 7f 2c 72 c8 24 8f 6c 72 c9 20 63 dc dc c2 2b 77 e7 f2 cb d8 61 e1 9c cc cd d1 6c 73 cd 38 0b 70 b3 ce 3c cb ec 73 cf 33 07 9d f3 ce 44 eb fc 86 01 20 b8 e7 43 7c 36 24 42 21 0d b4 60 c3 c5 7e fd 6d 48 a0 12 56 13 58 60 81 48 Data Ascii: hFs7PA),B4TYM4JJ:dyX0@0Z?xrA]nJqPtUA&-J;m]eb6d~(Y2)~~0['<+G,lq_qoq ,r$lr c+wals8p<s3D C\|6$B!`~mHVX`H
2025-01-02 05:12:34 UTC	4744	IN	Data Raw: 9c 8c 30 c4 c5 98 1d 5a d0 32 e0 ca 0c bd ff f4 95 af 22 0e d1 88 f8 7a 8d 12 41 a3 1b dc a8 c6 36 be 89 62 70 a6 28 c5 e1 dc 86 65 c2 b1 22 15 a7 88 9c e6 30 07 66 60 0c 23 cc 58 56 b1 f0 9c 6c 64 58 b8 58 1a 31 b6 c6 11 c8 6c 61 6b 7c 63 e8 80 36 c7 39 0a 8d 67 31 83 0e cd ae b3 c7 3e 0a ad 68 78 14 c0 7a 40 b0 86 39 24 22 40 89 e8 81 0e b0 91 80 6b d0 c2 71 fb 01 83 d5 04 a4 b6 01 59 12 40 00 02 c3 2e 68 a0 84 03 85 81 06 3a 80 41 18 e2 f6 0d f9 84 21 0c 63 c0 9a 17 3a 19 37 23 d5 ad 1a 1f 72 e4 19 7c a0 a4 14 7d e3 46 21 92 91 0f 44 94 80 c1 09 a9 07 13 38 90 7e 7a 40 04 12 f0 28 0c 6c b8 11 8c 7c 34 20 2e c4 a2 1a df 50 12 11 be 01 a4 cc 09 89 4a 52 f2 1c 0a be 23 ba f3 6c c9 9b e8 c1 12 38 c5 44 ce 72 76 29 78 b9 a3 88 3a 7b 07 11 8b 78 e4 9d ee 04 Data Ascii: 0Z2"zA6bp(e"0f`#XVldXX1lak\|c69g1>hxz@9$"@kqY@.h:A!c:7#r\|}F!D8~z@(l\|4 .PJR#l8Drv)x:{x
2025-01-02 05:12:34 UTC	5930	IN	Data Raw: 43 1d c2 50 82 8d 30 c0 c8 4f 0a 1f ce b8 e6 1a 1a 6c b8 cf 45 18 d8 38 66 0b 25 7c 60 43 87 33 a4 90 42 07 1d 88 58 c2 06 2f 94 b8 2f 0c ff 10 0c 23 14 6c 7c 20 32 0c 36 c0 00 a3 07 1f 7a 90 60 3f 0f 27 50 10 0d 34 50 70 e2 b9 ed ac f3 12 8b 2f 77 fb 72 4c 30 b9 2c 93 4c 34 cf 54 13 cd 4c da 74 13 94 4c e0 84 b3 cd 39 df a4 f3 ce 38 ef bc 60 1a 4e fa f4 b3 cf 4f fe 04 54 d0 3f 03 2d 54 50 43 fd 4c ff 74 50 4e 16 25 f4 51 41 5f f1 53 d2 49 ff a4 94 d2 3e 3d e9 53 d2 5a 24 e5 f4 95 4e 39 d1 54 53 49 47 15 15 d4 57 46 45 f5 54 4f 6a f1 24 55 4f 5e 6d 35 56 57 63 b5 f5 56 5c 73 d5 75 94 64 3c 19 05 d7 5f 7d 4d e6 d7 4e 84 1d a5 58 5e 47 49 b6 93 65 8f 75 96 d9 4e a2 7d 56 da 68 ab b5 d6 da 12 8e 2d 01 db 6b 3b d9 36 da 6f bd ad 61 1c 61 ca 15 06 94 72 d1 4d Data Ascii: CP0OlE8f%\|`C3BX//#l\| 26z`?'P4Pp/wrL0,L4TLtL98`NOT?-TPCLtPN%QA_SI>=SZ$N9TSIGWFETOj$UO^m5VWcV\sud<_}MNX^GIeuN}Vh-k;6oaarM
2025-01-02 05:12:34 UTC	7116	IN	Data Raw: 3c 10 7b ec 37 1f 7d fb 11 bd 61 d5 15 63 aa f9 fe bb 3f c7 20 d6 80 0e c4 63 50 43 70 39 b0 90 03 73 09 00 ff 3c f4 82 95 12 cb 00 d1 54 10 04 3c 47 94 10 07 05 2f f8 5c b3 35 a9 84 ff 42 6f cf 6d 92 43 11 c7 08 46 cb 35 87 35 40 84 f1 c8 0b 97 03 fa ca 67 c5 95 2f bd e9 5f ff 1d 2c a1 74 13 8a 3f a4 51 0d 67 54 a3 80 11 30 60 04 12 88 8d 08 60 a3 81 0e c4 c6 37 20 18 41 08 52 b0 82 d8 28 cc 35 20 78 0c 0c 7e a3 30 85 f9 06 2c 38 78 8d cf 90 10 1b 19 7c 20 fb b0 51 0d 13 d2 82 0a a0 01 cd 31 aa 91 42 6c fc af 19 fe 08 c7 ec 72 a8 c3 1d ce 4e 7c d6 40 86 35 b8 81 0c 6e 5c 81 1b c0 b8 02 30 90 81 8c 2b 58 83 89 43 04 22 12 ad f1 43 64 24 f1 87 55 04 22 16 7f a8 c5 2c 2e 71 0a c8 98 c2 15 bc 18 46 6b 4c a1 8c 53 20 e3 15 d2 98 46 33 f2 b0 8d 6e 7c e3 1b 61 Data Ascii: <{7}ac? cPCp9s<T<G/\5BomCF55@g/_,t?QgT0``7 AR(5 x~0,8x\| Q1BlrN\|@5n\0+XC"Cd$U",.qFkLS F3n\|a
2025-01-02 05:12:34 UTC	8302	IN	Data Raw: 3a 28 ca c6 80 01 b6 c0 08 80 40 1c f0 a2 db fa 50 0c 19 60 db 98 6c c9 88 c2 31 16 63 2c a6 81 11 13 a3 1d b2 68 28 0a a0 1d fa 2c 8a dc 81 09 76 a8 c9 88 02 08 36 41 8c 7c cd 04 86 20 34 30 c0 96 5a 64 26 e0 08 8e 72 43 8e ca 85 c8 62 20 3a 1a 6e e1 6e 24 09 8c a0 46 3e 6d 09 96 20 0e 48 20 0e 48 ed 05 2a 88 02 7a f1 59 9c 05 18 74 a4 d0 aa a3 06 9e e4 1a 8e a1 97 4e e9 00 74 c0 01 1c 20 46 04 2e e0 34 23 33 50 e1 d9 3e c0 d7 ff 7e 8d 3a bc e1 18 fa 82 da b8 a2 14 96 60 44 7c 41 1c 81 a0 d6 02 d1 08 8e 20 0d d0 31 47 de e1 08 d0 6d dc d0 cd 1d 73 44 0d 8e 00 9d e8 cd 1e b1 01 09 f0 11 1b be 41 4e e4 44 4b 30 20 44 94 89 3a 58 c0 15 fc a1 df 08 e0 88 12 d2 16 12 00 1a 41 89 46 5e d1 15 15 0e e1 18 ce 15 0d 2e 22 bf 29 22 2b 52 48 82 04 03 0e 40 42 9c 81 Data Ascii: :(@P`l1c,h(,v6A\| 40Zd&rCb :nn$F>m H H*zYtNt F.4#3P>~:`D\|A 1GmsDANDK0 D:XAF^.")"+RH@B
2025-01-02 05:12:34 UTC	3668	IN	Data Raw: af 8a be 86 6b 4b 22 a9 f3 9f 09 ef 10 ca 9c c0 0a 15 00 6d 5d c0 0d 00 e1 4f e0 40 82 02 fb 6c 80 d0 ff 25 e1 42 08 f2 04 3a 6b b1 50 21 04 08 5f 28 26 ec c2 05 87 89 1c de f4 68 2b 18 d2 1f 91 7e 39 72 14 c9 e1 eb 5b a9 6b d7 12 2c d9 82 d2 17 2a 72 de 4a e6 d8 92 e3 c4 2c 4e 3d 7d 2a f3 e7 60 48 86 a1 45 89 1e 3d fa 23 e9 d1 a1 4a 9b 32 cd e0 94 28 2c 7f 0b 3c 71 f2 f4 aa d6 2b 81 45 87 0c 8d 0a d5 a8 54 a9 50 a5 0e a1 ba 60 94 a7 b5 9e d8 ba a5 2a d4 57 06 5f 43 7d 11 9c 9b 77 48 5d bd 74 e9 b2 f0 35 97 c5 a6 21 9b f8 66 60 21 b0 82 bf 04 80 03 f7 f3 c5 e2 d8 b5 c1 80 01 f7 bb e6 af 86 af 7e 97 59 88 83 0c 19 b4 2f d0 a8 3e cf 44 5d c3 9f b2 4e 9d 4a b8 86 dd e9 0e 00 da 21 52 dd c6 9d 2a 04 6d 00 5f 7a db ce ad 9b f7 f0 e0 a9 14 0c e7 7d 1b d7 f2 e5 Data Ascii: kK"m]O@l%B:kP!_(&h+~9r[k,rJ,N=}`HE=#J2(,<q+ETP`W_C}wH]t5!f`!~Y/>D]NJ!Rm_z}
2025-01-02 05:12:34 UTC	10674	IN	Data Raw: 9d dd aa cc d9 0b ae d8 33 1c 58 20 82 22 10 07 3d d0 81 cd fb cc 2c 90 9b b8 21 4d d2 23 4d c3 f4 9c 30 a8 22 d7 7b 3e ee 4a 9d c4 92 4d cb b1 81 da c1 4d f1 ba 9d f3 ba 9d 09 b0 1d 18 98 80 34 54 dc 12 00 ce e2 f1 3e e6 b1 9e f1 43 4e f2 8b dc e5 b1 1e e6 5c 4e ee 19 30 f1 e1 04 56 80 03 eb c4 08 85 50 80 96 23 08 05 20 cf fe 13 08 06 9b 08 fd 09 40 08 d0 b0 2e 98 80 1f 48 a0 93 f0 86 76 2d 88 2d 20 07 99 02 82 f6 6c cf 5f f9 00 33 14 88 6b 60 83 0a f4 06 6f f8 8c 70 21 82 62 d8 5c 4e d0 b9 82 e0 a0 24 6b 95 04 08 a1 0c a0 8a 90 50 06 ac c0 8a 57 70 8b fe 74 57 58 21 05 b7 78 8b 05 38 c3 1f 9a b2 c3 e0 8b af ff 40 d1 c0 f0 8b 25 c4 b2 2f 9b d8 c8 00 2a c8 30 8c 19 a5 42 c8 a8 86 6b a0 95 2f 72 12 13 da 8c 2f d4 c8 05 e2 42 5f 68 57 d0 10 87 31 4c 52 df Data Ascii: 3X "=,!M#M0"{>JMM4T>CN\N0VP# @.Hv-- l_3k`op!b\N$kPWptWX!x8@%/*0Bk/r/B_hW1LR
2025-01-02 05:12:34 UTC	11860	IN	Data Raw: a4 40 2b 57 aa 69 b8 40 07 7e 66 02 02 6b 22 29 61 0c 4c 60 07 12 a1 07 1a 20 23 b1 ff 89 16 cc a1 38 be 21 08 8f c1 15 06 76 60 87 43 1b 80 ee a9 28 26 61 a9 aa e8 5c b2 63 30 f4 c9 40 c6 1f a4 a1 10 a6 c0 14 6c f2 26 57 41 61 ba ea 0a b4 ce eb b2 ca 07 f4 20 01 08 e1 a5 74 c6 11 6a 40 09 78 e6 e4 a0 b2 07 7c 26 01 1a a0 01 12 c0 32 94 46 2b e9 6e 0c a4 06 06 0a 21 2e f8 40 02 f4 ce 0e 92 85 8d e8 c2 0a 10 08 81 be 46 2d d5 32 b3 0e 2f f1 96 16 b3 e4 c6 f1 1e 0f f2 44 cb 2e 39 61 01 90 00 02 ba 80 72 08 27 72 d6 2a 4d 0e c1 71 20 67 03 38 4f 4f ac 81 30 23 87 f4 6c 0b 02 94 80 b7 c0 02 80 18 81 53 d2 84 b8 ee 01 80 7a ab 3a db 96 32 5d 74 0b 16 c0 33 f5 e6 15 78 2f f8 0e e2 34 4b 53 20 04 17 79 0e 82 20 88 0f bc 60 41 34 95 8f bd 20 22 f9 a8 47 22 24 37 Data Ascii: @+Wi@~fk")aL` #8!v`C(&a\c0@l&WAa tj@x\|&2F+n!.@F-2/D.9ar'r*Mq g8OO0#lSz:2]t3x/4KS y `A4 "G"$7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49766	23.224.82.187	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	586	OUT	GET /img/Fky_1300x240.gif HTTP/1.1 Host: ig72.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	1092	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 1775 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83ee23cde0faf-LAX Content-Length: 296725 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:10:57 GMT Etag: "67617e53-48715" Expires: Sat, 01 Feb 2025 04:41:22 GMT Last-Modified: Thu, 02 Jan 2025 05:10:57 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=voJjKKNDAjLrYuShSNIZrATZbbHm1ltnqNur%2FRgwMqMh%2BMF26uyCGKGWsymafVcO%2BNPR137uE236VbQhlQk9zVJpoxrtT%2FFoBsj4vIr4UO56nNcHZBtP%2FYlhoKDu9SSiWQ%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=947&min_rtt=725&rtt_var=50&sent=1006&recv=108&lost=0&retrans=1&sent_bytes=1392172&recv_bytes=4530&delivery_rate=420436058&cwnd=708&unsent_bytes=0&cid=c3364a81f29d4527&ts=24003&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:34 UTC	94	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 00 00 14 64 a5 29 a0 df ff da 24 ff ff b4 f9 b8 b2 fc d6 d5 64 56 a0 9a 56 22 94 32 ff 94 64 aa 18 8d b2 6b 49 20 28 6d d5 b0 ef fe fb d8 f3 fc d1 b6 2a d5 f4 61 98 a8 2f 34 b6 ff ff 6e fc b4 d3 af 91 5c 0b 51 72 51 b3 65 63 56 61 90 f0 ff fd 90 b7 Data Ascii: GIF89ad)$dVV"2dkI (m*a/4n\QrQecVa
2025-01-02 05:12:34 UTC	2372	IN	Data Raw: f2 af 96 5a 1e 19 d6 d4 f7 8c 55 ff 4b d0 f4 a5 dd 9b 63 e5 54 54 26 ae f9 4e 94 fb 6f ae 67 33 cd f2 96 8e fe d4 46 db 74 6b 2e 29 ff fc d8 6f 5a a0 28 0e 28 6f 3e b5 f6 d0 24 12 d6 8d 2b 9f 16 11 6c 45 cb 6d 32 fe f6 d6 8f 6f 67 fb fe 94 d1 f0 8d 77 d8 8d 71 50 2b fe f6 b4 33 90 72 d0 74 f2 fd 2d 9c 6b 90 6f fc d8 d3 d4 6a b7 f6 af dc fb d8 32 69 4d 33 4f b1 8e f9 fd b7 f4 a5 d0 6f 62 cf 95 d6 b1 8f fb 6d 94 d7 b1 d2 b2 6e 44 a7 98 2e 42 f7 ff d8 92 8f 70 6e d2 cf 90 4b cd 76 28 4b 55 fb f7 b3 4c 8e 8b fd 1b 15 1d b0 8f d5 d5 d3 b3 d2 b1 6e b3 b1 d8 d4 b4 b2 b5 91 91 90 b2 d0 3f b6 d5 b6 b2 f3 b6 b1 b2 58 27 ce 8c 4a 45 f5 b2 6e d3 69 57 d6 d3 8f 90 90 d4 d4 b2 f9 b3 d3 d5 3e 8f f2 8a 6d 40 70 8c d6 90 b5 f4 b0 91 b0 ef 4a 71 ad 73 cd f0 94 28 d4 6d 0e Data Ascii: ZUKcTT&Nog3Ftk.)oZ((o>$+lEm2ogwqP+3rt-koj2iM3OobmnD.BpnKv(KULn?X'JEniW>m@pJqs(m
2025-01-02 05:12:34 UTC	538	IN	Data Raw: 68 a1 8d 32 da 27 a3 91 e6 e9 e7 a1 80 66 6a a8 9e 97 76 7a 27 9c 68 8e d9 66 9a 60 92 39 a5 9b 51 82 e9 01 98 ac 8a 6a 66 9e ab 9e ff 59 66 ac af 86 ba 0b a8 b0 f2 b9 ea ab 6d d2 da 66 99 bb 00 6b 26 9f c1 a2 49 ec a7 77 de ba 68 b2 80 26 bb ec b3 ce 46 0b 2d 2f bd f8 39 cd 9d d5 ee 72 2d b5 dc 56 eb 6d b7 e0 7e 2b 6e b8 e4 8e fb ed 34 e3 06 ab 6a ac ac b6 ea 6e 94 6e f6 00 88 0e f4 26 d0 86 0e 6d dc 9b ef be fc f6 9b c0 bf 09 00 12 30 20 31 14 6c f0 c1 25 1c ac f0 c2 0c 37 bc 70 c2 0e 47 5c b0 21 86 dc 71 07 c5 2b ac a0 43 02 1b 6f ec 84 c0 15 df 41 05 15 14 5f 6c f1 c9 16 53 81 f2 c9 14 b7 ec f2 cb 30 c7 fc 32 0f 16 dc 31 90 40 00 28 c4 c3 42 11 20 14 41 43 3c 5c f0 90 44 14 19 41 11 48 1c 35 60 34 4b 26 a5 24 d2 49 2a d1 42 92 d4 2b 41 dd 92 11 30 a5 Data Ascii: h2'fjvz'hf`9QjfYfmfk&Iwh&F-/9r-Vm~+n4jnn&m0 1l%7pG\!q+CoA_lS021@(B AC<\DAH5`4K&$I*B+A0
2025-01-02 05:12:34 UTC	4744	IN	Data Raw: 3c 83 18 0e 32 51 dd 32 00 a3 62 b4 48 17 2f aa 91 8b ff 84 28 a4 20 cd c8 47 48 2c d2 8f 76 54 a4 ec fc e8 89 44 8a 62 14 11 a1 a4 29 d0 c1 8a 56 54 43 fc ac 21 3f 44 4c a9 07 58 02 a3 07 c4 28 c6 2e 49 09 55 5a 72 53 ab ec 14 25 36 c9 ea 4c b5 12 d3 99 42 45 c7 34 c6 8a 8d 9f f2 53 9d d0 94 26 36 e2 89 8f a5 02 d6 9b 8c 25 aa 42 aa 69 90 7a d4 23 1b 27 55 aa 3d 16 ca 55 90 bc d4 9b d8 44 49 4b 05 32 4e c6 52 e4 a5 12 25 28 63 f9 f1 56 84 94 d5 3a 1a 19 c8 39 d6 6a 5d 5a c2 a3 9d 82 45 26 52 9e 69 94 ab 82 95 9f 72 45 a6 57 2d 0a 4e c7 fa a4 9b 56 e9 81 51 26 12 96 c5 f2 63 ae f2 74 ab 60 c9 89 95 c1 f2 e5 28 8f c5 4c 40 f5 42 5b d0 e4 56 34 b3 75 ad 6d 4d b3 5c d8 f4 56 35 cd 15 ae 6d 76 ab 9a bb c8 16 bb c6 59 ac 72 f6 72 17 3d 58 87 0e 00 d1 83 5b e0 Data Ascii: <2Q2bH/( GH,vTDb)VTC!?DLX(.IUZrS%6LBE4S&6%Biz#'U=UDIK2NR%(cV:9j]ZE&RirEW-NVQ&ct`(L@B[V4umM\V5mvYrr=X[
2025-01-02 05:12:34 UTC	5930	IN	Data Raw: 0a 9d 7b 4f bf 07 6f 1b 2e 03 db e0 83 0f 9c 0b b3 81 ce 3a 6b 9a fb e5 98 63 5e 3c 26 1b eb 60 b4 d1 c6 61 6c 94 f1 18 70 8a d1 d1 46 1f 6f 94 d1 9a 17 7f 58 24 88 20 fa 80 23 08 56 42 61 92 49 38 58 11 44 90 11 a8 ac 52 8c 55 7c a9 46 19 5f b8 e4 32 9f 6a aa 99 60 82 65 84 f9 e6 81 43 e0 80 43 10 54 1e 39 84 04 12 0a 29 24 ce 42 16 d1 a0 86 45 6a d0 b3 95 56 28 a0 a0 86 42 6a e8 93 4f 3e 29 28 83 08 07 0a 25 ff 82 82 56 88 58 94 d1 24 92 21 06 1a 62 1a c8 c6 9a 4b 33 b5 06 c6 4d 3b 3d 66 d3 4f 43 3d e6 03 4e 47 35 95 54 54 6f 54 75 55 70 8e 99 62 88 1e 60 1d e2 d5 1e e6 99 e7 9c 5b 6f 9d 82 0e 3a 7a e0 d5 d7 5e 79 3d c5 d7 1e 86 fd b5 d8 62 3d e8 c1 83 53 94 f5 60 1d 0f a2 95 56 5a 68 a7 9d 16 5a 72 a6 dd 25 da 6c b7 9d 36 5b 0f bc 05 97 5b 0f 78 29 d7 Data Ascii: {Oo.:kc^<&`alpFoX$ #VBaI8XDRU\|F_2j`eCCT9)$BEjV(BjO>)(%VX$!bK3M;=fOC=NG5TToTuUpb`[o:z^y=b=S`VZhZr%l6[[x)
2025-01-02 05:12:34 UTC	7116	IN	Data Raw: 64 d8 5f 27 99 b3 52 4b c5 b8 04 d3 4c 1f fc 52 53 0b bf b4 b0 67 31 5c 5c b0 53 3b 47 15 55 54 34 0f 3c 40 80 f1 c9 1f ff 80 0f 05 98 a1 94 53 5b 44 25 95 57 5c 75 b5 7d 57 db 64 e5 bd ea 62 a9 ae 11 5c 69 b5 de 3a 3a e4 a7 e5 96 59 6a 99 15 9a 6f be ed a6 57 61 86 21 46 d2 62 7b e9 75 ff 0e 61 8e 45 86 d2 6f 66 77 99 87 0c 83 39 ba f8 1f 49 40 03 1a fd 99 e4 3a 98 99 c7 69 72 71 9b 94 a0 e7 35 b3 89 09 6d 90 53 1c e2 c4 6e 30 89 79 48 7c 4c 72 92 e1 0c f0 35 b6 89 8e 06 5d f2 1c f2 a0 e6 35 28 1c c6 6f 2e d3 1c e4 90 47 3d cf a1 21 72 c2 83 43 ed e8 70 85 38 1c 60 36 1c 32 9e 18 ce 2f 30 fb 03 21 60 86 38 1e cc cc c6 1a 18 7c 8e 35 86 11 45 05 19 a8 36 55 44 50 6c 74 b1 a0 03 01 68 43 b4 39 50 4c a6 58 27 0d 69 a8 4e 32 a1 d3 31 7e 50 05 1f a9 e8 44 28 Data Ascii: d_'RKLRSg1\\S;GUT4<@S[D%W\u}Wdb\i::YjoWa!Fb{uaEofw9I@:irq5mSn0yH\|Lr5]5(o.G=!rCp8`62/0!`8\|5E6UDPlthC9PLX'iN21~PD(
2025-01-02 05:12:34 UTC	8302	IN	Data Raw: 8f ae c8 8a 92 e1 8f 5e 84 08 62 84 90 6c 04 d4 10 69 47 18 c9 51 7e e4 50 1e 29 49 9a 64 93 2a 49 92 22 89 49 82 49 49 62 6d 4c 50 09 d7 ee c4 96 54 09 4e 52 69 4e cc 24 4e 80 09 50 ea c4 d7 bc c4 96 02 45 97 06 25 97 f0 04 50 66 e9 96 f2 04 4f e0 44 d7 1e d1 da 5e f1 d4 1a 69 91 98 89 db 98 e9 14 50 aa a2 a6 09 e2 e2 2d e4 78 51 e4 7e 11 18 db cd e2 86 b1 17 2b 2e e4 96 41 0b 98 45 e3 a2 c5 9e 3a ae 5a 52 8e 18 7d f1 18 83 91 1a 13 2e 1a ff 89 f1 17 af 81 e5 22 0a 5d f0 49 dc 8a 71 1a 85 11 1c a1 b1 1a a9 91 17 a1 f1 1c 89 d1 a1 00 2e e0 5c 0e 53 56 aa 1b 63 ae 04 0c a0 e6 66 ca 02 70 2a 06 fa 20 e7 5e 0e 5f 00 86 0a 22 00 13 5e 46 01 22 60 18 72 21 1b 34 01 0c 40 22 21 17 12 e9 8c 2a e9 aa ce a8 94 ee e8 16 e0 e8 2a 60 eb b6 4e eb 36 c6 08 b2 4e ac 0c Data Ascii: ^bliGQ~P)IdI"IIIbmLPTNRiN$NPE%PfOD^iP-xQ~+.AE:ZR}."]Iq.\SVcfp ^_"^F"`r!4@"!**`N6N
2025-01-02 05:12:34 UTC	3672	IN	Data Raw: a9 60 18 94 57 5c b5 42 b2 d2 5c 96 88 21 18 a9 2d 5d 76 0e 03 82 61 3e f4 ff 17 00 91 2a 51 04 39 5c e4 c8 f9 81 ff e9 18 b8 61 d9 74 65 1b f6 10 5c 04 34 0b 2a 2e a8 60 4f 98 38 65 ca 38 72 f4 d8 51 9c af 55 17 17 9c 5c 80 c1 e2 4a 95 15 31 54 44 33 e0 5a 48 9a 1d 69 56 73 89 32 a5 c5 81 e0 20 46 64 c8 b0 e1 af 63 72 12 ed cc 99 14 e9 d2 96 4c 59 ae 54 aa b4 a9 4a aa 68 22 c9 39 a6 e9 64 85 01 cb 44 7e b5 09 32 ec d7 91 93 4e aa cc e8 15 e4 5a 65 d5 56 e9 84 6b 51 a3 d8 90 1c 49 c6 45 a9 f2 ca 80 09 60 43 56 38 89 66 2e d8 6a 4b 76 2e 18 33 40 dc c7 90 6e 51 72 bd 46 d7 a3 2f c3 27 2b 61 9b c9 56 59 be ca 28 23 59 3b 06 1a f4 30 d0 e0 ac fd 12 8d 3a f4 b1 79 44 5c 97 21 e2 20 36 91 56 a0 1e 3d 12 04 27 48 10 38 ac 04 8d 10 74 68 04 6e 36 82 04 3d 1a 01 Data Ascii: `W\B\!-]va>Q9\ate\4.`O8e8rQU\J1TD3ZHiVs2 FdcrLYTJh"9dD~2NZeVkQIE`CV8f.jKv.3@nQrF/'+aVY(#Y;0:yD\! 6V='H8thn6=
2025-01-02 05:12:34 UTC	10674	IN	Data Raw: 5a ae ad ca aa 94 3d b1 8d 00 af 25 5b b3 25 88 ae fd 5a 4d 60 5b b6 dd 82 b6 85 db ad bd da e7 91 83 96 c8 1f ff 2b 20 11 b4 88 fd f1 9d a5 95 c0 f1 04 5c 06 f3 20 10 42 b0 e5 e3 ae 65 10 86 c4 4d 39 9b 58 06 7b f0 4e 7b 58 dc c0 1d 4f 5f e8 04 b8 c0 00 85 b0 06 24 2b a1 14 0c a1 d2 11 8d d6 98 8d 17 24 02 12 c0 4f de 80 50 dc b8 8d 1c cc 8d 2f 43 85 30 fb c1 31 a3 0e 0d 40 42 25 6a 0e 18 a2 00 54 60 c2 26 84 03 28 fc 03 29 bc 33 29 aa c2 2c a0 8f e1 d5 8f 3f 13 b4 11 fd 42 31 04 a3 31 34 d1 34 92 23 1a 2d 00 fd 68 51 18 7d 10 3a 2a 90 71 a0 51 77 e0 a3 6e 38 9f 63 40 04 8b 19 b5 29 28 35 9f 30 11 50 eb 01 3a ff 38 5f 56 73 24 42 2c d2 2a 68 83 2a 20 d9 25 81 06 50 3a 92 5b e0 35 29 c5 5f 7f 18 d3 12 b0 52 72 28 b6 18 38 36 5d 59 17 2d 89 5f 20 69 36 2d Data Ascii: Z=%[%ZM`[+ \ BeM9X{N{XO_$+$OP/C01@B%jT`&()3),?B1144#-hQ}:qQwn8c@)(50P:8_Vs$B,h* %P:[5)_Rr(86]Y-_ i6-
2025-01-02 05:12:34 UTC	11860	IN	Data Raw: d0 75 e3 38 46 58 37 ca 1c f1 31 5e c1 51 1b 31 92 26 c5 ea 1d 9f 86 ee ac 41 ef ac ff 01 af fa 75 6a 8a 21 28 fb ce b2 0a cb b0 40 a1 06 50 a1 6c 08 af 6c ca e6 b1 22 8b 2b f9 46 03 32 8f 02 0a a1 6e da e6 2a fb 86 6f 28 8f 08 0a e0 70 0e c7 2c 0f 81 f3 e0 80 0f ce 66 b5 de 72 0f 50 60 64 fd 60 65 f9 60 71 28 01 0e 16 69 72 aa 44 74 9e 84 74 6c 96 00 7e eb 2f 61 8f 74 74 6b b7 76 eb 45 08 c2 47 9e 61 22 2c 62 b2 fc e6 76 2c 69 f8 1a c2 32 71 e9 4c ac 6b 69 43 22 19 ba 01 1a b6 c1 33 cb 4b 34 b1 b6 fe 92 53 28 52 73 28 da 80 c3 e0 82 c3 62 33 2b ee 2c 37 33 10 39 83 a2 bd 56 33 28 ee 27 3b e9 6f 3b e7 6b bf 4a 00 0b e8 16 0b e6 e2 bf 72 ec bf ec b6 6e e9 16 1a d4 96 6b ff ab 0b f8 b6 0a bc b3 6b 83 33 6d 05 b7 6e ab 80 6e 9f c1 3c d3 f6 bd e8 76 71 db 36 Data Ascii: u8FX71^Q1&Auj!(@Pll"+F2n*o(p,frP`d`e`q(irDttl~/attkvEGa",bv,i2qLkiC"3K4S(Rs(b3+,739V3(';o;kJrnkk3mnn<vq6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49762	99.86.4.79	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	631	OUT	GET /media/dd9a87_67f016f8ae5948e4a82fbfedd1ad400a~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	764	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 267600 Connection: close Server: openresty/1.27.1.1 Date: Wed, 01 Jan 2025 14:29:08 GMT Expires: Wed, 01 Jan 2025 15:29:08 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Thu, 28 Nov 2024 18:00:55 GMT ETag: "255d2547f187ffe25a9feef511734f25" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-7bh25 Via: 1.1 google, 1.1 d5fb859c39a16d7f218b4c7fb1528ad6.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: -Lqy3wSbWMTE-vavOtstAhPZTdIPV5vfHjnZn8Kb3ZJydW3aGTctIQ== Age: 53006
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 10 10 08 ff ff ff a8 83 77 52 48 48 96 79 88 05 04 03 4e 33 46 a7 78 69 0d 68 69 d6 00 29 8b 28 12 06 9e 9f db fa fb 00 ff ff dc b9 a9 a5 87 8a ff 66 27 9a 87 97 a5 6d 52 8b 52 4a 60 43 37 8f 64 55 ef 00 4a f7 ac e3 fd d5 dc e9 cc bb f6 6b 8c 97 75 79 a5 94 a6 ef 17 bd b6 ac b0 69 fe fd 6b 36 32 cf ce d0 6a 08 12 46 01 31 4e 09 0e 99 86 8a a5 8b 99 87 66 69 f7 b1 be 8b 6a 75 93 4f 35 c8 9a 8b 88 76 79 f0 52 76 c9 a7 99 75 56 66 00 cf d4 b9 97 89 25 15 15 25 13 24 f4 19 ca 45 26 35 46 37 36 78 21 0e 76 68 67 97 76 69 9c 98 9a 2d 21 17 63 57 56 68 46 46 27 02 21 17 09 22 34 27 26 22 02 18 74 70 8b 8e 97 a5 92 03 2b 78 56 56 a8 97 98 8a 78 85 55 34 36 3c 2d 48 33 16 25 f5 6c d2 37 34 34 67 45 55 27 24 24 75 48 55 78 46 Data Ascii: GIF89awRHHyN3Fxihi)(f'mRRJ`C7dUJkuyik62jF1NfijuO5vyRvuVf%%$E&5F76x!vhgvi-!cWVhFF'!"4'&"tp+xVVxU46<-H3%l744gEU'$$uHUxF
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: af 46 10 c5 d6 8c 57 4e 9c bc 9a 61 6b d5 aa 31 ab 7e 90 4a 62 3f c9 30 fc e1 0c 0c eb df 3f 89 29 1c 08 c8 81 09 04 12 68 c2 03 09 0a b0 a0 00 fc 08 70 00 3f 11 f2 23 81 04 65 f0 67 4d 7e af bc 62 df 7f 7e f8 d1 de 0c 33 f8 90 1e 09 35 80 70 c5 13 4f 10 b2 62 1d e6 d4 f1 62 1d 12 1c f0 22 85 12 d4 b1 01 1d 1b 08 60 8e 00 74 4c a8 c2 2d 41 4a 70 cb 90 b7 a8 a0 c7 14 ae f8 f0 43 29 a5 68 a1 04 18 35 50 a2 47 16 5a 64 a1 47 19 ac a4 b0 65 0a 47 10 40 80 97 61 7e f9 ff a5 98 64 8e e9 e5 98 69 82 09 e6 06 5e 9a b2 66 98 6d 12 60 ca 06 60 1e b1 41 0a 70 bc b0 e7 0b 84 e8 89 c3 09 2f 04 aa e7 09 70 9c 50 68 0a a6 28 1a 66 09 90 44 f0 28 a4 11 18 c8 41 04 05 4a 6a 82 09 11 24 58 69 a5 99 7a ea 29 a7 99 86 1a 6a a6 0f 70 fa a8 a8 a6 6e 9a 60 09 25 3c 00 c9 03 ae Data Ascii: FWNak1~Jb?0?)hp?#egM~b~35pObb"`tL-AJpC)h5PGZdGeG@a~di^fm``Ap/pPh(fD(AJj$Xiz)jpn`%<
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 83 1a 03 10 26 48 21 87 24 b2 48 23 7f fc 20 c6 05 42 0c f0 3c 12 5a 7c 64 46 35 18 fc b1 4a 2b 97 eb 22 46 18 74 c4 0f c2 2e 2f 3b 91 13 33 b0 68 01 85 2b 69 bc b1 81 4e 30 74 10 3f 30 bf f4 32 ce 2d 88 68 d1 47 ff 18 88 d1 17 39 f7 84 b3 4f 08 5b b4 60 c6 18 1b c0 ec 3b 4e d8 0c d1 9f 16 31 90 a6 bf 24 1b a0 63 d1 fe f0 6c c0 17 3a 2d b0 13 be 47 17 c0 a2 45 e5 fa 1b d4 4d 51 4b 24 15 99 28 a0 19 d4 97 41 1b 98 24 8a 49 54 cd 13 81 28 a2 40 94 99 28 d2 e8 24 cf ff 4e 10 c8 64 d5 4a 57 85 75 d6 f3 a6 89 02 01 63 8f 45 40 b8 54 7d 65 16 58 67 61 cd 33 cf 59 75 64 06 19 62 67 4d d6 d9 65 17 88 42 9c 28 60 85 d6 d7 70 9b f5 05 06 6c 17 80 c1 97 71 97 25 37 c6 49 d2 b8 75 01 75 9b 25 97 db 01 20 09 84 2f c9 f6 15 0b ad af 04 f8 2a 60 81 4d 08 f8 8e 07 ee f0 Data Ascii: &H!$H# B<Z\|dF5J+"Ft./;3h+iN0t?02-hG9O[`;N1$cl:-GEMQK$(A$IT(@($NdJWucE@T}eXga3YudbgMeB(`plq%7Iuu% /*`M
2025-01-02 05:12:34 UTC	15137	IN	Data Raw: 27 50 6a 4a 0a 97 9a a2 e9 a6 9b b2 60 ca 11 9f 62 6a ca 06 9a b2 92 c2 0b 2f 34 91 84 14 ac fa 21 85 12 b0 ce 30 83 2d 3f 38 71 05 a5 29 a4 70 42 6a 87 6d 21 4d 38 05 14 f0 cd 18 8a 8c 61 6c b1 c5 32 32 06 23 cc 36 cb 48 10 d0 06 e1 c3 b4 d4 fa 00 c6 b5 d8 82 f1 cb b5 3e 04 b1 cc 32 3e 60 62 8d 39 f7 7c f2 49 3f a6 58 53 83 0f df 0c fb 2c b4 dd 42 fb ac b3 cc 2a c2 08 b2 c4 1a 3b 45 01 5b 08 a4 d9 16 2e c1 44 16 47 2f 5d 04 03 5f 00 30 03 91 25 0a 2b bc 30 c3 96 ff 58 74 51 03 e8 94 c6 cc 02 05 33 55 14 62 a5 3d 86 97 c4 30 35 14 99 5e 08 44 d5 00 3e 79 81 3c b1 2f 23 7f 6c 32 3e ab c5 dc 2b 59 7f a5 a5 9a 5f b0 01 e6 da c0 54 a9 44 1a ce 35 ef 3c 90 61 32 ff 7b 55 69 2c 7d d6 d7 65 a4 25 5d 10 af 45 43 0d f4 d1 4a 77 bc d2 4c 48 2d 46 f3 62 6b e5 8c 56 Data Ascii: 'PjJ`bj/4!0-?8q)pBjm!M8al22#6H>2>`b9\|I?XS,B*;E[.DG/]_0%+0XtQ3Ub=05^D>y</#l2>+Y_TD5<a2{Ui,}e%]ECJwLH-FbkV
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 90 8b 49 cf 1e 91 05 80 ed c9 d2 28 7d ef f8 82 e4 4f 8a 2f 28 d5 64 96 79 52 b8 b0 a4 fa 2a 39 ba c4 04 06 bc 6f 49 8a cb 90 85 79 4b 8b 0d 92 49 64 68 ce 74 ca 88 9f 17 f0 c1 b4 1e c5 01 33 35 4c 08 f0 c1 f0 1a 4c 64 cc 23 7c 81 17 a4 83 05 44 d9 fc 29 45 9c 55 f0 2e 0d 5a c9 9c 0c 3d 09 5a ac 12 5a 0b 07 9b 4e ac da 48 5c cd 5f 96 6b 34 00 c0 57 c0 75 00 38 c3 00 ff 84 80 b3 1c 7a a9 79 00 61 ca 0a 5c 87 80 06 e6 49 09 a3 0d a9 99 f0 47 05 b1 d9 0c b1 ec 22 8a 11 3e 85 2a ac 36 16 40 f1 51 74 15 65 23 55 16 4f ac c7 a6 73 18 23 85 b1 79 ca 50 c9 da b3 dd ba 52 30 71 17 4f 43 b1 9f f6 69 6b e9 16 2c e7 b0 0b d5 4e c8 71 77 ae 66 62 43 f1 62 38 81 37 20 c3 b5 cb 80 b6 6b bb b5 47 01 56 4d 61 0d b0 a1 d0 b6 0e bb 75 06 5a b5 a7 2b cc 80 14 80 88 ea 8c 48 Data Ascii: I(}O/(dyR9oIyKIdht35LLd#\|D)EU.Z=ZZNH\_k4Wu8zya\IG">6@Qte#UOs#yPR0qOCik,NqwfbCb87 kGVMauZ+H
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 68 3c ce 44 f7 b8 a0 b2 10 a0 fd 91 f2 d4 91 1e e9 91 59 0a 2d f6 64 12 ed 66 9a eb ce 62 8f ec 55 2c 79 ad b9 53 1d ba 23 05 1b 00 02 cd 1d e3 96 ee 1d 2f ec ad 62 92 45 dc d9 a0 66 b2 05 45 98 56 65 45 37 21 65 17 42 89 09 41 61 2e 56 40 94 13 20 76 a2 76 bc 46 b1 5d 5c 93 c3 5e a3 83 5f 4b a7 df 0d b6 13 f0 c2 a8 56 a6 de 09 a6 65 a2 17 a8 98 01 a3 a0 9f d4 e3 6a ff b1 cc 13 60 99 81 20 90 81 86 78 16 b3 d4 de a8 d8 81 10 62 77 31 f0 e4 1a 10 71 b4 96 70 51 4e f1 0c ca 16 4a 48 82 9e 50 a6 39 49 58 04 e5 77 85 dd 89 9e 10 5d 38 89 13 eb cb f1 59 6c 93 5b 86 eb fc fd 20 8a f0 f1 85 5a cb 72 3f ec e5 3e d3 91 23 f4 83 d3 db 09 fe c0 52 ad c6 1d 5b e2 52 b5 b3 e2 ac ce b4 7b 68 62 ae ba cc 06 ed e7 bc c6 73 fc 38 f9 a3 40 2f d3 b3 3b ff 60 d5 5e ed 29 67 Data Ascii: h<DY-dfbU,yS#/bEfEVeE7!eBAa.V@ vvF]\^_KVej` xbw1qpQNJHP9IXw]8Yl[ Zr?>#R[R{hbs8@/;`^)g
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 99 34 89 23 1b 9e 1f 0d 51 7e 58 77 09 b3 0d 02 46 ff 87 4c 63 76 89 4d 0e 51 b6 02 a7 7f 8c 14 0b ae 4d 96 80 60 7d 73 63 a1 fe a5 9e 0b 0b 73 50 5b 20 f7 9c 7e 8b 81 23 02 71 4d 22 0a 29 90 24 72 66 b8 1d 11 c4 a1 84 7f 1c 01 12 81 a8 29 1d 1b 52 02 16 b1 e8 8e da b6 3a f4 a3 2f fd e9 bb e4 dc e6 96 eb 2d bb 6e 12 f1 ba 9b bd 38 19 5f 34 00 40 0e 72 0c 06 5e f9 25 df 16 72 66 ef 9d 31 2d ad a2 f0 e2 3f 5a 10 d6 27 f5 8f 91 8a d4 a7 a1 ce 0c 03 eb 33 d2 24 58 bb fc d3 e4 c7 3f a0 40 4f 0c 5e 03 2c 1c c1 79 15 ad 44 5c da 30 de aa 10 91 88 6d 07 c6 61 18 78 d0 8d af 94 58 a4 3d 9c 49 a0 d5 3f 00 08 72 55 06 61 9c c7 09 05 06 aa ad 47 29 dc ce e6 cd de 4b c5 1a 6f 21 4e b7 68 d4 7f 5c 8e 2a 88 43 29 b8 07 b8 34 42 cd 21 88 c0 25 9e ff 75 a0 cf 39 50 63 29 Data Ascii: 4#Q~XwFLcvMQM`}scsP[ ~#qM")$rf)R:/-n8_4@r^%rf1-?Z'3$X?@O^,yD\0maxX=I?rUaG)Ko!Nh\*C)4B!%u9Pc)
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 3b 3c b0 1e b3 e5 67 fd 77 8f 46 1e ad 35 f7 c5 9e ff 74 47 73 ea 93 25 31 8b 21 4a 95 3a 1d 75 a8 8f ba 9d 35 e8 54 44 46 33 59 cb 8a 66 53 ff 00 bb 8d 58 05 96 60 a1 1c 8b 08 53 b0 9b 0d 90 88 d6 f2 1b 6d d3 88 dd 30 ad c2 21 bd 09 a4 40 dc 61 17 7e 7b 13 7c 13 ab 75 b3 0e c8 c9 34 d5 49 be 78 c3 b3 36 fb bc 87 32 23 ca 89 16 fc 90 b7 2f f3 aa 33 ba b0 f8 68 9c ec 1b 41 dc 6a 9d 30 42 b8 1b 4c b8 59 aa c0 78 71 b8 1d bc 97 88 fb 87 aa 93 8e 87 d0 05 8a 19 3e 63 b0 bd 8f b1 80 47 f8 91 8f 6b 81 00 18 1e 26 cc 1e 0c 70 aa 92 b3 80 1c d1 80 2c cc c2 8f 73 1e 63 68 a4 ee 21 2f 91 a1 10 00 7b b9 85 93 b2 96 c8 8b c4 5a 8c c6 90 9a a5 c0 20 54 03 94 03 02 ac f3 93 0a be 18 97 d1 93 88 f7 88 b0 47 d1 28 00 9b 25 38 82 2b ef 13 16 da 49 1a 0e 13 b5 e8 e3 13 c2 Data Ascii: ;<gwF5tGs%1!J:u5TDF3YfSX`Sm0!@a~{\|u4Ix62#/3hAj0BLYxq>cGk&p,sch!/{Z TG(%8+I
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 84 06 68 80 4c 00 44 1b 9b 2b 72 30 83 7f 68 85 00 f8 07 7a 60 80 2e e8 82 72 80 81 49 40 00 32 1c 43 53 8c 42 4e f0 07 55 c4 80 2f c0 00 06 78 45 58 84 c5 2e f0 05 5f 98 84 53 9c 42 72 a8 c3 3b 54 c3 3d 54 03 67 08 45 18 40 00 64 02 bd b8 e2 ab 61 1c 12 02 b9 11 9b 61 b7 1d 93 19 c2 42 ac d5 8b c6 20 8b 91 9b 99 bd 24 91 ac 87 f8 19 6e aa a0 a9 61 02 4b f8 bd 3f 18 89 b0 73 09 e2 a3 16 84 9b 8a 6e b9 9d d8 a8 09 9b 08 07 9f da 83 d6 f2 89 7b 4a 83 01 58 83 1b ca a1 3d 08 07 26 c8 04 9b a8 c7 de 1a 0c ac 30 84 0a b8 85 2c b0 14 2d f0 04 3b bb 33 20 28 83 15 c0 83 03 c0 83 50 e1 0a e7 6a 22 0a d8 2e 41 2b 03 ff bc 28 03 4c b1 14 4c 99 39 9d 63 0b 90 ac 88 4d 50 40 91 b0 ba 67 91 1d d7 c8 8d 62 79 17 c9 d0 81 4f 8b 16 a1 72 09 c7 18 0d d2 38 35 d0 e8 ba 23 Data Ascii: hLD+r0hz`.rI@2CSBNU/xEX._SBr;T=TgE@daaB $naK?sn{JX=&0,-;3 (Pj".A+(LL9cMP@gbyOr85#
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: b8 25 06 a2 12 0a 74 2b 4d c5 54 df 58 11 1e 04 13 44 92 06 db d8 8d 86 86 0f b2 67 68 57 92 2d 30 94 7c a7 d6 13 aa b6 6a 39 f4 57 e7 f1 6a 38 d0 07 54 71 7d 86 b5 15 46 54 2f 49 f4 58 01 99 2f 67 d1 44 04 b9 2f 73 e1 01 48 10 46 14 20 08 ed b7 03 82 20 03 5e 64 08 8d b0 09 15 70 7f 95 71 7f 66 24 01 2a b0 7f 79 a0 46 13 70 0b db 26 01 75 30 92 e3 86 04 9e 50 00 df f0 0d a5 91 80 51 80 1a 0e 68 1c d8 35 48 8a 14 81 c2 95 33 32 73 81 3b a3 07 8b 34 1d 3f 23 07 1c 98 6f 13 e8 81 90 04 82 d0 d1 19 28 18 35 dd 21 5e d2 a7 35 54 d1 07 a6 e4 70 52 73 5e 36 60 14 a9 64 71 98 44 01 19 f7 07 00 d2 71 1b b0 07 0f 70 ff 84 61 29 96 63 39 4c 26 17 73 4d 18 4d 30 c0 0c 84 c8 05 25 92 0b 33 17 23 c2 70 79 da 30 28 54 c8 4d 3a e7 4d cd a3 4f b8 f3 73 e9 00 62 fe 35 86 Data Ascii: %t+MTXDghW-0\|j9Wj8Tq}FT/IX/gD/sHF ^dpqf$*yFp&u0PQh5H32s;4?#o(5!^5TpRs^6`dqDqpa)c9L&sMM0%3#py0(TM:MOsb5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49770	23.224.82.187	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	587	OUT	GET /img/GYyh_1300x240.gif HTTP/1.1 Host: ig32.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	1082	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 5236 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83e838bd5f7cf-LAX Content-Length: 510915 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:10:42 GMT Etag: "67700bb2-7cbc3" Expires: Sat, 01 Feb 2025 03:43:26 GMT Last-Modified: Thu, 02 Jan 2025 05:10:42 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R32eRPa7TgouhQukKuPZH7BB45gKyDCimQsJuytTiMMwqRcbkWoO7kwkm4vDU5VVA5zfkKgu%2BzQj7DQStCuF%2FqRsCflvoO2a58WGmWc6r3iLgrOrSlrqjrZd6WXm7unwsw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=883&min_rtt=739&rtt_var=45&sent=347&recv=38&lost=0&retrans=0&sent_bytes=487017&recv_bytes=3529&delivery_rate=320863636&cwnd=412&unsent_bytes=0&cid=3e24dfef123ab61c&ts=8613&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:34 UTC	104	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 e6 00 00 59 10 01 66 76 b5 9f 1b 02 f1 25 15 fd c3 22 fd e8 80 f5 62 14 db b4 97 b6 6e 6c f2 dd cf 90 70 6e 2a 06 69 8f 88 94 dd ff fc 8b 75 8d dd cf c0 d7 72 47 cf 72 68 ba 44 44 4c 20 70 b9 4c 2d 74 5e 58 f9 6f 40 20 04 05 f8 71 64 b6 72 4f 88 88 cc d4 f0 d4 c3 aa 87 b8 b0 d0 bb Data Ascii: GIF89aYfv%"bnlpn*iurGrhDDL pL-t^Xo@ qdrO
2025-01-02 05:12:34 UTC	2372	IN	Data Raw: 42 04 77 88 b9 d9 db ee ac 77 84 aa 91 af 83 76 ad 6d 3a 1f 93 67 53 8f 40 2f 90 aa d2 c4 6a 28 ba ae b1 b9 33 39 cf bb c6 bf 82 04 97 52 42 8c 41 05 be cc e9 ff 30 35 55 81 d6 94 6d 01 8e aa b3 b4 99 c9 97 b6 e7 97 6a 2f ab bb e2 9a ab 8a cc 55 66 f5 8b 7a ff 55 66 ee dd ee cb cc ad 76 4d 6f cc 44 44 66 88 dd ff 44 3a ff 44 55 ff 55 55 dd 55 55 88 88 aa a8 9a 82 ee 55 55 ee ff ff 77 86 cc 77 99 ca ff ff ee ff ee dd 88 88 bb 78 99 dd cc 55 55 66 80 cc ff ff b8 99 88 aa a6 88 72 ff ff dd bd 88 74 88 99 c3 88 99 a6 aa 88 99 99 88 bb ff ee ee c5 99 75 ff 55 3c bf 99 9a ec ee ee 99 99 bd bb 55 5e eb ee ff dd 55 43 ee ee dd dd 43 44 ff ee c3 ca 55 3d 77 88 dd bb 88 99 aa 99 99 ff ee ff 66 99 dd ee ff ee 99 99 a7 77 aa cc ee ee c8 e0 ff dd eb ff c2 ee 44 33 66 Data Ascii: Bwwvm:gS@/j(39RBA05Umj/UfzUfvMoDDfD:DUUUUUUUwwxUUfrtuU<U^UCCDU=wfwD3f
2025-01-02 05:12:34 UTC	538	IN	Data Raw: 74 0b 4d 74 d3 e8 b4 57 c0 c6 08 44 2e f9 e4 46 da c0 b8 36 02 17 20 8e 17 1c 48 4d 24 00 d7 c8 3a 2b d2 5a 2f 9c c0 12 63 7c 0d 76 d8 63 4f ec e5 42 44 b6 20 7b 40 09 70 a0 76 db b8 e7 3e f7 ee bc 27 3e ad db be db ad 32 ca 5f 74 70 c3 0b 20 24 ef c5 f2 3c 24 ff c2 f1 56 64 97 77 53 c5 1f af 3c f3 cc 3f 6f 7c f4 d3 93 55 83 f5 d7 67 ef fc ff 09 4e 00 6e 7e df e7 ff 9d be e0 ec 13 8e ed e1 f0 23 1e 3c 9e 43 33 7d b9 36 48 ff 3e f9 fe 83 8d c6 78 05 ab d2 1c 91 e6 e1 39 d0 61 83 04 28 b0 c0 e8 08 50 ba 05 65 ad 07 55 88 a0 04 27 a8 ba d5 b5 6e 4b 12 31 1b ec 64 07 86 0e 56 21 6d b7 d3 9d 08 47 d8 ac de 99 70 7e 24 44 a1 f0 f4 74 03 ec 95 ee 85 30 8c 21 0f 6e 20 bd ee 69 a0 03 2e 94 a1 0e 4b d7 01 f7 a9 a8 85 3b 0c 22 0f db b7 3e f5 a1 cf 88 48 2c 22 11 97 Data Ascii: tMtWD.F6 HM$:+Z/c\|vcOBD {@pv>'>2_tp $<$VdwS<?o\|UgNn~#<C3}6H>x9a(PeU'nK1dV!mGp~$Dt0!n i.K;">H,"
2025-01-02 05:12:34 UTC	4744	IN	Data Raw: c5 28 2f 51 c0 d1 7d 84 a1 04 d9 b0 9a 32 99 c9 82 50 a1 ee 33 a0 99 23 45 57 ca 52 8d 58 13 83 d0 cc 26 37 67 ea 4d 71 8e f3 a6 86 cc e9 39 77 6a 4e 74 12 6f 9d bf 99 e7 0e 63 9a 4c 8e 9a e1 a8 c9 04 a4 1c 87 4a 4a 13 15 0f 92 44 2d 2a 52 93 4a bb 37 ee b0 87 7d ff b2 c2 0b a0 7a 00 82 48 75 aa 54 75 66 10 e3 59 50 82 ba 08 04 4d 35 ab 5a d7 5a 56 83 aa f2 ad 70 4d a8 5c 17 4a d7 86 da 55 85 01 89 68 2d 51 50 48 2c 4e e9 af 53 82 00 05 fc 02 ba 33 56 d5 34 d4 30 c7 32 97 d9 d5 37 1a 36 8e 15 74 29 1e 5f 5a 20 6c ca 94 a6 10 09 a4 4d 71 8a 36 07 7a a9 6c a0 5d c1 37 fb ca d3 d2 f6 54 2f 1a 4c ad f1 b6 f7 b3 d5 ba f6 b5 51 ac de 6b 61 0b 54 9c 08 55 86 5b 10 ac 07 76 cb db de fa 76 b7 09 34 e9 55 49 74 5b 18 06 f2 a8 bf 4d 2e 6f 51 a0 d4 e1 8e 28 9f 41 ac Data Ascii: (/Q}2P3#EWRX&7gMq9wjNtocLJJD-*RJ7}zHuTufYPM5ZZVpM\JUh-QPH,NS3V40276t)_Z lMq6zl]7T/LQkaTU[vv4UIt[M.oQ(A
2025-01-02 05:12:34 UTC	5930	IN	Data Raw: 5f 79 85 6a 18 68 a7 d5 1a dc 6d b8 e6 2a 1b ab 1d f4 ea ab af 9b 41 82 9b 6d c4 e6 66 ec b1 ba f9 38 13 71 66 42 a2 dc b3 d0 46 7b dd b4 d5 55 4b ed b5 dc 69 97 06 86 2d 74 bb 42 06 d6 90 d7 c8 21 e4 55 d1 5f 81 24 00 00 c0 16 1f 1e 80 88 01 2e dc 87 02 7d 16 a0 70 1f 09 28 ec 77 ae 2b 39 cd cb df 2b fb c6 72 d1 2b 0a 32 68 70 23 9a 94 f1 e0 84 0c 37 6c e1 c3 a3 b8 98 01 04 a9 50 1c f0 c5 21 8a 48 a2 c6 26 fa a2 62 01 54 78 27 f1 24 5a 50 d4 cd 8a fe 88 53 54 c9 2c b7 dc 32 05 32 3a a9 a7 cb 34 3f 02 24 94 48 12 f9 25 ce 56 0a 78 33 cf ec 3c 09 34 38 2a db f1 00 95 42 26 14 0b b8 fc 24 6d 50 81 e7 74 e8 8e 38 1b ad ff 0c 09 4e 2e 68 09 e8 a0 52 95 e4 35 d7 28 4d f5 65 59 cd e2 c8 54 4f 60 87 5d df d7 69 9b 34 95 4c 64 c3 98 b5 33 68 b7 cd f6 dd 60 bf 5d Data Ascii: _yjhmAmf8qfBF{UKi-tB!U_$.}p(w+9+r+2hp#7lP!H&bTx'$ZPST,22:4?$H%Vx3<48B&$mPt8N.hR5(MeYTO`]i4Ld3h`]
2025-01-02 05:12:34 UTC	7116	IN	Data Raw: 65 ee be fb 80 2e d4 49 3c 45 05 e0 36 f5 fd 64 fa b2 bb 76 f7 3a 8c 46 c0 16 09 93 10 9a 68 f0 6e f1 3e 67 a4 a1 16 f0 fe 04 f7 7f b0 91 36 08 59 b8 e8 22 20 26 58 64 65 08 4c a0 71 2e 86 31 0a 38 70 2f d0 e3 18 b1 10 d0 1d 94 55 50 3b 23 2b 99 c9 c8 f5 31 ee 89 8f 65 8b c8 12 27 96 76 34 af 11 49 67 0c 32 e1 e1 b4 87 42 10 0d 89 10 3e 03 d0 d9 22 94 c2 17 02 a0 66 4a 0b 86 7c 92 86 b5 1e 1a 4d 10 88 c8 61 d3 ec 80 a5 18 e2 a7 6a e9 f1 21 69 0c 47 b3 44 30 4d 85 f2 99 53 36 08 31 9a c1 11 ee ff 7d 19 c0 92 95 16 96 24 c5 b9 4c 44 d9 f0 c4 d9 ec 67 0c 2b 62 a2 37 b6 d9 e2 65 d4 66 c6 c5 bd 6d 77 51 13 53 19 07 77 c6 2d a4 d1 4a 2b 4a 1c db 30 91 a2 13 6e 0e 72 80 8c 1c e5 4e 67 ba d7 55 2e 0c 88 bc 5d 3b 16 82 a7 43 66 aa 74 89 12 d4 07 42 b7 28 87 50 12 Data Ascii: e.I<E6dv:Fhn>g6Y" &XdeLq.18p/UP;#+1e'v4Ig2B>"fJ\|Maj!iGD0MS61}$LDg+b7efmwQSw-J+J0nrNgU.];CftB(P
2025-01-02 05:12:34 UTC	8302	IN	Data Raw: 96 37 3b 42 58 19 9a d7 0d fa f6 1f fc b6 43 15 17 67 e6 c4 65 a4 e7 65 4f 08 85 46 40 51 e7 b2 70 ae a7 71 c7 22 7b 4b c8 08 e0 20 70 e3 14 44 90 85 85 8e d7 72 18 f7 00 be a7 5c e0 27 08 a3 71 40 fb 53 86 25 27 7d e4 95 4f c9 57 73 e9 45 00 dd e4 86 6f 78 18 5a e4 0f c6 c7 51 33 67 47 de 87 7d 2a d3 87 a4 c1 78 3b 57 88 9d a6 6a e4 f7 88 8d 84 7f 51 05 02 34 b0 7f fc 77 89 98 f8 7e 59 30 7f 49 67 7f 49 21 89 07 48 07 99 38 8a 98 48 07 f2 d7 5f 1b 88 49 56 b1 80 5e 50 89 97 18 7f ae c6 80 a9 f8 80 66 c1 8a 94 28 8a 9a 48 03 50 e5 5e b4 18 81 be e8 49 b7 81 2b 15 38 8c c4 28 4b 36 38 1d 52 f3 34 fe 53 01 6d d7 8c 2e 54 6d 0b 60 40 27 88 82 2a c8 ff 6d 80 86 1c 16 e0 01 f6 02 6e 80 d7 63 31 28 83 c7 18 8e 37 18 29 88 51 42 89 b7 83 ef d6 7a 90 13 5c 47 c5 Data Ascii: 7;BXCgeeOF@Qpq"{K pDr\'q@S%'}OWsEoxZQ3gG}x;WjQ4w~Y0IgI!H8H_IV^Pf(HP^I+8(K68R4Sm.Tm`@'mnc1(7)QBz\G
2025-01-02 05:12:34 UTC	3662	IN	Data Raw: f5 57 7b f5 5f bc ed dd 9e d0 a1 e1 db f3 1a ef 07 5f ee 1d 5d 2f cd 6d dc c7 dd d1 5b a0 dc 57 8e 08 df e1 e4 00 2f ef 86 30 c2 68 3e 29 1b 6c f0 80 cf 5a 83 cf e3 27 0d d3 50 7e 08 a2 69 dd ee 98 62 8d 0f f0 33 ad 8f 23 b0 7d 94 bb f4 9a bf f9 9c ff 04 28 3c ba af 3b f1 b1 3c b4 16 3f d4 8d ad d6 1b ef e9 ae 83 9d f5 50 ff df 21 ff e8 3d 74 92 89 ca 88 41 91 01 fb e0 ed cc cc f2 20 e1 f2 30 0f f3 31 bf d6 33 4f f3 36 3f fc 38 8f ea 3d 7f fc 3e 1f f4 ca bf fc 48 df fc 4e 9f 4e 49 ff fc d2 3f fd d4 6f fb d6 7f fd d8 9f fd 51 5f eb c3 62 ce e7 ec 82 59 af f5 2a 32 f5 d7 4c d7 d1 2e f6 01 4c ec d6 5c f1 61 bf f6 b8 af d0 90 df b7 1c 14 f0 94 ff e5 f6 5e d2 8a bf 83 79 6f f8 93 0f 08 05 13 0b 84 0b 23 83 85 09 65 51 05 8d 05 04 90 91 92 93 8e 8d 04 06 14 85 Data Ascii: W{__]/m[W/0h>)lZ'P~ib3#}(<;<?P!=tA 013O6?8=>HNNI?oQ_bY*2L.L\a^yo#eQ
2025-01-02 05:12:34 UTC	10674	IN	Data Raw: 8f 0e 48 97 46 1a a8 81 da 42 1a c8 9f fb f9 9f 88 4a a0 42 96 7a 01 3a 12 04 49 06 69 80 ff a0 92 9a a0 4a 42 75 2b 78 a9 3b d9 a0 58 f2 a3 ca b2 40 9e 9a a9 5a 91 28 98 5a 10 e0 57 9e d4 76 a2 0b 99 aa aa fa a1 ac 0a 1b ad 8a a1 25 1a 0d 3a c0 18 a5 83 19 ac 58 45 30 9a 12 3a c1 1d c1 d0 36 ba fa 69 50 8a 9a e8 26 71 a2 a3 9b bd ca 1d a5 c4 62 14 00 9b ca 12 a4 c3 7a a3 54 95 8e c7 5a 1c 02 91 a7 2a c1 ac 51 e8 a4 d5 17 ac c2 1a 7e bc 38 9c fc 61 6f cb 69 94 58 ea ad e0 9a 2b 4c a9 0a 96 e4 9d ce 49 2a aa c2 49 64 ea 08 c4 42 02 f3 87 48 5c e1 8a 14 86 8d 9a 45 78 6c 2a 50 86 f7 8d 61 d9 91 64 99 4a e5 b8 2f 26 73 04 08 9b b0 0a bb b0 0c 0b 45 ca c0 02 d5 ca 96 0a b8 a7 7c da a7 f4 59 9f 74 f9 19 82 ba 62 29 51 5c bb e6 b1 86 da 97 c4 45 12 89 aa 5c 8a Data Ascii: HFBJBz:IiJBu+x;X@Z(ZWv%:XE0:6iP&qbzTZQ~8aoiX+LIIdBH\Exl*PadJ/&sE\|Ytb)Q\E\
2025-01-02 05:12:34 UTC	11860	IN	Data Raw: 0d b3 48 8b a6 20 1f b7 18 96 a6 50 1f 57 54 96 02 80 09 69 89 2d 74 23 92 bf 28 6a c1 c8 80 cb 18 0e 70 87 8d ad 80 8c 48 25 8d 73 d9 8c 09 56 8c d1 28 8c 6a 37 57 08 c1 04 db 38 78 e2 30 76 da 78 60 e3 b8 77 7a 19 0d cd b8 98 93 24 98 1f f2 60 e8 98 6d ea e8 8f 45 d2 7a d8 d3 8e 25 50 8f f9 38 31 aa 35 8f 89 b0 02 2e 86 ff 99 4a 01 90 d5 e8 87 e4 a3 8f f1 88 2e 4f f2 84 43 68 9a 32 71 6d e2 88 84 2e e3 53 5a c8 77 30 a2 9a 5e 02 56 09 a9 90 0b c9 90 bb e7 05 77 e1 00 10 19 91 90 c6 86 ed 45 89 c5 47 88 b6 25 7e d1 35 71 34 84 36 4f 50 9d d6 b9 75 79 28 87 a7 85 7c a1 c9 4e 88 08 2a 26 d9 72 de 37 93 b9 91 43 db a7 50 5d e3 27 2d d0 93 a5 38 83 16 f9 35 7b f3 3c 9c 28 95 54 59 18 a8 78 95 1a 94 94 43 57 18 ec 69 19 c7 30 66 7d 76 0d 89 f5 9f 38 69 38 89 Data Ascii: H PWTi-t#(jpH%sV(j7W8x0vx`wz$`mEz%P815.J.OCh2qm.SZw0^VwEG%~5q46OPuy(\|N*&r7CP]'-85{<(TYxCWi0f}v8i8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49764	99.86.4.79	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	631	OUT	GET /media/dd9a87_4314275b0467418ab4bd32c8da4d6358~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	766	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 1016730 Connection: close Server: openresty/1.27.1.1 Date: Tue, 31 Dec 2024 15:54:08 GMT Expires: Tue, 31 Dec 2024 16:54:08 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Wed, 27 Nov 2024 13:34:44 GMT ETag: "294291294d851fecadaf4c11864f83e4" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-fktdr Via: 1.1 google, 1.1 c275031486c6f7b744b8d30847e98b14.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Nw-r-3inCFznc9VPxaIyVpoHNrRsTOOsgiNQNqxpdsTDlIm2tUaUFg== Age: 134306
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 aa 76 54 fe 33 90 50 89 f4 f5 f0 f9 a2 c5 fd 8d 67 cf 83 ac f7 9b 9b 99 cc cb ca d1 a5 77 a9 a7 9a ed ba b0 53 4c 45 aa 89 77 b4 55 b8 6b 77 e2 d6 45 a6 2a 1a 14 ce aa 98 ec c7 9a fb ca b0 c7 bd c7 52 37 32 bc 99 89 37 91 ff cc 4a ab a7 9d a7 f4 d7 ec f6 ae d3 8b 4e 34 4a 2a 16 e7 ae 7a eb 9d a1 7a 7a 85 c1 d1 fa 7a 62 48 98 6a 63 fc 6d ad d9 9b 78 f6 96 c5 cc 8f d0 66 66 58 ec 3c 9a b7 67 ba d6 6c ba 64 30 1a 64 5a 65 cb 9d 85 db 9b a5 d6 e5 fe a8 a7 8b db ad 97 fb c6 df b6 b5 9c a8 5b c0 c9 c7 bb cb 99 93 ab a9 a9 89 66 54 b9 b5 ab fd 51 9f b0 76 c2 d1 ac dd 93 5a 64 ab 5a 62 7a 64 54 c9 78 68 8f 7a 87 9b 85 60 81 38 42 95 8b 87 89 89 87 99 76 66 d7 a5 8f a7 9b 97 b7 ad ab d9 99 87 bd bd b3 76 78 74 cd 8b 92 e9 9b Data Ascii: GIF89avT3PgwSLEwUkwER727JN4JzzzzbHjcmxffX<gld0dZe[fTQvZdZbzdTxhz`8Bvfvxt
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: e7 1c d2 19 10 01 ab f6 27 ad d2 2a 1d 46 ec 1c ce 5e 5c e8 a1 1f 1e 48 ed 49 95 a2 91 93 a8 ec 1e af 86 83 52 85 c3 bf d1 23 cb 38 5f 0c 2a 0c 54 aa a1 9b 42 43 10 b8 40 25 48 62 b4 d2 58 40 d6 41 0b 2a d2 32 30 69 9c 95 86 23 bc 0d 1b e4 c3 3b 6c ff 16 00 8c 28 00 b0 ce 1c d4 46 91 61 5c c6 35 80 8a 1a 49 6e 74 5e eb 86 5f 2d 0c 69 91 36 40 18 a4 42 72 a6 68 1e d0 ae ed 7e c2 1c 20 e9 24 c1 01 1c 28 dc 3d 8c 80 32 d4 01 8d d5 41 cc 64 c2 2c 40 29 36 92 91 11 fc a7 de 04 22 4f e5 67 27 18 c1 11 8c 03 a2 f8 19 87 e0 c1 d8 f5 4d a0 ed 21 87 c8 45 dd 06 10 a7 0c e5 3a da 05 1d 30 90 01 ad e9 34 0a 88 e9 15 8a 9b ce 02 9c 56 81 17 40 c3 08 90 96 55 b6 20 a7 55 6b 25 44 97 8d dc 83 f5 e9 80 17 b1 e7 9f be 86 25 c5 46 7a 4a 5c a1 5a 41 72 46 44 2a 94 03 a5 96 Data Ascii: 'F^\HIR#8_TBC@%HbX@A20i#;l(Fa\5Int^_-i6@Brh~ $(=2Ad,@)6"Og'M!E:04V@U Uk%D%FzJ\ZArFD
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 70 36 63 78 86 7c ce 00 9d 30 15 04 7a b3 2d 0f 82 11 e8 32 10 aa 43 ae 03 41 aa 1b ff da 29 7b 60 b2 99 e7 c4 52 e7 05 c4 6c 27 4d 05 ad 8a 3a 10 05 9b a3 81 1a 15 94 fc 12 e6 db 14 94 70 9b 03 eb 97 80 9b c6 68 a0 83 32 58 7c f9 e7 86 70 ac 0f c3 27 68 b8 b5 32 62 03 07 29 b0 c7 ff b0 0f d8 12 0b 1f b8 b1 74 60 b2 ee 01 b6 d9 a8 c8 9d 99 8d 14 6c 27 0f b5 54 56 80 67 c2 f8 14 b2 49 bb 7c fa 12 a9 7b cd 48 ad c9 d7 5c cd b4 1b be f7 c9 b7 3b ea d4 eb 98 b4 09 0d 9b 47 0a 7b ec 96 5f d2 ca 73 c5 24 10 43 b0 22 fb 41 05 58 75 14 e7 50 b6 0e 9c 8d 51 b3 c8 30 c1 29 d6 c6 29 9c e2 02 bc 43 bd d8 60 6d 6b 00 23 0a e2 36 42 08 ad 2d b7 6e b2 4a 10 f3 e8 97 3d 69 d8 4d 21 cd 5c 5c 10 d0 5c 10 45 dd 05 94 30 be 7e 3d b4 7e 4d 9b 78 59 10 fa c8 c6 a3 8c c3 ba 07 Data Ascii: p6cx\|0z-2CA){`Rl'M:ph2X\|p'h2b)t`l'TVgI\|{H\;G{_s$C"AXuPQ0))C`mk#6B-nJ=iM!\\\E0~=~MxY
2025-01-02 05:12:34 UTC	15108	IN	Data Raw: a8 48 ac 52 85 0a 44 4e 55 32 f5 f9 b7 f1 1f b4 7f 23 04 8e 18 d1 87 e4 88 52 41 fe 05 59 19 04 4e 10 1d 5e f0 c1 11 38 53 a0 a3 82 05 e1 e0 d3 f1 6f a6 97 94 5e 4a a5 28 39 91 0a 30 60 d9 ce 58 38 83 b3 a9 d3 a7 50 a3 4a 9d 4a 55 60 26 81 c0 08 56 a4 52 09 9a 43 87 9c a0 55 f9 77 f1 5f 15 68 99 46 40 bb a7 12 e5 c0 94 74 58 aa 74 e9 a8 65 4f 81 3a 1c f1 fc b7 05 df c0 9a 36 ff 21 99 e9 08 0e e0 96 29 fb 78 a9 12 a4 4f 25 60 0b 67 59 00 e6 a2 aa e5 a7 31 04 1a 10 71 b9 73 d3 2d 63 a8 30 a8 c2 70 a0 c4 7f a1 67 49 84 38 f6 df 2c ab ff 32 8d ad d2 27 31 c9 81 25 05 a6 74 8b 2f a4 61 81 5e 74 a4 fc 47 e2 df 4d 9b 33 f1 dd ec eb 88 ce bf 1f 70 9c 97 f2 a2 bb 76 10 65 7d 2a 32 a0 92 74 1f 3b cf e0 0d 08 ff 10 21 fe 01 01 f0 9e ef 34 e4 d8 da ac 57 ae 12 e1 57 Data Ascii: HRDNU2#RAYN^8So^J(90`X8PJJU`&VRCUw_hF@tXteO:6!)xO%`gY1qs-c0pgI8,2'1%t/a^tGM3pve}*2t;!4WW
2025-01-02 05:12:34 UTC	30	IN	Data Raw: 1f 6b 66 40 ce 3f d0 55 a8 dc ce 2a 28 01 d1 62 d8 11 68 81 03 ad c1 21 75 98 41 a4 a5 ea Data Ascii: kf@?U*(bh!uA
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 90 e2 19 97 d3 a9 cc 8e 56 c9 4a e7 72 31 ad 14 67 2f 87 b1 74 86 8c ad d8 93 3d 65 86 11 1c c0 3f 04 83 11 dc 81 27 04 43 30 1c 01 36 68 4c bc f6 4e 90 8d d2 ed 98 df d2 e0 1b be 22 23 06 47 8d 0e e5 c4 78 6d 0a 09 fb 63 77 55 42 0e 8f 44 0b c8 f3 24 27 42 25 60 42 24 fc 40 07 d4 70 22 2c c3 0f a0 d1 f5 d8 81 b2 b1 81 dd 8a ac 96 30 46 66 9c a7 4b d4 10 53 29 87 17 04 c3 1d 10 c3 8d 38 84 cb 68 01 ba 49 e1 8a a9 ca 2a fe c3 22 4c de c6 74 02 ab 58 6b 6a bc 08 17 67 86 2c c6 62 8c c9 a2 cf f6 f5 9f d9 96 13 22 a1 5d ab 65 6e 69 03 31 b0 b4 36 1c 40 30 e4 c1 17 68 0c 3b cc 82 b4 88 52 74 60 89 eb 19 ff 55 26 b8 40 e0 02 96 d8 dd 84 97 b4 52 88 64 30 1c 18 19 75 2c 43 26 75 2c 26 70 43 34 9c 01 26 08 0f 27 fc 40 77 fc 80 dd 62 42 22 94 42 24 ec f3 3f 00 82 Data Ascii: VJr1g/t=e?'C06hLN"#GxmcwUBD$'B%`B$@p",0FfKS)8hI*"LtXkjg,b"]eni16@0h;Rt`U&@Rd0u,C&u,&pC4&'@wbB"B$?
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 6c 60 80 a4 84 86 73 5c c9 75 1c 01 6f 28 05 1d 78 47 1d 88 47 00 40 b2 25 4b 03 7b 00 23 90 0a 0e e2 20 10 25 29 08 6c ab 8a 7f 08 05 be bc 32 ff df 99 33 09 68 ad a0 92 1a ea c8 0e a1 d2 0e 09 7b 29 9e ba c8 24 44 87 1a a8 0e e9 e0 48 cc 5b aa 9d e3 41 5b e0 c7 e0 00 19 2f 22 01 c1 22 81 06 a1 a4 7f 68 07 56 fa 2a 2e 6a cc 10 58 03 ea 5a 28 50 b8 c3 38 2c 18 b1 b2 40 ee 19 89 58 5a 11 2f 18 9f f7 fc 07 ea f2 02 7c 68 18 dc f3 82 85 b2 2e 12 3b 03 7c 61 00 60 68 07 4c 18 3e 35 38 44 81 0b 02 1d 90 4a 47 e0 1a b7 f3 ab 4f b8 9f 3c 70 8c c6 21 19 8b 83 0c 40 28 92 ed 5c 21 95 e1 cd aa 50 23 29 21 90 39 e1 3f 3d 49 c2 5b 40 27 09 20 c2 e2 dc 0a 18 68 ad 24 00 c5 1a d5 b9 fe db c5 5e 8c 9c 7f c0 3e 01 64 b8 c8 f0 ab e7 13 34 d8 50 86 4a 68 ba 16 f8 07 67 70 Data Ascii: l`s\uo(xGG@%K{# %)l23h{)$DH[A[/""hV*.jXZ(P8,@XZ/\|h.;\|a`hL>58DJGO<p!@(\!P#)!9?=I[@' h$^>d4PJhgp
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 01 ae 50 10 33 70 93 b7 f0 0f 2d 0a 84 37 99 87 40 07 84 3a a8 7b 2f 40 0f b3 86 03 28 46 67 9f d5 0a 49 f7 84 25 c5 45 44 44 38 f7 82 20 0e d2 22 a2 81 81 2c 52 05 d4 80 8d 29 80 8d 12 fa 0f d5 39 15 28 30 5d 63 59 8e 2e 78 8e a5 a8 8a 4f 91 49 a0 d5 0a f3 96 29 85 b0 8f 4e 21 06 04 25 05 2d 2a 10 12 e0 7b 32 2a 10 7a b8 59 37 2a 6b b8 e7 97 38 96 59 77 f0 51 36 b6 80 4a 94 4d 92 07 07 36 01 25 6a a2 15 f8 04 71 d7 e7 02 e7 30 06 0f d2 8d e7 70 0e 9a ff 28 15 9f 23 96 22 89 a5 ff 60 00 69 99 72 04 70 72 20 ba 14 76 f3 72 2f 56 97 db 11 9b 4e f1 83 85 a0 a6 03 f1 9e b3 d9 a2 ad 99 04 70 66 87 28 66 87 7c 58 78 04 d1 8f 00 89 88 ba 86 78 51 d4 00 03 94 40 d0 43 24 05 13 04 75 b0 75 55 39 7d 91 12 0e 0e 9a 8d ab e2 02 c4 fa 0f 7b 30 a5 51 31 8e 1b 5a 96 93 Data Ascii: P3p-7@:{/@(FgI%EDD8 ",R)9(0]cY.xOI)N!%-{2zY7*k8YwQ6JM6%jq0p(#"`irpr vr/VNpf(f\|XxxQ@C$uuU9}{0Q1Z
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 7c 83 a4 7b 1a 04 1f cd 20 3b f3 0a 0c d2 b3 8a c0 94 55 2e 56 64 00 cc 02 03 17 55 33 6b de cc f9 29 30 71 16 04 82 4e 98 f0 9f 44 cb a7 4b 03 5b cd b1 4a 95 4a a4 a1 85 fc 68 f7 1f 4a 9a ff 52 b2 d4 1d b3 54 10 df 70 e0 d0 f4 c2 57 47 70 81 5e 70 fe 4b 3e e2 f7 cc a1 d0 5c f4 f1 18 79 d6 18 60 75 2c 2c 15 d8 a8 b3 f7 ef e0 45 6f ff ac f4 10 da 3f f2 b2 dd 16 75 4b e5 9f 5b 85 54 c2 52 31 cf 36 e5 3d 4e ff 4e 8e 14 0a ed 20 71 9a 79 d1 04 98 40 74 cc f4 8f 62 ff 38 82 8f 5f 03 0a 84 0f 3e c4 19 87 db 62 76 79 21 5d 15 2e 8c f1 d0 2c 16 88 b3 cf 3e e1 85 28 a2 54 dd 24 64 1e 7c 0c a4 18 9f 8a a4 29 f4 cf 18 8e c5 e8 1a 51 ae 65 82 19 34 38 fe 93 02 4b 2c dd e3 db 4b 33 15 e6 0d 4e 70 e0 54 ca 82 7c 21 d9 97 40 70 20 e9 05 60 c1 39 a9 52 1f be c5 44 45 26 Data Ascii: \|{ ;U.VdU3k)0qNDK[JJhJRTpWGp^pK>\y`u,,Eo?uK[TR16=NN qy@tb8_>bvy!].,>(T$d\|)Qe48K,K3NpT\|!@p `9RDE&
2025-01-02 05:12:34 UTC	16384	IN	Data Raw: 6f 5f 81 5f 82 25 1c f8 0f cf f9 7f 74 24 ae 5f 1f 8e ce 1a 87 18 05 62 14 1f 99 d8 d7 cb 95 f7 63 96 61 04 a6 95 0e 60 e5 88 59 96 f1 82 04 5e 00 78 27 8d 54 04 b2 23 0d 3b 54 4b 23 b5 7f 78 f1 e3 12 5e d4 e8 60 99 7f 30 01 c6 82 33 3c b0 c0 83 7f 8c a8 21 2b 23 94 68 69 11 84 8e 38 80 98 f2 04 62 65 91 03 5a fa e8 80 3b f4 33 4b ff b2 e8 04 fa 8a ac 7f c6 39 c2 08 67 40 71 86 2f 22 d5 43 8f 49 82 fe 01 85 8e 3d c6 48 61 8f 58 62 f9 67 8d 14 ce f9 a7 0a 88 da fb e7 08 b1 2c 2b a8 a3 03 82 ec 2f 24 b4 d4 f2 48 06 e8 fe 19 a2 8f 2a 74 60 43 a0 3c 74 9a 03 8b 7f ec e0 a9 42 21 00 98 c3 8f 62 2c e1 a5 83 4c 6a e3 06 98 a8 2c 60 40 14 05 1c 45 8e 15 e7 d4 4a 69 25 62 cc fc e7 00 e0 aa 6b cb b2 31 2b 4b 8b c6 95 6e 14 f2 88 2f 7e d4 a2 45 81 bc fb 22 04 8c be Data Ascii: o__%t$_bca`Y^x'T#;TK#x^`03<!+#hi8beZ;3K9g@q/"CI=HaXbg,+/$H*t`C<tB!b,Lj,`@EJi%bk1+Kn/~E"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49769	23.224.82.187	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	588	OUT	GET /img/fftyc_1300x240.gif HTTP/1.1 Host: ig38.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	1092	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 6613 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb840eb880ffb38-SJC Content-Length: 497098 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:12:21 GMT Etag: "6773daf0-795ca" Expires: Sat, 01 Feb 2025 03:22:08 GMT Last-Modified: Thu, 02 Jan 2025 05:12:21 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BZfKFw3GmchSPg4FVe4FMR3zalGbfAH4vt2zVufBRq4TflQSvBLS3Sin0et%2Fvalu%2BmjHSeoG5LhzWcZjga15yzydhVdJpyPExy7L7QziCXGV0gGOzxJeI4XeQKXRYLYybw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=11264&min_rtt=10000&rtt_var=465&sent=1866&recv=133&lost=0&retrans=9&sent_bytes=2641737&recv_bytes=8271&delivery_rate=10012555&cwnd=690&unsent_bytes=0&cid=a69495051c0abe8a&ts=32473&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:34 UTC	94	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 00 00 ff dd 2b 17 04 03 fe f1 a0 32 5f ae da b4 54 ef a8 94 a1 ac 53 24 8c 55 d5 cc 51 fc ae 05 ab d5 a0 b3 89 2c d2 ad 35 d5 cc 6f 71 48 12 4f 97 55 68 28 01 24 90 cc e8 72 64 f8 93 07 9d d7 e0 b8 69 04 5f d8 a9 d0 27 2b 47 0d 00 5c a3 ce 32 cc b9 Data Ascii: GIF89a+2_TS$UQ,5oqHOUh($rdi_'+G\2
2025-01-02 05:12:34 UTC	2372	IN	Data Raw: 93 67 29 4f 23 01 6b 95 52 90 4c 09 d4 71 0b f5 97 2f ba 23 27 25 b3 be 05 5e 1c 8b 4f 25 b6 b3 b0 92 92 8c f5 da c6 92 6a 46 8d b4 d8 6f 6f 71 d4 73 29 d6 89 0f 73 99 68 b9 bd 59 af 4f 0a 75 aa 6c 4d 4b 4f d6 4c 2c bd b2 86 91 6a 0f 6c ce ce cb 24 e8 52 94 67 fc 2f 24 fe f0 0c db cf 2f b2 2a 0c 91 2a 09 cf ee f4 f8 4a 2f ab 7c 4f 90 b8 86 76 33 21 70 b6 86 33 44 55 33 48 76 47 48 6b 8c 09 0a b5 8c 0e 90 77 65 53 91 05 6f 04 02 b9 b0 3f 4d 84 ba b4 4a 27 db af 0f 4b b8 bb b6 11 22 f9 70 34 f3 73 06 73 4f 3f b7 95 7a 27 7f bd 96 8a 36 d6 28 0d d7 ee ce 70 8b 8c d1 4c 0a 90 b7 b1 41 b1 6c 6e 8d b9 71 6b 46 0d 88 3d 0d b3 b9 f0 24 17 6f b4 bf af 0b 05 e6 28 54 32 32 4a be 51 47 51 69 7b f8 b2 cc 4a 71 3c 0e 89 bf d4 0e 09 cf db f2 f7 4b 07 bc 82 68 30 88 95 Data Ascii: g)O#kRLq/#'%^O%jFooqs)shYOulMKOL,jl$Rg/$/**J/\|Ov3!p3DU3HvGHkweSo?MJ'K"p4ssO?z'6(pLAlnqkF=$o(T22JQGQi{Jq<Kh0
2025-01-02 05:12:34 UTC	538	IN	Data Raw: b8 ac 45 c0 06 20 7a 28 22 aa 75 a5 4a 8c 31 b1 18 ff 53 e2 60 3c 9a b0 a2 62 2f e6 2a 23 64 9c 55 86 a3 66 36 c2 60 42 61 40 78 66 ec 67 40 ba 80 1a 31 c4 c4 32 8a 2c 0d 6c 66 80 8e 8f 4d db 19 10 26 dc d6 6b 6e 9a e4 06 a5 8b bd c1 f0 9b 95 e3 96 9b c5 70 5c 7e 19 9d 97 0f 44 87 9c 97 07 dc 40 e6 75 f2 3e 00 a6 74 cc 4d e7 c5 be 21 5a 41 e7 bf 00 07 2c 70 42 76 ea 99 e7 45 08 cf e0 28 a4 0c 37 bc f0 c3 0e 47 2c 31 c4 14 4f 6c f1 c5 15 67 fc d4 0d 02 a4 73 e0 56 9c 64 74 e9 a5 5f c1 e2 00 5f c1 88 6a c5 a7 6c 91 da d6 12 74 55 f8 29 0a 56 d0 d5 6f 87 ae b4 e2 ca 59 b1 6c b2 8d 2d 84 69 92 8f ad 53 ea ea 62 8c 2d 60 bb eb 61 52 de 26 a5 09 fb 74 3b ec b4 c4 1a 3b 43 b2 42 2e a1 43 6b 84 55 0d 03 15 51 7f cb 19 93 4b 0a 7b d9 0c 54 32 16 ae 95 c4 9d db 82 Data Ascii: E z("uJ1S`<b/*#dUf6`Ba@xfg@12,lfM&knp\~D@u>tM!ZA,pBvE(7G,1OlgsVdt__jltU)VoYl-iSb-`aR&t;;CB.CkUQK{T2
2025-01-02 05:12:34 UTC	4744	IN	Data Raw: 22 df b7 8a d5 99 1a 15 a6 04 bf 18 22 fa 04 80 00 40 2c 61 87 b2 61 de 12 87 85 c4 2e e6 26 1c 52 3c 9e fa 80 50 02 6e 94 40 7d 56 da 42 fb b8 11 c6 54 c4 ed 38 be 91 df dd 54 80 9c fb ed cf 39 78 c4 17 74 b4 e3 85 4d 91 c0 66 15 48 59 02 11 48 c8 41 1a b2 90 87 4c 24 22 17 39 1e 46 3a 52 91 90 7c a4 24 bf 73 15 06 5a 12 61 2d e0 a0 26 31 c8 c9 4d 7a b2 93 a0 fc a4 28 47 09 9f cf 51 4a 00 9c 28 cf 08 4f 65 97 14 96 6a 85 ab 8b 8b 0a 61 91 c2 b1 84 a5 66 9b 12 4b 87 f8 b2 3d 57 f8 32 42 ad d0 1d 8f 54 d4 02 62 e2 0a 88 42 2c 1e 16 7a 81 3e 6e a0 11 89 4d eb 96 f8 7a c5 45 2a 30 af 8d 53 14 52 8a 64 c3 a4 2c 6e cb 6c 52 9a 81 f1 ac 17 45 65 12 af 99 d3 c3 e6 32 c7 a9 3e 38 ba f3 6e 5c 62 d7 bd f6 a8 c7 e9 a0 ee 8f 1b c0 45 20 83 e1 ff 8e 49 46 d2 9f 8d 04 Data Ascii: ""@,aa.&R<Pn@}VBT8T9xtMfHYHAL$"9F:R\|$sZa-&1Mz(GQJ(OejafK=W2BTbB,z>nMzE*0SRd,nlREe2>8n\bE IF
2025-01-02 05:12:34 UTC	5930	IN	Data Raw: 8c 91 8a 5e 7a 29 61 84 77 be 38 60 47 1d 7b 7c 67 04 20 1f c1 27 8d 34 72 f4 11 48 24 df 51 24 95 13 c2 89 31 46 13 34 d1 a4 05 07 1c 20 24 9c 59 7e 39 01 08 18 b6 e0 46 cb 54 d2 51 60 8b d6 78 dc 91 0b 2e 0a 51 e0 04 2d 67 f0 c2 8b 0e 64 9c d2 00 2d b9 29 61 4d 30 d9 0c 4a c7 03 14 a1 86 49 26 61 80 e4 9d 4f f2 cc 53 01 21 fa c4 ff 93 c9 29 3a 68 e1 51 47 21 95 34 52 4a b9 ea 80 2b 4b 2d 4d e3 52 47 37 d5 b4 03 38 3b f0 14 4e 2f ac 30 15 16 fc 70 09 c6 c0 64 68 70 60 83 87 76 8a d5 26 5a 53 91 4b 90 2e 6c c8 b5 8b 90 54 f0 55 8f 12 4a f0 55 05 2f b2 28 27 8b 61 55 50 29 d9 60 93 35 a1 9c 61 8b 55 49 8f 61 83 3d e3 5a 3d b2 c8 e4 a0 59 65 cd 29 21 83 ca d1 63 dc 18 54 30 69 dc 33 f4 08 84 9a 61 f5 78 16 d9 61 97 ad 56 d8 61 9f f5 82 5c 65 55 88 81 dc 12 Data Ascii: ^z)aw8`G{\|g '4rH$Q$1F4 $Y~9FTQ`x.Q-gd-)aM0JI&aOS!):hQG!4RJ+K-MRG78;N/0pdhp`v&ZSK.lTUJU/('aUP)`5aUIa=Z=Ye)!cT0i3axaVa\eU
2025-01-02 05:12:34 UTC	7116	IN	Data Raw: 0c fb a5 98 22 89 54 9c 2d 96 50 24 24 49 05 15 c1 3a a7 40 cb 96 ff 26 44 87 c7 7b 12 8e f2 28 0c 36 c7 0f d1 57 a3 bd 3f e9 a4 de 19 0c ca 8d 5e ba da 82 1d 85 62 0f 37 61 a1 9c 1b 81 b5 2f d8 06 68 39 54 ff bd f0 2d 4a 65 1d ae 04 90 af 45 88 e2 19 39 c2 43 93 74 31 8c 21 2d 70 18 54 c2 92 90 9a f4 24 7a 40 89 18 ca e0 11 2c ac 40 03 3c 6c c0 0a b0 08 92 94 94 11 a6 31 dd 82 17 4d da c4 26 b6 81 80 34 a9 c9 00 0e 20 cb 2f 9a b2 28 3c 8d 60 86 1d b8 01 b0 62 85 ac 18 ee b0 87 b3 80 14 35 0e 95 86 65 11 6a 52 30 02 c2 0d 6e 75 02 20 bc 03 87 74 ca 0b a9 68 f5 00 52 31 31 26 40 88 a1 09 a6 a0 89 7c c0 ea 58 dc 78 40 af d2 80 aa 4c e1 8a 87 25 98 21 24 80 25 2c 64 f1 6a 26 3e 9c 19 0f 51 90 8f 2d d2 d1 5a d0 9a 23 1e ef d8 82 7c f0 91 5b 7e ec a3 b6 02 d9 Data Ascii: "T-P$$I:@&D{(6W?^b7a/h9T-JeE9Ct1!-pT$z@,@<l1M&4 /(<`b5ejR0nu thR11&@\|Xx@L%!$%,dj&>Q-Z#\|[~
2025-01-02 05:12:34 UTC	8302	IN	Data Raw: 29 ce 4e ed b8 c2 e8 66 26 0d 20 ac c1 b8 01 ef 2a 22 60 c2 e1 21 2e a9 05 16 8c 95 90 20 42 28 66 06 90 00 09 3a 00 09 4c 60 c4 32 b1 10 09 21 2a 5a a3 22 f6 4e 2d 42 6c ec c8 2e 11 21 f1 e9 00 2f 2d 68 4c 16 5d 2c 91 8a a6 01 a2 a3 01 a0 66 f8 7a f1 f8 f0 a2 6e a8 81 6a 14 83 31 b2 06 51 ee 8f d3 22 c3 6e e0 26 0b 8a b1 6d 02 60 f4 36 6a 6d da e6 6d 18 23 6e ff 94 c3 17 3f ca 36 36 4f 37 9c 31 34 82 c3 1a 7d cf 6d 4e a5 cf b2 d1 1c 8d ef 1c f7 82 71 7e eb 09 a3 d0 34 16 8d 4b 18 8d d2 50 c0 34 e6 4d 00 ec 51 9b 9e af 05 31 c0 46 34 04 fb ee e9 1e f7 42 fb 4e 03 1f 4f e3 05 01 d2 3d c8 ea 49 28 24 08 80 ea d6 e8 d1 3d 3e 8a da ca cf 1e ed 71 06 94 00 b2 6a 47 9b b4 a9 22 09 d2 2f 42 a4 20 03 12 ad 08 60 06 78 4d d7 90 d0 fa 02 50 24 57 32 22 5b b2 1e 39 Data Ascii: )Nf& "`!. B(f:L`2!Z"N-Bl.!/-hL],fznj1Q"n&m`6jmm#n?66O714}mNq~4KP4MQ1F4BNO=I($=>qjG"/B `xMP$W2"[9
2025-01-02 05:12:34 UTC	3672	IN	Data Raw: 00 81 29 d3 2f 81 02 07 16 34 28 ff 2f 5b aa 85 0a 05 8c 1a d5 49 e2 44 8a 15 4f 55 dc 44 4a c0 ac 4b 99 b8 61 29 a8 8e c2 c8 14 14 d8 94 30 b1 25 90 09 6a 98 4c 04 42 59 02 53 89 40 5b 4c c8 a4 79 93 25 b7 97 40 58 ea 8b 79 73 a6 89 94 26 f4 29 cc 26 48 50 36 7f 9c 1e 6e b2 18 55 ea 54 8a 0f 65 09 f0 73 40 eb 56 ae 5d bd 7e ed 3a e3 d5 b4 39 1c cc 42 d8 40 b5 d3 06 b3 18 da 22 83 2a 55 59 5b b7 c5 4e 90 3a 41 a0 2d 07 0f 6a 3b 79 70 ab 36 88 d9 8b 51 19 b8 45 0c e1 6c 10 12 c1 16 08 63 40 40 b2 32 64 c2 36 0c 76 ab 38 b1 db 5d 53 51 ed 55 16 b7 f0 44 12 66 51 61 5c cb c1 6f 27 cc 1c 30 cc 98 55 1a 31 81 d5 a8 6d df c6 2d 91 81 6b 0c 53 4b 9f 16 5d 5b ae 5b da a8 35 bb 9e 36 4b c0 8d ae 94 c0 3e d7 aa 71 5a 66 b3 2d 0f 12 bc 9e 5d 3b f6 ed dd bd 73 6f 0d Data Ascii: )/4(/[IDOUDJKa)0%jLBYS@[Ly%@Xys&)&HP6nUTes@V]~:9B@"*UY[N:A-j;yp6QElc@@2d6v8]SQUDfQa\o'0U1m-kSK][[56K>qZf-];so
2025-01-02 05:12:34 UTC	10674	IN	Data Raw: 2e ad d5 08 55 ec 0c 9c 8d c6 60 e4 85 5d 70 24 6e d0 4f b8 2d c5 4b 2c bb 1f c8 44 31 d1 db b6 35 3d b2 9b 86 b8 95 50 16 a5 5b d3 4b 17 17 82 51 4c d9 48 9c e1 c9 c9 2b 1d 7a 89 81 32 88 81 21 20 84 12 a0 80 3e 00 dd 3e a0 00 6b 88 b1 df 9a dc d3 4d d3 35 cd 49 7b 7c c4 7f 69 91 d7 d5 03 74 cc dc 9b 90 5d 87 14 99 21 c8 dc 18 28 01 15 c0 5d 74 24 0a cd 1d 02 87 0c 87 28 90 80 28 30 de 13 90 10 80 79 0a d5 ad dc e6 9d 5c 2d 8b d9 03 30 be 65 98 bf 6b 38 55 40 55 85 47 05 d5 b2 54 4a 3a c5 de ed 55 85 4b 23 9c 62 38 c1 20 f8 5e 3b ff c5 de 3b 13 d6 93 c4 be eb c5 06 71 b8 d4 f5 01 df eb 3d 49 40 35 33 58 98 df 44 c5 06 58 7d df 53 bd b3 61 a8 df 00 a6 d4 fc 3d c9 23 30 d7 03 d6 d5 04 be d5 a1 9c 5f 04 76 e0 04 0e e0 50 8d e0 f3 a5 df 5c 98 60 46 f5 00 b0 Data Ascii: .U`]p$nO-K,D15=P[KQLH+z2! >>kM5I{\|it]!(]t$((0y\-0ek8U@UGTJ:UK#b8 ^;;q=I@53XDX}Sa=#0_vP\`F
2025-01-02 05:12:34 UTC	11860	IN	Data Raw: a0 ff a2 9e d8 90 14 f6 a9 14 3b 54 3e 0e ee ad 56 33 10 fd 60 16 38 61 e7 5c 55 3d 95 30 39 71 44 a0 60 80 05 d1 a2 bd 74 13 d4 80 ea 05 d7 73 63 39 36 d4 80 aa 2d 1a 76 0a d9 42 3b d1 70 2d 52 d2 61 db 93 8c 60 ad 4d d7 93 73 a6 80 0a 08 60 06 62 36 66 8b 61 06 64 76 06 e8 86 04 36 b6 3a 39 16 3b f1 02 3d 7f 53 3f 99 90 63 f1 03 db 3a f6 68 91 d6 06 97 ca 68 b1 67 3e eb d3 40 97 f4 01 a4 96 ab 6c ae 2d 02 01 43 b1 b6 3f 73 71 7c ba cb 05 78 e7 e0 5c a0 bb 1c 2e 3f b2 b6 6c d5 e1 3f 71 f4 2d 6a a5 69 67 8e 49 05 f1 15 ec c2 6c c7 29 17 49 a0 56 bc f6 60 ef 33 8a 2e 14 6b 8b b4 56 aa 96 6c e5 76 45 f5 c1 e9 1a 2b 12 3f ae b5 2e b1 46 55 d4 41 bd 6e a8 08 20 15 6d d1 46 17 77 6b c1 0e 43 71 14 05 ce 16 43 19 d6 e7 ee d3 60 a1 b6 73 f9 49 6a d9 51 77 14 6e Data Ascii: ;T>V3`8a\U=09qD`tsc96-vB;p-Ra`Ms`b6fadv6:9;=S?c:hhg>@l-C?sq\|x\.?l?q-jigIl)IV`3.kVlvE+?.FUAn mFwkCqC`sIjQwn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49772	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	355	OUT	GET /static/search2.js HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	347	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:34 GMT Content-Type: application/javascript Content-Length: 3341 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 28 Nov 2023 09:27:22 GMT ETag: "d0d-60b3306961280" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:34 UTC	3341	IN	Data Raw: 76 61 72 20 75 61 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0d 0a 0d 0a 76 61 72 20 69 73 53 61 66 61 72 69 20 3d 20 2f 56 65 72 73 69 6f 6e 5b 7c 5c 2f 5d 28 5b 30 2d 39 2e 5d 2b 29 28 5b 5e 30 2d 39 61 2d 7a 41 2d 5a 5d 2b 29 4d 6f 62 69 6c 65 5b 7c 5c 2f 5d 28 5b 30 2d 39 61 2d 7a 41 2d 5a 5d 2b 29 28 5b 5e 30 2d 39 61 2d 7a 41 2d 5a 5d 2b 29 53 61 66 61 72 69 5b 7c 5c 2f 5d 28 5b 30 2d 39 2e 5d 2b 29 24 2f 69 2e 74 65 73 74 28 75 61 29 3b 0d 0a 76 61 72 20 69 73 4d 6f 62 69 6c 65 20 3d 20 75 61 2e 69 6e 64 65 78 4f 66 28 22 77 69 6e 64 6f 77 73 20 6e 74 22 29 20 3d 3d 20 2d 31 20 26 26 20 75 61 2e 69 6e 64 65 78 4f 66 28 22 6d 61 63 69 6e 74 6f 73 68 22 29 20 3d 3d 20 2d 31 20 26 26 Data Ascii: var ua = navigator.userAgent.toLowerCase();var isSafari = /Version[\|\/]([0-9.]+)([^0-9a-zA-Z]+)Mobile[\|\/]([0-9a-zA-Z]+)([^0-9a-zA-Z]+)Safari[\|\/]([0-9.]+)$/i.test(ua);var isMobile = ua.indexOf("windows nt") == -1 && ua.indexOf("macintosh") == -1 &&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49773	194.147.100.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	362	OUT	GET /pangda/base.js?v=9999999 HTTP/1.1 Host: xmad.7wzx9.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	556	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:34 GMT Content-Type: application/javascript Content-Length: 24639 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Wed, 01 Jan 2025 17:12:33 GMT ETag: W/"603f-62ab304f4024a" Server: nginx X-Cache-Status: HIT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: * Access-Control-Allow-Headers: * Access-Control-Expose-Headers: * Access-Control-Allow-Credentials: true Access-Control-Max-Age: 1728000 Accept-Ranges: bytes
2025-01-02 05:12:34 UTC	15828	IN	Data Raw: 0a 2f 2f 20 76 61 72 20 6f 6e 6c 69 6e 65 48 72 65 66 20 3d 22 68 74 74 70 73 3a 2f 2f 74 2e 6d 65 2f 43 43 39 31 41 56 22 3b 0a 76 61 72 20 77 7a 66 62 79 20 3d 20 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 70 64 73 70 2e 74 76 22 0a 76 61 72 20 77 6f 72 6c 64 42 67 49 6d 61 67 65 20 3d 20 22 2e 2f 63 73 73 2f 69 6d 61 67 65 73 2f 62 67 67 2e 70 6e 67 22 3b 0a 76 61 72 20 62 6f 64 79 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 0a 76 61 72 20 75 61 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 0a 76 61 72 20 64 6f 6d 61 69 6e 20 3d 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 6f 73 74 3b 20 2f 2f e5 9f 9f e5 90 8d 0a 76 61 72 20 78 6c 31 20 3d 22 22 3b 0a 76 61 72 20 78 6c 32 20 Data Ascii: // var onlineHref ="https://t.me/CC91AV";var wzfby = "https://www.pdsp.tv"var worldBgImage = "./css/images/bgg.png";var body = document.body;var ua = navigator.userAgent.toLowerCase();var domain = window.location.host; //var xl1 ="";var xl2
2025-01-02 05:12:34 UTC	8811	IN	Data Raw: 65 6d 6f 76 65 43 68 69 6c 64 28 6d 61 73 6b 42 6f 78 29 3b 0a 20 20 20 20 70 6f 70 42 6f 78 20 3d 20 67 65 74 49 64 28 27 70 6f 70 42 6f 78 27 29 3b 0a 20 20 20 20 62 6f 64 79 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 70 6f 70 42 6f 78 29 3b 0a 20 20 20 20 62 6f 64 79 2e 73 74 79 6c 65 2e 63 73 73 54 65 78 74 20 3d 20 22 6f 76 65 72 66 6c 6f 77 2d 78 3a 20 68 69 64 64 65 6e 3b 74 6f 75 63 68 2d 61 63 74 69 6f 6e 3a 20 70 61 6e 2d 79 3b 22 3b 0a 20 20 20 20 2f 2f 20 73 65 74 43 6f 6f 6b 69 65 28 22 6e 65 77 75 72 6c 22 2c 20 22 30 22 2c 20 22 37 32 22 29 3b 0a 7d 0a 66 75 6e 63 74 69 6f 6e 20 73 65 74 43 6f 6f 6b 69 65 28 63 6e 61 6d 65 2c 20 63 76 61 6c 75 65 2c 20 65 78 68 6f 75 72 73 29 20 7b 0a 20 20 20 20 76 61 72 20 65 78 70 20 3d 20 6e 65 77 20 44 61 Data Ascii: emoveChild(maskBox); popBox = getId('popBox'); body.removeChild(popBox); body.style.cssText = "overflow-x: hidden;touch-action: pan-y;"; // setCookie("newurl", "0", "72");}function setCookie(cname, cvalue, exhours) { var exp = new Da

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49794	172.67.148.80	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	608	OUT	GET /318d22cf923239b38dec8c9337224fb4.gif HTTP/1.1 Host: go.imgmimi.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:34 UTC	962	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:34 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 04 Mar 2024 13:40:35 GMT Vary: Accept-Encoding ETag: W/"65e5cf53-61f75" Expires: Tue, 28 Jan 2025 13:32:42 GMT Cache-Control: max-age=2592000 CF-Cache-Status: HIT Age: 315592 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j6odW6B%2FkJKZxbRGcC%2FWKUwgqxPfHDswsmj%2Bl0434W2T%2FWwusDywqpvEDfWOD8fS0Q7XaiCVwKMj49y%2BDnInMHjOzR3W2AdiRs7n0%2Foi%2FApHwNm%2B%2BfLmC7phY1u71R5M1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb84141c9800fa8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1648&min_rtt=1648&rtt_var=824&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4190&recv_bytes=1186&delivery_rate=178113&cwnd=252&unsent_bytes=0&cid=a0f66e7a5b09673e&ts=172&x=0"
2025-01-02 05:12:34 UTC	407	IN	Data Raw: 37 63 61 64 0d 0a 47 49 46 38 39 61 14 05 c8 00 e6 00 00 5f a7 f3 b2 a4 98 01 91 f0 f0 db d0 fc 59 16 fb db 64 dc cc b7 ea 20 e0 fc f1 d4 ed 60 5a f7 9c 0e 01 71 ef da d8 cf f5 d3 b7 e4 5d eb 8f b5 ed 67 59 54 e6 a3 f4 fe fe 04 b9 ef f8 00 51 dd 91 6d 57 fa 01 00 aa 8e 71 d3 b6 96 d4 b9 b0 1d 10 0b b2 d7 fa d9 00 00 d5 da f6 05 4b 9c 13 9f 03 1c 04 46 b4 04 04 fc d6 8c 93 d0 fb 01 66 dd aa 5a 1f fd f6 b4 72 fa 52 46 2a 20 63 d6 fd 62 45 32 ae dc a0 fb b7 6d f8 b5 b5 fb b9 43 f4 d7 f6 8d fb 6b 5d 69 8d 2a 90 f6 f9 26 03 f9 92 91 fc b4 91 ff fc 86 fa 29 28 06 af f8 00 88 da 77 92 ad 33 af fc fe 84 44 db f0 d8 45 25 55 01 51 f0 da 91 90 fd 93 6d 29 cb 0c bc c9 d4 d4 b1 70 d6 2b 28 c3 2a f3 27 73 ef 61 b4 55 1d d0 ff 8a 78 8b 27 6f d7 e9 72 84 52 7c db 50 e0 Data Ascii: 7cadGIF89a_Yd `Zq]gYTQmWqKFfZrRF* cbE2mCk]i&)(w3DE%UQm)p+('saUx'orR\|P
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 39 63 63 63 34 64 65 39 33 2c 20 32 30 32 32 2f 30 33 2f 31 34 2d 31 34 3a 30 37 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 Data Ascii: ETSCAPE2.0!XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: fe fb 32 a9 1b c3 58 7f 2a 6e ba 78 b0 e3 c7 89 09 73 6d 4c 79 72 e5 92 53 b6 6a b6 5c 53 32 e7 c8 97 9d 55 1d 4d 3a 5d bb cd 9f 53 ab 9e 17 c0 6d dc b6 6b 0b f2 6b ab 10 2d c3 da 59 d2 52 41 01 f7 f5 6e 14 01 f6 e6 b5 3b bc 38 63 e1 c6 93 43 f6 cc 7c b9 f3 e7 d0 43 4b 9f de 39 ba f5 eb ab a9 6b cf 0e 1a b5 77 ee df 9b 77 17 bf 12 6a e9 f3 e8 c3 ab 07 bf da a0 6f d7 70 17 e2 96 6f fb f6 42 de 72 df f7 f6 97 61 bd 45 e4 e4 29 27 60 75 d8 15 18 e0 76 04 22 58 60 66 fe 29 c8 5e 82 10 46 28 a1 83 13 1a a8 0b 83 0d 1e 67 e1 83 14 8e e7 21 87 03 02 63 47 88 1a b6 34 04 7a 28 8e 56 06 88 2c b6 a8 0a 6e fb c9 76 56 05 17 d4 68 23 8d 38 d6 27 a3 6b 3c ea 18 57 70 1b 92 28 64 85 00 fe 67 64 87 07 06 49 e4 ff 92 4a 22 f5 61 93 19 32 09 a5 94 53 22 69 e5 95 2e 66 19 Data Ascii: 2X*nxsmLyrSj\S2UM:]Smkk-YRAn;8cC\|CK9kwwjopoBraE)'`uv"X`f)^F(g!cG4z(V,nvVh#8'k<Wp(dgdIJ"a2S"i.f
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: e4 14 ec 69 51 9b d1 d6 76 14 ad 33 1c 2b 62 0d 8b 24 74 be 93 ad 29 05 87 f2 e0 2a aa 8f ce 35 2b 6e 8a 11 5e 27 48 5c bd d2 54 65 7d e5 17 11 6e 55 57 0c 22 c0 b5 85 85 dd 45 7b 3a 05 2e 2e 36 a1 8f cd 2e 64 1f 60 5d a1 92 81 01 94 05 ed 68 45 bb 59 02 98 97 b3 e5 45 6f 7a d5 4b de f1 8e 36 5e d0 5d 10 6d e3 cb d1 fa d2 d7 be b0 fd 6d 7e 59 6b 0b 3c 5e 0e b7 bb f5 61 80 01 1c d7 b3 de 37 1e b1 b2 67 ad f2 3a d8 bd 2e 31 91 75 b2 d9 ff ea 18 92 44 0c 04 d7 7c 80 3c 8c 6a cd 1a 24 a0 5e 77 a1 8d 05 f1 76 15 fb 58 85 de 0a a9 ec 5d ef 79 55 bc e2 16 b3 d8 b3 2f a6 ea 81 57 1b 5d fc d2 f8 c6 61 6d e3 7e 6d ac 5f 03 ef 38 c7 4d b2 2d 39 f4 c8 ce 22 23 e2 b6 10 85 9e 19 63 eb db 03 1a a0 02 76 2d 64 f6 18 6c 5c 08 d7 28 c1 39 c5 d9 95 bb 20 05 b1 f1 32 b5 f3 Data Ascii: iQv3+b$t)*5+n^'H\Te}nUW"E{:..6.d`]hEYEozK6^]mm~Yk<^a7g:.1uD\|<j$^wvX]yU/W]am~m_8M-9"#cv-dl\(9 2
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: 84 a7 07 8e 25 78 1c 5b 88 57 74 42 74 10 f7 7a a2 e6 96 9a e6 6e 32 d5 84 6d d3 8e 03 81 6a 35 10 3a e3 c8 1b 40 e2 1d 1a d9 7d c3 56 91 7d b8 59 18 a9 8f 8a b9 72 88 55 ff 80 86 77 37 00 50 90 04 49 7d 43 d0 7c 70 98 70 0c d5 05 f7 58 02 ad 44 91 65 67 98 5a e9 31 9e 09 91 cb 72 92 5f 79 88 61 b9 28 a6 79 9a a8 49 13 ab c9 9a b0 09 93 85 a8 92 b1 59 9b b1 89 09 b6 99 9b b6 49 0c 23 a9 9b 31 59 75 a9 29 09 29 60 8a 92 18 9c cd d0 9b ac a9 93 8a b0 92 b0 a9 25 f5 88 95 d0 79 94 a1 a9 1e 56 b9 8c d1 09 95 49 49 9a a8 d1 7b d6 79 9d 4f e9 8b 30 81 9c b2 e9 9b e3 49 9e e6 29 8b de 60 84 2a 42 24 ea e9 00 8b a9 96 ea 71 69 3a 10 97 ea 48 9f f4 66 2b 58 f8 3d 38 f2 96 b4 77 8e f8 51 02 b1 92 10 25 30 7e 0d 40 04 37 a3 04 c5 82 8b 14 a7 00 0a 20 86 9e e9 99 d3 Data Ascii: %x[WtBtzn2mj5:@}V}YrUw7PI}C\|ppXDegZ1r_ya(yIYI#1Yu))`%yVII{yO0I)`*B$qi:Hf+X=8wQ%0~@7
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: b2 35 48 4c 68 bf 29 53 c0 4d a8 37 6a 63 c7 f4 5a 5c 57 65 6a fc 50 c7 39 53 03 7f 45 b8 45 f1 9c 2f b6 99 23 3c 73 0f 48 c9 73 0b 0c 95 6a 81 b5 ba 92 3a a9 cd 9e ea cd 49 70 ba ab 4b ca 24 fc 7d a8 dc 3a 09 80 b2 b0 bb c2 78 18 8e 5a a5 c3 ba 2b 07 37 fc ca b1 68 ac ae 70 c3 93 d7 76 41 3c 07 2a 3d 9b 33 3d 6b c4 b9 b4 af 1a 9b be 7c d3 42 2b a4 5d ec cb 2d 2d 03 21 09 d4 2e 3d 9b 25 92 c2 d6 0c 95 0d ad 0d a0 dc d4 d7 f9 c4 af 10 06 52 1d 9d ce 18 d1 16 8c 0d 4a c6 32 63 9c c6 9f ec a6 e5 6c ce dd 72 2b 88 ea c6 6d 7c d6 11 0c c7 93 5a 12 7e 4b 11 fe 19 2c f8 0b c0 7b 6a c7 4e d8 ae 51 15 6f bd 04 05 73 22 b0 76 05 16 74 83 bd 0d ac c8 c9 08 04 a9 ab d5 94 8a ff c1 81 77 a1 8a 68 14 1d bc c9 38 d8 04 8f 1a bb a3 1a 91 c3 a8 ca 23 5d d2 a8 9c b2 d2 2c Data Ascii: 5HLh)SM7jcZ\WejP9SEE/#<sHsj:IpK$}:xZ+7hpvA<*=3=k\|B+]--!.=%RJ2clr+m\|Z~K,{jNQos"vtwh8#],
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: 4b 26 c6 b8 ec f4 e9 73 d4 b2 a3 38 57 b6 24 ca 33 8c 01 9b 38 5b 0c 65 0a 93 c6 8b 9a 2a 13 50 ed 59 75 1d d6 82 5f c3 8a 05 09 76 65 d2 b3 68 9b 99 4d ab 2c 82 83 03 70 e3 1a 81 1b 01 ec db ba 8b dc ce 95 0b d7 01 de 45 6f f9 f2 fd 8b b4 c3 5a b2 67 31 74 51 e0 a2 80 e3 c7 8d 19 b3 80 6c 83 72 bb a7 03 32 f7 d8 ac b9 18 e2 b2 6a a1 1a 16 3d 6c 05 86 d3 17 52 07 c8 60 80 75 6b d4 98 3b 37 98 ad b9 45 ff 6d d9 b8 6f d3 7e bd 5a b5 0a 0d 1a 54 08 a7 02 1c 85 f1 e3 c1 89 1f 87 30 d6 ab f3 e7 9e a1 47 6f 4e 6c 8a 9d c2 a1 0f d3 e4 4c fd f3 f4 ef da 8d 09 22 c4 09 91 be 52 43 30 49 fc 05 40 bd a6 6f 84 e2 c0 71 05 2a 55 ec 4a a8 5e 4d a5 bf 3f 81 ac ee a0 05 08 e0 80 04 7a 27 dd 4a 1d 95 04 df 68 e1 1d b8 56 82 0a 2a c2 51 45 16 85 e4 91 84 00 51 f8 51 58 23 Data Ascii: K&s8W$38[ePYu_vehM,pEoZg1tQlr2j=lR`uk;7Emo~ZT0GoNlL"RC0I@oqUJ^M?z'JhV*QEQQX#
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: 42 e4 61 3a 2f 64 ab c4 49 33 59 11 65 51 bd 8e f8 aa 91 ac b3 9d 29 1a ea 2e 1c 4a a2 b6 92 b4 41 fb 54 1d 0e 75 06 b1 83 2e 89 a5 51 f9 ff a7 db ca a0 d0 ad 32 31 34 4b dc 0a f0 f8 25 59 c5 8a 85 b0 80 1d a7 68 47 bb 20 30 d1 71 7a cd bb 63 59 4f 2b d2 64 36 43 0a d9 23 00 cc fe 44 33 ef b9 56 b0 d8 91 a9 f9 6a 4a d3 f4 f5 76 a6 bc dd 64 14 50 03 bf 4f f6 d4 53 bf 51 c1 05 70 6b c9 03 19 15 66 cf 05 54 f8 6c e1 ca a5 ce b2 a9 b7 bd ee e4 1a f8 8d e6 62 f3 a9 98 18 1b 7b d8 e9 1e ad 7a 10 b2 8b 10 18 58 8b a9 1f 64 31 b7 ac 1c c2 6e 39 31 87 4e 53 81 ce b0 49 7c ab 81 8c 28 d7 3c ac 35 44 d7 9c 6f 5a 1f 14 da 87 ee 15 c0 66 01 e2 a1 1a 37 d1 af c4 f3 5d f8 3d ac e9 98 d0 59 99 64 f1 95 13 a0 f0 c5 be 93 59 d7 21 93 b1 1d 06 a8 c3 84 54 e1 1f 05 54 2c 21 Data Ascii: Ba:/dI3YeQ).JATu.Q214K%YhG 0qzcYO+d6C#D3VjJvdPOSQpkfTlb{zXd1n91NSI\|(<5DoZf7]=YdY!TT,!
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: 83 a6 c8 77 5d e0 77 51 97 13 e4 b6 28 ad 58 78 42 b3 8a b1 48 53 50 50 8b b6 78 8b 05 29 76 97 74 15 35 33 33 9a f7 8b 90 51 7b 3a e8 79 c3 f8 86 c5 f8 92 e2 d3 85 e1 c5 87 44 78 0f d3 88 8c f0 f1 06 16 d7 6d cb b5 35 ea f5 36 c4 02 04 e7 08 8e 66 75 85 ea f8 2e 19 23 90 55 c9 21 bb c4 88 02 39 97 74 59 60 70 e5 86 65 91 8f c5 97 42 5e a2 60 9f d5 96 e2 f2 03 b7 54 8f 77 79 98 6f 30 95 87 f8 13 68 c9 6d b9 06 07 89 28 71 01 10 88 93 a5 77 ec 77 7f 39 f9 15 94 c9 4f e0 c6 77 e6 17 97 1e 79 98 a2 e9 6b 30 25 80 95 08 12 cc 23 32 34 01 27 2a 69 9a 29 09 93 b0 69 13 ae 41 0a f2 26 6d 17 08 5d 36 f8 77 d4 46 4c 09 49 35 3b c5 8a e4 36 ff 84 45 36 5c 25 a0 06 40 39 79 c0 d9 78 f7 46 94 f5 86 5c b6 a7 83 31 a8 48 9b e7 94 01 d7 05 51 00 9d 2e 59 85 c4 18 1e ef Data Ascii: w]wQ(XxBHSPPx)vt533Q{:yDxm56fu.#U!9tY`peB^`Twyo0hm(qww9Owyk0%#24'*i)iA&m]6wFLI5;6E6\%@9yxF\1HQ.Y
2025-01-02 05:12:34 UTC	1369	IN	Data Raw: 4c bb c2 a7 12 8f 4a 69 c2 1c c5 9a 63 05 b3 8c ba b2 fc cb 4b 78 cc 73 29 b4 06 91 14 5b 3c c6 a5 3a bd 51 fb 25 12 39 15 d7 ac bd 16 3a b0 5b 52 cd 56 3c 3b d9 6c a3 60 f1 ba d9 20 c5 73 20 be bc fc a7 6d fc 4e 6f 4c 09 11 30 48 74 34 b6 a5 60 c7 f3 0b ac d9 a5 41 7e 37 8a 7a 82 ac c8 fa c7 d5 ba b7 82 1c 64 3d 2a d0 87 4c b7 bd 91 c0 fb 0a 04 65 e0 d0 0d ed c0 12 1d ff b8 14 fd 9b b3 21 c1 95 ac 5c 47 2b ae 79 b2 b6 7a 32 82 e6 26 95 a0 1c ca a3 1c 4b c7 58 c2 28 8d b9 2a 5d 84 2a e0 87 ab cc 5e 97 fc ca 65 9c 44 4b 3c bb 9b db b3 ec 1a 38 ce ac cb 26 fc c3 d0 ec 88 c1 cc cb 45 2c cc 84 59 2a 3c 4b 22 e0 49 95 ca d2 ba 08 c1 ba b6 e5 ca d9 d2 a9 dd ec cd 93 e5 89 cd 3b d5 54 cd 74 2e 1c 3d 96 85 d5 5e 0d aa a9 f8 71 35 7d cc ef c4 ce 42 3c cd b0 4c 4b Data Ascii: LJicKxs)[<:Q%9:[RV<;l` s mNoL0Ht4`A~7zd=Le!\G+yz2&KX(]^eDK<8&E,Y<K"I;Tt.=^q5}B<LK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49767	3.5.146.228	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	612	OUT	GET /wns1300x200.gif HTTP/1.1 Host: sezhang.s3.ap-southeast-1.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	448	IN	HTTP/1.1 200 OK x-amz-id-2: UY9VTU6SihUP6Zb+6/2TMsJiVfn69l0AArq+7laWH0EIzKHijyiPmXUQZA4aBXKXDwRDreZmGr2mbuXUnm51vAfKQEtA0EEUDgDuULHsMRA= x-amz-request-id: PR4TV0AZNR1DXP27 Date: Thu, 02 Jan 2025 05:12:36 GMT Last-Modified: Tue, 10 Dec 2024 11:40:45 GMT ETag: "6f3da74816d4b2b65413f732991f8c10" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: image/gif Content-Length: 569641 Server: AmazonS3 Connection: close
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 fa 00 10 03 02 16 06 02 17 0b 01 1c 0a 08 1d 03 04 1e 12 03 21 14 04 2b 0e 03 2e 15 11 2e 21 13 3b 32 24 3f 23 1b 4a 3b 2f 4d 35 20 56 46 36 5c 54 42 17 00 02 18 04 04 21 03 04 2d 04 05 67 4f 35 69 5c 44 6b 62 47 79 5d 3f 7a 63 41 7c 6c 51 85 75 4f 86 71 5e 89 7e 5e 2f 11 08 3d 04 05 40 15 0e 4f 21 1d 69 52 42 7a 42 23 8b 6f 4d 99 7d 63 a1 89 73 40 06 09 5a 3b 2f 8b 63 45 99 79 61 79 51 3e 98 6e 65 4f 0f 0a 4f 15 10 40 01 08 60 21 1f 3e 00 05 15 00 00 33 02 07 17 00 00 62 38 1e 37 00 05 41 02 07 44 00 07 1f 00 03 1f 01 03 2c 00 05 2d 25 1f 3e 38 2d 76 69 5f 0b 06 04 4c 0e 07 2e 00 03 0b 01 00 66 26 3b 21 00 04 29 00 03 1a 13 0c 54 46 24 5f 49 21 95 77 4c 9c 82 62 5e 1f 15 55 50 40 7e 6a 40 98 82 4c 9f 89 65 a5 98 77 a6 9b Data Ascii: GIF89a!+..!;2$?#J;/M5 VF6\TB!-gO5i\DkbGy]?zcA\|lQuOq^~^/=@O!iRBzB#oM}cs@Z;/cEyayQ>neOO@`!>3b87AD,-%>8-vi_L.f&;!)TF$_I!wLb^UP@~j@Lew
2025-01-02 05:12:35 UTC	576	IN	Data Raw: f1 b7 86 6b eb 84 a8 53 6e b8 f9 90 41 ba ae 6b 55 6e b5 53 b9 ab 01 d4 78 01 08 c0 8d e3 b8 8e 33 5b 03 a4 03 2f d8 b4 b1 96 66 03 cc 35 12 47 83 11 44 ff 66 ca 9e 72 8d 02 e9 59 26 f6 2b 3f 79 bf c6 b2 61 4b 49 5d 41 89 96 b8 55 2c 2b 09 5e f1 f2 38 47 51 fc fa 72 93 02 b3 30 9f c1 30 53 ec a3 88 81 06 0c 80 03 2c e6 b1 69 4a a7 20 c1 02 5c e9 a7 b4 a9 17 30 81 31 52 66 67 ad ac cb aa 56 13 34 c1 18 95 11 a0 07 ba a0 03 7a 9f 27 01 12 18 ba a1 77 41 12 28 fa 69 ad 56 14 48 41 18 40 7a 01 97 26 2f eb 6c 6e 7b 4b 1a 38 c1 f0 09 9f f0 dd a9 6b b2 f3 0c 0c ad a2 c2 33 d4 32 83 70 33 2d a1 d2 a3 09 a8 00 09 e7 33 c1 49 ad cf 22 27 6b c2 70 c5 38 60 73 0f 34 ae 13 34 09 4e 67 1e 88 44 34 50 03 8b 45 43 47 97 a0 33 e8 d2 f3 86 b4 55 84 f7 06 d6 97 48 98 44 4c Data Ascii: kSnAkUnSx3[/f5GDfrY&+?yaKI]AU,+^8GQr00S,iJ \01RfgV4z'wA(iVHA@z&/ln{K8k32p3-3I"'kp8`s44NgD4PECG3UHDL
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 37 4f 4c 7e 34 0c 28 4f 38 f4 89 2c 34 79 63 7b 18 07 4e e8 8f 02 df 1e 84 5f 7c 3b 45 84 bb bc e7 be 44 5c dc 4c ef 5c 87 c1 80 29 50 bb e5 2a 8e ae 3e 06 0b a0 c2 23 98 c2 28 8c c2 e4 b3 bb 48 8e 04 2f 2c af f2 ae b7 f2 a2 77 8a bc 83 f4 db 77 ca cb 37 7e e7 f4 68 7c 61 f0 c6 86 1d 4a 0f 55 3f e5 9e 2d 03 fa 93 e1 df 49 ab ef c2 94 4c e1 f1 87 6a 6b c3 1b a2 1f e7 9d de 09 22 6e bc 82 fa 77 6b 7f 00 44 2e 81 03 a1 19 5b 56 26 58 42 60 0a 17 32 64 78 06 d6 29 61 99 2c 55 b2 b8 08 10 a0 3b 76 38 ce f1 e8 d1 40 81 90 02 48 96 1c 40 f2 11 3b 6f f6 58 b6 c4 e7 92 25 3c 76 82 02 00 b0 09 60 10 3b 78 2f 79 c2 e4 d9 6d 1d a1 9b 41 88 16 55 64 f4 68 52 a5 92 96 32 75 da 14 aa d3 21 3a a6 56 9d 60 95 08 d5 ab 5a b3 76 e5 fa d5 ff ab 55 1c 59 25 8c 35 5b 16 ed 59 Data Ascii: 7OL~4(O8,4yc{N_\|;ED\L\)P*>#(H/,ww7~h\|aJU?-ILjk"nwkD.[V&XB`2dx)a,U;v8@H@;oX%<v`;x/ymAUdhR2u!:V`ZvUY%5[Y
2025-01-02 05:12:35 UTC	1024	IN	Data Raw: 5f ff 3c 7e 91 23 d7 71 11 b4 78 0f 32 14 aa a7 73 bc 16 6c 5d 36 f9 5b e6 6b 80 c0 21 30 c7 40 09 05 0f 22 24 98 70 e1 41 08 33 1c c6 00 20 71 62 10 8a 15 2f 2a c2 98 71 a3 24 8e 1e 3b 7e 0c 29 72 24 48 92 26 4b 7a d4 a8 f2 64 ca 95 16 5d c2 8c e9 43 e6 4c 8a 01 2c 0a f0 91 73 a7 80 1d 4e ae f0 39 13 74 28 51 3e 49 16 f0 14 b0 40 c3 97 a2 4e f9 5c 89 1a 55 8c 93 06 05 72 16 48 80 64 8b 98 3e 5e b7 78 35 b3 c5 0c d9 b2 64 c3 a0 45 db e5 88 81 a4 6e dd 2a 68 e2 65 6e 14 ba 75 ed ce 3d 32 a7 6d 81 06 72 ef e2 05 2c d8 6e da c2 61 cc 1e 4a 9c d8 6b 1f 31 8e c5 18 8a 2c d9 50 17 a4 03 04 5c ce ac 79 c0 89 2d 69 3e 83 56 23 7a b4 16 07 7c 2f 27 90 a2 a6 cc ea 32 ae 5f bb 1e b3 a1 c3 81 03 27 b0 c0 ce 0d fb 02 ed 06 54 74 b7 ff 81 ad a6 04 88 0f 26 8c 1b ff 61 Data Ascii: _<~#qx2sl]6[k!0@"$pA3 qb/q$;~)r$H&Kzd]CL,sN9t(Q>I@N\UrHd>^x5dEnhenu=2mr,naJk1,P\y-i>V#z\|/'2_'Tt&a
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 20 ac 2f 5d 78 0c c8 c2 92 98 81 ad a1 60 69 69 82 55 f0 b7 b0 56 61 00 63 78 e1 e1 aa 2c 16 98 23 06 26 2d 73 31 cc c0 02 f6 15 91 4d 46 32 95 f9 e1 66 12 90 04 34 b8 2c 66 ee e1 42 c2 d4 64 01 2d e8 0c 38 6a 98 82 55 10 90 81 31 00 27 37 57 38 41 6f a6 93 46 d6 10 07 39 5d 83 ce 77 b8 03 1d e8 94 2d 6b 58 5b 5a 1a 9a 06 b5 e5 d4 31 90 e0 69 ce 77 c6 73 9e f4 b0 47 6d 68 83 0f 1f 50 c0 82 b7 41 d2 3c 26 5a 50 de 2a 49 20 4a fe a7 41 0f 0a dc 84 1a f1 80 0a f0 c0 70 9d 60 44 e2 18 b1 03 0b c5 c1 13 0f 20 dc 03 36 d4 21 1a 54 ce 73 b2 9c 25 2d 6b b9 1f d0 dd 2e 97 ba c4 1d eb 78 e9 4b 2b f1 2e 98 c2 44 9d 92 48 f7 4b 60 ea c0 77 ca 0c 5e 9a d2 b4 19 8a 41 b3 78 6f 32 15 fa 22 c5 be f6 49 cf 9a a4 ca 54 f9 ba 89 3e 44 a5 ff 4f 9b e2 8c 9f 37 cb 09 4e 6d b2 Data Ascii: /]x`iiUVacx,#&-s1MF2f4,fBd-8jU1'7W8AoF9]w-kX[Z1iwsGmhPA<&ZP*I JAp`D 6!Ts%-k.xK+.DHK`w^Axo2"IT>DO7Nm
2025-01-02 05:12:35 UTC	1024	IN	Data Raw: 80 09 06 dc 01 01 f1 ca 00 1c b6 a4 82 70 78 e9 16 85 30 05 2a e0 a0 a6 64 8c 63 91 1b a0 12 26 36 d1 08 54 f0 89 4e f1 80 86 9e e6 d4 a7 3d f9 89 21 74 12 54 06 96 d5 05 87 4d 8a 51 ab 9c 80 2a 59 a9 ad 35 70 ab 11 98 58 01 26 42 c5 a9 5a 36 62 07 21 20 41 09 28 49 ab 77 9c 40 98 27 50 00 ac 18 80 2a 64 d6 4a 99 9e c8 15 26 7a 80 09 eb 68 50 5f 3b e8 c4 9b 46 90 46 2e 24 6b 69 6b 18 01 b6 66 e0 cd 6f 86 13 9c e3 14 67 39 b1 85 00 65 61 6a 63 ff f2 17 3b dd 89 85 0a 11 23 89 33 4b 22 32 a6 01 c2 99 fd ca 5e ea 22 46 28 3e 48 2f 05 f9 42 0b 32 82 42 bb 42 b1 09 62 08 e4 0d 16 58 96 17 12 00 31 88 5e 2c 00 12 6d 61 45 53 88 82 58 ae 21 53 8d 20 63 3b 3d 56 2e 2d fc a2 1c c6 28 07 24 4c 96 06 35 5c 21 83 c2 4a 11 08 99 79 ff d0 50 10 63 16 59 c0 c2 c9 d0 e0 Data Ascii: px0dc&6TN=!tTMQY5pX&BZ6b! A(Iw@'P*dJ&zhP_;FF.$kikfog9eajc;#3K"2^"F(>H/B2BBbX1^,maESX!S c;=V.-($L5\!JyPcY
2025-01-02 05:12:35 UTC	1749	IN	Data Raw: 02 fd ec 57 5c b4 27 82 05 6a df 9f ff 9a 11 40 f9 c8 07 ba 3e e0 00 17 be b0 0b 41 5c e0 02 7f 18 41 12 c0 6b c1 e6 54 61 0a 49 78 c2 90 c8 30 5e 89 4b 9c 0c 56 40 06 28 a8 d9 41 c8 73 90 bd 93 df 43 79 52 11 8b 4a ac 50 f3 ec 59 0f 0c fd c0 07 1a fa f7 c5 3c 24 fd 07 36 70 20 83 cd e2 89 9e 60 a2 a8 1f fc 06 05 09 b1 60 d0 d1 42 18 c4 30 85 5a 51 73 c4 19 1e 00 02 2e f0 dd 01 5d b0 0a 3d d8 c1 8a 7a df 7b 2e 50 81 8c cb bf 02 85 9d df fc 2b a0 51 0c 13 5e 83 8b 61 0c 60 17 e0 30 8e 73 d4 a4 26 fb 94 27 3e 56 e3 08 3c f8 83 9f 28 b1 22 06 a0 80 84 22 10 c1 08 40 60 02 1e 7a 20 0f 5d f0 c2 33 20 11 82 ea 04 a2 14 0b 90 c3 28 b2 cc 65 3c e1 b2 3d f9 32 78 b0 85 3d 51 86 31 33 25 35 42 14 1c 50 33 34 6b 25 08 7c 40 6d 31 ff 94 29 60 97 50 98 06 4f 00 05 21 Data Ascii: W\'j@>A\AkTaIx0^KV@(AsCyRJPY<$6p ``B0ZQs.]=z{.P+Q^a`0s&'>V<(""@`z ]3 (e<=2x=Q13%5BP34k%\|@m1)`PO!
2025-01-02 05:12:35 UTC	9000	IN	Data Raw: c7 3f 0d ad 84 4c 2b 5d 78 3a 52 68 2d 80 dc de f1 99 c7 42 bd 47 c0 e8 df c1 d8 d1 c8 e8 ff 03 df 72 48 e1 1a ae 88 2c 0d 8a 64 bb d7 78 8d d8 00 97 cf 9b bb 0d 18 01 38 e0 05 54 68 82 27 70 20 c0 6b d5 12 08 81 0d f8 bb e5 c0 a0 42 94 3c ec c0 d5 99 8c 49 f6 52 00 56 18 05 47 08 04 16 c2 af 00 98 1b 39 d8 82 9e f4 49 fb b8 be 1f e9 01 66 4d 90 03 99 85 80 2a 30 d9 a3 56 68 a5 85 da 60 96 6c 0d 01 2a fe 22 46 4b 00 05 08 81 12 78 83 10 08 11 09 22 d7 0b f2 5a 4c 00 83 6d eb 30 02 19 a1 42 80 d7 b4 a4 57 1f c8 00 da d8 02 7d 45 56 b9 ac 01 80 95 34 5e c8 05 bb ec 32 8e c5 04 28 30 06 85 bd 04 16 e1 81 10 20 21 38 b8 00 1a 78 3b 67 78 87 2e e8 83 65 48 06 f4 60 11 2c 6b 05 07 48 11 47 c0 e3 2c 33 86 5d 88 57 e8 63 db 4d 26 33 13 15 cd d1 2c 4d 51 7e 40 b4 Data Ascii: ?L+]x:Rh-BGrH,dx8Th'p kB<IRVG9IfM0Vh`l"FKx"ZLm0BW}EV4^2(0 !8x;gx.eH`,kHG,3]WcM&3,MQ~@
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: c6 31 76 d6 b4 35 e4 3f 72 68 1b 5c ff 92 b3 2a 48 43 ae 73 13 dc e0 54 9e 57 6a e4 c2 16 73 0d 5c 5f ff 5a 73 c3 a9 22 10 27 b0 00 1c 6a 51 8b 5b 20 a1 10 b8 50 46 34 ce 71 0e ec aa 10 74 a6 53 fa 65 73 70 59 d5 69 b6 75 3b 78 83 c8 8c a6 00 14 53 9b 16 c4 48 49 03 66 f2 02 9c 78 4c 01 d9 01 0a 20 34 73 5b 40 90 62 b7 df fb 8a 34 20 f1 0c 3f fc 82 17 b9 30 46 2e 72 21 c3 61 18 c3 e6 4b 61 07 74 c7 b7 3e bf ff 9d ba e6 bb c3 20 52 b1 85 60 5c 01 03 83 90 05 e3 be 2b 88 24 fc 65 04 14 10 c1 11 de a1 de 76 b4 83 1b 50 28 20 32 1a 71 51 a9 23 03 f4 6f 40 6d 7c df e0 0b 62 58 80 82 34 b8 c0 80 0f fc 17 92 93 5c 83 fc 21 0b 83 71 03 81 d0 51 18 f7 28 e4 d8 d1 46 d0 85 00 97 46 3e bb d0 c5 2e bc 40 81 21 be 47 3c d3 48 49 27 42 81 89 ff 99 75 c2 13 a0 50 f1 26 Data Ascii: 1v5?rh\*HCsTWjs\_Zs"'jQ[ PF4qtSespYiu;xSHIfxL 4s[@b4 ?0F.r!aKat> R`\+$evP( 2qQ#o@m\|bX4\!qQ(FF>.@!G<HI'BuP&
2025-01-02 05:12:35 UTC	1024	IN	Data Raw: e8 f1 82 da d5 7e dc 3f 50 80 7c 17 98 fb dc 05 01 60 3e 92 17 41 08 52 2f 8b 84 38 44 38 24 68 45 82 98 fb 1f ce 33 42 f4 64 60 7d 5e 48 81 03 32 80 5f fd 82 3d 89 32 2e 64 0c 16 10 19 24 a0 62 10 34 b8 c3 1f 06 f1 87 cf ff 41 bb 17 80 fb 1e be 05 23 64 38 40 c3 66 34 c2 11 d2 98 46 10 57 c2 f5 ae 1f 31 89 a5 74 62 07 31 01 bd 83 00 04 0d 4c 21 08 1d 27 01 01 33 1e fe 9b 47 6d 2b cb 9f 67 0a 50 18 87 38 50 21 4c 18 6a e6 15 2f 13 54 0f 36 d1 4c 4f 8a ab 04 b5 78 44 94 55 80 82 14 78 c1 7c 24 f8 14 a8 20 bc 29 5a 58 e1 0b a6 0a 47 16 0e 92 85 35 b0 ea 19 87 08 bf 0f 93 40 01 e3 c3 b9 f8 ff 1d 81 13 38 60 fd 1d 29 d3 ae 84 42 23 e4 48 23 ec 80 b8 6c d2 1b 0c 8b b7 70 d9 06 54 13 26 60 02 32 ac 4b 15 30 9a f2 41 c1 14 b0 4b 38 55 ff 01 a7 95 0b 15 a0 8b 15 Data Ascii: ~?P\|`>AR/8D8$hE3Bd`}^H2_=2.d$b4A#d8@f4FW1tb1L!'3Gm+gP8P!Lj/T6LOxDUx\|$ )ZXG5@8`)B#H#lpT&`2K0AK8U

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49792	23.224.82.187	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	586	OUT	GET /img/996a_180x180.gif HTTP/1.1 Host: ig79.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	1087	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 1848 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb838e588862b90-LAX Content-Length: 509971 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:06:52 GMT Etag: "6769630e-7c813" Expires: Sat, 01 Feb 2025 04:36:04 GMT Last-Modified: Thu, 02 Jan 2025 05:06:52 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YOn2HhnTp8C7UjcX42DdIPDubi8neywq4MDfDQQqsZNAeZYMwcX%2FD2BXuoV9OjhBkp72wuIqWUZ1T7VaeDhLmF4nZSyvAiIbBeKgcPkTBpnsyBmD4EbiqJt4xAt1fxGZ2g%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=976&min_rtt=830&rtt_var=66&sent=11265&recv=592&lost=0&retrans=50&sent_bytes=15776986&recv_bytes=34493&delivery_rate=59182561&cwnd=266&unsent_bytes=0&cid=1b60333668623c9d&ts=37042&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:35 UTC	99	IN	Data Raw: 47 49 46 38 39 61 b4 00 b4 00 f7 00 00 d9 49 26 ff ff b1 0d 2c 49 f1 b0 93 a0 de f5 a3 b0 dc 4d 66 9b f9 ce b5 d6 6f 4a 0a 22 2f 22 fe 00 b1 0c 00 d8 4a 0c 5f af d8 00 cc ff f7 88 2b 28 4f 8c f4 b8 ae 5c d1 fe f9 44 30 f2 8a 71 fd f3 99 f2 67 4c 95 04 00 95 a4 aa b5 22 09 f9 b3 00 fe ec 67 f5 d5 Data Ascii: GIF89aI&,IMfoJ"/"J_+(O\D0qgL"g
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: 8a fa 0e 08 f0 70 29 24 44 71 b6 47 2d d5 8a 51 a0 95 19 f3 99 86 d3 0d 00 6f 8a ad 11 44 6e 0c 8c cc dc 8e 6f ee 90 00 b6 5d 53 37 b7 f4 25 30 4b 00 75 b9 d4 33 23 01 11 24 9a 9d 62 0c 88 b9 4a 4d 49 d8 6b 2c 61 63 1f d3 d9 f4 d7 76 69 da 95 8f cf f0 f8 28 67 96 25 32 6b ef b3 76 22 98 d4 b4 32 1d c8 d3 d9 dd 66 03 ff 99 3d f1 77 60 d7 55 3c f6 33 23 10 52 89 29 aa df f1 55 3b 0d 31 68 d0 b6 06 43 52 74 dc ab 6a 2d 45 4c 4d 69 72 5e 20 21 2d 68 b0 a1 e9 a3 d1 b6 af ff ee 2f 54 fa 1f 26 2c 2f 15 ae 15 ea 77 00 d4 d2 8e 2b 60 d0 93 e3 6d 26 53 af 1c 55 1e 09 b3 ee 67 7a cb 66 de 5f 6d 6f 77 d4 d4 b2 0e 66 91 78 8a 61 6b 6e 4c 10 46 52 dd cc 08 5a db a5 db 67 91 54 67 52 d4 ae 92 8e 2b 29 fe ee 0c 56 30 45 10 4f ac 07 aa da 75 4b 4e d1 f2 d0 97 22 10 98 2b Data Ascii: p)$DqG-QoDno]S7%0Ku3#$bJMIk,acvi(g%2kv"2f=w`U<3#R)U;1hCRtj-ELMir^ !-h/T&,/w+`m&SUgzf_mowfxaknLFRZgTgR+)V0EOuKN"+
2025-01-02 05:12:35 UTC	538	IN	Data Raw: a8 92 09 60 a9 04 05 65 2b ae c0 ba 09 eb b0 c4 ce 6a ec 82 75 fe 0a ec aa 7b f2 ea a7 23 ca 2e 9b 2b 1c 6b 10 bb 04 0b d8 66 3b ac b1 c7 76 6a 88 72 d2 e6 fa a8 99 d6 45 0b ee b9 e8 f6 90 81 6b da 2e e1 ee bb ee 6a ab 6d ab dc 76 9b a9 67 9e 9a 9b 6e ba a4 ba c7 a4 be fb aa ab 2e ab d7 c2 6b f0 bb f3 c6 5a 2f 97 c4 36 ec b0 00 b5 02 1c 70 06 86 94 89 9a af 19 0c ac f1 c6 1a af eb d8 c1 06 cb 20 b2 c1 09 d3 7b ac c3 f2 a6 ac b2 b6 4d 18 92 71 c7 1c 77 dc 6c 61 cf 66 60 f3 cd 38 e7 8c 33 b5 d9 86 2c f2 cf 40 8f 1c 6f c9 28 17 6d f4 ca 48 93 c8 42 cb 3a 37 9d f3 b8 70 95 eb f4 d4 eb 56 0b 72 d0 58 03 8d 30 d1 47 a3 5c 30 c9 d7 66 2b f6 d8 64 7f b6 46 1a 54 3b dd 2f 56 ff a6 dd b4 63 3d bf 9b f5 19 74 9f 91 b5 d0 5c 77 4d 36 c8 7c 83 ff 5d 76 78 e5 b9 dd b4 Data Ascii: `e+ju{#.+kf;vjrEk.jmvgn.kZ/6p {Mqwlaf`83,@o(mHB:7pVrX0G\0f+dFT;/Vc=t\wM6\|]vx
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: 58 3d 3c 24 e1 87 60 0c 23 07 fb c7 3f db 89 ed 88 48 1c a0 0e 74 c0 82 4e 30 4d 8a 70 ac 58 92 06 52 be 38 4a 51 4a 21 ac 22 0d 23 98 bc 3e be 4f 8b f7 c3 43 0f 73 40 c8 41 1a 20 07 78 48 a4 22 09 c9 48 27 38 f2 91 8f 04 62 07 89 68 44 34 12 81 84 6b 5c 23 b6 dc 08 87 25 96 69 81 76 6c a1 03 c7 00 b8 07 ba 8b 8f ae 4b 25 20 83 b8 c8 46 ba f2 95 8d cc 02 24 67 19 49 03 28 52 88 94 c4 5c 00 bb 87 c4 4c fa 92 8d d9 32 61 28 5b 68 a1 25 ba 29 3c a4 d4 e3 1e 55 19 c4 66 b2 b2 95 b0 94 65 34 65 49 cd 2b 58 f3 9a b3 b4 65 22 ef 47 46 33 86 90 97 98 cc 84 38 7f 09 4c 25 2e f1 74 8f 40 1f 32 95 b9 cc 55 3a f3 9d d0 9c 26 35 e5 79 cd 7a 5a 53 9a 8c f4 a2 f4 ce d0 ff cd 22 6a 4f 00 68 4c e3 38 d5 48 4e 1d f0 ee 9c 69 73 4c 96 d6 59 a2 19 b6 b3 6e ef 8c e8 20 61 f9 Data Ascii: X=<$`#?HtN0MpXR8JQJ!"#>OCs@A xH"H'8bhD4k\#%ivlK% F$gI(R\L2a([h%)<Ufe4eI+Xe"GF38L%.t@2U:&5yzZS"jOhL8HNisLYn a
2025-01-02 05:12:35 UTC	5930	IN	Data Raw: 4d c1 e8 80 9a a8 ba 0f 20 74 52 c2 ed 84 fa d0 3b 96 2e 54 6d c3 e9 3e d4 92 05 9d 42 8c 72 44 a0 2a 49 43 05 32 cb 2c 13 8e 47 c6 44 20 84 10 10 50 21 8d 47 2a 81 a8 89 47 40 58 93 4d 37 d3 68 02 a2 4a 9a 50 13 4f 15 40 78 64 8d 24 74 3a 52 a1 24 95 94 ff c8 c1 07 99 30 e0 d1 07 45 94 72 ca d4 aa 04 0f 43 0d 17 cc 52 4b 41 40 e4 a9 50 db c0 14 75 54 e9 4a 35 55 a2 26 9d 0c 15 d1 44 3d 5a 6b 89 46 1f 85 34 09 49 27 ad f0 3b bc ae d4 74 d3 2d 51 45 ef 50 52 83 15 56 d1 54 0d 88 74 8c db 04 01 73 51 07 1d 95 95 09 5a 81 55 d4 3c 2a ed ba 54 d7 5d 39 55 d6 d3 da a4 1d f6 5b 53 c3 75 95 4b 08 54 45 96 d4 25 61 75 56 d6 68 29 a4 d4 c2 6b ab 74 29 5b 6d b9 4d cf 5b 70 f3 5d 36 27 3c 20 ac 75 d9 25 63 9d 75 42 5b 43 aa d4 da 5c e5 85 6e 2f 4e 41 ec 72 55 56 f5 Data Ascii: M tR;.Tm>BrDIC2,GD P!GG@XM7hJPO@xd$t:R$0ErCRKA@PuTJ5U&D=ZkF4I';t-QEPRVTtsQZU<*T]9U[SuKTE%auVh)kt)[mM[p]6'< u%cuB[C\n/NArUV
2025-01-02 05:12:35 UTC	7116	IN	Data Raw: 16 85 dc ea a4 69 c7 7f 02 60 7d c4 48 b2 fd 69 b2 bb ca ad cc e3 21 d2 5a 49 ac 36 01 9a 85 62 66 7b b6 66 8b 18 68 bb b6 dc 95 16 6b 6b 61 a1 00 65 a8 85 5e 5d 36 b7 e8 e5 03 17 eb 9e 50 4b 82 b2 5a 59 55 eb 7c 3b 04 a5 87 ca 85 89 4a 4d 50 85 b1 b1 88 b2 e8 e3 96 61 ab 46 b6 d0 71 24 41 5f f2 25 b9 a7 40 5a 91 6b 27 95 3b 5e db 35 02 07 50 62 28 d6 71 9c cb 61 14 f0 5e 78 9b b7 50 78 53 49 a0 66 fb 37 b5 57 2b b8 e3 0a 93 e5 6a ae b6 a8 b8 ad 03 b6 8d cb 02 49 10 b7 2e 60 81 b3 76 62 52 b6 7e 4f d6 0a bd 76 78 14 a0 71 24 27 09 93 1b 6c 97 66 ba ce 07 73 f9 68 95 ab cb ba 58 ab 9c 5a bb b5 d3 07 6a 8b cb b8 c1 a5 46 5e d0 6a e1 f7 6d be ff d0 0a e6 a6 7e 42 b0 59 e3 4b 97 a5 70 0a 4f 76 6b 18 d6 71 ec 4b 97 95 3b 66 ab 75 b1 99 47 b5 56 b8 6f a0 e7 ba Data Ascii: i`}Hi!ZI6bf{fhkkae^]6PKZYU\|;JMPaFq$A_%@Zk';^5Pb(qa^xPxSIf7W+jI.`vbR~Ovxq$'lfshXZjF^jm~BYKpOvkqK;fuGVo
2025-01-02 05:12:35 UTC	8302	IN	Data Raw: 08 02 10 00 13 0a 50 c8 8d 84 b4 b9 75 7c 5f 56 d7 c4 0a 25 88 13 a7 e5 5b ae cc ae 46 e0 cb 2e 74 c0 04 3e dc 02 80 fb 41 71 66 60 79 03 60 ac e5 6e 2b 4e a5 02 8f b1 07 28 6e 7c 37 9c 04 0c c8 82 25 f7 cd ef c0 98 66 5a 58 a8 e0 02 0b 68 2b 85 db a9 de 06 4b 54 08 82 d5 e7 08 c5 19 de a8 5d 20 03 0a 75 aa 38 cd 4b e1 1e dc a2 04 1f 10 80 20 04 b1 61 01 e8 a0 04 9f ed 08 b6 06 16 91 26 37 99 c4 19 d1 45 60 2f 50 e3 54 3a 18 c5 28 2e ef bd 10 70 63 2c 5f 00 c5 42 08 01 67 7d f6 db 9f 56 b9 45 28 70 30 79 2f 00 02 58 30 41 ff 07 43 1e 72 91 75 f0 81 12 20 d7 be 4e ce 73 9e a1 dc 4a 0c c8 c0 0a fe bd 40 8b 9d 84 de 0b a0 80 03 03 e0 40 a1 b3 fb 89 13 1b 1a d1 3b d8 01 07 58 11 02 14 4f 96 14 82 bd 80 0a e8 26 04 4d ff 14 c3 fc 5a 80 a6 59 91 04 1d 74 22 ce Data Ascii: Pu\|_V%[F.t>Aqf`y`n+N(n\|7%fZXh+KT] u8K a&7E`/PT:(.pc,_Bg}VE(p0y/X0ACru NsJ@@;XO&MZYt"
2025-01-02 05:12:35 UTC	3667	IN	Data Raw: 4d e2 57 2f 0e ec 80 eb 53 17 f9 c7 0d ca f7 be fb bd ef b1 28 37 08 24 4b 78 b4 c3 61 7e 85 9f 81 de 11 9f f8 72 f3 31 f1 65 7f 76 18 04 90 00 01 24 01 03 b2 38 08 dc c3 23 f7 91 5c 02 68 a4 0d c1 05 2e 00 87 58 fc 3d 03 a3 4f 7d b9 57 cf fa d6 bb fe db a9 bf 80 e9 0f fa 4f 38 90 3e 16 b8 a7 7d e0 47 5f 7a dd 7f cc f6 bd d7 7d 06 6c 4f 7a a0 7b 81 f2 95 a7 bc e6 3f 1f ae ce 8b 84 f9 75 bf 7b ec a7 4f fd ea 5b ff fa d8 cf be f6 b7 cf fd d8 73 9b 03 68 48 02 ff f2 93 bf 7c c3 cd dd 05 13 48 ff 04 5c 90 6d 72 6f ff f5 f0 8f 3f fc bb 4f ff fa 7f df 0a 5e f8 80 0e c6 2f 80 f2 ab 9f 7c e7 a7 7e e9 d7 5f 3b 60 73 d7 f7 71 08 a0 04 21 50 78 0c d8 80 0e d8 80 21 70 2f fd 04 7f 16 e6 7a 3d 00 02 2a 50 76 ac 57 81 16 48 5a 56 50 02 10 a0 7f 3a c0 02 4b 50 82 26 61 Data Ascii: MW/S(7$Kxa~r1ev$8#\h.X=O}WO8>}G_z}lOz{?u{O[shH\|H\mro?O^/\|~_;`sq!Px!p/z=*PvWHZVP:KP&a
2025-01-02 05:12:35 UTC	10674	IN	Data Raw: bc f1 c8 11 30 9b 2f 82 c1 84 88 60 b9 27 93 1a 52 ca 22 87 b0 2a 42 25 05 23 a8 c9 94 5c d9 0f c9 a1 b2 9b cf 46 30 77 d4 2f 08 2b e9 9b 60 88 38 f3 14 93 82 e0 42 a9 52 c9 11 8c c0 53 4f 29 87 98 20 88 50 00 a5 ff 31 d0 41 09 0d f3 d0 3a f7 03 c0 15 94 06 58 0a 81 f3 00 fd 32 4e 1e 3f 29 2f b0 3b 1d d5 d3 88 2d ff 7a 45 50 51 f3 9c 40 be e5 4e 6d 34 d5 47 59 dd 8f 02 94 28 28 28 d1 be 42 19 c0 82 57 39 05 6c 00 58 09 1d 62 84 e5 80 0d 56 4f 62 fb 8a a0 d7 63 89 1c d6 b4 50 1e 73 f1 18 1b 2a 33 6d d9 60 3b 5d 85 14 63 f3 54 e5 5b 70 c3 05 73 d5 ed 98 f5 56 dc 42 73 3b 60 d3 73 d1 1d 37 d9 11 0a a2 00 b6 6a 5d e0 eb 80 52 da cd 51 db 75 cf 25 c1 10 80 03 2e 25 5f 4e 23 60 57 ca 81 03 16 98 60 30 49 45 35 ce 84 15 26 e1 12 86 a5 34 c2 3f 52 ce a4 34 5e 50 Data Ascii: 0/`'R"B%#\F0w/+`8BRSO) P1A:X2N?)/;-zEPQ@Nm4GY(((BW9lXbVObcPs3m`;]cT[psVBs;`s7j]RQu%.%_N#`W`0IE5&4?R4^P
2025-01-02 05:12:35 UTC	11860	IN	Data Raw: 89 0d f7 da d2 ea c7 ab f6 8b 82 a8 b3 09 21 32 c9 03 99 04 ef a7 9f 52 28 b5 d4 13 2f 6a f5 d5 28 38 dc 90 12 33 5c ed 75 bc 99 1e aa 26 02 24 10 7b 74 ad c6 dd 60 66 ab a8 44 fa d0 d3 a8 c8 c9 b4 40 26 91 0d 36 d4 78 e7 3d f1 c4 a8 f0 ff 3c f6 dd 7b df 2d 36 c8 16 ab ea d0 d3 a0 34 eb 90 ad a4 1a de d0 7e 9f a2 d0 eb dc 25 87 92 f4 00 11 64 ae 79 e6 36 00 ae b7 b9 2a 91 c2 b6 de 79 7f ea 78 7a 50 bb cb 50 ac d3 8a 4a ec ae d0 3a d4 31 09 9b ce cd d0 01 2e 7c ea f7 db f1 5e 82 65 e9 83 6f c4 2a 2a a5 17 0f 7b 8d af 83 12 fb e3 f5 7e c6 bb ef f6 e6 5a 36 09 b4 52 ce d0 f0 17 53 5b ad 0d 28 20 60 c3 f7 46 6b 98 fb c5 e0 97 ff ba ef 1b af f8 7a fa 37 7c 9a fe a8 a0 4b 6f f6 56 94 e3 04 8b 10 58 0a 5b eb eb 53 53 6d ba 4a 70 93 57 ff 10 10 af 09 a9 cd 4c 00 Data Ascii: !2R(/j(83\u&${t`fD@&6x=<{-64~%dy6yxzPPJ:1.\|^eo*{~Z6RS[( `Fkz7\|KoVX[SSmJpWL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49795	216.180.227.131	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	587	OUT	GET /img/FF98t_180x180.gif HTTP/1.1 Host: ig82.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	1089	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 754 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb837c68d2578d7-LAX Content-Length: 476245 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:06:06 GMT Etag: "6769630f-74455" Expires: Sat, 01 Feb 2025 04:53:31 GMT Last-Modified: Thu, 02 Jan 2025 05:06:25 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vrIr%2FtVFEiVF0xhRwJjFpceXLmmstx%2B8Xguibe6nZiRZ4R4kDlDlIB1U%2BmXHv4CZQklckFVt7v9uDS%2FaOsmQLumK0unZ8jUETrPmYgf3vIqviK%2FZDqwndF9f9MUItgJUtw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=6891&min_rtt=787&rtt_var=11629&sent=558&recv=45&lost=0&retrans=6&sent_bytes=781704&recv_bytes=2512&delivery_rate=1788130&cwnd=272&unsent_bytes=0&cid=06d2bfb77b177ca0&ts=2404&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:35 UTC	97	IN	Data Raw: 47 49 46 38 39 61 b4 00 b4 00 f7 ff 00 fd e7 ca 21 ff 00 ff f5 b7 f8 17 17 dd e7 f0 f9 b0 04 6d 90 a9 ca d4 dc ff f6 01 fe bc 74 a6 08 00 fd de b9 bd ce d8 ff de 00 8d a8 ba ec ef f8 01 01 01 d6 de fb 77 98 ef a9 bc cc ff ef 78 ff 98 fb fd d6 aa 8c a9 ef 4b 93 fe 59 5b 60 fd ce 97 a6 ff 97 Data Ascii: GIF89a!mtwxKY[`
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: b9 ca f7 49 70 90 fe c6 00 fc c5 88 ff 01 f7 e7 ee ef a4 bb f6 ed db b9 f8 b6 6b 9b b4 c6 e1 bd 86 4a 73 e7 f9 90 0d 34 41 5b ff ea 30 6c fe 51 f5 de c6 0b 4d b2 ff 5a f5 ff f8 d9 ff fa 94 ef f7 f8 ff ef 4a 32 65 d4 da b5 71 6b 78 f8 52 fd 30 e9 cc 99 36 93 fa b8 b9 b8 79 86 fe ee b5 66 d7 a8 56 ce dd e7 ff fa c9 8e fd 70 ec d6 ac 46 6b d3 c9 d6 f8 cc 11 0a ee b6 4d 64 88 e7 fe cb 2a 8b 8c 8f fd da 69 d6 71 00 9a 94 47 33 44 fe fe d5 4a fd 78 0e 26 59 ce ff cb ff 0d 51 cd e9 bc 78 fb ef e7 7e 9c b2 54 7a e6 f7 4e 13 c8 32 05 ec c6 8b dd c5 91 b2 a0 2e d7 ff cf f0 59 a6 8c 9a f9 35 65 87 45 4e fe f4 2c 13 d6 4e 05 f7 bc 31 ef e7 cb d7 de e6 e9 ce a5 c5 ff ba fd 48 23 ff ca 11 db b3 12 ff 27 f7 06 c7 f7 fa 0c 24 e9 ad 60 72 ab fa 67 82 9d 1f 57 bc 8f 72 e8 Data Ascii: IpkJs4A[0lQMZJ2eqkxR06yfVpFkMd*iqG3DJx&YQx~TzN2.Y5eEN,N1H#'$`rgWr
2025-01-02 05:12:35 UTC	538	IN	Data Raw: 60 30 af ce 79 8b 3c ab 62 84 67 ae 27 ea d1 67 ad c4 a6 19 22 a1 b9 1e 8a 52 af 0b 2d 9a 6b 22 25 3c 5a ec b4 80 12 e0 40 a5 af 62 9a 1d b3 04 71 8a 6c a7 c1 94 20 25 b5 e4 a6 59 ce 04 b8 5a fa 6d 0b aa f6 da 6a 91 32 12 2a 6f 0b f3 ce ab 07 03 e5 e6 ab a6 38 b7 be 51 2f bd 00 23 3b ef 89 a4 3d a0 69 84 fe ca eb 2f bd 84 2e 12 30 c3 53 f4 f0 8d 3d fa 56 ac e6 b1 f3 3a ac b0 c2 0c d3 eb db b2 0f 12 b7 70 c2 24 97 5c 32 b4 d2 5a ac 32 95 df f4 d8 81 c9 30 97 9c 62 a6 db 05 16 f3 cd 09 07 33 c1 b8 2b f7 9c e6 37 e4 ec 12 0c ce 38 b7 db 18 98 a1 24 f2 86 d2 4c 13 ed af 1e c0 f8 2c 75 a4 c0 e8 a1 b4 d3 24 2b 1d ca 2d 75 fa a5 5a 22 4e 2c bd b4 27 4c 27 62 f6 d9 67 07 e1 40 04 b3 4e ed 36 cb 3d f8 88 f6 dc 74 8b 9d c8 c7 6b b9 45 36 d9 89 cc ff 70 b7 d9 7b ff Data Ascii: `0y<bg'g"R-k"%<Z@bql %YZmj2*o8Q/#;=i/.0S=V:p$\2Z20b3+78$L,u$+-uZ"N,'L'bg@N6=tkE6p{
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: c8 06 32 0d 38 e0 f0 8a 51 0c 63 11 70 f8 c3 1a 8c b1 06 b6 88 5f 0a 97 c8 46 2a d9 e3 01 76 b0 85 19 c9 48 c6 39 f2 f0 8e 38 ac 41 0d 00 28 10 98 e8 f1 8f 80 2c a2 0f 03 a9 47 2e 00 03 54 6d 4c e4 a8 ec 41 0e 60 70 81 90 79 fc 63 24 b1 a8 c7 9c e4 51 8e 73 14 a4 1e 31 79 c6 1a 9c 50 91 a0 24 d6 37 5a 88 49 3d 0a 12 93 72 3c 25 20 75 b0 49 34 d6 80 95 72 44 25 1a d5 18 ca 5a d6 aa 89 22 40 85 2b 5d 19 cb 56 c6 12 0e 70 d0 81 1c 59 09 4b 61 be 52 8e 86 fc 83 2d 97 49 ac 37 72 00 15 c6 1c 26 1a 75 40 cc 57 be 92 98 d4 cc e6 35 75 c0 85 5a 90 63 7e cc 0c e7 a8 c8 21 04 2e 64 53 9b e7 d4 01 30 d3 99 4e 4b 44 40 9c f0 a4 56 04 2c c1 ce 7a d6 93 0b 29 8b a7 3e 6b 45 ff 00 73 d6 73 9d f7 dc a7 40 8b e5 4f 7b da 93 0b 03 4d e8 a8 0a 9a 4e 80 b2 13 a1 0a 8d a8 9f Data Ascii: 28Qcp_F*vH98A(,G.TmLA`pyc$Qs1yP$7ZI=r<% uI4rD%Z"@+]VpYKaR-I7r&u@W5uZc~!.dS0NKD@V,z)>kEss@O{MN
2025-01-02 05:12:35 UTC	5930	IN	Data Raw: 7a 34 f2 48 23 83 c8 e5 48 25 93 ec 31 88 02 85 94 32 c8 05 8b 64 12 c9 26 b3 ec f1 84 20 9c f1 70 4a 30 83 24 71 93 13 b8 34 33 88 32 cb 44 d3 cc 32 37 79 85 c5 30 e3 74 11 1a 32 d3 54 33 cd 35 9d d9 04 48 39 fb 14 72 3d 2a 4e 08 34 50 41 03 8d d2 4f 44 85 5c 15 70 93 41 a9 10 e4 96 0f 13 95 34 48 72 60 74 13 ce 49 bf 0a 08 00 21 f9 04 09 03 00 ff 00 2c 00 00 00 00 b4 00 b4 00 00 08 ff 00 ff 09 1c 48 b0 a0 c1 83 08 13 2a 5c c8 b0 a1 c3 87 10 23 4a 9c 48 b1 a2 c5 8b 18 33 6a dc c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 f1 41 2d 38 5e bc 58 aa f5 87 a6 cf 9f 0b 23 f8 ab e1 05 90 ae a3 5e e0 f8 7b 00 b4 29 d0 5a 96 04 79 39 aa cb 15 20 57 48 6b 58 62 ea b4 ab 4b 7f 5c 98 61 ad 6a d5 15 d6 b1 55 05 ed f4 ca f6 a4 3f Data Ascii: z4H#H%12d& pJ0$q432D27y0t2T35H9r=N4PAOD\pA4Hr`tI!,H\#JH3j CI(S\0cIA-8^X#^{)Zy9 WHkXbK\ajU?
2025-01-02 05:12:35 UTC	7116	IN	Data Raw: 1e f0 e9 c8 fb 04 a9 cf be 23 9b dc 8f c8 9d 6a ea 81 42 7a f4 59 b0 1e 7d e8 d1 d0 24 7d ac 74 30 43 e6 94 01 06 3a da ac 74 67 1e 07 d7 b8 ae 89 e3 b6 71 c7 c0 01 e8 f1 80 47 65 84 80 c1 a4 0e b3 9c e7 cd e5 b0 23 a6 25 05 14 00 54 50 b9 ac c4 c6 1d 05 64 d9 ff 51 05 1f 04 e8 71 26 28 a1 ea 49 10 fc 9a 24 6a c9 a3 28 d5 54 d3 27 23 d5 a9 07 1f ac 81 d1 4c 37 95 5b 88 cd 33 dd 71 67 41 42 0a 40 40 00 21 08 38 b1 80 78 06 20 95 1e 17 27 2a f5 4c 0d fd 42 a7 87 08 28 30 a9 9f 7a 56 5d 55 9f 01 5c 45 d1 0a 05 98 75 d6 0a 42 b0 71 73 c1 44 b1 d3 48 a3 06 64 80 e5 01 4f 77 32 72 d3 4d 31 4d 0a 5c 4a 3b ed f6 a6 07 ee 2c 60 41 55 f5 59 b5 cf ab 54 4d 75 8d 2f bc f2 81 80 08 ee 44 c1 56 37 6d dc a6 cf 43 6c 95 57 9f 35 aa c8 48 1e 02 62 a8 ea 2a 77 fd 1d 40 c4 Data Ascii: #jBzY}$}t0C:tgqGe#%TPdQq&(I$j(T'#L7[3qgAB@@!8x 'LB(0zV]U\EuBqsDHdOw2rM1M\J;,`AUYTMu/DV7mClW5Hbw@
2025-01-02 05:12:35 UTC	8302	IN	Data Raw: b8 84 bb 08 1d 20 b8 06 f0 9b f0 39 01 3c 86 b3 06 73 a5 5d db 03 e0 d6 03 07 d0 03 96 1b 98 69 1a 8e 9e cb b2 ee 49 07 5d d0 01 74 f0 9e 90 8b a9 eb b0 80 2d 98 51 34 9b 1c 81 1a 3b 69 35 5c 35 3a bb b4 5b bb b6 fb 1e 35 23 0e 21 c0 01 77 6b b0 76 4b b7 3f ab b7 81 39 b6 6e d0 01 1d 30 ba c6 4b 07 ca fb 98 cc eb 06 cd bb bc c6 7b bc c6 eb 9b 2d ca 63 21 10 03 f6 20 0e 89 0a 6e 54 39 05 ce ab bc bf ff e9 a2 76 60 07 7d eb bd 74 90 01 4d 3b ba be 09 9c 66 4b 00 21 30 b9 59 ea 53 9f f9 21 1b 74 57 54 00 72 78 b5 8b fa cb 8b b1 ea ab 4a 35 4b 2d 85 03 74 eb bb 1a 51 aa 02 2c c0 18 20 0a 0a 3b 9e dd eb bd 82 fb 98 8d db b8 53 30 c1 14 5c c1 bf d9 b8 ce cb b8 64 6b b6 98 7a 2d 17 d6 33 53 59 02 ee 29 b8 90 f9 b8 5d 4b be 7f 6b 00 cb 0b c1 ef 19 96 7f 79 bd 06 Data Ascii: 9<s]iI]t-Q4;i5\5:[5#!wkvK?9n0K{-c! nT9v`}tM;fK!0YS!tWTrxJ5K-tQ, ;S0\dkz-3SY)]Kky
2025-01-02 05:12:35 UTC	3669	IN	Data Raw: 40 7e 98 42 95 94 dd 4b 23 55 3f fa a7 d7 bd df 1c 01 b3 16 e4 e5 2f c7 5a 5a df 98 67 07 27 9d 1d 4e 44 11 40 1a 6c 23 ca e8 51 a9 ba ab 64 7d 70 b8 99 03 ad 61 dd 36 76 f9 03 f2 8a 3a aa b9 ed 09 50 dd 1b a2 8d 46 1f 40 6c 75 36 13 c5 b1 bc 6e cc a4 fb 21 b9 49 75 6a f2 49 28 58 45 1d 9f 2e a5 19 7b d2 de 8a a1 8d 76 d6 ad 0c 0d 16 dd 4e b5 86 1c dc 5d af 72 75 55 ce 3b 77 5d 3f 2d 43 26 57 f5 63 ed d6 f5 c2 5d db 96 e6 72 45 a5 e8 ff a1 f7 ed ec 3d df fa 56 7a ba 7d 18 83 38 7a 76 50 64 e6 29 02 fc a5 69 96 3f 0e 72 31 db 4f 6e 5a dc d0 dd 94 dc f0 e2 22 56 e5 de 9e 78 b8 39 6a da 2a 66 1a dc 91 9c 00 57 c9 e9 21 8d 43 09 85 b6 2c 9e c9 bb 5a 49 42 07 01 55 21 e7 0a 79 a8 40 64 bb 91 a5 83 86 8d 0c 52 51 09 f1 7a 1b 1b df b9 2b af 0c 33 7d dd 3e 4c 20 Data Ascii: @~BK#U?/ZZg'ND@l#Qd}pa6v:PF@lu6n!IujI(XE.{vN]ruU;w]?-C&Wc]rE=Vz}8zvPd)i?r1OnZ"Vx9j*fW!C,ZIBU!y@dRQz+3}>L
2025-01-02 05:12:35 UTC	10674	IN	Data Raw: 81 b1 c5 db 4a 96 6c 81 a4 80 f1 e2 8d 1a b1 8a 60 c5 17 09 19 36 1c ef 2f 64 c8 37 25 16 50 8c 19 ef 5f cd 12 9b e6 55 ac 96 6d 44 6b e1 de ae 84 65 6f 6e 03 6b 56 04 5a 91 05 06 a1 ff c2 90 49 71 cb 21 b4 b1 c1 99 dc bb 07 df 5e 18 9a 72 83 26 8b 83 0f 1f 3c 19 e7 f2 e0 49 4f 1f 6f 80 58 38 74 39 f4 7c 4b 44 c1 3c 29 d4 83 c3 2f 6b e7 8a e2 b6 ee a4 6a 15 78 f0 e8 f6 ad 4a 72 b0 5e 46 24 46 8c 3b ee bb 97 f3 e7 27 64 bf 3a c2 fd 00 bc 6b b0 c1 ee e8 88 ba 06 2a 49 8c 40 01 2f 1b 42 a2 05 2f fb 6b c0 c1 0a 43 90 33 02 bd cb 4f a1 c6 3c 4a 4e c0 c1 d4 1a c2 32 d2 a0 f2 2f 22 ce 48 a3 10 1b f5 88 39 b0 01 0a de 2a 67 b5 19 05 a0 ac 89 09 73 cc d0 41 ee f6 db 71 c7 de da f2 41 00 01 86 54 41 22 90 7c d4 71 38 b6 80 53 72 c0 bf 26 d4 8c 82 22 89 f4 61 3e e4 Data Ascii: Jl`6/d7%P_UmDkeonkVZIq!^r&<IOoX8t9\|KD<)/kjxJr^F$F;'d:kI@/B/kC3O<JN2/"H9gsAqATA"\|q8Sr&"a>
2025-01-02 05:12:35 UTC	11860	IN	Data Raw: fa 0a b0 4a 3b da 91 8d 74 74 87 7e 56 a2 87 20 54 8d 5e 0d 58 26 04 37 39 ce 37 1e 2e 5f d9 dc 26 3c b7 41 c6 72 10 00 68 25 cc 22 37 c1 a9 c9 c6 79 28 9a 11 a9 84 3b f8 06 50 78 4e 6b a0 11 41 c2 37 58 f2 0f 88 ea c5 2f a8 29 d9 2a b9 f9 ce 5f c2 ec 9d 16 c5 68 40 07 e2 83 75 e8 21 11 04 b0 87 d0 60 89 51 8b 82 13 46 ab ec e7 2f 01 1a b5 90 ed 85 a2 85 bb e8 2a 6d fa b5 21 54 cb 6d 0b 95 c8 46 5b aa 49 42 b8 d3 a5 37 3d c4 40 ac d1 12 88 46 54 92 eb 5c 26 4a 5d 0a d4 81 34 01 a0 37 9d aa 26 1f e4 d0 44 bc c1 1e 38 1c 08 e5 a8 ea d4 ce a5 f4 a9 9b 6c e1 5d 56 12 82 10 f8 85 a9 63 fd ea 10 0a 44 b2 26 16 60 00 54 a5 6b 55 ed ba ca 2a fc eb a1 49 a5 e4 5e 4a aa 3c 8e 3e 75 95 d1 db 28 42 53 9a 3d 7b 04 23 18 0e 1c 80 60 11 ca 4d f2 3d 96 ff a3 16 f5 e4 b5 Data Ascii: J;tt~V T^X&797._&<Arh%"7y(;PxNkA7X/)_h@u!`QF/m!TmF[IB7=@FT\&J]47&D8l]VcD&`TkU*I^J<>u(BS={#`M=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49791	149.104.32.188	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	586	OUT	GET /1300x200.gif HTTP/1.1 Host: 5967.5967007.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	480	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: image/gif Content-Length: 1399506 Connection: close Set-Cookie: X-SUDUN-WAF-R-C=0001695112; path=/ Last-Modified: Fri, 20 Dec 2024 06:12:57 GMT Vary: Accept-Encoding ETag: "67650ae9-155ad2" Expires: Thu, 02 Jan 2025 05:42:35 GMT Cache-Control: max-age=1800 Server: layun.com Access-Control-Allow-Origin: * X-Request-Id: cd6246953ccd6cf43a81c9e6bc4ce1ac cache-status: EXPIRED Accept-Ranges: bytes
2025-01-02 05:12:35 UTC	15904	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 e6 7f 00 fe ec 6d ff da 03 ee 05 25 ef b0 61 e5 a9 9c fe a7 02 fd e5 a2 f7 f3 d4 22 a0 df f4 63 73 33 30 2f 78 74 71 b4 b2 b1 af 86 60 90 8f 8d da db fb 6c 6c f8 f5 dd ee 03 01 6f 05 03 8b f9 ba d3 45 47 f4 88 88 fa 0f 09 f7 47 b2 e6 a2 d9 f5 22 11 f8 0e 00 da 05 ff 3c 03 01 00 58 5d a7 02 74 b9 57 29 26 44 44 33 b4 b3 d9 29 22 dc 21 0b dc b3 b2 f3 72 53 4c 5a cc fe d4 ee f8 42 20 67 69 66 5d 33 44 f2 91 91 d5 bb 95 89 c0 82 30 68 84 b5 95 70 77 ba aa 8f 72 71 d1 47 46 db 9d 06 ff 45 33 ee 07 88 c8 9e fe b1 54 4e 69 8b b1 d5 8c 90 b9 25 0f 0f 89 77 e9 6e 50 6c d5 f6 d7 55 66 f6 32 3c 46 22 22 1f 35 31 8f aa 98 ab 57 fe 80 56 55 f4 94 ae b3 55 66 54 ab 99 d6 90 b0 f1 51 68 6e 9c 99 f6 ca 6d f9 31 44 33 5a 54 dc c0 c5 1c f8 3a Data Ascii: GIF89am%a"cs30/xtq`lloEGG"<X]tW)&DD3)"!rSLZB gif]3D0hpwrqGFE3TNi%wnPlUf2<F""51WVUUfTQhnm1D3ZT:
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: a6 13 04 79 13 b5 35 6d af 95 0e 5d a1 2c 2b ba 05 98 e1 10 3c 79 79 73 75 57 04 23 59 e9 86 71 f1 08 1b 70 f0 06 4a 03 6f 3b 82 80 09 e8 27 14 98 27 fa 36 92 f7 96 7a 82 d0 27 8d 63 35 64 53 0d d7 f0 5c 25 89 4b 04 c7 3c bc d4 98 06 d1 1d f8 49 37 f6 b0 00 39 31 06 60 10 04 38 92 3d ec a5 37 2a c3 52 05 83 06 7b 30 31 be c6 3d 2f b8 23 c3 b3 36 35 c8 85 95 10 09 3e 97 4d 06 86 95 27 77 18 52 22 85 11 01 04 75 23 09 64 29 43 fd 92 39 c6 86 11 47 b0 96 58 19 2b 26 e4 a2 70 89 07 72 19 24 76 3a 06 77 79 9f 04 05 32 64 18 63 96 92 0a fa 92 ff 46 b2 c5 05 91 d1 02 b1 f3 97 c2 31 08 d3 36 6d 87 89 1f d9 65 64 59 ea 87 03 e7 0b a3 38 21 09 81 3c 93 f9 91 2a 69 99 83 e8 0f c5 33 ab 28 41 36 92 49 52 93 41 73 c6 58 ac c6 7a ac c8 0a 1d 6f b0 0f ad d9 65 ef f3 65 Data Ascii: y5m],+<yysuW#YqpJo;''6z'c5dS\%K<I791`8=7R{01=/#65>M'wR"u#d)C9GX+&pr$v:wy2dcF16medY8!<i3(A6IRAsXzoee
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 27 34 5b b0 25 9c 30 7b b0 d8 4b be 74 7b 8a 70 50 a9 a0 97 24 58 43 0d a2 74 52 12 6d 2e 98 7b cc 56 20 2d 23 3c 2a 17 5d 90 61 61 8e 32 91 bd d8 3c d9 65 4d c6 f7 6d d6 77 5a b3 e5 6e a8 25 99 8b b1 95 5b 99 7d 96 59 1f f6 c1 3d e0 17 7e e0 63 6f f2 b5 8c f0 a7 30 ec e7 6f c4 31 1c c6 51 8d b0 79 9a 6f 90 58 0d c7 70 ad 19 41 f6 c4 2e 09 d3 9a f0 d5 25 ac 90 28 4d d1 29 8b 69 5f 22 67 0c ed f8 59 3b 40 05 68 30 3a f6 c0 48 2a b0 03 c9 f9 41 dd b0 8f ef e6 8f 28 16 90 93 90 82 33 59 32 49 27 63 bb f3 31 db c9 9d 8b e0 90 31 b8 21 b4 70 ff 1e 17 89 91 b4 a5 33 e5 15 44 ee 69 71 45 d6 3d 48 25 92 4c 34 84 e1 69 09 f3 d6 10 24 21 8c 3a 52 05 fe 19 23 c2 18 0e 30 79 0c 52 78 9f 97 90 9f ef 61 65 70 17 66 40 88 46 3c 49 04 76 07 94 12 aa 36 b6 88 94 21 20 3a Data Ascii: '4[%0{Kt{pP$XCtRm.{V -#<]aa2<eMmwZn%[}Y=~co0o1QyoXpA.%(M)i_"gY;@h0:HA(3Y2I'c11!p3DiqE=H%L4i$!:R#0yRxaepf@F<Iv6! :
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: d6 56 9b f6 85 f3 83 7a a9 57 27 35 c7 7a 88 f6 73 b8 38 0c 54 78 62 94 31 1d e8 f4 37 eb 85 4b 51 b7 10 33 c1 06 89 f5 4b 06 71 04 5d c7 7c 09 e8 20 dc a3 8a 05 66 0d 99 55 47 e1 b0 73 da 20 5c 98 b0 7f da d0 7f 97 e0 82 e8 97 7e 1a 81 8e e8 a7 7d a2 24 31 c1 11 0e 7a 00 85 c0 50 7d ef 41 71 e9 f8 7d ea b6 0b fb 07 05 f2 f3 8e c0 00 81 96 40 7f fd 31 6e e5 c6 4a d3 75 20 fb 68 09 18 52 5f 41 b3 71 2a 10 03 12 c2 82 9d e4 69 c9 88 7b 00 37 2b 02 89 7c 9d 02 70 cc e1 53 ec d0 0b 0b e9 07 43 10 5e 89 57 22 52 f0 31 cc 67 09 fa 85 7b 01 28 ff 15 cd c1 23 b0 11 60 90 c0 25 15 d7 2d b7 b4 72 19 35 72 2c f9 1a a1 68 28 54 01 72 a8 13 6f 9f f1 00 65 70 8b 50 28 3c cb 43 4f 21 06 31 60 b2 3c 49 19 74 c5 28 64 6c a2 94 51 14 0d b5 70 26 8e a6 18 57 08 0c 50 69 0b Data Ascii: VzW'5zs8Txb17KQ3Kq]\| fUGs \~}$1zP}Aq}@1nJu hR_Aq*i{7+\|pSC^W"R1g{(#`%-r5r,h(TroepP(<CO!1`<It(dlQp&WPi
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 4f fd f5 c7 1b df a5 1e 89 3e bb f9 bd bb cb 4d b8 ff 0b 57 fc be 5f 0a 43 e0 b6 45 f7 08 0a b1 07 f8 b9 8b 3f 7e ac b4 1e 7b ea f0 9c 35 8e ff fe f3 51 c0 7f 6d 0f 80 80 19 20 00 a1 ff c5 ac 0d 99 4b 81 db c0 b7 40 06 e6 6b 5f fa d2 97 03 27 b8 40 09 36 90 82 5c c3 81 78 f2 30 07 d6 8c 61 55 0a 23 4f 0f 70 b7 bb 12 e6 ce 05 81 39 9c 10 ee 67 c0 16 46 88 01 b4 13 21 09 4d 58 42 17 f4 e0 70 29 38 83 6d fc 00 af 56 8d 07 63 33 a4 e1 f8 fc 95 30 21 08 0c 7f 92 62 99 0b 97 c8 c4 0c 95 21 0e 10 a0 c3 05 be 70 44 3e 3d 80 66 4d 74 cd 16 56 55 2d b8 c9 4f 88 60 0c e3 db e4 a6 35 13 88 27 87 ab 19 83 0c 80 65 3b c1 c5 4d 8c f1 d3 da bd d0 60 3e 0f 68 2c 8b 78 cc 8d a7 d8 68 2f 2f c2 11 6b 72 73 81 ac 4c a6 04 b2 c9 66 76 0a 93 00 0e 16 30 00 3f fe f1 8d fa 32 5c Data Ascii: O>MW_CE?~{5Qm K@k_'@6\x0aU#Op9gF!MXBp)8mVc30!b!pD>=fMtVU-O`5'e;M`>h,xh//krsLfv0?2\
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 25 c2 88 1f 6e f4 16 86 70 9b 08 97 60 23 bf bd d1 ff 20 14 ca 69 17 56 77 a4 4a 07 5e 7b 12 2c 50 e4 28 cd 49 30 05 c3 c5 4a 15 5e 53 48 8c a1 d5 04 f4 65 2c d5 00 5d bd 57 ca 18 f3 89 3c 55 03 d5 49 80 44 bd 30 bf e6 9f 00 00 be e2 87 03 06 6a 28 89 02 0a 9c 31 f0 87 0c 8a 38 08 14 13 97 12 b4 d0 02 54 28 ca 18 3c eb 3c 09 24 43 fc 1c 33 2d 70 20 2d 00 14 c0 4e ad f5 d6 6a a9 b8 cb 1a 67 6a 70 90 b4 07 ed d2 d3 99 3d 61 b3 cd 1a 64 af 98 f6 68 a6 91 6d 8e 69 70 b3 bd 0b 1d 07 15 03 36 90 6e 0e 39 71 48 64 b8 24 8c dd 6b cb 74 f6 2e ee ac b0 46 0d 35 cc 30 03 e3 5f 38 fe 78 0d 2b 38 be 02 e3 33 38 c1 78 e3 8e 63 2e 83 13 2b 82 2d 53 dc 66 83 3d 1a 1d 10 a4 5e 42 b9 46 fe f1 19 a2 6a 77 74 d8 1a 14 91 f1 59 39 ba e8 62 46 05 10 14 a1 06 0f 22 5d b6 f6 68 Data Ascii: %np`# iVwJ^{,P(I0J^SHe,]W<UID0j(18T(<<$C3-p -Njgjp=adhmip6n9qHd$kt.F50_8x+838xc.+-Sf=^BFjwtY9bF"]h
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 7f 28 a8 e1 2a 1c 42 c3 cd 84 d5 38 50 1b 2d 0c 44 ff 48 a2 2e 1d 74 71 22 3b 1e 6a 18 62 83 34 d6 68 e3 8d 0e c5 71 01 45 06 61 b2 0f 04 32 3c 15 09 2d 2c 20 95 93 4d 87 e4 43 55 55 ee 40 e4 92 48 48 59 94 13 94 15 21 99 54 95 3d 22 44 25 49 26 11 f8 07 93 9f b0 10 91 4f 2b ac d0 d3 4c 22 49 e9 91 48 33 6c 52 d2 4f 6b 54 f0 43 11 3c fc 71 c0 0b 46 32 22 03 0f 3c f0 83 84 1c a3 e8 f1 87 0c 11 f1 40 06 98 ea 8c 11 47 1c 22 c8 e0 81 07 7d 09 21 5f 58 74 a1 83 44 77 68 b1 f7 5c 0f 5f 79 f0 40 83 63 e4 c5 97 10 1e e8 20 42 0e 39 30 e0 00 73 99 6a 5a 58 01 71 49 20 04 4a af 10 0a 1a 26 8c 50 06 89 24 98 45 04 99 66 85 00 db 12 b0 c4 0e 2b 1a b1 c2 02 7b 81 4b 48 fc 51 1a 8e d0 de 08 44 0c aa b1 36 5d 33 50 10 80 db 5d b5 d4 d6 db b7 b8 fd 16 1c 71 c3 b5 e6 da Data Ascii: (*B8P-DH.tq";jb4hqEa2<-, MCUU@HHY!T="D%I&O+L"IH3lROkTC<qF2"<@G"}!_XtDwh\_y@c B90sjZXqI J&P$Ef+{KHQD6]3P]q
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 95 91 61 4f da 88 19 4e 9c 88 38 f0 e7 5c 9c 96 d8 ff 72 ea 8c b6 a6 82 13 6f 5b 7c 09 1d 4a b4 e8 00 03 11 0d fc b1 63 c7 00 00 03 06 e0 40 6d ca 14 ea 23 00 7f 9e 8a 19 b3 a5 ab 9f af 60 c3 3a ea c5 80 63 0a 17 22 d3 3a 94 48 60 a2 45 81 42 82 92 92 61 56 ad dd 85 24 25 a6 38 29 41 86 29 74 d6 a0 cd f8 a1 cb c9 32 55 0f 46 e0 dc 39 4d b0 05 63 ee fe fc f3 f4 29 41 a6 04 a9 04 29 da cc d9 90 83 b1 bd 28 6c 1a 4d ba 34 8c 36 45 1f 8d 51 d0 b9 35 a2 2e ff 7c 59 2a bd c9 05 e5 d4 b8 73 eb de 9d da d5 01 23 6b 66 8d a8 35 e2 07 0f 08 2c 78 97 22 83 64 d6 2d 63 10 8c b1 e0 05 ae d4 33 5a c4 a3 0d b7 35 62 cd 9a 11 dd 6b 7c ef ee 1d bc f7 f2 e4 c7 af 11 6f 1e 7d 76 12 da a4 c1 9c 81 64 4c 75 52 3f 48 f0 90 34 c6 55 30 5a e0 69 47 42 0d 33 cc 50 ce 7d bf 90 31 Data Ascii: aON8\ro[\|Jc@m#`:c":H`EBaV$%8)A)t2UF9Mc)A)(lM46EQ5.\|Y*s#kf5,x"d-c3Z5bk\|o}vdLuR?H4U0ZiGB3P}1
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 17 4c 61 72 aa 20 a4 43 2a 6a 23 6c a4 cd 5c 0a 4f 06 12 1d 73 0a f8 1b 12 92 19 cc a2 8a 9c 5e 3b cf 25 77 d8 4d 8a d7 7a 61 d8 28 13 7f 39 ad 73 3b 83 43 6e c6 7f 96 0d 8d f1 cc 4c cd b8 d9 97 f5 7f 41 53 75 80 36 16 49 9a 25 ea 37 c2 88 05 cf 12 85 91 54 eb 69 1d 39 42 24 51 8b d5 d5 b5 dc 04 31 c8 09 b6 6c 38 58 bb 40 12 c2 f0 09 15 51 ff 9a 3d 38 d7 c8 d9 b1 11 fa 32 e4 07 73 1c fb 0b 89 13 a7 ff e7 ac b8 45 25 7b ad 0a 51 4d d1 24 7a d1 d4 2d 5f 2f c5 d5 f3 65 92 89 5c c9 3e 76 c9 22 fd 6a 3c 89 b9 ad 50 ac 91 91 5d cb b5 3a 8e 71 95 a7 18 47 b9 84 21 a4 1a 32 4d d9 27 0e 85 d6 91 8d 13 b8 80 c7 bb 80 b7 06 e1 61 70 9a 5d dc 93 21 36 8c 48 81 ac be cd f0 8d 8b 21 29 e2 b5 d1 33 59 0f 8a eb 6e df ed 6b d8 40 d5 7f 10 dd f0 30 0f f2 60 86 c3 db c8 fa Data Ascii: Lar C*j#l\Os^;%wMza(9s;CnLASu6I%7Ti9B$Q1l8X@Q=82sE%{QM$z-_/e\>v"j<P]:qG!2M'ap]!6H!)3Ynk@0`
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 06 60 a0 b3 64 d3 3d c0 48 b3 07 5c a7 33 78 2f 7f c5 c0 c1 ec 21 ac a5 4a 7f c0 bb eb 11 02 3a e7 5a 7a e6 27 84 35 cd 7d 76 00 13 0c a8 18 c4 29 51 d3 9b 8e 10 06 60 8c 11 ee a8 c6 c1 c9 23 21 3c 0c 06 06 81 f1 f4 6b e1 0c c7 99 41 9c 93 c0 48 6c 55 40 dd 11 02 23 06 55 00 e3 ba 18 b7 71 79 91 17 c0 6a 71 fb ec cf fd 1c d0 fc fc cf fd 3c ff d0 1b 27 a5 b2 cc 0a 76 30 c4 5c 6c 09 f9 7b 2e 93 f0 27 40 30 06 cc 14 20 73 b5 03 1f 45 05 26 40 d1 53 bc 05 2a f0 51 66 a9 26 53 68 17 96 8b b9 1b 0c 12 eb 3c 12 80 a6 6f c4 25 ce 74 3c 5c 6c 0c 00 12 0c 19 28 4c c6 ec 9c 19 45 87 d2 36 6d 11 1e a1 ba 94 c6 65 91 70 1d fa ba 1e 1c 16 03 6e 10 21 9f 70 c8 dd 61 bb 1c 6b 20 f3 01 c9 c3 d7 06 64 e0 06 54 4d 00 57 90 49 20 4b 0a aa bc ca a3 e0 07 5c c0 bd 9e 3c ca e8 Data Ascii: `d=H\3x/!J:Zz'5}v)Q`#!<kAHlU@#Uqyjq<'v0\l{.'@0 sE&@S*Qf&Sh<o%t<\l(LE6mepn!pak dTMWI K\<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49790	149.104.32.188	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	580	OUT	GET /11.gif HTTP/1.1 Host: 5967.5967007.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	476	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: image/gif Content-Length: 18662 Connection: close Set-Cookie: X-SUDUN-WAF-R-C=0001695112; path=/ Last-Modified: Fri, 20 Dec 2024 06:12:50 GMT Vary: Accept-Encoding ETag: "67650ae2-48e6" Expires: Thu, 02 Jan 2025 05:42:35 GMT Cache-Control: max-age=1800 Server: layun.com Access-Control-Allow-Origin: * X-Request-Id: 3b00e0cffe412ec464bcdf643b519696 cache-status: EXPIRED Accept-Ranges: bytes
2025-01-02 05:12:35 UTC	15908	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 fd da 2d ff f0 39 c6 0f 2e ff c6 0f fe e5 32 a8 90 15 bb 06 24 5e fb 54 f6 cc 36 f9 c7 2a ff d1 1a ce 15 35 df 22 45 f4 ba 28 dc 20 42 f5 b7 19 01 55 de e7 4e 6a ff e8 50 e9 a0 33 fa d7 36 ff c1 0a ff d6 22 db 1f 41 c5 0e 2d de 21 44 df 98 2d e6 93 2b ff c5 0e e9 97 33 d2 18 38 e3 89 24 1e 19 03 8d db 5b c5 27 29 d9 70 1e e6 84 34 c8 11 30 ff be 07 ff eb 8e de c5 25 d5 66 1e 02 f9 8f 02 b2 b8 ff f4 cd eb a3 29 ff bd 06 e8 96 1a dd b6 16 d5 30 36 d6 58 2b f3 bb 34 e4 7b 34 ff fe f7 db 74 27 f2 ac 17 ff d9 50 ce 51 1e ff fe 01 89 73 0e e3 6c 3e e4 8d 16 f2 9c ac dc 62 32 d8 1d 3e c9 38 27 d7 2a 38 ee a4 1b d3 19 3a d4 4a 2c ff e8 6f d8 53 31 66 56 09 d5 1a 3b e4 59 3e ff f4 b8 ff d2 1b dd 47 3b fc c3 17 e0 83 1d cf 16 Data Ascii: GIF89a-9.2$^T65"E( BUNjP36"A-!D-+38$[')p40%f)06X+4{4t'PQsl>b2>8'8:J,oS1fV;Y>G;
2025-01-02 05:12:35 UTC	2754	IN	Data Raw: 47 94 1e 18 4a 57 18 12 80 d4 47 d4 14 10 46 a2 e2 8a 91 cc 87 c4 7e e8 85 c1 e2 79 7d d5 b2 e2 14 1a a2 05 02 8b 96 f5 b5 c3 8a 8d c0 b8 13 0a 2c 9a 18 c7 14 2b 32 88 56 01 2c 36 a9 62 2d 3b e9 21 a3 88 0d ca b8 a2 78 44 31 c9 a2 84 b5 ad 48 23 5a 48 38 89 e5 4e 5a 46 c2 e5 5b 48 b2 48 25 51 71 b0 08 ce 9b 70 be b9 83 25 70 ae 19 63 9c 1e fa 33 45 9c 6f 2e f6 96 27 70 0a 49 27 9f 5f 12 85 04 9c d9 a1 05 08 9f e0 9c 89 56 9c d7 44 5a 4b 55 94 22 81 82 9d e3 85 11 69 a4 1b 6e ea 29 a6 82 6c 3a a6 3f 9a 7a 7a 4d a2 1f 6e 8a 69 01 a6 72 5a 5b ab 98 92 ff c9 4a 18 b4 d2 5a e8 4e b5 e6 6a 6a a7 b0 4e 27 6a 5f a5 7a 8a 2a 51 aa 6e d6 ea 35 26 06 8b c9 b2 b1 fa 23 48 ae b6 02 0b 6d 18 28 2c bb 6c 61 ac 58 6b ad 90 48 58 3b aa 25 da 2e 0b 65 5f d6 62 0a 48 b8 98 Data Ascii: GJWGF~y},+2V,6b-;!xD1H#ZH8NZF[HH%Qqp%pc3Eo.'pI'_VDZKU"in)l:?zzMnirZ[JZNjjN'j_z*Qn5&#Hm(,laXkHX;%.e_bH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49781	216.180.227.131	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	587	OUT	GET /img/1KKky_150x150.gif HTTP/1.1 Host: ig23.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	1093	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 5956 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83de2ab2b524b-LAX Content-Length: 507238 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:10:16 GMT Etag: "676a971d-7bd66" Expires: Sat, 01 Feb 2025 03:31:00 GMT Last-Modified: Thu, 02 Jan 2025 05:12:30 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zbj81QzA9ArLTxVePLawV07neaJNL6PReufwuFF5WqwzyXWronKb0mPw2xmcSciHHYY8FrqyZiYYmXp01piS3AUKrURs8z5eoj%2BIxkqOM2TMR0l%2BaXdNz9%2BhwS3BhrLGCw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=6918&min_rtt=732&rtt_var=11551&sent=851&recv=101&lost=0&retrans=0&sent_bytes=1175206&recv_bytes=6653&delivery_rate=316750000&cwnd=633&unsent_bytes=0&cid=b91984593079846f&ts=38194&x=0" Vary: Accept-Encoding X-Cache: HIT, server, memory Connection: close
2025-01-02 05:12:35 UTC	93	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 00 00 fe f8 aa fa b3 00 d8 4b 0b ff ef 00 da 49 27 ab 93 73 f2 d1 8f 01 cd ff 9d 6c 61 b7 4a 2a 9a e3 f7 d3 90 8c b5 a7 88 02 75 b8 d4 af 8f f3 8e 73 b3 0b 01 21 fe 00 d0 0f 04 d4 6b 4b ef 90 00 5b d2 fd 0f 0f 10 5b 50 17 93 04 00 fa 0f 08 ee 8a Data Ascii: GIF89aKI'slaJ*us!kK[[P
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: 33 b5 22 09 f4 99 8e ff cc 52 69 5c 53 a0 8a 01 f2 67 4d 4c b7 ec f2 44 2b fe f4 97 d9 90 6f ee 71 2c 0c 8f d0 de 66 01 31 b6 f3 ef aa 73 cf b3 00 d9 6b 2b da 76 63 da 8b 52 47 2f 1a fe 99 3d d2 33 22 f4 77 61 db ce 96 d3 54 3f f5 33 23 10 87 b8 95 e5 66 da ae 6c d2 b2 ae cd f1 fa b2 31 22 52 f9 1a d4 d7 d4 d6 cc b2 e8 77 00 f3 cf 75 24 97 d3 a8 f8 95 f2 55 3c 2d 28 25 ff f1 4a ff f2 27 56 8d af 28 aa e0 2c 25 11 fe db 2f ff f1 6f bd 77 7e 18 52 10 f2 b6 d4 11 11 22 8b bc ce 12 50 65 78 f7 53 1d ae 02 0b b0 ee da ff d3 ee 4b 0f 64 db 9f 07 ad db d9 8d 00 a3 ee 03 26 10 10 95 22 10 c9 fb b4 ff dd f0 da 94 b0 d4 b3 4b dd cc 00 1e 35 42 97 2c 26 d6 da 29 c4 dd e8 f2 97 b4 c4 c5 76 57 a2 0d 49 3a 3f 0e 22 2a 0e 28 0f 23 11 22 d3 b3 2c 7f 82 66 d7 ee 00 d6 f7 Data Ascii: 3"Ri\SgMLD+oq,f1sk+vcRG/=3"waT?3#fl1"Rwu$U<-(%J'V(,%/ow~R"PexSKd&"K5B,&)vWI:?"*(#",f
2025-01-02 05:12:35 UTC	538	IN	Data Raw: c2 f8 a6 6d 90 9e d2 29 a0 0b 7a ff 6a 25 8f 97 2a a4 12 26 5e 06 1a 68 81 9b 30 e2 20 a1 30 06 cb a8 a9 a9 0a db 66 b1 b6 2d e1 88 ac bb ee 7a 65 96 b5 0a c4 67 97 9c 8a e9 ea b5 65 9e 69 ec b6 c7 a2 ea 6d aa 88 36 8a c6 12 0e 30 7b 6d b3 a7 3c 1b ed 1d 4d 6c c2 2b 95 8b 58 bb 2b 02 1e 34 0a 2e b7 f7 be 17 ee b7 f7 de ab e4 9b 8f c6 0b ab c0 05 56 59 c6 26 96 fa 58 4b bb d5 0e bc 88 83 2c 7e 4b ec a8 32 92 9a af b6 68 2a 9a aa c6 68 ae ea 41 ab e8 ee fa 4b 13 36 01 97 a9 9f 61 a6 6c 49 bc bf 76 3b 71 bf 17 e3 6b a8 bf f6 9e 39 6e ac 2a df 69 25 c9 1f a6 c5 d7 2f 5e e6 6c 09 af 8e 38 a7 2f cd fd 4a bc af 16 19 53 4c 73 c6 1b 5f 3c 2e c8 43 d7 19 e4 c1 1e aa 45 19 d0 55 de 78 8a d7 f1 d2 5b 6a c5 e1 22 a1 b4 d3 65 17 fb f4 a9 31 7b fb e8 b2 5e c7 7d 30 ad Data Ascii: m)zj%&^h0 0f-zegeim60{m<Ml+X+4.VY&XK,~K2hhAK6alIv;qk9n*i%/^l8/JSLs_<.CEUx[j"e1{^}0
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: f8 95 21 4b 99 12 8f 0c 9b 58 42 cb 2c cf 84 36 74 01 84 e2 33 2c c1 f9 d0 82 f8 bb e0 17 f7 37 ba 26 7d 70 88 df 0b 61 f8 94 05 3f 1a 5a 31 7e 2b e4 11 d0 16 60 c2 3a ae 06 8b 76 b4 0c bd 5c 70 01 17 68 71 08 9d 4b da f5 c8 98 43 2f 16 32 58 3d ec a0 06 35 06 c0 10 a6 31 59 55 cc 23 1e 25 f9 46 2b 56 f2 79 2d 41 83 1f 35 a9 c9 3f 02 d2 7e a9 ca 9f 28 43 c9 41 20 0a 12 7b 87 24 a4 f7 6a c6 ca 00 0a f0 6d 77 a4 a3 2c 2d a9 1c 3c 6a c6 96 7b 1c 02 1f d1 70 01 5e d2 c7 8f 9f 0c a2 f6 38 27 4c 52 1a 33 70 c7 5c e4 30 d7 86 a4 33 ba f2 51 58 bc 65 2d 35 43 cd 59 9a 70 36 45 dc 64 2f 7b e9 c7 6e 06 f2 90 a8 5c 26 06 8b 09 c6 70 8e f2 82 8d 2c 62 1a 0b 95 06 35 de a6 8e b7 ac 66 34 35 d3 12 e9 58 40 8d bb dc 26 1a 38 09 ff 48 2e 96 32 91 8a ec 5e fd 90 69 ce de Data Ascii: !KXB,6t3,7&}pa?Z1~+`:v\phqKC/2X=51YU#%F+Vy-A5?~(CA {$jmw,-<j{p^8'LR3p\03QXe-5CYp6Ed/{n\&p,b5f45X@&8H.2^i
2025-01-02 05:12:35 UTC	5930	IN	Data Raw: 31 c3 ee f8 a3 cf a7 0f 71 14 31 38 18 61 94 d1 8b f3 52 5c f1 c8 e3 46 23 b1 00 08 83 2c f1 b9 1d 41 44 8b 31 1b a3 e4 e9 a6 9f 68 f2 e0 b2 25 1d ec b2 00 22 d1 43 72 4c a5 56 69 42 41 12 bf 24 71 a8 02 3c b0 aa 31 f9 a8 94 b3 4a 0f e7 4c ec bf 05 4d 54 b3 80 25 7a 69 82 4c 40 41 bb 23 17 05 1b 64 73 81 25 4c 84 ff 71 89 c1 5c 43 0c cb c3 a4 44 69 d2 9b 80 4a 03 0d a1 1e e4 f3 c1 44 11 85 70 89 25 9a c8 25 50 52 05 4d 30 d1 43 51 55 f4 41 04 a0 ac f3 d5 1c a5 ac 2d cb 47 4b fa d1 d0 3d 41 0d b3 54 5e 43 ab 25 17 4f 4d 54 b5 53 54 5d bd 90 4a 4b 39 a4 14 ab 95 b6 4c 95 c9 61 37 f5 22 97 02 7b b5 36 b4 26 bc 00 95 cf 4d b9 8d d6 cd 64 b7 db af 3a 58 f7 c3 33 51 6f bb 25 96 b3 51 af 75 b7 38 42 b7 4d 97 53 75 1b 3d f6 43 fb 5e ba ca 05 a1 a2 ed 94 db 4d 8f Data Ascii: 1q18aR\F#,AD1h%"CrLViBA$q<1JLMT%ziL@A#ds%Lq\CDiJDp%%PRM0CQUA-GK=AT^C%OMTST]JK9La7"{6&Md:X3Qo%Qu8BMSu=C^M
2025-01-02 05:12:35 UTC	7116	IN	Data Raw: 10 7b 02 d0 02 e1 d1 02 d7 a8 07 ed ff 85 fc 42 20 04 c0 df 92 89 a8 fb ba 0f e8 84 2f 0b 31 a4 f8 89 af f5 8c 9f b1 61 4f f5 64 66 96 c1 e6 32 16 6f 09 43 5a 0c 04 50 54 76 b3 ee 88 0e 10 90 1e b9 12 01 c1 85 0b 08 87 62 3c 82 24 28 d0 c3 87 86 30 2d 02 41 20 c1 85 04 55 40 2c c2 64 08 62 c4 44 9b 62 10 ca e3 c2 82 93 93 29 d7 a8 64 89 72 e5 c9 36 94 44 4d 0a 04 69 d1 4d 9c 02 33 e1 bc a9 ca d0 4c 51 69 5a 6a 51 33 d4 65 4a 84 1b fc 70 b8 f3 20 c6 d3 18 0f 6a 11 38 b4 48 10 aa 53 31 40 08 e1 2a 04 44 8c 53 57 39 28 92 f0 c0 e3 a6 07 5b 8d 75 8d c1 a1 e1 25 18 10 66 90 12 94 88 43 8c b5 6c 1f 74 84 14 a3 51 31 a3 2d 8b 1e 85 09 60 66 dd 48 3c 23 e9 54 dc 51 d6 24 19 5a 52 0e 0e 2c 59 a5 a2 bd 1e 63 64 e0 cc 19 8f 29 0e a4 20 81 c0 d3 d9 b4 e9 18 3a 05 3d Data Ascii: {B /1aOdf2oCZPTvb<$(0-A U@,dbDb)dr6DMiM3LQiZjQ3eJp j8HS1@*DSW9([u%fCltQ1-`fH<#TQ$ZR,Ycd) :=
2025-01-02 05:12:35 UTC	8302	IN	Data Raw: 26 13 75 3a d3 b4 51 5d 1c 4d 9d 70 c6 6c ac 07 0f 00 a8 55 fa 45 10 e1 b1 06 f1 70 33 d1 85 ce 08 86 0c 41 c2 15 4a 61 e9 7b b8 c0 59 6b fa f2 c7 31 33 03 c6 b4 71 27 33 4d c9 ff a4 c5 2b c5 c6 df ab b5 33 d3 c6 af 74 09 0c 60 a2 46 7c 97 1c ec 85 29 a8 c9 b7 57 1a 25 ec 9c 63 65 b8 85 cc c6 8d 6b 6e a2 8c 33 9c 74 51 8a fb 4a 02 d0 33 13 2c 49 2f a5 07 a2 8c 7f 6c 55 cb 51 d4 4d 0b 7a a1 cc 18 7b 94 08 71 3f 69 9b bf f1 c9 5f d4 03 dc d4 20 86 60 5a 4e e2 ca 68 ab 4d 0c 72 b5 ad a5 49 05 f3 4a 9a b8 ca 34 cc 4c 69 0c 21 15 eb b0 f0 8a 09 2c 10 57 18 bc 9e 23 88 c9 07 b1 97 9a ec 5b 5f c8 a8 a3 80 bf e2 e9 01 3d 60 5a aa 7c 40 44 c5 6a 0b d2 cd 67 0b 2c 25 a5 cc 8c c7 5a 2d ec 20 1c b0 01 2e bc c2 0e d2 cd 04 f0 cd a1 f4 45 24 48 c7 7d f7 62 d0 fb 66 4f Data Ascii: &u:Q]MplUEp3AJa{Yk13q'3M+3t`F\|)W%cekn3tQJ3,I/lUQMz{q?i_ `ZNhMrIJ4Li!,W#[_=`Z\|@Djg,%Z- .E$H}bfO
2025-01-02 05:12:35 UTC	3673	IN	Data Raw: d1 89 7d 36 e3 6c da 06 64 91 86 51 db 88 3d d0 4d 9d 4e 01 33 30 ad da 2f bc ff ad 1a 58 13 20 b6 70 97 c5 0d bd c2 2d a6 a5 cb 38 d7 e3 da 5f ed 8a b7 45 23 2d 30 d7 6c 03 08 fe 1c d9 d9 03 d2 57 73 17 d7 1c 12 8c 40 4d 75 34 15 fb 4c 19 eb f4 4c 66 51 47 ea 96 16 e4 9d de 67 4b dc a3 0a bd 22 12 3f d4 dd 89 b1 ed 47 ec 4d 19 0b 14 e1 be 5c 47 38 88 10 fd 7d 49 39 e5 dc cd 44 e0 d9 23 01 90 1d d2 53 51 4e e5 24 01 9e 5d b6 e6 9d 11 a1 80 de 66 7b 07 02 26 46 11 31 1e 1a 35 15 10 50 df 26 41 4b 48 4d 27 70 42 d8 ab 2c e2 33 10 12 79 22 01 ce 23 37 17 0d e2 78 82 e4 4c 7e 09 48 2e 1a e6 85 5e a2 db ae 2d 8e 11 f8 db e0 cb 33 15 3d 6e 0a 2c 40 00 4b 46 00 d2 b7 54 1b 5e d6 75 74 d6 f3 9d 3d 1b d0 e3 78 b2 40 66 9e da 62 bc 41 70 c8 ae f5 6b ba 1d 3a bd a5 Data Ascii: }6ldQ=MN30/X p-8_E#-0lWs@Mu4LLfQGgK"?GM\G8}I9D#SQN$]f{&F15P&AKHM'pB,3y"#7xL~H.^-3=n,@KFT^ut=x@fbApk:
2025-01-02 05:12:35 UTC	10674	IN	Data Raw: 47 51 54 c9 a2 50 c5 b5 3a 43 9e ec 41 4b ec c6 4b 04 bd 5d 2c 49 a5 04 be 20 8b 0b 88 18 13 bc 58 02 0c 60 49 51 70 c9 e0 d2 49 3d 43 ca a4 9c b1 ee fa be 45 3c bb 28 fc 38 08 30 3a f0 6b ca af 0c 36 7e d4 8d 24 54 09 ac 64 c9 3d 0c be 70 63 4a 20 db c5 57 74 2c 09 9b 01 18 b1 bb 8a 3c bb dd 92 30 d4 80 80 1b d3 cb b6 fc bc 89 83 80 14 c0 18 c7 58 80 bc 98 4b a3 bc cb 9b 6c 39 df 5a 4b 85 b4 2d f8 4a 00 70 64 81 b1 ac b4 c7 5a 4b 45 80 2f ea 1b 01 f7 40 3f dc b3 4b f3 eb ae 50 e9 47 ac 98 3a a2 e4 cc 49 d0 40 ae ac 4d db 5c 32 b1 00 af 0c 83 30 5b bb 40 ac 01 c7 d1 79 0b ff 09 90 32 bc a4 ad 0b dc 80 d6 04 47 21 ec 2e e4 a2 4d c1 34 ad d8 7a 40 5b 8c 99 2f 71 00 d9 90 4c 03 88 2f ed dc 4e 08 80 01 03 98 14 1b 49 af e1 1c 4f d9 ba c0 3b c4 8f b7 01 80 1b Data Ascii: GQTP:CAKK],I X`IQpI=CE<(80:k6~$Td=pcJ Wt,<0XKl9ZK-JpdZKE/@?KPG:I@M\20[@y2G!.M4z@[/qL/NIO;
2025-01-02 05:12:35 UTC	11860	IN	Data Raw: 1b 78 66 d6 02 30 4f 1d ba 71 7b 9d 10 c0 0a 08 c0 01 46 a4 00 43 19 4d 40 0a 5c b3 02 08 7a f4 68 d8 ec 09 23 48 b0 02 3e 4e e0 97 19 6c 01 23 66 da 02 7b ce 80 13 03 34 84 08 37 30 4d 49 2a 33 9a d6 54 68 d6 5a ba 87 64 6a f1 04 79 98 a1 0a 80 59 d4 13 58 ac 70 1b f0 a3 24 bc e9 ce 0c 26 60 05 27 e8 44 0b 33 e8 87 15 08 60 92 1a 3d 41 02 f8 78 55 b1 ce 13 98 b7 63 25 4a 09 70 82 0b 55 74 61 94 a8 e2 54 09 e0 4e 30 ea 40 8b 7e 08 24 fc 48 e5 ce 48 ba 8b a2 49 75 e8 fd 92 f9 cf 93 f1 41 13 93 4c 66 29 24 d1 11 4e b4 00 02 79 e0 ea 06 26 4b d9 ca 5a b6 13 94 c5 ac 66 2d 0b 59 cb 4e 36 af 93 35 e7 91 7e 29 54 e5 f1 d4 b0 ee 3a 6b 69 87 89 05 2d 46 0d 94 81 b5 d7 9d 06 17 32 0a ff 54 f4 a5 8c 25 20 27 36 57 55 7b 42 56 02 bf 0d ae 70 83 eb 59 60 ee 92 b3 93 Data Ascii: xf0Oq{FCM@\zh#H>Nl#f{470MI*3ThZdjyYXp$&`'D3`=AxUc%JpUtaTN0@~$HHIuALf)$Ny&KZf-YN65~)T:ki-F2T% '6WU{BVpY`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49780	99.86.4.79	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	631	OUT	GET /media/dd9a87_34be67cd0dc34bedbba06a4a787cba19~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	765	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 148349 Connection: close Server: openresty/1.27.1.1 Date: Tue, 31 Dec 2024 15:24:45 GMT Expires: Tue, 31 Dec 2024 16:24:45 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Wed, 13 Nov 2024 08:10:42 GMT ETag: "6543c524ce4220d5af9217f0adb44911" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-2wl4v Via: 1.1 google, 1.1 3095e870e1a1a1b03178e40ab1872de4.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: yajdQNWwqmeoU15-zbUdbUaISdnON5_UkXV_3i7KkjEq8Jf90QovuQ== Age: 136070
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 b8 ab a4 ce ec ef f7 d2 d8 5d 25 d6 70 5b 61 b4 a6 9d 49 4a e6 d5 c8 bb 6f 63 5c 8c 83 79 f7 ba c8 97 78 74 9c 93 89 8e 59 66 57 52 59 aa c6 c7 30 35 4b 7b 72 6b df 18 29 14 12 20 a7 79 81 0d 09 18 d9 d7 f8 78 56 5c 2f 66 f6 b9 d7 d9 47 3a 44 ae a3 99 59 59 64 e9 54 6c 76 86 88 e8 10 4c 77 75 76 48 43 49 95 66 6b 6f 77 84 84 99 99 ca bc b4 95 a8 a8 85 7b 73 a2 ba ba 55 45 49 a7 8b 83 f5 ae ba c5 b5 ad 9a 68 73 a3 6e 7a b7 c5 fb b8 b6 f3 a4 9a 93 73 6a 63 94 8b 83 6b 63 62 fb f8 fb ed 70 87 68 75 78 53 4c 53 9c b5 b6 94 74 6d 87 85 87 ad 9c 92 30 41 62 b9 9a 94 4a 48 52 be b0 a8 a3 88 7a de d4 c6 63 5b 5c 74 6c 6a 28 26 34 c5 ad a4 8b 71 e2 83 75 6b 69 49 52 d9 cc c3 8c a4 a5 a4 95 8a 91 85 7c d0 c3 b6 83 89 ef 62 43 Data Ascii: GIF89a]%p[aIJoc\yxtYfWRY05K{rk) yxV\/fG:DYYdTlvLwuvHCIfkow{sUEIhsnzsjckcbphuxSLStm0AbJHRzc[\tlj(&4qukiIR\|bC
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 41 14 bc 5d dd 45 c1 ae 5e 9c 23 88 42 c5 8a 42 dc 0e a3 dd 36 eb 6f 7a 2c b1 ca 82 30 c8 82 df ce 40 32 dc 69 9c 6e 24 b1 3e 2b b1 e2 5c 30 04 2b ce 6d 64 28 cd 80 de 7d ec 46 26 9b 87 26 e7 af b9 43 29 b8 28 98 7a 40 3d ac 68 6c 59 cf 29 e9 ff 56 cf 0a 5b e8 ca 41 2b 04 ed d0 56 42 2b 0c ed e2 98 63 bd 5e 00 29 60 aa 1d 60 4a ec 5a 6d 93 e2 86 fe f0 2b 92 72 13 b4 a4 aa 3e 42 66 1f bc 47 8c ad a2 91 ec ca ac be 26 56 a1 12 c7 c5 d6 32 d6 61 1c d6 ad 23 b8 81 71 f6 e6 30 6e 41 c7 a6 e9 16 78 ac 2c 68 01 36 c8 02 36 30 80 df 7a 2f b3 0a ee 9a 8a 82 54 d9 42 f9 9a af f9 fe a6 b1 de a9 2c e8 5d 9a 7a 28 cb 72 68 b2 95 60 33 82 a9 e5 c2 96 f5 ed 00 f3 81 27 98 12 82 da fe af b7 f5 6c 00 87 2e 17 b4 81 4f 7e c1 20 bc 97 50 5e 40 3c 28 ad 1d d8 81 1a 30 c2 05 Data Ascii: A]E^#BB6oz,0@2in$>+\0+md(}F&&C)(z@=hlY)V[A+VB+c^)``JZm+r>BfG&V2a#q0nAx,h660z/TB,]z(rh`3'l.O~ P^@<(0
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 53 6e 35 67 ee cb 6a 1b 57 58 93 8a e7 95 13 12 d2 90 cb db 8e ad ab cd 72 65 7b 52 b3 fe cd b9 cd 09 d0 df 31 44 de bf 27 8b 2d 0d 92 71 05 68 64 5b dc a0 dc c3 9e a1 21 68 76 18 7d 16 d0 18 81 ba 57 93 33 c7 31 1a 0c 80 78 00 35 c6 51 f5 48 97 35 03 dd 08 07 ed f1 ad 1b 11 59 c0 ac 8a 3a ca 12 e4 ff 94 85 66 08 e3 1d ef 40 7b cb 84 81 57 61 cc f5 80 be 25 66 08 5c 04 97 ba db dd b3 3e e2 d7 8f 8e c1 77 86 8c 87 78 c7 3c e1 99 4a 3e 32 31 87 2a e5 e5 14 30 7f 17 df df 21 44 be cc 7f 90 bc fa db 3f 86 38 c0 3f 0e 2e 77 80 1e 22 e1 d4 3d c0 16 94 35 8c 43 d1 f9 ac 87 a5 63 38 37 b1 b0 51 3a 1f 33 40 bd 3c 91 19 15 a3 86 1c b0 8d aa 33 ab 49 93 bd 54 b0 3d 0f d1 0d e5 d2 8d 79 2b 1a 33 68 8a dd 9a 05 08 31 8d 62 50 04 45 30 01 45 00 29 45 63 99 94 18 8d 91 Data Ascii: Sn5gjWXre{R1D'-qhd[!hv}W31x5QH5Y:f@{Wa%f\>wx<J>21*0!D?8?.w"=5Cc87Q:3@<3IT=y+3h1bPE0E)Ec
2025-01-02 05:12:35 UTC	15019	IN	Data Raw: 20 4a db 1b 0e 89 12 48 1c 12 df 80 04 00 5a 8c ee 9f a6 1b d5 3e 80 ba c8 f5 de 77 ef 9e eb e4 82 ef be cb d5 db 9e 23 27 f4 bd 45 4e 84 e2 83 ed 82 67 9f a2 01 a7 38 85 b3 2d 2f 82 cc 73 41 da f8 d0 01 3e 3c ff 79 a5 a7 39 10 df 36 f7 8c a1 ae 6e 74 b6 7a 55 57 71 64 70 00 4e c0 13 f6 26 04 0a 10 ff 2b bc f5 75 b7 87 7b 7d 36 76 09 f8 13 04 87 80 0f 86 2b c2 77 09 c5 b7 76 c6 77 09 8e 96 7c 12 97 0d cb c7 69 46 70 58 ea 06 80 a6 66 6a 78 97 77 a8 76 0b 35 c6 63 2f 88 2e e7 82 2e 82 a7 5e 42 32 18 ea e5 6b 0d a0 78 32 e7 83 89 a0 3d e7 17 6c 46 b6 7e 22 d0 6c 40 d7 02 d5 56 6d 0b 50 6d f5 e7 84 fc c7 7f 6a e6 6d 6e 66 0a 94 20 72 51 67 60 ac 67 04 12 07 7b 0a 30 40 b3 07 4e 15 d2 67 71 e5 67 19 e6 13 76 55 6f 0b 43 31 18 88 2b 0a 50 7c 68 92 26 4e b0 70 Data Ascii: JHZ>w#'ENg8-/sA><y96ntzUWqdpN&+u{}6v+wvw\|iFpXfjxwv5c/..^B2kx2=lF~"l@VmPmjmnf rQg`g{0@NgqgvUoC1+P\|h&Np
2025-01-02 05:12:35 UTC	5712	IN	Data Raw: c3 1e e7 33 06 1b f2 49 e8 9e d9 41 d2 64 06 42 04 0a 0e 3c c2 c6 a1 0e 83 64 e4 4f 7c 81 6b aa da c6 54 1f 4f d4 c6 48 f0 08 cd 69 eb 0e fa e7 4f f9 94 93 ad 1e cd 46 81 36 65 a2 7c 4a e6 e7 99 6b 8f d9 02 ba ae ab bb ba eb 0e a0 ab bb fe 2c d4 49 ea cf 16 ed a5 b2 27 4f 6a 01 4f 6e 2a 7a 26 40 65 11 d9 94 7e 1a 13 66 5a db 2c 4c c3 1e 0f 20 39 ec c2 54 02 12 78 ad d7 e2 6a 2d 90 ec 17 8c 0b 9a 6a c6 05 20 80 1d d8 01 23 5c c0 f3 a9 a5 5a b2 e1 85 3d 42 66 e0 19 26 40 e5 6a 22 81 c5 b0 a2 03 22 40 d6 65 0c 4f 5c 17 a0 de 40 4b 61 2b 02 76 eb a7 51 e2 d0 11 25 93 2e 80 23 30 69 a6 06 a9 93 6e 81 cf ee 28 e6 66 2e ba 06 03 ba c6 eb bb 86 ff ea d3 71 ee cf fa ac 90 66 2e 4f f6 98 63 ae a3 36 b1 2a 39 d9 67 62 89 6b eb 92 5a 63 b5 42 25 38 99 1c d4 ae c3 72 Data Ascii: 3IAdB<dO\|kTOHiOF6e\|Jk,I'OjOnz&@e~fZ,L 9Txj-j #\Z=Bf&@j""@eO\@Ka+vQ%.#0in(f.qf.Oc69gbkZcB%8r
2025-01-02 05:12:35 UTC	5712	IN	Data Raw: 99 17 14 f6 d1 0f 98 17 03 a8 00 35 dd a0 6c 14 52 00 ba d5 5b bb d7 7b 25 13 22 15 75 1d de 95 68 d9 b5 46 dd 55 3c b9 73 21 15 60 3c 73 01 3d 39 f5 5c c5 13 22 3d d2 23 df 80 08 ad 96 0f b4 d6 22 bf 8d 5e 1b 16 56 5f 77 00 ae 34 66 a9 f4 3e e9 81 58 f9 f1 09 2e 56 80 f7 11 06 80 55 77 f7 f1 4b 91 55 64 c5 74 59 cb b4 4c eb 96 7a 33 18 5a 31 20 22 a9 80 7a 93 b6 70 69 2d 73 11 c1 7b b9 d7 7b fd 14 7c ff f7 51 00 1c f5 3a 87 a1 46 85 56 5d 5d d4 06 1a d7 3a 5d 14 48 7f b4 68 65 b8 3c 1b d7 09 04 96 74 4f 97 0c 74 ee 14 4b ca 41 01 78 00 fc a1 81 03 f8 35 73 b5 3f 8f e0 1b fa d6 1f 7a 95 56 17 12 14 ba 74 81 e9 56 6e 13 58 59 93 15 4d bb 18 83 cd 94 7a a9 60 83 37 98 0a fc 80 1f f9 e1 18 5b 41 21 fd 01 0d 4e d8 8d 51 78 21 57 a0 51 2f 97 8e 2d 17 52 c1 77 Data Ascii: 5lR[{%"uhFU<s!`<s=9\"=#"^V_w4f>X.VUwKUdtYLz3Z1 "zpi-s{{\|Q:FV]]:]Hhe<tOtKAx5s?zVtVnXYMz`7[A!NQx!WQ/-Rw
2025-01-02 05:12:35 UTC	5712	IN	Data Raw: 47 0d 22 37 49 70 01 8e e2 42 97 b2 7d f7 97 7f 90 15 1f f3 11 0b 45 50 1a d7 a7 01 45 65 82 8f c4 1f dd 34 1a 81 85 03 57 80 0c 1c e0 18 10 70 12 27 a1 34 1c 00 86 12 86 81 42 91 02 cb a7 1d d9 e1 4a 2b c7 31 79 24 82 a4 51 30 38 94 82 2c 38 87 2c 48 2f 31 44 1f db 80 03 53 60 09 38 50 63 05 52 51 bb 70 59 fa c6 3c 38 b0 2b 41 a1 2d 6c 30 66 2e b4 88 47 78 7f 34 ff c5 10 fc 81 53 91 11 12 05 52 20 3f 50 0e 30 60 49 05 92 79 34 21 12 02 28 0d da b0 09 49 d2 24 77 c6 01 38 e0 12 43 90 1f a6 68 6d d7 f6 37 8f d0 5a db d1 6d 7c 87 14 b1 c8 32 41 51 82 31 65 87 9f 42 87 74 b8 0d 2a e8 8b 1e d6 17 4d 08 65 9e 98 79 14 15 02 bb d0 41 11 60 47 96 f0 07 f0 17 78 f3 67 2e 2c 65 84 b2 b6 7d 58 37 48 95 52 04 3f a0 2f c5 16 20 9b 18 0b 23 f0 0b 1c 50 1a 0e 10 80 3d Data Ascii: G"7IpB}EPEe4Wp'4BJ+1y$Q08,8,H/1DS`8PcRQpY<8+A-l0f.Gx4SR ?P0`Iy4!(I$w8Chm7Zm\|2AQ1eBt*MeyA`Gxg.,e}X7HR?/ #P=
2025-01-02 05:12:35 UTC	5712	IN	Data Raw: 4c fc b5 e1 f2 c4 4f 1c 36 91 30 39 20 dc 0e 4f 49 81 f4 00 28 3f 83 85 47 58 ab c6 fb 03 2a d4 c2 32 d8 05 4b 28 03 5a a0 81 ff 5d d8 83 cc 13 3a 72 7b 45 04 70 45 2a 24 b7 2a 74 c5 65 03 49 57 14 ba fd d3 bf c1 d8 83 21 68 86 89 a2 ab ae f8 03 78 0b 8c 63 b9 31 c4 80 43 ac fb 37 79 b8 03 57 f0 85 6d 7c 86 67 08 87 a0 7c 86 00 20 ca 6f fc 43 66 f0 85 6a a2 16 6a 4a 3e 12 a8 3a 66 c9 34 01 d9 16 33 88 b5 a7 8c af 59 70 49 7b 00 96 06 29 89 76 c8 8d b1 e2 47 2b c8 c4 ab 19 ae e1 42 ad 99 80 1a b5 b9 1e 0e fb b0 55 41 2b b4 f2 b6 50 da 42 02 10 ba 5d 28 83 32 d8 03 5a b0 84 5d d8 42 5d 74 c5 71 43 80 71 23 b7 8f 34 b4 5d 19 03 4b b8 c8 2d ec b9 93 14 3d 8a 82 06 3d 80 06 68 98 02 76 60 8f 89 8a b7 07 8b 83 63 c1 ab 2e 61 16 4f e0 2e ac 53 47 c6 72 05 6c 24 Data Ascii: LO609 OI(?GX2K(Z]:r{EpE$*teIW!hxc1C7yWm\|g\| oCfjjJ>:f43YpI{)vG+BUA+PB](2Z]B]tqCq#4]K-==hv`c.aO.SGrl$
2025-01-02 05:12:35 UTC	5712	IN	Data Raw: 21 34 81 3d 22 c7 8c b5 53 da bd 44 3b 15 97 18 80 c0 33 3a 0a f2 61 dd ed a1 62 e8 bc c5 ba cd 59 14 c0 52 fb ad df fa 45 d9 14 3a c2 02 f4 94 38 d4 9f 5b f1 87 34 2c 1a 32 ee 83 c7 08 63 24 b0 04 d7 2d 02 62 2a 02 03 0c c9 09 28 60 10 6d db af bc 11 93 d8 62 ae 19 c2 d2 e1 61 1f 00 1a 1f 6d e6 06 96 98 3b 14 c9 7f 06 68 f4 6d e2 f4 39 82 23 92 20 42 42 9f 3b 4a a2 52 ee 8b 28 b0 53 55 b2 93 0e f2 a3 54 5e 9f 52 ce 44 13 38 c2 6b d6 df 7f d2 98 0d 92 15 d7 a9 d5 4b 60 1d ad 40 a2 39 9e e8 0a f1 85 06 76 db 9c 39 07 e1 d1 41 17 b0 1f 4f 62 67 03 2e 40 62 88 82 34 4c 42 35 2d 83 34 4c e2 0e 44 82 17 ca c2 3e ac c4 2f 9e e7 3e 08 23 b6 f9 53 10 45 ff 47 2d 04 85 4d ba 81 d2 41 59 13 e2 67 53 89 e3 53 e5 96 51 12 65 db 05 68 52 ba c4 ad 1c c9 4c a8 55 d3 3c Data Ascii: !4="SD;3:abYRE:8[4,2c$-b*(`mbam;hm9# BB;JR(SUT^RD8kK`@9v9AObg.@b4LB5-4LD>/>#SEG-MAYgSSQehRLU<
2025-01-02 05:12:35 UTC	5712	IN	Data Raw: e7 f4 0d f6 94 30 d1 4a f6 1a d0 07 12 91 74 62 14 06 0b f5 05 03 6f a7 72 8e 47 27 c4 11 64 68 01 1c e1 32 83 b4 53 76 62 29 3a a9 88 82 e3 45 76 c2 34 8b 28 11 9a 54 48 a0 f4 29 6e 05 13 ac 50 40 c1 e2 7d b0 63 3d 4c e2 23 54 a3 4b c5 a8 97 1a b4 2c ed 6e eb 74 8d 0f 22 94 1c 78 91 1c c8 c1 cd a8 86 17 a6 b3 f9 ea 94 24 e5 72 4e e1 74 19 59 e0 17 86 95 4e a5 a6 4d f9 80 4e df 00 24 f7 f4 0d 8c a0 4f 65 8f 0c ff 61 12 1b 4b 6c fb 78 c0 a5 68 d4 46 33 c1 06 81 ca 48 ea c6 11 c2 d5 d1 5c 60 3d 27 95 88 78 c2 05 5a 61 01 c4 21 53 dd d5 fe e2 b3 e8 be e0 70 06 61 f3 84 04 13 a4 54 5f ad 10 3c b6 02 65 64 c6 11 66 23 24 9a 87 4b 69 91 37 0f ce 55 13 2e 02 d1 92 0c 78 11 4d a7 53 1a 8b f1 44 49 32 58 29 16 4f 85 15 24 8f 15 59 e5 34 22 21 c1 63 21 e1 21 59 80 Data Ascii: 0JtborG'dh2Svb):Ev4(TH)nP@}c=L#TK,nt"x$rNtYNMN$OeaKlxhF3H\`='xZa!SpaT_<edf#$Ki7U.xMSDI2X)O$Y4"!c!!Y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49793	194.147.100.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	352	OUT	GET /pangda/tbad.js HTTP/1.1 Host: xmad.7wzx9.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	555	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: application/javascript Content-Length: 7051 Connection: close Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Wed, 01 Jan 2025 17:12:33 GMT ETag: W/"1b8b-62ab304f3fe64" Server: nginx X-Cache-Status: HIT Access-Control-Allow-Origin: * Access-Control-Allow-Methods: * Access-Control-Allow-Headers: * Access-Control-Expose-Headers: * Access-Control-Allow-Credentials: true Access-Control-Max-Age: 1728000 Accept-Ranges: bytes
2025-01-02 05:12:35 UTC	7051	IN	Data Raw: 76 61 72 20 61 70 70 41 62 6b 44 69 76 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 27 74 62 61 64 27 29 3b 0a 66 75 6e 63 74 69 6f 6e 20 6c 6f 61 64 43 6f 6e 74 65 6e 74 28 29 20 7b 0a 20 20 20 20 2f 2f 20 e5 88 9b e5 bb ba e4 b8 80 e4 b8 aa e6 95 b0 e7 bb 84 e6 9d a5 e5 ad 98 e5 82 a8 e9 93 be e6 8e a5 e3 80 81 e5 9b be e7 89 87 e9 93 be e6 8e a5 e5 92 8c e5 90 8d e7 a7 b0 0a 20 20 20 20 76 61 72 20 69 74 65 6d 73 20 3d 20 5b 0a 20 20 20 20 20 20 20 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 6c 69 6e 6b 3a 20 22 68 74 74 70 73 3a 2f 2f 76 75 79 38 31 2e 74 6f 70 22 2c 0a 20 20 20 20 20 20 20 20 20 20 20 20 69 6d 61 67 65 3a 20 22 68 74 74 70 73 3a 2f 2f 63 63 37 37 37 69 6d 67 2e 64 71 73 6c 64 7a 2e 63 6f 6d 2f 69 Data Ascii: var appAbkDiv = document.getElementById('tbad');function loadContent() { // var items = [ { link: "https://vuy81.top", image: "https://cc777img.dqsldz.com/i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49788	99.86.4.79	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	631	OUT	GET /media/dd9a87_b1d6c5504d164c40835d918239dcd10e~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	764	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 975329 Connection: close Server: openresty/1.27.1.1 Date: Wed, 01 Jan 2025 06:59:53 GMT Expires: Wed, 01 Jan 2025 07:59:53 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Wed, 13 Nov 2024 13:00:11 GMT ETag: "c935ad6dde4cf98f305eaf0d69f195cc" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-hm64q Via: 1.1 google, 1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: JynjEA68Sw8oPfOAo3dxVsTX7Eb5L_3l8iN2jiM2yRlGq6Twj1VYBA== Age: 79962
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 ce 99 8c 67 44 32 d4 95 73 ff 50 03 df 5f ab b5 aa 97 75 6f 68 1a ae 72 91 66 50 f1 b9 b0 2b 26 27 f6 ee db f8 dd f7 a3 0e ab 61 92 b1 b8 cc d4 aa 00 dd 72 54 46 23 bb 88 62 af d5 b4 bb ce 92 b6 ce 06 05 05 4c 32 2b d0 b7 da 4f 48 47 ae 77 6a b0 70 4c 9c 71 94 8c 50 2e ff 87 16 8f 88 75 93 1c 1a d5 11 f1 b3 ce ef ef 67 64 59 76 90 dc ee f1 26 0f 0b ff 1d 0b d8 b2 ef b2 62 e5 8b 54 49 f5 b2 d6 20 58 98 f7 b0 f7 98 99 ac ee 22 ff c5 18 9a fe 99 ff 90 d8 f9 25 2c 4f 8f aa b7 aa 99 ab 6d 11 11 71 11 cd 6b 66 5b 2b 48 68 f8 70 c9 22 96 c8 6d cc f2 2c 22 11 4e 2d 46 ef aa 75 45 23 16 a8 dd c6 dd aa 77 f3 72 fc fd 54 d9 cc 87 5d f5 cc 98 4f 09 0b 6d 31 29 25 0f 26 b7 b1 ea f6 8f d8 d4 94 d7 91 28 52 d4 93 ad 0d 23 27 10 11 Data Ascii: GIF89agD2sP_uohrfP+&'arTF#bL2+OHGwjpLqP.ugdYv&bTI X"%,Omqkf[+Hhp"m,"N-FuE#wrT]Om1)%&(R#'
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: a2 c5 54 0c cd 14 e3 c4 88 98 40 5c 86 df a5 85 00 fc 51 5b a8 40 07 f0 09 88 61 4c 07 e4 ac 09 e0 41 cb d6 c8 13 f0 81 ec b4 ac 1c 18 c0 35 32 e3 8f f9 0c 91 fd 8c d3 1e cd 33 96 8b b9 2c 0d d1 2c 4d 34 12 0d 01 50 81 01 b0 23 0e 7c 80 80 04 00 ef f8 41 29 48 17 98 d4 40 fa cc 82 ac d8 63 02 9d 19 59 79 5b db 98 cd 0c 90 1b 89 a8 8d b7 35 0c 55 6e 04 df 70 4e e1 fc e6 9c d9 08 b7 02 4f 00 34 41 37 c1 c5 84 ec d1 84 2c da 1e f1 02 2f c0 45 5b 44 86 a5 80 16 c9 7a ab 45 70 a5 b9 7d 8e 81 68 c4 41 2c 84 a9 8d 51 8c c8 99 9a 5d ff 0a 1f c4 4f 8b f0 c1 fd a4 5a ac 49 84 44 c4 4d 05 05 88 aa f9 40 1f f4 9a f8 d4 90 bd 7d 10 08 91 90 0e b9 e5 7c 84 d4 f7 7d c7 95 44 43 dc 46 1b 3d 52 c4 cc 25 90 fd 64 da 59 29 40 03 51 10 a6 85 d9 57 d9 4f ff dc 8f fc 10 d0 57 Data Ascii: T@\Q[@aLA523,,M4P#\|A)H@cYy[5UnpNO4A7,/E[DzEp}hA,Q]OZIDM@}\|}DCF=R%dY)@QWOW
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 91 31 72 79 c3 2f 30 05 7b 94 97 7c 4c 48 7b 31 05 5c 80 32 25 1b 98 81 51 98 c1 75 4a 82 12 18 26 43 18 6e aa 81 53 b8 84 49 2b 86 2a 7b 1b 78 a9 c7 c1 75 85 79 30 80 31 08 00 0c d9 99 61 f2 25 67 38 a4 99 b9 80 d0 d0 ab 4d f0 d6 52 68 d4 61 40 19 94 3c 99 ff 30 18 00 e3 00 be 42 1a 50 60 43 3e f3 33 67 c9 d3 c0 98 9a 3c 3d 34 af 21 8f 46 6b 34 13 28 3b 3e 60 07 b7 01 05 a4 e4 b1 7a f1 db c9 55 98 68 e0 00 bb 09 19 86 91 4a 22 18 35 c5 21 4b bb 48 1c c9 21 4b 58 93 9c ed 0d 3f ca 09 dc 5a 13 bf bb a8 1e eb 69 a6 16 6d a6 18 ff cc d2 08 c8 04 6e c0 05 8f 08 89 0c 00 80 5c 78 84 6f 50 84 04 d0 86 5e 00 80 55 48 a1 4c 58 85 55 18 90 b6 5a 1d 02 59 85 7d 93 99 7f 3d 3e c5 6b 99 67 32 9e 05 f6 36 2b 10 9e c8 0c 1b 05 78 1e 73 23 1f bc a8 9e 0b 0e 4d 7a fb 1e Data Ascii: 1ry/0{\|LH{1\2%QuJ&CnSI+*{xuy01a%g8MRha@<0BP`C>3g<=4!Fk4(;>`zUhJ"5!KH!KX?Zimn\xoP^UHLXUZY}=>kg26+xs#Mz
2025-01-02 05:12:35 UTC	15135	IN	Data Raw: b8 a3 01 c1 84 94 8c 85 5e 16 30 68 41 32 68 3f 91 01 c0 22 25 e2 c6 7d 8c e5 88 8e c3 b0 b5 22 0e c0 c0 0a b4 50 a9 ba f1 2b 0a 10 07 eb c0 71 20 27 44 90 e0 0e d0 d6 43 ec 63 6d d5 c6 96 e5 01 97 f5 03 0d f8 e3 91 88 95 04 89 f3 a5 13 3a 40 05 d4 3f 49 82 89 ec 35 12 08 50 b0 b7 15 21 2f 42 0b bc 91 13 85 d7 0a 7d 24 6f 29 f2 08 c3 d0 0c ae 90 2d a8 50 5d bd 60 2a 86 74 48 8a 50 09 2a a4 83 13 7a 6e c8 e3 0a 14 90 44 1f d7 43 a3 80 71 cb 26 0a 96 70 3e a9 c9 c1 1d 1c 3e b0 99 3e 26 6c 72 b8 b9 9b 2a 6c 45 52 54 45 60 e4 03 ff c2 e9 5b 8d 12 bc 8c c2 67 49 a2 78 47 23 1b bf a1 02 5b 60 1b 9e 56 74 df 30 3b ad f0 0c 08 d0 0a 0b dc 74 7b 17 09 2d e1 08 4b 71 48 51 97 2a 7d d7 12 2b 00 4f 2d 80 01 cc d0 02 e6 79 0c 1a 1a a3 ef 59 79 1a 8a 01 98 60 11 0c 50 Data Ascii: ^0hA2h?"%}"P+q 'DCcm:@?I5P!/B}$o)-P]`tHPznDCq&p>>>&lrlERTE`[gIxG#[`Vt0;t{-KqHQ}+O-yYy`P
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: b8 21 19 18 60 17 8a 11 03 b8 81 01 aa 05 c0 6c 41 17 b0 65 05 ba 81 c0 14 ec 1e 96 80 09 0a 84 a6 f6 8c f1 f0 a0 2e a0 00 1c d9 25 09 5a ee 11 fa ca af 5c b1 11 98 30 7b 02 00 52 82 82 0e f8 2c c4 ea 6c fa b6 2f a0 c8 60 03 5e c1 b0 84 e6 56 64 a5 bc 62 a5 19 3a 40 00 f2 00 1b 12 00 46 7a 21 01 b4 a1 13 5e 01 16 2e a6 17 7a 01 46 3e a1 c8 56 a0 13 26 32 19 96 60 09 ba 41 1a 9a ec c9 64 21 66 fe 2b 01 72 61 2a be 69 01 90 06 69 3e e1 ff 13 bc 6c 27 6e e6 15 54 a1 21 10 e2 15 f2 2f 86 a4 c6 22 10 20 77 84 a0 12 de ac 12 10 e0 02 a4 c0 c1 50 ec 1d d1 46 7c 30 2e 60 22 44 89 82 43 89 54 20 14 4a e1 16 40 61 29 15 cd 29 77 85 d0 f2 46 2a 09 eb 13 fa 66 6f 26 8d 11 56 80 00 5c 00 71 1e 47 d3 64 27 3f 14 e7 d4 50 ed 73 28 e7 72 32 27 d7 48 87 80 40 c7 73 48 07 Data Ascii: !`lAe.%Z\0{R,l/`^Vdb:@Fz!^.zF>V&2`Ad!f+raii>l'nT!/" wPF\|0.`"DCT J@a))wFfo&V\qGd'?Ps(r2'H@sH
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 42 7a 1a 1c 34 ce 24 c0 82 24 e4 c2 16 58 24 ab 61 64 ab a5 1a 12 b8 9a e6 a5 08 10 b4 c1 3a 40 c2 00 f1 0f 33 fc 8f 00 8d 42 00 e1 1a 4a 0e 50 09 e8 da c4 c5 e0 b1 4d 83 b1 d1 e4 25 a4 49 01 b4 c2 07 f8 46 08 71 10 09 a1 c8 06 59 db b4 a9 50 06 54 de 0c d0 93 ba a8 8b 05 28 00 2d 78 05 2b 35 11 39 91 13 2b 80 c2 b8 21 62 29 00 40 29 c8 90 2b 49 55 56 71 82 12 8d 05 0d b1 42 be c9 90 01 b0 c1 0c 44 00 2d 6c 45 2e 00 dc 15 55 9e 09 6d ff 5f 25 e1 41 4a 80 90 15 18 00 2a 9c 02 05 50 1c 1c 31 44 c5 55 1c 43 2c c4 03 1c 04 45 88 04 08 79 84 47 54 04 20 7d 84 61 7e 04 3d 41 41 49 20 01 21 20 41 49 34 12 4c c8 44 24 25 c1 8a 3c d2 6e 7c 9c 4f a0 8b 52 0e 45 0f 0c 05 01 0c 41 1b 34 81 fc c4 13 3c 59 c0 11 fc 84 53 44 85 0a 50 05 2a 51 c2 77 6c 42 2f 34 11 2c cd Data Ascii: Bz4$$X$ad:@3BJPM%IFqYPT(-x+59+!b)@)+IUVqBD-lE.Um_%AJP1DUC,EyGT }a~=AAI ! AI4LD$%<n\|OREA4<YSDPQwlB/4,
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 37 75 98 82 21 48 21 10 68 09 1b d8 84 75 fb ca 75 4b 87 92 20 23 8b 28 9a 46 48 93 10 09 1c e5 db 37 83 db 37 49 80 a6 96 92 84 4c 70 05 57 78 05 45 60 4b 49 c8 9c 14 28 09 36 a2 a0 34 42 08 8b e8 21 87 98 a0 08 ea b6 66 ab a0 30 5a 08 87 88 38 87 6b 4c 88 73 b8 8b 28 21 46 b0 23 99 b8 21 3e 52 21 98 b8 a3 3d 9a 89 3e 60 82 9d 48 a4 cf 3c a4 9f 20 24 d0 64 8a 97 9b 04 a3 80 24 0a e8 39 4f f8 b9 aa 58 9b 02 a8 01 53 28 00 be d8 84 50 ff e8 81 bc f0 24 24 0b a5 86 92 8b 4f b2 82 1c a8 b1 0c c0 a5 dc c9 01 67 78 84 d9 60 85 e5 33 05 e0 94 bc b0 bb 8c b2 9b 83 4b 10 8d dd d8 84 31 78 82 62 d2 0c 2f 01 8e 5f 62 8c c8 61 05 ee a4 97 79 11 05 50 10 0a 44 02 05 dc 08 26 33 cc 26 c9 e9 a6 2f 51 0d d5 d0 8d 59 c2 80 c6 13 05 48 70 8e cc bb 25 ee 80 02 7a 72 0e 5b Data Ascii: 7u!H!huuK #(FH77ILpWxE`KI(64B!f0Z8kLs(!F#!>R!=>`H< $d$9OXS(P$$Ogx`3K1xb/_bayPD&3&/QYHp%zr[
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 20 0a 9e 29 3c 44 11 02 bc a1 1b 87 51 9a ba 11 02 b6 84 4b 07 c7 07 bc 04 1a 4e 87 09 c9 80 09 a4 61 1a 55 d7 4c ad 91 4c b4 11 1b cc f4 09 d2 e0 0f 64 17 76 ba 81 77 ba 51 4d 28 10 76 fd f0 05 e5 30 11 9b 40 4f c8 60 79 bf e1 76 0e 62 1d 9d 50 4f 8a f0 1f c7 50 06 fd 40 1d 52 45 9c fe 80 0c b5 e0 0d e7 61 04 f2 d1 1e de 50 05 de e0 0d d4 70 0f f7 40 0a 8c 27 1f b5 90 00 a9 70 0d d7 30 50 4b f2 7a d7 37 20 07 92 0e 5f 12 7b 70 a0 04 ff 3b 97 02 d3 07 22 20 02 07 17 72 09 e8 f7 4d da 29 26 04 e2 54 e0 31 11 13 10 5b b1 35 01 1d 90 30 30 c2 0b 94 c0 30 a5 80 23 36 f5 08 40 e5 30 1d 07 24 b4 60 01 33 30 03 c6 42 03 b9 10 54 44 e1 51 14 72 54 4b 35 1d 25 82 55 d6 67 7d 63 e2 79 e3 27 a3 98 87 55 e2 e7 24 ed a4 55 8c d0 55 71 02 02 84 a0 26 67 45 56 e8 27 a4 Data Ascii: )<DQKNaULLdvwQM(v0@O`yvbPOP@REaPp@'p0PKz7 _{p;" rM)&T1[5000#6@0$`30BTDQrTK5%Ug}cy'U$UUq&gEV'
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 22 85 ab 50 e5 04 33 21 02 18 43 01 92 c0 ac cc ea 02 f8 e0 02 d8 ee f8 24 43 55 7e c5 fb f0 ea 59 32 85 15 c4 6f 10 15 2b 59 bc a5 11 b4 81 5c 70 06 fe 9e 0d 59 06 d1 55 9e 82 11 b2 21 19 3a 87 f9 8c 45 11 72 41 03 4c a1 04 e6 c4 61 30 a5 5b 84 65 2a da 6a 52 60 04 51 b2 ad 5d b2 e2 b3 44 01 5e 9e c0 07 98 20 1e 5a 81 17 4e 2b 45 22 4b 58 0a d0 66 d0 93 ab 62 cb 52 4e 90 12 02 20 00 2a 81 a1 72 c1 65 26 10 64 24 41 03 b2 40 10 12 01 ff 63 74 e0 0b aa 6b b7 52 e6 11 50 a6 51 be a1 60 8e 6f ba 54 26 05 53 f0 1b b4 85 66 0c 14 01 87 65 0d 97 20 11 84 c6 06 81 10 68 c0 b0 2e 18 60 07 cd f4 68 1a 00 06 b6 c6 be 1a 60 17 d6 0b c0 c0 26 09 e1 d4 2e 76 61 6e b8 c0 bf ee 26 6d da 06 03 ea 62 17 da a6 6f f8 82 03 22 0c 1e fd c1 18 0a 87 0b ca 14 2f 3c 4c 0c d0 90 Data Ascii: "P3!C$CU~Y2o+Y\pYU!:ErALa0[ejR`Q]D^ ZN+E"KXfbRN re&d$A@ctkRPQ`oT&Sfe h.`h`&.van&mbo"/<L
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 08 35 c4 be 7c 8b b6 00 60 c0 4c c1 a7 5c 4a 58 89 c0 c4 ec 68 c4 48 0c 1b b0 00 c6 b0 00 09 8c c1 1c 44 83 03 44 43 34 d0 40 5e 59 42 68 6d 42 2f 3c a9 7f f5 97 cb 4c a9 ca 8c 0d ca c8 54 98 54 82 0a a0 c8 ce fc cc cf 8c 40 22 bc 41 1b 6c 00 2f 7c 09 70 3a d8 37 f4 82 24 80 e0 37 00 40 3c 10 c0 7c c5 17 0e 7e 83 36 50 57 ca bc 4d 23 44 42 cb 48 97 04 f5 a0 80 d1 0c 9a d8 4d 2e 90 4c 73 c1 02 cd e0 0d 99 38 98 99 e0 cd 23 2c d7 a2 16 ff 18 08 ca 94 0c e6 82 06 74 01 11 10 c0 72 71 89 99 64 0d 75 f1 20 a0 aa a9 98 50 42 26 8c 81 82 f6 00 14 48 09 14 48 81 19 04 43 34 10 41 17 20 a2 ee 08 80 2a e4 4f 25 f0 02 fe b4 99 00 bc 83 24 74 c2 24 ec 02 57 fd aa 6c 9d 90 b8 dc d5 31 50 8a a6 01 60 ae 68 10 29 08 01 29 50 03 27 4c 01 ea 04 0c ba bc 0e ee 84 0f e9 a8 Data Ascii: 5\|`L\JXhHDDC4@^YBhmB/<LTT@"Al/\|p:7$7@<\|~6PWM#DBHM.Ls8#,trqdu PB&HHC4A *O%$t$Wl1P`h))P'L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49803	23.224.82.187	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	586	OUT	GET /img/GYyh_180x180.GIF HTTP/1.1 Host: ig55.vip Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	1055	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 844 Cache-Control: max-age=14400 Cf-Cache-Status: HIT Cf-Ray: 8fb8304e1a582f43-LAX Content-Length: 353124 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:01:00 GMT Etag: "67700c5f-56364" Last-Modified: Thu, 02 Jan 2025 05:01:00 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4CMk%2Bjf0TF62pF9qK20cpRASVt8rmubadlD3n4Hngjj%2F88Tz8AvAzwn1VWNv%2BUw%2FBcil%2B6NB4wT%2F0eqaphhzu5HevNTYi3oXPt4W6qrYSHn%2BUcvRmsHYQMv0y4ZqgxTsRA%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=944&min_rtt=832&rtt_var=84&sent=2248&recv=264&lost=0&retrans=0&sent_bytes=3089202&recv_bytes=15253&delivery_rate=305262693&cwnd=609&unsent_bytes=0&cid=581ea9534db1ee0a&ts=112891&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:35 UTC	131	IN	Data Raw: 47 49 46 38 39 61 b4 00 b4 00 f7 ff 00 ff 26 26 ff ee ab ff db 00 ff 01 f3 da dc e6 a0 fe 90 ff fb e5 18 7e a4 88 89 8f fb d7 ce f5 f5 f5 91 76 41 ff 9c 5a ff 53 30 00 cf ff e2 e3 ee ff c7 00 ff 5d f6 35 b5 ba ff 00 b6 ff f2 01 02 02 02 24 ff 00 97 4d 84 d0 f5 fd 60 e0 fd ab 92 6a eb ed f5 92 88 52 ff f3 8d ed ed ed ff ce b8 ff 3b 3a d5 c7 b2 74 fe 59 6d 6d 71 fe f8 d9 ff 30 0b ff 94 10 01 Data Ascii: GIF89a&&~vAZS0]5$M`jR;:tYmmq0
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: ad d9 ff ac 0c ff f5 c5 ff 32 32 ff d1 48 95 71 3f a3 8d 56 bb bc c6 e3 e3 e3 c7 b1 97 ff 02 02 ff 67 29 c5 c5 ce de de df ff d0 ff ff 6f 0d ff 4b 40 53 90 94 ff 4e 10 ff 1a 1a ea e4 da bc aa 8b 8d fb 71 ff ec 6c f5 ef e9 fd b7 a9 b6 a2 38 56 ff 39 ff 12 11 ff b3 fb ff d1 2e ff 0a 0a ff da 65 fe de 86 ff 8f fb fd a9 92 d2 fe cc ff fe f1 f5 f6 fc b3 f0 fe e9 f9 fd d5 d5 d5 3b d9 fe ff 2b f3 d7 d7 e1 cd ce d2 b8 b9 bc be c3 ca ce bc a5 b4 36 95 ff 76 68 ff 82 24 ff 90 83 a4 a5 ac 8a e8 fe c0 fe b3 2a c3 c8 fe e7 dc 3f 3f 3f db be 1c 59 a0 70 ff 68 59 ce b3 27 e0 d6 c3 ff f7 4d 96 97 9d 36 ff 15 ff ca 13 53 a3 c6 ff 38 1d ff ed ff 44 9d a9 fd f5 f3 79 77 69 74 75 7c 59 6c 65 ff 14 05 ec fd e9 aa ab b1 ff f3 26 fd ea c2 ab d3 e3 ff b1 3e 7b 5b 7d db 18 a6 91 Data Ascii: 22Hq?Vg)oK@SNql8V9.e;+6vh$*???YphY'M6S8Dywitu\|Yle&>{[}
2025-01-02 05:12:35 UTC	538	IN	Data Raw: 2b ed 78 d7 1d 2a 1a 6a b3 4e ab ed 7e b7 5e a6 94 14 96 6e 2b ee b2 9a 7a 0b 16 a8 e3 a6 8b 20 b3 e6 62 a6 99 ba f0 4a 58 ad a7 10 86 17 ef bd 13 76 4b 15 13 f8 f6 eb 61 3c 73 f9 2b b0 bc 73 f9 3a f0 c1 c9 05 8c f0 c2 d6 15 cc f0 c3 be 29 0c f1 c4 9e 39 4c 31 c5 12 5f fc 30 c0 68 19 ac b1 c0 19 7f 8c 30 c7 67 79 2c 32 be 21 9f 2c 30 c9 5f 99 ac 32 bc 29 bf 8c 2f cb 5e b9 2c f3 b8 31 df 0c 2f cd 55 d9 ac b3 b6 39 ff 3c 2e cf 54 f9 2c b4 b2 41 1f ad 2d d1 4a 19 ad f4 af 49 3f ad 2c d3 49 39 2d f5 aa 51 5f fd 2b d5 3f 59 ad 75 a8 59 7f bd 2a d7 3e 79 2d b6 a3 61 9f 1d 2a d9 32 99 ad 36 a1 69 bf ed 28 db 31 b9 2d 77 9c 71 df 4d 28 dd 23 d9 ff ad ed 0f 3f 60 8c d6 c4 3b 98 11 cb 0e 10 f3 2d 92 df ca 9a 01 43 02 3b c0 60 06 c4 79 8b fb c6 15 04 34 42 cb 14 30 Data Ascii: +xjN~^n+z bJXvKa<s+s:)9L1_0h0gy,2!,0_2)/^,1/U9<.T,A-JI?,I9-Q_+?YuY>y-a*26i(1-wqM(#?`;-C;`y4B0
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: dc 28 c7 d6 7c b1 8e 34 a2 23 1e fb 13 c7 3d f2 47 8f 7e bc a3 1f e7 a8 c4 41 ae ab 8f 86 1c 0f 20 f7 28 c8 44 1e 68 91 78 6c a4 23 f7 03 c9 3a 4a 72 92 ee a9 a4 1c 2f 89 49 f1 68 f2 8d 9c ec a4 72 3e c9 c6 50 8a 32 62 85 3c a5 8a be 93 2d 55 f6 e6 13 b2 f1 56 04 da e0 4a df 94 23 09 ed 9a 49 62 6a c9 98 ff e4 32 26 e0 72 65 b9 7e 09 cc 56 e2 11 96 c2 52 0a 10 ac 04 25 5a fa f1 96 88 fa 87 b1 a8 82 98 3a fa 52 46 1f 30 08 a5 e6 b3 cb 31 0e 73 3e 9c 32 c8 1b 90 c2 4a 7b 39 11 99 16 32 80 45 96 d9 1c 67 16 11 9a 38 d2 c8 34 95 52 4d 1e 5e 73 4b d9 44 c9 36 87 d5 ff 4d bd 7d 73 58 e1 44 c9 38 93 99 14 f0 bc 0d 9d 42 52 67 4e d8 79 18 77 4a 0d 9e 61 2a ca 07 98 89 a7 7e fe ec 9e 82 ca 27 54 ee b0 ab 0d 5d 94 a0 3f 21 d6 56 06 8a 2d 73 5e 0c a1 6a 7a c3 60 18 Data Ascii: (\|4#=G~A (Dhxl#:Jr/Ihr>P2b<-UVJ#Ibj2&re~VR%Z:RF01s>2J{92Eg84RM^sKD6M}sXD8BRgNywJa*~'T]?!V-s^jz`
2025-01-02 05:12:35 UTC	5930	IN	Data Raw: 22 c2 d8 b3 cf f1 b5 34 b1 81 3d c2 2c c0 c3 f5 f5 d4 c3 25 44 d0 6b 04 78 43 b5 84 7b bd 91 57 84 6d 4f 23 a0 44 13 cd 03 b5 00 02 18 cc 10 8f 5f f8 ef 17 b4 d8 c0 02 16 d0 ba fb bd 6c 44 1b 62 48 fc 32 d2 96 e9 29 84 52 0e 94 d4 02 ff 50 a3 4f 1c 03 14 7d a8 43 2d ea d1 84 68 f4 a1 11 e0 b8 47 2d 98 00 b6 f5 65 b0 1e 0b 73 c8 04 31 32 3f 86 64 10 4b f9 d3 00 96 ee 71 8c 3e e8 a3 84 7a f8 c4 27 ff 8c f4 07 e5 0d ef 86 11 5c c8 0c 2f 52 41 fa 21 b1 46 da 83 86 3d ba 61 0b 5b 50 a3 16 9f 00 47 34 0c 58 a4 6e 98 c2 8a b5 a8 86 fa 9e 28 43 bf c9 4f 2c b8 1b c8 13 6b 41 37 7e f8 01 1d a1 18 c3 22 72 b1 88 50 d8 e3 1e fa f8 84 07 c6 40 c7 31 68 22 14 dd d8 81 f2 a0 75 bf 32 62 2e 7a 57 b1 60 42 d6 c8 81 05 10 90 79 f1 b0 85 26 72 31 8a 7b dc c3 14 b8 a8 a3 07 Data Ascii: "4=,%DkxC{WmO#D_lDbH2)RPO}C-hG-es12?dKq>z'\/RA!F=a[PG4Xn(CO,kA7~"rP@1h"u2b.zW`By&r1{
2025-01-02 05:12:35 UTC	7116	IN	Data Raw: 69 cb f6 77 b1 f0 5f fc a0 0b 45 28 69 5f 86 4b 92 61 5d 0a 66 06 66 10 0b 46 f7 29 88 c2 6c ab f3 6c c0 d2 5f 42 ff c8 25 1c 50 20 53 56 35 1a c0 6d 0a b0 4c 5b 16 7a 85 37 7a e5 d6 16 64 c7 1b d6 c5 57 a6 65 06 57 f0 82 57 40 79 60 90 0f da 97 22 6c f2 29 ba c0 03 f5 70 2d 7f 47 7f f2 96 39 b5 c0 56 dd 51 22 d0 80 58 88 65 08 82 d6 1b bb c5 01 80 28 19 3b b0 57 bc 98 39 8a f5 07 3c e0 8b 1a d0 8b 1a 10 7a 71 d8 89 79 91 62 66 c0 03 24 e3 8b b6 a7 01 30 10 63 3f 60 06 d8 40 63 29 b2 03 7f 30 8e 7f b0 5d e9 a0 62 3f a0 00 ea f8 06 9b 95 8e ea d8 46 3b e0 8e b4 57 20 98 76 8e a2 e5 8e 0a 60 86 3a c8 59 9b 05 20 e9 10 6e d1 08 85 b0 a4 3c 72 16 61 06 89 57 4e c8 89 02 39 4d 8c 75 90 0e 19 5e 09 59 7c d2 88 18 54 f5 90 16 39 5c 0c 18 70 0b 49 52 4e 72 91 1e Data Ascii: iw_E(i_Ka]ffF)ll_B%P SV5mL[z7zdWeWW@y`"l)p-G9VQ"Xe(;W9<zqybf$0c?`@c)0]b?F;W v`:Y n<raWN9Mu^Y\|T9\pIRNr
2025-01-02 05:12:35 UTC	8302	IN	Data Raw: fc dd df fe fd df 00 1e e0 02 3e e0 04 5e e0 06 7e e0 08 9e e0 0a be e0 0c de e0 0e fe e0 10 1e e1 12 3e e1 14 5e e1 16 ce 13 01 01 00 21 f9 04 09 03 00 ff 00 2c 00 00 00 00 b4 00 b4 00 00 08 ff 00 ff 09 1c 48 b0 a0 c1 83 08 13 2a 5c c8 b0 a1 c3 87 10 23 4a 9c 48 b1 a2 c5 8b 18 33 6a dc c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 b3 a6 cd 9b 38 73 ea dc c9 b3 a7 cf 9f 40 83 0a 1d 4a b4 a8 d1 a3 48 93 2a 5d ca b4 a9 d3 a7 50 a3 4a 9d 4a b5 aa d5 ab 58 b3 6a dd ba b2 96 57 ae 53 bd 8a fd 0a d6 e9 d8 b1 65 cd 9e 15 9b 76 e9 d8 37 b1 d0 b6 4d 3a f6 07 8f 74 72 e7 1a ad ab 41 41 5e bd 44 c7 fe 31 f4 e7 2f e0 a0 67 a1 2d 28 6c f8 f0 ce b5 5e cd 2c d8 01 b9 96 e3 c7 95 63 2d 80 56 d9 f2 65 9b 9d bd 5e d9 1c da f3 e7 98 90 Data Ascii: >^~>^!,H\#JH3j CI(S\0cI8s@JH]PJJXjWSev7M:trAA^D1/g-(l^,c-Ve^
2025-01-02 05:12:35 UTC	3635	IN	Data Raw: 81 fb a7 1b aa a1 4a 3b a0 11 70 99 5c 4b b8 00 62 a4 c6 9b 22 49 37 b1 b0 3b 56 18 c0 25 8c 1b a4 e1 8a aa 4a 0b 19 4c fb 37 92 5b 0f 69 5a 0b de 3a b9 14 8b b9 99 ff 3b 16 52 8b 99 9c 89 b8 da 29 4b c2 4b 4e f5 70 a2 f6 09 b8 93 6a b6 c8 43 ba 92 2b 16 7e c0 25 b5 20 52 da 79 0f f2 5b bd 46 0b a9 c8 46 bb 7f 2a 9e 4a ab bb 91 a9 b0 03 74 63 37 a6 a1 e5 59 a3 80 5b a1 90 db b8 89 1b 49 ec fa 9d 76 0a 27 e3 ba a1 b5 40 ac de 19 1a 7f da b0 f3 fb 06 60 fb a5 04 bc 11 90 71 9b 3f 6b a4 e5 80 b8 5a 9a b3 90 d1 ae 48 fb bd d6 8b c1 b7 2b ba 95 01 bc 40 4a bb dc 3b 9e 95 ea 15 23 5c 99 65 2b c3 88 da 9d 39 aa bd f7 69 68 46 ea be 1a db bc 4b 0b b8 9f 60 bb a5 f1 9c 13 3a c1 51 7a 47 59 db b4 03 f0 ba 42 2c ab f7 fa a2 18 b1 16 1f aa b5 7f 3b 47 0c 7a ae 6f 7b Data Ascii: J;p\Kb"I7;V%JL7[iZ:;R)KKNpjC+~% Ry[FF*Jtc7Y[Iv'@`q?kZH+@J;#\e+9ihFK`:QzGYB,;Gzo{
2025-01-02 05:12:35 UTC	10674	IN	Data Raw: 01 44 d0 98 5e 51 0e 97 19 1a 88 b9 99 84 59 03 95 41 99 95 f9 98 9d 81 98 a9 99 04 a1 f9 80 10 01 19 35 20 05 03 30 00 8a 19 01 b5 19 01 9e 79 16 6d 90 04 b5 39 98 49 40 9b 03 a0 9b 5e 51 9b c6 79 9c b5 79 99 44 80 9c c6 99 04 05 d4 9b c2 39 9c d1 19 01 e5 50 03 b5 79 9a b8 f9 9b d1 a9 98 6b b1 9c cc 69 9c 9d 11 9d cc ff e9 9c 71 47 11 59 42 04 d1 d9 98 f1 e0 9b b6 b9 9b 5e d1 06 c2 49 9e 9f 50 0f ec 39 00 86 19 0f de 79 9c 52 60 98 62 11 0f b3 d9 9c fc 59 1a f5 39 00 49 a0 53 c1 89 9c 90 51 9f fb 29 16 0a fa 9a 72 53 0e d9 89 9c 0e 2a 16 e5 f0 9d 0b ca 51 17 b1 16 15 da 9c 38 b5 a1 b6 79 16 d9 29 05 6b 91 9d 11 80 24 f9 f9 9b c2 26 16 de 59 03 29 da 19 11 3a 00 4d f6 9e e2 99 a2 6d 10 a1 11 b0 16 d6 d9 9c 1a fa 9d 37 ba 16 be 29 9e 03 40 04 2d 2a 63 16 Data Ascii: D^QYA5 0ym9I@^QyyD9PykiqGYB^IP9yR`bY9ISQ)rSQ8y)k$&Y):Mm7)@-c
2025-01-02 05:12:35 UTC	11860	IN	Data Raw: 7f fe fa fe 4c 8c 97 dd 59 3b 75 d7 9f 7f 42 1d 38 1b 44 72 71 a5 56 6e 0a 22 f8 9f 82 5e 35 58 d4 7b 83 45 08 db 53 1a be 74 9f 50 06 18 b0 5f 87 a5 71 48 e2 6c 01 18 30 a0 49 7c f1 77 a2 84 43 bd 58 cb 1b ed 6d a4 99 8c 25 3a 85 23 4c a9 59 e4 d0 1d 12 ed b8 a1 89 42 da 07 e4 8a 06 ed e4 92 8c ff 28 c5 95 90 3d b1 e6 db 76 5f 41 99 a3 56 56 c2 d4 9b 51 1e 41 98 e5 70 5b 7d 09 93 57 7d fd 53 8f 81 62 c2 48 a4 98 f5 64 d5 e4 8b 6f 12 46 57 9a b0 d1 09 26 5a 76 52 67 27 66 79 0a 94 a6 6a 7d c6 e9 9d a0 78 95 27 a6 9f 42 96 67 90 95 88 32 a9 28 42 89 12 1a 99 55 94 3d 1a 5b 7f 94 d6 39 29 a4 6d 59 7a 51 5e 61 6d 66 98 9e 85 52 e4 96 9a 9e 66 54 ea a8 8d 52 95 6a 68 49 99 ff 4a aa ab af f2 19 ea 77 a6 9d ea 64 ad b6 e1 da 59 ab 43 f2 ca 6b 61 bb 0a 6b 2c b1 Data Ascii: LY;uB8DrqVn"^5X{EStP_qHl0I\|wCXm%:#LYB(=v_AVVQAp[}W}SbHdoFW&ZvRg'fyj}x'Bg2(BU=[9)mYzQ^amfRfTRjhIJwdYCkak,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49806	104.160.179.210	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	608	OUT	GET /f3dab33316b44c64a6f119272fb4489e.gif HTTP/1.1 Host: 555ww666yy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	328	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: image/gif Content-Length: 708549 Connection: close Last-Modified: Mon, 23 Dec 2024 08:29:11 GMT ETag: "67691f57-acfc5" psc-cache-status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2025-01-02 05:12:35 UTC	16056	IN	Data Raw: 47 49 46 38 39 61 14 05 04 01 f7 00 00 fe 01 04 fe 01 10 fe 00 00 fe 01 00 f0 03 02 ec 0d 01 d6 0b 02 e3 0f 0c ed 12 0f f2 24 0d f2 21 1d de 27 27 d7 28 10 cd 19 24 b8 1e 22 b3 20 11 b3 18 06 a1 12 0c 92 13 16 85 17 0a 82 06 02 70 12 0a 5d 15 0e 61 19 11 5b 23 1b 3f 19 18 24 15 18 1f 1e 23 24 22 3b 26 24 4a 33 2a 4f 4f 2b 53 4a 29 63 33 32 80 29 3a 8c 43 4f 6e 42 4f 59 48 53 4b 25 61 2d 2a 86 39 49 93 42 67 9e 40 75 99 56 6b 71 78 6f 77 8f 7d 84 93 8e 99 92 a6 9d 96 b1 8c 8a aa 79 74 a6 6d 5d a7 73 48 b8 7b 39 b4 8c 2d aa 74 2a 90 66 28 72 66 2c 84 4f 32 78 3e 25 88 33 21 95 48 11 a9 4b 14 b1 54 23 b4 67 12 c8 71 13 d6 66 22 d7 52 1f e7 43 31 f7 3e 37 f3 4f 20 f5 6d 25 f2 6e 09 fa 87 05 f5 92 06 f2 91 13 f0 96 2a da 90 28 d5 9b 13 e2 b1 13 ea b2 0f f6 b0 Data Ascii: GIF89a$!''($" p]a[#?$#$";&$J3OO+SJ)c32):COnBOYHSK%a-9IBg@uVkqxow}ytm]sH{9-tf(rf,O2x>%3!HKT#gqf"RC1>7O m%n(
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: ec 36 3a 9a 2b 58 5a 52 27 b5 a2 31 35 52 03 d8 2e a8 03 3f a8 43 2c 88 42 26 10 4b 42 21 54 5d 49 0c 26 60 02 cf 64 35 58 d7 55 26 60 42 b0 60 02 58 11 4d ad 74 b5 d2 6c 42 3c 1f 4d 59 3f fe 54 c4 b8 f5 55 6b 0c 28 c0 82 31 a0 03 3f 18 03 52 37 35 d1 26 2d 2c a0 c2 5e a7 c2 36 7a 96 67 b1 02 61 83 16 32 58 40 07 2f 36 d9 fd 26 b7 a5 ae 91 30 b6 64 ff c0 2d 25 03 68 55 83 05 dc d2 0f 14 09 b7 29 a5 05 64 f6 2d 51 00 68 8f b6 68 df 12 69 23 83 1f 2d 81 52 96 41 67 ef c8 7f 3c 76 6b ab b6 af ed c8 63 ab d2 0f 7c 56 81 10 12 81 f0 c1 04 3c 93 33 51 80 38 ed 00 0c 10 88 35 a4 01 13 10 14 a1 88 81 22 fc 87 37 41 93 73 13 8a 98 ec 80 65 a7 02 0c 54 d3 33 f5 93 33 f1 c1 24 1d c2 71 1b 8a 6f f7 ae 0c c8 02 67 c1 c0 32 fd 36 a6 d8 40 20 4c 52 21 0c 94 73 fb b6 18 Data Ascii: 6:+XZR'15R.?C,B&KB!T]I&`d5XU&`B`XMtlB<MY?TUk(1?R75&-,^6zga2X@/6&0d-%hU)d-Qhhi#-RAg<vkc\|V<3Q85"7AseT33$qog26@ LR!s
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 69 88 07 9f 8d 07 68 88 86 12 2b ec 15 b0 06 e2 c9 1c dd 11 6c 0f 70 da 6b ae ec 72 3c c7 dd 11 ec 65 58 1e aa 8d 04 59 a8 59 11 38 9e e3 61 33 bb 9e b3 55 f8 80 64 88 84 b2 1d c8 9c ec 1e 8c 2c 06 11 60 81 35 58 82 fb a2 5b bb 15 83 71 ad db bb 9d 83 f5 a9 49 5f 1b 1f be ad 1f e1 6e 49 c1 45 38 22 c2 8a 83 3b a2 59 53 00 95 94 9f 9c 9c 9f 97 24 b6 5f b8 49 5e 38 9f 5f 20 36 5e b8 dc f3 29 36 9a cc ee 9a 28 b5 cc e5 1f 97 38 49 13 6a 00 75 43 38 13 ba 36 59 7b 21 04 9a 21 f7 8e ca 19 a2 4a 25 e0 1f 17 3a a2 d1 48 22 31 d2 1f 78 53 ee 30 42 00 28 98 02 7a db dd 97 ac 85 b4 a4 85 5b 20 f0 df fd 5d b8 a4 9e 04 5f 70 df 2d de 04 48 38 6f 43 00 25 98 82 5b ab ef 32 ea 83 48 c2 8c 88 a3 38 0f 3f 0b 56 48 05 54 48 4c c1 d0 0b f3 65 39 96 63 4c 49 08 85 50 f8 fe Data Ascii: ih+lpkr<eXYY8a3Ud,`5X[qI_nIE8";YS$_I^8_ 6^)6(8IjuC86Y{!!J%:H"1xS0B(z[ ]_p-H8oC%[2H8?VHTHLe9cLIP
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 3d 84 20 08 bd 3d 01 32 10 09 b1 ad 06 90 d0 db b3 2d db bd 3d 62 30 e0 b5 ac fd db b3 ed dc d8 9d dd 43 b6 0c b4 ba 41 dd 7d d0 de 0d de dd 5d b8 40 b9 00 42 e9 b8 f4 b0 00 6d e0 06 27 e4 42 e4 36 43 4b 19 01 99 9b 42 6d 90 43 13 01 11 6a e4 0c f9 ad df fc 4d 13 14 77 11 f4 c6 0c ce f0 0c 88 30 07 cf f0 0c cb 90 0c 30 90 03 5b c4 03 02 91 03 3c f0 b3 34 90 06 6a 80 06 33 d0 95 5e c4 03 75 b9 d6 13 50 20 77 e9 95 5e 29 03 67 47 47 80 09 98 43 71 98 28 be bc 23 87 98 a2 50 0a cc 8b 09 a0 b0 bc a6 90 09 de 0b bd 46 21 0a 9a 10 6d 23 55 09 7f f4 47 a4 e0 bd 40 6e 0a fe 43 61 06 32 f7 15 5c c1 03 d4 39 16 67 31 49 40 e0 c2 4d 40 06 77 b1 07 82 90 c1 cb 89 08 79 00 03 33 00 d9 63 77 11 88 00 08 5d ee 75 3d 60 01 18 50 20 3a b0 02 5e 89 01 3a 50 01 6c 30 06 80 Data Ascii: = =2-=b0CA}]@Bm'B6CKBmCjMw00[<4j3^uP w^)gGGCq(#PF!m#UG@nCa2\9g1I@M@wy3cw]u=`P :^:Pl0
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 77 36 24 ef 25 71 2b 78 fd 72 02 18 20 19 2a 04 79 cd 80 06 d0 20 06 d0 40 06 d4 40 06 26 fc 0e f6 77 ed 88 97 7c 0c 84 10 fa 60 ed 3e 9c 7d 45 5c 10 1e 6b 3b 3a 6e 13 58 23 3d 6e c9 10 46 7c c4 53 84 3f 42 11 19 10 81 7b 1d 3b 11 38 44 7f 5f 13 0f 98 61 11 e4 e3 12 1c 5b 10 f8 40 10 d8 0b 46 12 61 19 38 a1 9a 44 a9 10 94 bc b0 16 98 0f 00 61 c9 0b 81 9f 22 78 ca f7 40 4a 8d fe 85 19 64 c0 11 92 8e 83 87 b8 9d ea c3 46 04 01 0c c0 00 0b c0 e0 09 0f a1 9d dc 29 41 9c 22 a2 36 64 3b dd fc cd e1 fc cd 09 84 88 2d 81 c4 be f7 ce 09 01 cf f5 3c cf f9 fc ce 23 a1 40 4c 8f 12 c8 49 d0 21 a4 d0 0f 41 cc cb 9c b1 0b 9d d0 19 7d 9d 64 ea d0 c7 1c 0c f4 69 32 0b 81 d2 2d 1d 7c 2f bd d2 d1 fc f5 90 ca 2a 0e 9d cc c5 9c 0f a2 82 d3 29 ca 9a f8 c3 6c 2d 56 14 b7 58 9c Data Ascii: w6$%q+xr y @@&w\|`>}E\k;:nX#=nF\|S?B{;8D_a[@Fa8Da"x@JdF)A"6d;-<#@LI!A}di2-\|/)l-VX
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: ac 81 18 54 6e 8e 7f 41 18 8c 01 1b b0 81 1b 0c 01 11 14 c1 12 50 6e 91 7f 01 8e 83 6e 95 23 e4 9b bd d9 de bc 4a 9e b5 ae ae 10 0b a1 d1 40 0d 9c af f1 32 81 4e 8e 6f f2 d8 2e ae e0 00 fe 06 cc 8f 0b d8 81 a9 9d 4f f1 9c 01 19 cc cf fc 5c 99 f9 90 0f f7 d6 80 16 04 10 59 16 da 19 40 6f 0d fc af a2 55 6f 0a 90 6f f2 94 c1 12 a4 4f 0a 88 c1 ac 25 65 f2 3c 5a 1d 3c ba 4e e2 c0 0c bc 80 f5 3e e5 12 00 5f 29 28 c2 0b b4 c0 0b 18 1b 13 e0 5a 56 72 d0 07 49 db 07 71 10 22 2c 83 3c a0 c1 1e 98 41 9c af 64 c6 e5 8c d5 1e 30 35 c0 03 3c 50 c3 64 d6 50 10 c5 c1 06 bf c1 1b 38 c3 33 78 c2 a0 6c 42 24 40 43 1c cc 43 1b cc 77 29 ba 01 1d d4 75 d1 24 02 21 f4 41 be d8 41 33 30 c3 33 24 f0 65 f2 10 0c cf 30 66 56 8c b7 db 20 1a e1 f0 67 3e a6 43 6c 04 55 8f af 4e f6 a2 Data Ascii: TnAPnn#J@2No.O\Y@oUooO%e<Z<N>_)(ZVrIq",<Ad05<PdP83xlB$@CCw)u$!AA303$e0fV g>ClUN
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: b4 a1 49 19 47 fb f3 b4 5c e4 ac c1 9a ab b9 1a ba 1c 1b b8 6c f4 2f be 8c 03 46 1b 4e e0 09 51 00 4c 2a 48 82 f6 89 60 02 f8 b7 81 f3 1e 24 98 02 5a c3 84 48 a2 04 0e 06 a2 4c a0 1c 69 d3 84 c6 c1 84 50 68 f5 c7 d3 04 51 88 75 dc bc 0c ce ac f5 6a c3 75 d9 59 66 1f d6 e1 dd f1 f5 63 f6 75 5f ef 75 da d1 9d 5f 37 b0 a1 db cd c1 dc 1e 29 48 02 ed 41 62 26 c6 37 7d 8b 02 7c 73 b7 27 96 37 04 78 b5 b9 71 60 04 38 82 4c 77 e0 82 03 b8 c1 e4 76 b8 f9 83 b3 e1 1f 89 06 63 52 1b 8c 63 d3 9f ff c1 20 c2 61 a1 02 32 b9 79 a7 f7 7a 97 20 0a 02 e4 00 02 85 5e b0 f7 7e f7 f7 93 cb 77 40 de 77 75 c0 1a 1c ca 1a 1c 22 05 e0 29 ba 52 58 05 83 3f 05 48 3e 50 53 50 85 66 28 22 23 12 83 33 f0 81 24 8a 00 06 b8 80 26 ba a5 57 98 05 67 86 57 5a a6 22 33 b0 3a 21 58 86 fe c4 Data Ascii: IG\l/FNQL*H`$ZHLiPhQujuYfcu_u_7)HAb&7}\|s'7xq`8LwvcRc a2yz ^~w@wu")RX?H>PSPf("#3$&WgWZ"3:!X
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 20 0b c0 2e ec c1 4e ec c3 6e ec c5 8e ec c0 ce 0b c9 03 ec 6d d3 ec dc e3 ec c9 b3 ec 6d 33 ed c4 4e ed d6 2e 0b c6 e0 0e ea e0 0e ed c0 0b 9c 00 82 c8 92 4b ee c3 2c b9 55 40 24 78 5c 4c 66 8a 8f c2 bb 4a 4a 5e 9c e9 89 3f b6 5c c1 24 c9 f8 97 36 38 36 ef f5 5e 8a 46 c6 ef f8 ae a4 4a 56 ef 8d ce 63 b9 05 66 9b d3 8a be 45 5e a8 83 af be a5 35 bb 45 62 bb 05 64 0d f4 f0 da e2 f0 eb 65 f1 c7 e8 65 70 b6 5e 83 16 3e da f8 66 78 f6 f1 0c bd 31 1a 04 41 34 d6 41 fd e3 40 27 ef 3f 94 06 36 ab c3 68 89 f6 f2 95 16 0b 27 3f f3 91 a6 40 0f d4 41 1d 84 8f 94 96 41 fe fe 83 6a ab 50 41 19 24 0b ab b0 8f 3f bf 40 1e 34 f4 a2 46 6a 26 6d d2 fe 08 d3 6d 83 f4 2a ad f4 31 0d 43 34 1d d3 32 7d b3 0d 29 11 31 e4 6a b1 76 91 3d c4 b3 16 b9 11 44 1d 12 d1 e6 91 20 d9 6c Data Ascii: .Nnmm3N.K,U@$x\LfJJ^?\$686^FJVcfE^5Ebdeep^>fx1A4A@'?6h'?@AAjPA$?@4Fj&mm*1C42})1jv=D l
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 31 e3 e7 68 49 df 7f 8e 15 16 21 0d 96 c1 18 b2 ca 17 76 e1 10 1c 01 11 46 d4 05 2a d9 96 ae 61 4c 34 78 e0 59 21 19 60 60 19 ea 00 05 52 c0 06 a2 e8 1a ea 20 98 83 59 07 66 e0 2c 6e 80 95 39 20 07 38 80 95 d7 ae c0 ad 89 04 40 00 07 ae c8 03 30 e0 03 64 a0 04 4a b4 44 c7 43 9b 6a de 04 46 fe e2 92 43 07 74 20 90 56 a0 05 68 54 0d 98 00 0a b2 20 0b b0 20 0b a4 a0 09 e4 80 fe 11 3a 61 12 0e 01 97 eb e0 11 9a e1 0d 36 6f 41 20 6a 49 bd b9 a1 c8 d4 9d b9 54 4b 3f 00 1f 6c a0 09 e6 e1 1e ee e1 03 d6 5e 48 84 e4 1e 50 2f 9d ed e1 06 78 e0 8b 02 01 f6 20 e4 a4 36 8f eb 19 24 0e 40 81 05 ea 89 11 16 e1 11 1e 01 11 da 03 10 f2 20 0f c4 80 0d 82 c0 08 4c 42 09 96 80 0c d0 23 9e fe 6e 04 80 46 b7 af c1 0e 36 3f 1b be 01 68 66 a1 64 8f 81 17 da 24 fc 58 80 05 00 49 Data Ascii: 1hI!vF*aL4xY!``R Yf,n9 8@0dJDCjFCt VhT :a6oA jITK?l^HP/x 6$@ LB#nF6?hfd$XI
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 05 58 90 06 e8 c0 07 c8 c0 0e e8 1e 15 51 d1 07 90 80 52 28 85 57 c4 40 0b c0 80 65 d8 42 2b 94 c2 2c 64 82 26 b4 c2 2d dc 42 30 84 02 27 84 82 30 74 c3 37 64 6e 39 94 03 21 c1 ed 1c fe cc 81 f7 79 01 53 06 c1 3b b3 a9 29 b8 99 9b 82 16 29 5c 56 fa 3d c3 74 68 74 3e bf 9f 9e 92 07 9f f2 3d a0 86 c7 48 81 07 49 ed 94 79 10 fe 2b 58 34 1c d0 29 00 22 e0 43 27 a0 ca ba c2 2c d0 94 2b c8 82 3d bb c7 4a e1 bd fb 51 60 23 c8 42 53 a9 58 53 65 e0 02 24 c7 88 fc f4 11 a8 60 ac 72 95 0d 92 08 4b 0b 40 e9 83 15 98 1f c1 90 d8 f4 ea 3f 07 12 30 89 8d dc 95 4f 4f 81 ee eb 7e 49 ef f4 ee 47 81 72 b8 c1 75 e8 e9 65 11 3f 2a 5c 56 2f 64 2e 31 cc 42 5f cd 82 3a 1c f8 dd 0a 03 97 5c 38 31 04 43 30 90 49 3a b4 43 75 74 96 15 76 7f 67 41 42 1b b6 6e a1 6c 62 a4 8c bf 34 1e Data Ascii: XQR(W@eB+,d&-B0'0t7dn9!yS;))\V=tht>=HIy+X4)"C',+=JQ`#BSXSe$`rK@?0OO~IGrue?*\V/d.1B_:\81C0I:CutvgABnlb4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49807	104.160.179.210	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:34 UTC	608	OUT	GET /dd611258bd2c4f1a9cd4bcf648f7ef2e.gif HTTP/1.1 Host: 555ww666yy.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	329	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: image/gif Content-Length: 1023445 Connection: close Last-Modified: Sat, 21 Dec 2024 09:32:40 GMT ETag: "67668b38-f9dd5" psc-cache-status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2025-01-02 05:12:35 UTC	16055	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 fe 01 00 ff f5 70 b0 8f 21 d5 ac 95 fb d6 b2 fd b3 b3 60 8d 54 69 10 68 ff fb 8f fe f1 d2 25 00 01 8d 0e 5b ef ab 6a fc da 6f fa b5 91 d7 90 27 f9 d6 91 d6 91 06 fe f7 b2 4f 62 a3 b3 d0 f9 85 25 84 fc d8 d3 f8 95 28 fd 51 50 db ba 46 9b af f4 d5 01 03 b7 69 05 dc 53 31 24 52 26 d6 8b 6d b4 6e 27 ff cc 2b 0f 24 70 f4 52 26 fb 95 49 d6 ac 2b 2b 53 53 d6 ab 0b 0d 00 01 9f 52 9d b1 01 06 f6 92 6e fb 93 8f fb 2a 29 2e 4b 9b d5 b2 6d d5 92 4b fe f1 50 4f 11 91 70 95 f5 00 10 fa 00 53 ff 92 4e 27 02 23 8f 5f 96 93 fc 70 6d f9 47 10 b3 6c 4a da bb a4 d5 98 86 90 70 2c d5 b6 d7 d3 6f 4e b3 91 6f 02 22 b2 d1 73 07 a4 d8 b2 70 6c 4c 57 6f e6 4d 4c 28 8b 91 6f 03 22 d5 fa 29 0b f9 6d 4d 8c 8f 47 94 01 02 49 01 01 f3 93 09 d3 73 Data Ascii: GIF89ap!`Tih%[jo'Ob%(QPFiS1$R&mn'+$pR&I++SSRn*).KmKPOpSN'#_pmGlJp,oNo"splLWoML(o")mMGIs
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 55 14 8c 81 00 2c 6a 2b 20 55 52 31 c1 08 e8 80 21 60 e7 1e 90 01 22 0c 02 28 70 82 00 30 58 2f 08 00 35 70 82 8a fe a5 e0 dd a4 1c 52 4f 03 c8 a7 74 50 e9 5d 08 25 18 5c 04 14 f8 13 52 08 07 0f 34 40 14 b4 16 1c 94 00 0c e4 c0 0a 68 16 e0 60 40 22 b4 40 2d 24 19 92 35 e8 2b 28 01 00 fc 01 11 98 42 1b 80 02 22 c0 41 14 ec c1 ae 12 e8 11 80 e8 1e 20 c2 36 b4 25 59 fe 01 1b ee 01 35 80 83 21 f8 e8 9a 65 82 37 78 83 a9 a6 d3 1e a4 83 72 e2 42 14 d4 43 4c ae 93 00 08 ff ea 05 30 81 2d b4 82 39 50 41 09 3c c0 13 6c 43 a4 ae 99 38 84 80 8f ee 01 5c a2 80 00 70 80 0d 69 e3 64 72 4d d7 49 69 f1 45 a9 c4 4a 01 1a f8 00 de 80 00 14 60 2c 08 6c 07 01 cc 83 9f 12 01 0e 64 00 1b 68 56 0e 00 c1 12 64 17 1f 1c 5c 07 b4 c0 08 20 d9 83 b2 25 44 8e 41 15 c8 63 9f 46 41 17 Data Ascii: U,j+ UR1!`"(p0X/5pROtP]%\R4@h`@"@-$5+(B"A 6%Y5!e7xrBCL0-9PA<lC8\pidrMIiEJ`,ldhVd\ %DAcFA
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 7b c0 39 85 06 88 f0 6a 7b 18 c4 20 8e a0 87 32 78 00 cd 47 18 04 22 8e 21 00 12 74 80 0f af f0 c6 d5 64 3b 0f 0c f0 a1 05 c8 1b 01 a0 a9 a0 8d 17 c8 d6 b6 23 00 00 00 46 90 81 e8 8e 8a 8a 6f f5 01 15 5e 91 81 c8 a1 e0 08 d5 a8 c2 8d 33 60 8b f1 92 e0 15 9e e0 06 15 b7 e0 03 51 6d 21 0a 15 0b 84 92 b7 c0 84 12 40 a1 72 2f 53 29 b1 86 a5 c6 2d 06 60 9a 04 84 23 b4 10 c0 83 1d 80 01 0a df 0c 43 01 7a aa 88 01 dc 62 1a 51 d8 82 3e 8f ad cf 23 30 21 0a 3e 48 41 10 74 27 80 0c b4 80 0f 00 50 02 43 8f d0 62 01 54 e1 02 1b 78 c5 06 00 ff f0 6d 18 3c f7 08 3e 00 01 0c 74 f0 6d 20 07 22 a3 83 30 c0 20 40 41 69 17 f5 42 de 02 18 01 09 10 e1 29 01 5c e0 bb c5 5c ae 8b 98 40 05 12 08 60 d3 d7 e3 d1 11 04 20 aa 3d 28 fc 18 19 a8 9c cb 22 ae 82 1e 20 00 a6 56 be 75 7b Data Ascii: {9j{ 2xG"!td;#Fo^3`Qm!@r/S)-`#CzbQ>#0!>HAt'PCbTxm<>tm "0 @AiB)\\@` =(" Vu{
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 10 d8 c1 19 60 29 4b 20 28 e2 03 0e 08 c4 11 f6 a0 07 01 98 83 01 ee a8 c9 12 96 30 04 0c 14 33 0e 8c e0 83 ea 94 f0 87 43 f0 c2 11 7a 00 c5 1e 40 d1 09 4b 64 d1 12 51 b0 04 13 2e a0 84 0d 00 e0 0f ad c8 57 2b 4a d0 0a 49 ca a2 04 25 f0 c0 4a 7a 21 8e 3c 1e 43 00 55 90 54 2b 46 f0 8a 07 d8 2b a7 02 e0 c4 05 ae e1 47 4b 84 c0 10 24 19 c4 c1 56 b2 87 21 04 14 2a 4e 51 c1 1d de 00 ca 00 94 82 17 a5 ff b4 18 2a c1 42 ca ad 8c 22 94 7d d3 05 1d c0 00 86 58 be 12 08 50 a8 65 35 f6 60 00 53 1c 02 0c 39 f8 40 0e c2 10 06 98 c4 81 a4 69 30 26 ea 5e 01 03 63 e0 90 28 65 d8 c2 1e 72 09 02 28 94 00 6d 10 b4 dd 03 5a d1 0a 9d 5e 40 00 b8 d8 83 00 9e e0 46 76 b4 c2 16 02 d0 81 12 9e 20 80 0b 3c 81 50 c7 c0 85 2c 22 70 41 1d 9c a0 04 b0 3d 93 12 84 8a 8b 56 fc c1 9e 83 Data Ascii: `)K (03Cz@KdQ.W+JI%Jz!<CUT+F+GK$V!NQB"}XPe5`S9@i0&^c(er(mZ^@Fv <P,"pA=V
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 70 73 09 1d 00 42 1a 30 d0 81 44 ae 92 a7 c3 93 58 ad 04 1a 50 7a 4e 6c 03 46 b5 a4 2b 8b 7a d4 78 26 d6 86 63 19 8b 54 d8 c0 88 38 d0 81 0e 3b 78 01 04 e4 c0 85 52 48 40 a5 6c 3d 69 00 79 d2 00 02 b6 c4 17 1f 35 1d 1b 0f d5 a7 3e 7d b6 b5 ad d5 45 66 21 10 53 99 2e 21 11 54 c0 e9 2b a8 a8 2a c4 22 f6 92 89 0d aa 3e 83 6b d4 e1 29 81 0f 3a 68 01 4e a5 0a 48 d9 ca d5 b5 6c 45 c0 67 d5 aa 0b 62 16 d0 98 e4 52 60 5a 75 51 8e 06 94 14 ba de 35 a9 d4 ba 0b d6 f1 96 d4 b3 9d 3d af 2e 38 04 5b d8 ca 76 9b dc 5c 01 57 a8 60 57 9c e6 54 af 54 04 27 15 81 37 02 1d e0 14 a7 4b 90 ef 12 48 00 03 12 30 c0 01 f3 d8 26 04 e4 4a 80 af 42 d7 ad e3 85 ae 78 21 2c 61 f0 96 34 00 db 6d 80 58 3d 6a 4c 0a a1 35 27 16 2e 47 39 c8 fb 60 0a 83 37 c1 10 60 af ff 5c 4d 9c 5e 06 9f Data Ascii: psB0DXPzNlF+zx&cT8;xRH@l=iy5>}Ef!S.!T+*">k):hNHlEgbR`ZuQ5=.8[v\W`WTT'7KH0&JBx!,a4mX=jL5'.G9`7`\M^
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: e0 5e d1 77 19 69 84 0e 98 d9 4f c5 b3 32 7a ad 70 bf 1b 03 68 fd 14 b8 89 47 22 64 33 6a a2 88 dd a3 40 ef 7a ae b8 3e 1b af 7f ff 0a b2 01 83 92 2b 7b 09 89 10 7e 82 ff 6e 46 7a 9f 1b 00 1b 38 77 ff fd 9f 00 7e db b4 e9 9c d0 19 9e 01 f2 df 55 8d 92 72 08 d5 0a 7c cb b7 7c 1f fb bd 1f 05 ba 5e 0f 38 00 06 89 dd c3 31 8a ea cd 1a 56 54 20 08 aa dd fb 89 20 57 7c 1f 03 88 e0 67 79 dd 12 10 98 6b 2d c1 ee b5 40 fe 29 98 f0 bd 02 83 29 81 0d d2 20 0d 0a 9f f0 29 18 55 61 40 07 60 00 14 d4 0f 09 ac e0 03 ae 80 f7 69 5f eb 89 20 08 b6 9e 8a 80 ff e0 d7 05 40 39 34 40 39 94 42 3c b8 ce 2a c4 40 39 60 21 04 7c 96 fa bd 1e e8 a9 1f fb a9 c8 67 7d 56 56 90 e1 7e 2c 61 37 f4 c0 0a 80 9e 19 4e 60 56 7c 00 09 84 41 0e 2c 41 f2 c4 df 0a cc 9f 92 8c 61 57 68 df 0b a8 Data Ascii: ^wiO2zphG"d3j@z>+{~nFz8w~Ur\|\|^81VT W\|gyk-@)) )Ua@`i_ @94@9B<*@9`!\|g}VV~,a7N`V\|A,AaWh
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 28 00 16 a0 d8 20 64 02 0f 55 01 09 70 9d 17 0c 1c ab 75 a0 0a 44 c2 0b f4 58 00 04 40 ac 31 5c 61 41 51 18 0c 5f 99 bc 48 17 f4 40 01 b4 57 19 48 0f fe f0 1b f9 94 8f 07 e8 81 ef 1c c1 34 90 00 98 3d 1b 22 14 9e 36 28 c1 2b b4 00 b8 51 81 11 de 94 34 74 95 f4 3c c0 2b 78 ff 02 00 50 41 15 30 57 5d 09 e0 6e 35 dd 2b f8 5c 41 45 41 03 50 61 15 40 da 11 64 83 27 6c 80 12 3c c3 fa 0c 82 14 b4 02 f3 f8 40 0d 59 42 14 6a 55 15 c0 00 14 6c 1d 00 79 94 ae 7c 17 78 05 80 c9 38 84 09 4a 41 a3 28 c2 88 f8 05 01 9c c6 00 10 40 06 2c 4c 1d 88 5e 14 2c cc 16 b8 c2 e8 b1 84 f9 71 03 00 a0 d6 08 98 03 5a 45 c1 16 bc 40 06 2c c1 fa 6d 00 00 74 22 15 64 40 06 8c de 0e f8 80 39 ac 5f 27 5e 80 21 14 d4 11 08 00 fd 48 61 0f a1 9b 2d 98 43 0b 98 83 07 60 9d 00 5c 80 00 ec 50 Data Ascii: ( dUpuDX@1\aAQ_H@WH4="6(+Q4t<+xPA0W]n5+\AEAPa@d'l<@YBjUly\|x8JA(@,L^,qZE@,mt"d@9_'^!Ha-C`\P
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 4c 21 17 f6 80 02 4b 38 c0 2a 78 60 21 1e f3 78 0c 22 38 e0 74 22 cc 23 20 f3 68 00 07 d0 01 08 58 50 40 0b 57 00 05 20 28 82 04 4b 5c 21 0a b0 28 42 2c 38 40 22 ac 00 dc 1b da 85 35 78 6d c8 24 f4 fa 9a f3 aa a1 8b 2c 88 68 07 be 81 41 a5 2e d5 03 39 e4 a2 19 75 30 c1 f9 cc 67 09 44 0c c2 ff 7c 65 10 df 15 5e 00 86 37 dc 81 0d 8a 20 00 fe ba 57 3e f0 0d d3 12 47 38 26 28 1c b0 02 99 84 61 05 53 b8 82 08 2d c1 85 2b 70 01 09 2c 0c 1f 22 ca 70 04 44 1e 83 26 04 10 c5 1f 01 a9 00 0e e2 a2 7c 1e 78 04 03 e0 85 05 11 32 81 00 55 c4 41 11 0c 20 88 32 5c b3 0b 1c 44 02 16 6e a8 49 77 e1 70 07 1b 9a c6 49 a2 01 4a 87 41 20 88 03 18 22 10 30 45 c8 24 02 81 01 41 c0 62 1d a6 29 ad 69 4a b4 9a 75 a8 a2 e1 b8 30 99 17 14 60 05 72 6b 43 11 b8 f0 02 1e c8 4e 0e 3c 20 Data Ascii: L!K8*x`!x"8t"# hXP@W (K\!(B,8@"5xm$,hA.9u0gD\|e^7 W>G8&(aS-+p,"pD&\|x2UA 2\DnIwpIJA "0E$Ab)iJu0`rkCN<
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: d1 a0 eb 45 7c 6a 00 1b 6f 00 02 18 80 17 08 02 ef 7a 29 61 55 e0 f0 72 00 22 e3 82 b4 93 00 4f 9c d5 cc 9a 90 f5 74 fb 4b 50 85 4b 90 09 2e 80 00 08 b8 7c 2e 28 05 2e d0 05 ca ba 2b e6 30 03 d2 8d 2b c4 e7 02 47 64 19 22 73 00 3c b8 02 c6 ca 04 df ec c9 a9 0f c1 10 c4 82 2a 28 00 39 c0 02 39 c8 04 44 d8 82 ff 1e 78 78 ff f6 73 16 80 04 2e 30 cd 29 10 e3 7e e7 e0 37 68 02 15 50 fe 26 00 02 91 27 74 84 48 6c 7c 41 86 e1 18 c2 dd fc 80 1d 80 81 e5 2d 48 1e 60 81 30 60 01 2e d0 b5 23 40 e8 22 e8 d6 23 b0 84 3a b0 04 26 b8 00 08 70 85 37 78 c9 37 f0 02 36 58 81 06 08 87 22 28 03 fc 05 85 f4 0f 47 06 00 88 0f 74 2e 81 b9 44 87 cd 07 35 96 2c 5d 61 e1 e0 0a 92 88 4c 82 44 44 82 87 c7 80 2b 10 78 bc b8 f2 f0 ca 15 2c 41 82 30 61 52 84 0b 8c 20 03 b0 0c 3a 72 65 Data Ascii: E\|joz)aUr"OtKPK.\|.(.+0+Gd"s<*(99Dxxs.0)~7hP&'tHl\|A-H`0`.#@"#:&p7x76X"(Gt.D5,]aLDD+x,A0aR :re
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 02 26 f0 e3 37 78 83 4b 68 82 4b 70 e7 2a 08 02 c7 52 73 c7 12 04 77 ee a6 99 64 81 1c c8 81 1e 40 01 14 a8 82 15 28 80 23 30 74 46 67 74 39 18 00 08 68 83 41 e8 85 41 38 06 4b 3f 86 46 47 81 22 70 80 b5 d9 03 14 a8 03 7c 9d c9 30 80 80 22 40 81 5e c0 03 14 c0 05 25 0c 03 7a 5d ca fa 7e 83 f9 ec 01 69 90 e5 3e 1b c8 16 72 0c 5a 95 21 81 b3 46 1e 98 28 20 98 c9 d9 33 11 0d 68 06 42 40 84 23 b0 04 85 2c 83 44 b6 84 22 28 83 af 71 00 3a a8 73 1b 78 01 24 b0 84 32 48 24 6c 2f 03 50 d8 02 4b 70 84 32 90 83 0f 18 74 b3 c3 02 14 b0 84 2b 00 bb 3a 40 81 63 40 76 50 d0 03 75 7f 81 97 2e f5 4c 67 74 5c 58 f7 3a 78 81 26 48 34 14 d8 02 5d 50 84 d2 9a d0 32 30 f5 22 a8 74 2c 60 85 48 70 4a fa 66 ca f9 66 80 dc 21 ed 2c a5 24 2e 3d e3 ff 67 b5 8c d8 b0 dd d9 e3 9f 7e Data Ascii: &7xKhKp*Rswd@(#0tFgt9hAA8K?FG"p\|0"@^%z]~i>rZ!F( 3hB@#,D"(q:sx$2H$l/PKp2t+:@c@vPu.Lgt\X:x&H4]P20"t,`HpJff!,$.=g~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49799	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	599	OUT	GET /i/2828/qqww-1300-240.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 139280 Connection: close Accept-Ranges: bytes Age: 82327 Cache-Control: max-age=2592000 Etag: "676f8c9d-22010" Expires: Fri, 31 Jan 2025 06:20:30 GMT Last-Modified: Sat, 28 Dec 2024 05:29:01 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: b53eb4dcf3429db2cb49fc7034f34c17 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT via: cache02.oversea-GM-FRA2
2025-01-02 05:12:35 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 d5 3f 00 0a 0a 09 fe fa 55 ff fa 1a ff ff fd fe 12 02 99 01 ff 10 98 ff f6 ab 15 fe fc d6 2a 90 4d 02 01 fe 00 53 ff fb 63 0f 9c 9e 9a ff fe b3 ef b7 50 ff ff 89 a4 e4 ef fc a8 9f 9d de aa 48 02 e3 54 b2 9d f9 70 5b d9 a0 fd 9d a8 61 00 b4 ff 60 db a5 5c b5 ef f8 db d4 71 d6 e9 d5 d4 d6 a1 5b 0d fe d9 83 b9 40 f8 2a a3 8b 01 cc ff d6 23 45 50 44 e5 a0 55 a5 cc c7 b6 8b 8c e7 56 08 a1 f7 da b7 87 14 8c a8 91 2f e4 f0 f5 08 5c 6e 63 65 77 a3 d8 5c ee d2 fe 91 5c 5b a8 16 63 91 16 04 2e e1 84 c5 6a fe d1 f6 b5 cf f8 d4 d8 cf 7f 2c ab fb 03 82 d2 cd 66 92 db f0 87 30 8e d4 ff ff ff 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 Data Ascii: GIF89a?UMScPHTp[a`\q[@#EPDUV/\ncew\\[c.j,f0!NETSCAPE2.0!XMP DataXMP<?xpacket begin="
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 10 1a 32 b6 41 ec 4d e3 59 79 d5 76 72 e7 33 9a 1e 36 30 00 2e dc a3 30 e4 45 36 ce 1e 1b 48 80 80 a4 a0 5a 91 e7 fc 25 96 02 54 27 43 8e 98 88 d1 e7 7c 7e d8 39 1a d6 d4 24 96 8f 70 04 b7 8d 23 01 e4 98 7d 7a 18 7e a6 40 75 d6 27 7d 4a 52 7f 1c 28 88 e1 27 3d 8e 27 09 d0 00 09 cc 80 0c 54 67 35 00 24 00 94 96 91 e0 e2 20 91 d6 2c e8 63 da 04 c9 69 fd 91 8f 24 67 1b 1d cd 42 0a a8 80 e2 27 01 80 23 47 54 27 ff 40 a5 e8 80 9e 9e d4 38 44 99 54 49 94 bc e7 21 05 e8 82 f2 e8 87 8d 9a f5 89 d2 8d 0a e9 95 68 04 e3 65 8e 55 8c 05 a1 04 92 07 04 8a 91 28 45 2e d0 ce 8f 48 29 a2 84 8e 0b f8 12 4d 52 20 0a 72 0e a4 d0 60 24 84 e4 56 24 84 92 b6 d7 79 f1 a4 21 58 20 e7 d8 c1 4b fa 64 7d d1 17 23 bc e0 2d d8 e4 ed 88 e5 4f c2 42 0a a0 60 96 e6 e0 af fc 4b fa e4 00 Data Ascii: 2AMYyvr360.0E6HZ%T'C\|~9$p#}z~@u'}JR('='Tg5$ ,ci$gB'#GT'@8DTI!heU(E.H)MR r`$V$y!X Kd}#-OB`K
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 03 4a 88 00 01 28 4f 79 62 e7 ce 58 47 d6 64 ad ea 6a 91 a1 7a 60 ae 64 8f 17 7b d1 17 7f 11 18 83 51 18 a9 2f 03 55 03 fc 32 69 06 da cf 25 7c e0 18 55 a3 25 1c 2b 03 4d a0 df bc 42 06 f6 01 05 bd 65 00 15 83 af 9c e5 00 cb c3 1b 13 43 62 f6 80 60 5e 8b 33 66 60 05 ce 31 05 cc ed 1b c3 91 83 4e 90 3c 28 c0 dc ce f1 8e cc d1 3c 9c 05 de f6 ad 59 9a b1 18 f7 31 da f4 80 19 b1 62 83 14 0e 98 b4 51 18 b3 ab 1b ff ed 08 96 de 6f 06 cc f1 b6 b4 83 1d 79 d1 07 ba 31 31 ec 28 1b 0b f0 ae d2 66 c0 54 ae c2 b2 e0 9d 8e 50 99 8a ae 71 ea 66 20 5a c3 44 92 80 99 98 e0 9d fc 2b a7 b6 50 92 a2 d0 25 59 b2 6f ca c9 70 88 6e 66 f6 a3 bf 64 e0 04 8e ce 42 92 ce 1f cf 50 0f 3a 02 0c 3e 84 0d 45 20 02 54 a0 07 30 00 00 70 2c 47 2e 8f 75 d0 a4 13 5b c0 01 a0 67 02 1c 40 02 Data Ascii: J(OybXGdjz`d{Q/U2i%\|U%+MBeCb`^3f`1N<(<Y1bQoy11(fTPqf ZD+P%YopnfdBP:>E T0p,G.u[g@
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 48 90 81 a5 e9 a9 91 24 7c 60 26 e3 c4 49 7e 3c 15 aa d6 95 8a 54 4e 39 97 5f a6 32 4f f0 e5 00 03 3d 48 70 51 07 23 96 1c 38 c0 7d 13 9c 16 5c 44 30 97 ce cb 65 f1 f2 f4 f5 f7 4e d5 bd be 18 bb bd 02 6c cd e9 53 af 99 61 ef e5 d7 d3 1e 81 06 80 7d 2a fb fe 1a da d0 9e b6 7f 77 5f 98 61 35 40 db 2a d8 75 d7 e7 00 ee 3b bc 26 02 b0 41 7e 6e 92 df 9a 3c 90 1b 69 e5 ab 82 6e b2 a9 a8 ea 53 ff fa f5 b1 f0 13 2a ff b6 32 ee 7b 8c fb 1a d3 98 b8 59 14 7e ef 83 ff fc 3f c3 98 fa a9 21 33 63 bd cc 19 e8 8f 46 06 ca 5f fe f1 57 41 71 f4 8f 46 fc 49 ca 9d a8 a6 bb 0d 67 b4 05 0b 27 38 f2 67 7f 3b 12 47 23 d7 64 59 b7 80 0c 98 71 79 24 0e 22 47 72 1b 62 71 27 27 21 2a c7 72 d9 70 75 1c 07 73 84 34 4a 96 e0 03 39 97 70 c9 f0 73 7e 43 82 01 a8 05 3b 17 38 24 b0 47 8e Data Ascii: H$\|`&I~<TN9_2O=HpQ#8}\D0eNlSa}w_a5@u;&A~n<inS2{Y~?!3cF_WAqFIg'8g;G#dYqy$"Grbq''!rpus4J9ps~C;8$G
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 92 ad 1e 2f 2a 91 3d ae a1 b3 75 6e ed 05 12 49 a6 8e 84 29 cf 60 b1 8c b4 0e 24 1a 36 02 ab e4 81 b8 80 35 18 7a 08 40 7e d4 02 0e b4 e0 04 e2 c5 99 07 34 2b 10 19 48 ad 5b 3b d8 81 8a c0 f1 a2 10 8e 23 97 62 eb 06 3b c8 1c 0d f9 98 2d 9b ad 95 81 0c 2c c0 82 40 39 a5 54 63 4a 29 e9 e8 b2 35 71 5c e0 05 2b 18 68 11 e3 e2 01 99 a0 31 89 08 48 8c 60 aa 1b 52 8d 0e 2a a3 02 60 41 e4 0e 65 38 56 71 94 50 13 b8 ff c1 04 aa 22 5d 16 34 f7 b8 d8 65 81 76 55 60 b7 ba 78 57 44 2c c0 40 4e 6e cb 81 39 c9 64 1c 3a 19 53 ed 26 fa 2a f8 46 0e 04 2a 89 74 02 44 50 1e 41 20 28 05 4e 00 76 b0 81 5d 06 0b b7 18 c6 06 7a 30 19 84 bd 6c 27 f0 c2 0c 8f dc 81 b2 49 80 0b 2e 34 a1 17 bf 66 76 b3 97 d1 5f d4 fc 8b 3b f7 62 8d b4 f7 b0 05 6b 47 41 c4 cd 4b b6 7a ce c0 99 32 60 Data Ascii: /=unI)`$65z@~4+H[;#b;-,@9TcJ)5q\+h1H`R`Ae8VqP"]4evU`xWD,@Nn9d:S&FtDPA (Nv]z0l'I.4fv_;bkGAKz2`
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: c4 39 52 3d 26 2b 5e 81 c9 ef 8a 57 25 67 12 00 98 59 3a 0f 30 49 b7 4b e1 19 4a 54 f4 a3 e7 f5 18 e0 90 4c 38 8f 33 12 59 87 f7 d8 40 11 5e 96 86 a0 87 c9 d5 30 11 55 cd 89 80 61 a3 8d 6a 12 b0 14 4a 19 eb 11 8f 08 50 71 d4 35 ce 27 d0 5b f6 ef 73 cb 0a a0 10 40 88 1c 0e 0e 40 a0 e5 f2 d6 70 da 35 9d d7 38 01 5c c8 c1 4d 04 65 63 9c 9c 52 27 36 c1 d1 20 03 51 93 86 dd 04 55 35 cd a1 4e 17 a3 69 4b 8f 4e c4 ff 7f 0a 78 e1 e3 f8 59 28 50 99 65 89 57 d8 e2 14 8f 08 32 41 3c 31 3d 60 ed a9 1e 8c 18 56 2e 5e 4c 12 31 58 2b 12 3b d0 1e 1d 08 11 ae 47 8c 6a 21 2e 30 45 bc ce 21 ac 4a 9c c4 0b 40 f4 0a 3c b1 40 8f 2c 50 87 88 0e 00 22 50 00 e3 17 1b ba 90 46 34 74 58 22 88 c2 6c 3c 63 46 24 17 4b 84 a6 dd a2 92 16 12 8b 64 83 11 c8 17 10 92 90 10 78 40 36 52 a3 Data Ascii: 9R=&+^W%gY:0IKJTL83Y@^0UajJPq5'[s@@p58\MecR'6 QU5NiKNxY(PeW2A<1=`V.^L1X+;Gj!.0E!J@<@,P"PF4tX"l<cF$Kdx@6R
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: d7 72 4d 40 73 e3 19 9e e5 59 73 2f 40 9b 37 40 9d 3b 40 9b 4f 80 9e fd 19 05 e6 19 a0 35 77 2e 4c 40 9b 27 00 9d f7 99 9b bf f9 06 1c e0 04 d6 f9 a1 bd 79 9f a5 19 8c 4b 40 9b 01 18 9c 25 3a 9f 21 7a a3 d1 19 07 b4 99 88 71 f1 9c c3 39 02 a4 59 a3 39 fa a4 ad 59 a2 1b 9a 45 b4 f9 06 46 da a2 c3 99 a1 a5 59 a1 23 7a 03 3a c0 a6 c3 59 a5 c1 58 09 16 40 9b 3d 00 9d 65 7a 9c 1d 00 9d f1 19 a5 bb b9 9d 65 21 9a a5 b9 03 88 5a 9a 2f da a8 37 1a a9 57 a2 22 f0 63 3f 50 c4 aa 27 51 ec 06 c4 41 06 59 3f 00 a6 3f 54 ea 27 2c b0 76 ad 9a 15 7e 13 16 84 a2 22 ab da ab ab c1 62 80 c2 11 4f a4 ac 51 ff 44 45 fa 16 72 b5 99 a6 a1 3a af ab 99 a4 a5 79 95 25 6a 7b 05 21 5a 01 3b c4 58 b9 09 6e 13 18 a5 55 09 44 ac 5a 95 70 9b 14 1b 7c a9 15 19 f3 09 b0 e4 4a 16 1a 3b 21 Data Ascii: rM@sYs/@7@;@O5w.L@'yK@%:!zq9Y9YEFY#z:YX@=eze!Z/7W"c?P'QAY??T',v~"bOQDEr:y%j{!Z;XnUDZp\|J;!
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 8f 8b 8b bb c9 0b bc 93 6b bc 6f d7 b9 f6 52 bb c9 4b bb ca 4b bd cb 1b ba bb 4b bb 86 eb b8 2b b0 bb b1 8b bb 21 a9 bd 99 bb bb c4 3b ba 16 40 b8 cf b0 bb a8 cb bd a6 bb 02 98 0b be ee db bc df 90 35 3f 40 b8 94 7a bb 43 5a bd f9 6b bd 0b 40 b9 b3 a0 02 12 f0 00 01 0c c0 02 1c c0 0f 30 c0 06 2c 50 22 c1 5f 07 cc c0 05 cc c0 45 2b 12 94 88 c0 04 4c c1 13 9c c0 21 c1 5f 15 dc c0 15 9c a7 21 d1 02 2a e0 c0 21 ac c1 01 5c 1f d0 bb b9 b8 cb 88 fd bb 29 7f 42 bb ed ab bf a1 3b bb e4 63 70 2e f6 b5 5c 90 b6 3a 81 22 28 52 aa 2e c5 aa 19 d2 c3 37 c3 aa f8 96 34 ad 8a 04 49 23 44 b8 29 bf 8f f0 ff aa f6 ba 8d 78 fb 20 48 b0 02 80 2b b8 53 4c c5 2d 2c bb e7 4b 01 fb fb c2 5f aa c2 c7 7b ba 92 bb ba 56 1b 8e 26 bc ab 5a 3c 9e eb 6b b9 f7 7a b9 92 8b c6 c5 89 33 17 Data Ascii: koRKKK+!;@5?@zCZk@0,P"_E+L!_!*!\)B;cp.\:"(R.74I#D)x H+SL-,K_{V&Z<kz3
2025-01-02 05:12:35 UTC	8747	IN	Data Raw: 3f 45 01 3c bd 54 7c 11 c2 c3 c0 d3 0b aa 54 08 c4 00 39 14 80 23 f4 d4 3b 2d 36 48 75 55 2f 0c 54 ec 1c ce ac 1b 02 0c c0 53 47 55 d4 39 a5 40 56 e5 d5 44 05 d5 a8 8c d5 1d a0 35 3c 5d c2 3f a5 53 5f 4d 4e d6 8c 8f 4d a5 42 57 a5 53 1b 42 81 68 ad d6 64 b5 56 45 35 56 44 13 56 09 c2 56 62 05 56 6f 0d d7 6b b5 47 3c 15 00 3e 84 49 70 1d d7 74 05 d4 01 4d 57 6d 0d a8 6a 0d d4 cc 7b d6 6f a5 d3 ae 14 d7 75 ad d7 6a ad d4 b1 ac d0 b2 dc c4 ad e2 82 0e 25 86 2c e8 2a 3e 2a cb d6 a0 0d ff d0 37 b3 dc 9b ba b4 cb 3c b8 0d 08 28 cb c2 31 b2 e7 e8 4b 8c 4b 03 86 fd 57 7e e3 2b 79 3c 56 4a a5 1f ff 6a 55 57 1f 40 54 6c 65 d4 49 b5 9f 48 73 4d e0 d2 0e a5 db 25 f5 3b 06 21 45 ba 25 55 cf fb 9b 3f f9 6b 86 98 b5 02 d2 94 84 68 14 4d c5 aa 84 10 60 b3 03 24 47 a0 bd Data Ascii: ?E<T\|T9#;-6HuU/TSGU9@VD5<]?S_MNMBWSBhdVE5VDVVbVokG<>IptMWmj{ouj%,>7<(1KKW~+y<VJjUW@TleIHsM%;!E%U?khM`$G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49796	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	598	OUT	GET /i/1616/PPJJ-200-200.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 301616 Connection: close Accept-Ranges: bytes Age: 70015 Cache-Control: max-age=2592000 Etag: "675feb46-49a30" Expires: Fri, 31 Jan 2025 09:45:42 GMT Last-Modified: Mon, 16 Dec 2024 08:56:38 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: d18dfbcf459bbe4ae1f124b5eccba450 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT via: cache02.oversea-GM-FRA2
2025-01-02 05:12:35 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 d5 3f 00 ff fe 0e f9 d3 4e ff ff fe fe cf 30 97 09 06 e0 b6 49 f7 db 68 f8 b5 2e c7 2c ff f4 a3 a2 dc 67 10 9a 92 12 06 04 01 fe f2 2c ff f7 49 fb b3 0a 53 16 05 99 65 16 fe e9 73 fa ec a0 07 4a fe f6 8a 0e fc ca 15 62 4d 0d ff 00 00 d0 95 30 f4 6e 6e a4 9f 9e ce 05 06 da a9 34 d2 cd 0b f8 c9 c5 e3 96 ff f7 9f 1e cb 87 14 6b 6a 66 c4 36 08 aa 88 70 d2 d0 cf c5 b3 0c f9 ec e1 fd 37 34 ab 67 4c f5 33 06 f8 dd fe dd cb 2b db 3a 33 3c 67 d1 e6 c6 69 ed c6 4c e0 18 7a 15 c5 a0 9a b6 ff 31 2d 15 90 30 13 e8 be fd c2 18 06 ee e6 0f be ad 71 b4 cf ff f1 19 10 f4 e3 3a 67 1a a5 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 Data Ascii: GIF89a?N0Ih.,g,ISesJbM0nn4kjf6p74gL3+:3<giLz1-0q:g!NETSCAPE2.0!XMP DataXMP<?xpacket begin="
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 7a 81 d9 84 d0 25 3e 66 90 d4 02 01 a0 ea 8f d0 4c 19 43 23 b5 b0 7a 62 76 ea 46 5c 6c 04 e2 dd ff 58 1d 31 1a 97 03 86 41 a0 35 93 03 74 be 37 1e e0 01 a7 43 ec fb c1 eb 5a 35 ec c6 3e 30 71 70 54 c8 2e 18 4c 83 0c c8 7e d9 76 8d 34 4a 83 36 52 f3 3a 51 53 35 93 ce 16 e5 82 31 72 24 e9 88 90 ac 01 21 e7 44 7c 5d fd 04 a3 fa 71 b8 58 1d 80 0a a8 1c 3f e1 7b 56 fb 26 0a 28 7e 27 6c 06 03 32 64 46 45 38 28 7b 0b 0b 60 38 eb 20 de ec 10 3b c6 c0 b3 60 83 b2 05 1f 0a ff 41 e7 0c 4f e7 d2 84 e7 0d 8f d5 86 21 68 62 d1 29 a0 7e 30 fe c8 7a 62 d1 18 62 91 1c 77 33 2b 98 56 2d 84 b0 33 ca ae ec 79 9e e7 25 0f 62 b9 12 34 42 66 d7 ed e5 f2 80 63 d7 dd a6 6d 50 ed f2 36 7f 91 39 a6 45 bf 98 93 fb a1 e7 e2 72 0c 4e 53 0b cd 54 1e 11 b3 37 c9 61 f4 55 bb 21 a1 70 ef Data Ascii: z%>fLC#zbvF\lX1A5t7CZ5>0qpT.L~v4J6R:QS51r$!D\|]qX?{V&(~'l2dFE8({`8 ;`AO!hb)~0zbbw3+V-3y%b4BfcmP69ErNST7aU!p
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: ae 60 19 00 9c d6 b5 03 68 ac c0 1e 3d f7 ea d5 53 34 c1 1e 9e 16 a9 da 5d 70 57 43 20 42 83 20 bd 28 3b 51 a3 06 03 77 01 fb e0 19 10 88 4d 08 18 13 0c 18 48 00 83 8d 9d 3c 8a 5a 44 58 68 f2 82 07 ff 84 0d 42 0a bd 82 30 47 04 06 26 c7 b5 90 14 28 84 53 a7 1a 62 48 98 20 00 c5 04 18 4f 9d 1e 88 21 09 e3 42 a4 11 10 02 18 4a 36 0a 42 92 0c d2 fa e4 04 a0 87 a0 1f 07 34 40 0d 31 80 de 04 14 02 26 48 c0 2a 57 ae d6 3b 78 3c 6c 34 89 f4 e7 d8 b2 88 93 e4 40 b8 20 2d d2 05 88 2a 15 79 aa e1 40 0f 8a 31 27 68 76 10 e0 40 56 0d 43 06 b0 45 4b 78 01 42 82 89 53 0b 31 7c c1 f1 da b6 48 9c d6 55 64 00 6b 82 02 30 26 1a f0 9c c0 69 11 c0 39 5a 13 0e bb 4c 35 e2 a2 ad d3 2e 58 1c 34 49 08 03 7a 7a 14 c8 e6 57 2e 0c 7b 03 9e ce 62 ec 98 c1 85 b3 c6 c9 16 25 cc c0 34 Data Ascii: `h=S4]pWC B (;QwMH<ZDXhB0G&(SbH O!BJ6B4@1&HW;x<l4@ -y@1'hv@VCEKxBS1\|HUdk0&i9ZL5.X4IzzW.{b%4
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: b5 54 54 96 89 c0 d1 7d c4 d3 a3 a5 ec 44 9b f0 cf 6d 0b 13 d4 21 0e 0f ed 20 d6 3e a2 db 32 3b 48 22 55 26 87 5e 1e b1 c3 96 3e 36 9d 40 38 8e ff 28 da 0c c2 69 0d d2 ee 5a 74 bc f5 2a d5 47 bb 45 12 c9 57 d7 65 c3 49 5d 1e 95 f2 0f 44 19 99 37 16 46 0d 3e 38 da 60 0f 81 61 08 7b d3 88 ed d2 c9 ea 3b 93 53 7d 3d dd 18 e0 38 ad 1d 38 25 37 42 72 52 9f 7b be 45 52 a3 75 bf 8b 80 ae 9c 79 95 b8 43 75 03 2e a3 2a 2d 7d 62 33 31 84 12 fa b0 22 c9 24 5a e5 88 b3 00 70 20 2b 7d 89 9b d1 5f 06 9c 7b 33 e0 ac 5d 36 05 9c bf 9a 30 cd 35 24 6c 8d 30 c9 25 81 89 cd 91 f5 ca 2e cf c3 ec b0 06 a0 62 be 30 6e 13 10 44 74 18 16 b9 5a e7 60 b1 10 03 a8 16 2e e5 36 b1 10 c2 c0 96 bb e6 42 63 21 9c 84 f9 41 48 6c 36 60 dd 26 07 82 78 a9 82 71 2d e0 e3 a2 7b ad dc e8 47 20 Data Ascii: TT}Dm! >2;H"U&^>6@8(iZtGEWeI]D7F>8`a{;S}=88%7BrR{ERuyCu.-}b31"$Zp +}_{3]605$l0%.b0nDtZ`.6Bc!AHl6`&xq-{G
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: d0 48 67 b8 22 72 27 af 3e 8b 76 ac 1e 15 3f 36 f8 c3 7b 35 a3 54 43 8e 54 94 08 ce 64 14 6e 17 0f 1b 00 ea 0b 20 dd a6 45 40 48 41 0e 5e d1 2b 00 aa b6 d6 bd 10 80 ec 07 96 21 19 e7 26 b8 a5 73 a9 cb 42 2a 43 db 01 34 88 40 d4 d1 8c 4d 9d 71 5a fa d6 97 3c fe 45 03 25 51 d9 c7 3e f4 36 0c 16 c6 af 1c 0b 48 c4 ef f4 97 05 4a b0 c7 61 ae 13 a0 f2 0a 48 ad 8b 21 50 63 1b d4 5a b7 2c 54 81 8f 7d 04 82 0b a2 e0 d8 4e 46 a1 06 de 28 4c dc 7a 17 f4 28 85 26 58 bc ed 30 b0 69 80 0e 49 48 37 43 44 c7 1c 28 d4 49 3f e8 37 46 73 5c c0 0a 34 d4 df 89 dc 74 b8 2d aa 8f 87 d6 aa 54 bc 50 e5 ae 0c ad ff 0b 6c 95 09 5b e7 b2 47 b6 cf 85 ee 82 67 bb 54 10 23 37 3e 48 ad 89 75 d0 a0 9b 01 02 b0 c8 2d b2 28 76 20 8c 8a 39 26 59 bb 49 3e c4 8c ba 4a 23 0d a1 c1 b4 08 24 52 Data Ascii: Hg"r'>v?6{5TCTdn E@HA^+!&sB*C4@MqZ<E%Q>6HJaH!PcZ,T}NF(Lz(&X0iIH7CD(I?7Fs\4t-TPl[GgT#7>Hu-(v 9&YI>J#$R
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: dc 8b 4e fb 80 cd 3a 71 cd 0b 1d 14 a1 bc ca dc 1c cd 18 42 1a 07 13 03 21 a7 29 69 24 b9 12 8b a9 ef dc 02 23 90 1a 6b b1 95 50 ec 00 19 10 01 ab d1 1b 8c b8 c5 0d 60 29 44 45 cb 35 36 ab 48 e4 97 34 4b 3e 93 0a b2 00 65 59 e8 c2 27 38 dc cd 95 01 d1 88 1b 22 66 29 4b 3c 71 cd 11 1c c1 db 6c c4 43 51 1c 5e 9b 1c a0 01 4c 56 c1 4f d5 d8 c4 e8 8c 29 cb fb 7b 2b 6d 03 23 60 03 27 30 cf ef 7c 02 5b d1 ce 89 9c b0 f5 01 01 ff 0e 8b cf f0 a7 40 86 b2 94 4a 7b c9 f3 aa c9 8a 43 44 c5 b2 c7 03 6d 34 05 1d 14 e4 d0 09 d9 9c d7 3f e1 13 06 6d d0 44 c1 cd ea 4b 1c ba 5b 2a e9 12 90 4a e8 53 80 fc 5e 1c ed 1f 0d 90 01 5c 31 02 21 ad 31 45 e2 00 2d 60 03 28 a1 62 56 7c d5 68 e1 10 08 07 7d a0 2b 7f f0 3b 8d 1b dc 9a 4d 6a 53 f9 b4 38 af 63 23 3b 8d 27 4a 91 d4 aa fc Data Ascii: N:qB!)i$#kP`)DE56H4K>eY'8"f)K<qlCQ^LVO){+m#`'0\|[@J{CDm4?mDK[*JS^\1!1E-`(bV\|h}+;MjS8c#;'J
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: ea 32 87 e5 78 6e 35 89 55 30 64 91 e1 ea 26 6c 58 eb 6c 17 a6 5a 89 e3 91 9d 97 25 21 ec 1b fa 46 19 a5 23 ad ff ed 98 f4 ac a3 b3 82 2c 86 cb b3 88 ef 30 f9 56 e1 84 00 40 a4 38 89 c2 09 a7 fa cc 69 c4 5d 9c 74 ac 0d 75 33 8d fa 74 bd e4 4f 1b ff c9 a6 e0 dd b3 d3 6e 5e 30 41 79 45 d7 ed 16 19 f4 3d 6b b9 a3 a3 6c c2 0a 05 a2 d6 75 6a 23 18 41 c3 a7 29 6a e1 f6 db 6d af b8 80 c3 cd 32 4b 71 d3 ad 07 7e 23 91 d1 d5 24 ce 19 79 43 d9 f2 72 30 67 de 65 01 f9 c0 b6 02 e5 8b 5c 0c c2 da dc 4c 17 ae 14 b5 2f 1f 08 b3 02 87 02 c0 a1 16 74 29 70 18 31 df f9 30 28 35 6e a5 25 71 d6 93 db c7 1e 77 ae 74 e1 ef 47 f4 4a 19 d9 96 e7 bf e3 d1 e9 78 9f cb 43 05 af f0 38 da 34 68 34 3d 98 9b 04 46 93 8f 9d 35 4b 4a e9 31 4b 1a 9e a5 30 55 a4 26 07 3d 48 42 07 32 98 c4 Data Ascii: 2xn5U0d&lXlZ%!F#,0V@8i]tu3tOn^0AyE=kluj#A)jm2Kq~#$yCr0ge\L/t)p10(5n%qwtGJxC84h4=F5KJ1K0U&=HB2
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 23 53 5b 8c e2 f8 28 05 32 a8 93 33 77 a3 1e 0f 34 4d 55 72 0e 62 67 b6 9a d3 4d ad 73 b6 42 65 c7 dc b2 23 59 f1 63 8c 6a 48 49 81 14 e2 73 3e 45 94 b3 f0 68 bb 38 6b 44 d9 c4 99 de 08 c6 ba 66 75 9c a2 34 b2 22 a8 82 aa 5b c6 68 6a 48 92 12 a8 c5 3a 29 c1 25 6b 6a 10 57 32 09 0f d4 17 e9 c7 40 0c d4 4d 83 2c c8 66 eb 13 9a e0 69 ee ce 51 41 2e c7 dc 6b 63 74 e0 c1 de cd 2b 98 34 1c a9 a7 8c b4 28 98 3e 28 72 a8 00 48 ae a0 57 7d 95 d7 ae 45 0c ee 01 07 89 48 15 f3 d3 16 0d a6 33 e9 ff c0 00 9e 2d 61 32 d5 1e 9d 95 33 e3 d4 e0 ac b3 df 50 f5 3e f1 2c 6a ac c6 2d ed 6b 69 02 ca 6a c6 f3 14 6e 53 51 17 62 b6 42 a3 3e 60 40 56 64 63 2c d8 02 19 72 c4 4a 5c 46 f0 c4 c0 22 80 4c b6 3c c2 31 2a a1 40 0d 25 2c df 01 41 eb 45 53 a7 35 60 4b 75 5e 52 55 5e f8 6d Data Ascii: #S[(23w4MUrbgMsBe#YcjHIs>Eh8kDfu4"[hjH:)%kjW2@M,fiQA.kct+4(>(rHW}EH3-a23P>,j-kijnSQbB>`@Vdc,rJ\F"L<1*@%,AES5`Ku^RU^m
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 1a a6 e6 35 97 bd 64 06 66 b6 d9 a1 76 b6 a2 a6 2d cb 15 8f a9 53 66 65 42 12 23 15 d1 02 2c 46 4f 11 34 a5 4b 90 4b 27 3b ff a9 db c8 8a a5 4c 21 e4 20 31 78 32 d2 12 d0 d1 04 d9 1d 8f 0e 86 eb 40 1d 18 f7 b8 c8 6d c7 08 34 7a b9 0f 7d 0c b4 5e 71 86 79 2c 99 82 d6 89 88 a4 23 8a e4 c7 f2 67 9d e5 99 4a ff 01 fd 18 6b c3 3e 5a 60 48 41 b6 1b 9c 81 81 0a 44 74 50 bf 59 49 4c f7 a0 86 37 05 d0 36 f9 72 16 26 37 20 ed 1b 3c 19 e0 11 35 25 72 92 13 02 a4 10 36 4a c0 64 60 01 15 1e 30 aa 28 18 47 ed a2 d5 54 24 4a f1 58 ae 41 ca e4 9d d8 9d e4 fd 07 29 29 8c 62 e7 72 c7 93 59 73 46 06 7a 85 b6 f8 82 f8 ad af b8 84 63 1d cb 3b 72 59 ac 75 55 76 ec 48 2a 54 3b f6 f0 cd 23 95 12 40 f3 66 2c e0 8f 91 54 04 78 aa 32 7a 7a b9 65 27 8c d4 9f ee b3 11 df 02 82 22 d3 Data Ascii: 5dfv-SfeB#,FO4KK';L! 1x2@m4z}^qy,#gJk>Z`HADtPYIL76r&7 <5%r6Jd`0(GT$JXA))brYsFzc;rYuUvH*T;#@f,Tx2zze'"
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: bc 15 c6 cd 43 cc ed 6e 09 1b 39 82 2a f5 b0 c2 3d 03 81 97 c9 58 e3 6d e8 99 21 22 1c 26 26 0c 19 28 eb 56 8c 8f 68 b0 79 1f 81 e1 ab 51 7a 86 24 08 41 17 6d e0 81 8a a2 c4 44 28 46 71 7a ff 3f 90 c3 c2 94 3a 36 73 a3 2f ca f6 66 67 f7 7d e0 35 39 64 c1 20 01 da 63 53 f1 76 a0 c6 74 d7 04 03 fd 05 23 33 b3 43 8f 5d 5a ae f5 24 5e 94 6e 2e 67 fa 85 30 a0 3a 20 b6 b0 34 a0 c9 04 80 8c 04 c6 5a de b4 7d 99 00 24 10 8b 02 50 92 ed 2d c2 70 cc 39 66 ad 92 f6 53 47 9e 9e b6 af b9 31 b7 00 4a 80 03 71 9f 96 00 3b e6 5c 40 75 76 55 00 03 37 04 44 a6 c0 53 a3 6a 60 e4 26 ed 71 09 36 11 38 c3 73 b5 80 ea 16 84 57 c9 6a 86 1b 60 00 09 5c 56 01 d8 35 80 37 4f a0 00 91 82 8f c4 50 29 a3 02 3a 13 6a 51 e7 38 2e f0 4b 80 c8 47 4e f2 92 97 7c 90 2e 20 d9 7d e5 ec 3e 5f Data Ascii: Cn9*=Xm!"&&(VhyQz$AmD(Fqz?:6s/fg}59d cSvt#3C]Z$^n.g0: 4Z}$P-p9fSG1Jq;\@uvU7DSj`&q68sWj`\V57OP):jQ8.KGN\|. }>_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49798	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	596	OUT	GET /i/2828/qqww-200-1.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 189139 Connection: close Accept-Ranges: bytes Age: 84086 Cache-Control: max-age=2592000 Etag: "676f8cba-2e2d3" Expires: Fri, 31 Jan 2025 05:51:10 GMT Last-Modified: Sat, 28 Dec 2024 05:29:30 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 27da75c9eebdc396f31906f5ec5d97e8 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT via: cache02.oversea-GM-FRA2
2025-01-02 05:12:35 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f5 1f 00 ef bc 31 ff fb 9a ff fc c6 09 0a 0a fd d8 c4 ff ff ff fd d4 51 a2 a4 a3 90 8d 77 ff ec e8 74 70 70 cd e7 bb fe f1 7c fe de 67 f3 c7 3d db e4 7d ff fe e6 ea f9 ff 4f 4d 41 cc cb c8 04 53 ff 5c bc f8 c8 ed fe e1 ed ff 06 52 87 4e 71 ef 0f 9e fe 95 d8 fd 8a d3 b8 bd d4 ff e7 e7 e6 fd ac a0 ec e9 44 8e 7e 26 ff ff 56 55 09 a4 ea e7 23 ba 4c fa cc c0 75 ff fe 2c fe fa 0d 7d 00 e6 ca c9 13 c0 bc 31 cc 79 fc 9b 00 ff f7 e8 ff d6 d2 4f ed cb ff dc a1 fc a5 04 ff ae 2c fd fc 16 09 fd 8c 2b ff cf 13 0a 06 f8 d4 0b 5f 95 15 6a 48 02 f5 fd 5f 41 f3 0f f5 b0 01 cf af d4 5f 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 Data Ascii: GIF89a1Qwtpp\|g=}OMAS\RNqD~&VU#Lu,}1yO,+_jH_A_!NETSCAPE2.0!XMP DataXMP<?xpacket begin="
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: b3 e9 71 f7 db 3f 00 da a7 e4 eb bb 0f f4 2a b3 20 71 d8 07 7f 9f d4 7e ff fc e7 7f 8b 44 80 f6 97 80 0a f8 7e 73 e5 58 78 85 48 99 15 7e 0a 18 7b af 07 7d c7 16 71 89 b3 80 0c c8 7b a7 56 62 88 c7 7c e7 77 52 99 13 71 a8 04 82 0d 18 81 ee 07 7d 0f 86 80 1a d8 82 cc 47 81 cf 37 7b 71 24 42 12 78 7f e2 44 7c f8 77 40 34 c8 82 13 58 65 0b 56 68 12 98 7f 6b c6 7b a7 67 7e f6 54 70 d3 67 82 a2 f6 81 2e d8 84 de 67 58 35 28 7f ea 87 78 14 c8 83 3f d7 45 0c 18 76 19 c6 84 2d 28 80 b2 37 74 72 d7 45 cd 56 60 ed 03 76 07 16 46 46 48 69 ca 57 80 a5 33 85 3c e8 84 36 08 85 cb 67 00 46 e8 86 02 98 84 6c e8 43 6f 38 81 73 05 80 74 d8 85 fe 95 43 2c 18 82 4f d6 80 a2 37 87 7f d8 7f e0 97 83 c9 35 80 79 b8 3c 6e 08 87 2e 08 83 9a 27 87 f8 77 67 ec f7 87 06 70 89 a2 c3 Data Ascii: q?* q~D~sXxH~{}q{Vb\|wRq}G7{q$BxD\|w@4XeVhk{g~Tpg.gX5(x?Ev-(7trEV`vFFHiW3<6gFlCo8stC,O75y<n.'wgp
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: dc a4 78 c3 f4 35 51 77 52 8c 00 0c 88 28 82 2b 62 b1 79 51 fc 22 de 28 c8 c7 3e f2 71 7e e4 db e0 fe 70 57 46 fa c9 00 8d 47 80 e3 f2 86 57 b8 f3 e1 ad 8c 38 ac a1 17 5b 40 c7 42 52 6e 7b 79 14 dc 09 0c f8 43 32 16 31 84 85 b4 80 e7 aa 98 c4 21 18 70 91 a8 93 5e f6 da 66 bb 49 ba b0 7c 56 b4 dc fa 5e 97 c7 38 76 d2 93 23 b8 24 26 0b b9 4b 3d 8a 71 72 d4 ab 9b 2e 91 57 4b 0d bc d2 05 95 74 e4 20 0b b7 bf 1d 1e 73 8c b7 c4 25 2a 23 90 45 14 2e 90 98 aa eb 9e 11 2e 79 c2 61 1e 4f 91 92 fc 25 29 a5 b9 c3 1a 52 30 8c 8a 2b 67 1c ef c8 4e d8 99 a0 98 dd e4 25 36 55 70 4d 43 6e 93 91 d6 bc 9f 26 c1 69 cc 49 8e f3 83 60 64 de 08 94 29 ce 70 82 4f 82 6d 0b 1c e6 22 e7 c7 e7 85 f2 92 2c e4 21 f2 22 b9 cd b7 35 f1 84 b2 cc 9d 2b fd a9 47 80 2a ff 6e 7a 0c b5 a1 1b Data Ascii: x5QwR(+byQ"(>q~pWFGW8[@BRn{yC21!p^fI\|V^8v#$&K=qr.WKt s%#E..yaO%)R0+gN%6UpMCn&iI`d)pOm",!"5+Gnz
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 6e bb df f0 b8 7c 4e af db ef f8 bc 7e cf d7 6c 2c 80 81 82 83 84 85 86 85 1b 15 4c 18 45 8c 1a 18 8e 90 42 92 8f 8d 1a 19 98 53 15 9b 93 91 91 96 7d 47 15 11 05 a5 a6 a7 a8 a9 aa ab ac 05 8a 49 18 03 b2 b1 b3 b2 03 b4 b5 b9 b7 b6 18 35 3b 3b 35 51 15 0e c4 07 b6 bb ba b8 8e a1 44 a4 ac 1b d0 7f ad aa 80 d0 d3 ae b0 bc da ba c8 dd ca be 3b 21 c2 c4 0e c6 db de bc cc 44 a3 ad af 7e d7 a8 ee 16 d3 1b d9 c9 e7 e8 c9 e0 c1 50 c3 c5 c7 ca ce 2d 53 b7 c1 54 a2 4d 08 dd 09 49 88 f0 02 2a 67 11 3a 0c 61 07 b1 a2 05 58 90 32 6a dc c8 b1 23 24 04 20 11 48 39 40 b2 82 c7 93 ea 86 74 30 38 65 5e 3d 29 2b 4b 5d 24 92 41 87 8e 0c 01 67 d1 82 a4 b3 67 b2 ff 9d 4d 72 7a db 49 54 60 3a 3d 31 0b bc ac 10 ad a9 d3 97 1a e6 29 7c 52 50 66 11 1d 29 52 e8 10 2a 34 9f d7 01 41 Data Ascii: n\|N~l,LEBS}GI5;;5QD;!D~P-STMIg:aX2j#$ H9@t08e^=)+K]$AggMrzIT`:=1)\|RPf)R4A
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 3e 67 35 01 ea ed 67 50 81 b7 f6 c8 2c 00 b3 42 b4 a7 50 61 6a 98 b7 f0 89 c1 99 45 74 a4 48 a1 83 28 d1 7c 60 07 0c 3d f7 d5 2b 59 a5 2d 35 8c 3a 14 68 c8 4b 85 eb 1a 36 5c 4a 73 88 56 ae 66 b9 e5 ed 26 76 11 59 7c 7b 95 a1 2d 95 a8 5f c5 53 af ae c2 ab 2b c4 26 4e af 46 6f 41 3e ba 4c 49 e4 a2 94 27 27 d5 b3 94 30 45 b9 ee 0e c7 5b 09 0f 2b 91 8f 56 50 6a 2c a2 a0 84 eb 8d 8f 56 43 41 cd 79 f4 3b 55 4d 59 c5 05 fd f0 14 63 0d c7 04 53 c1 77 ac 08 8e e3 38 bc ce 3e 5b 1b f1 67 d0 0c 75 33 e9 6d ea 77 70 5b 56 c8 e2 32 8e 5c f9 13 ef 79 3a 63 6b 22 ba fa 73 b8 a4 7d 37 3a 97 3d 33 76 22 25 8e 97 00 3f 76 60 73 53 af 9c 46 7d 3a 0f b7 5b 54 13 09 61 51 01 bf d1 86 85 81 9d 60 90 93 6c 2a 55 21 5e 7e fb 41 d5 9f 6d e5 49 35 a0 75 cc 5d 71 9d 2c 45 6c d8 ff Data Ascii: >g5gP,BPajEtH(\|`=+Y-5:hK6\JsVf&vY\|{-_S+&NFoA>LI''0E[+VPj,VCAy;UMYcSw8>[gu3mwp[V2\y:ck"s}7:=3v"%?v`sSF}:[TaQ`l*U!^~AmI5u]q,El
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 8d af 8c 6b 39 d4 1f 1b f9 6e c6 95 6b 90 6d cc e4 26 0b e0 b4 45 4e 6c 80 9d 4c d6 60 2e b9 bd 7e f5 a3 57 e7 7b 65 27 87 58 c7 03 9d 26 90 e1 eb d7 1c 60 f4 38 f0 fc 32 4c 37 eb dc 36 b7 f9 8f 4a f6 b2 9c 7d 0c d9 5f da 97 c6 2d 7e a8 90 f1 ec de b7 12 34 b1 35 9d 33 93 99 8b 04 1e f3 19 cb 12 5d e4 6c 03 10 5f c4 f6 52 91 cf 8c b4 a4 23 3d 4b 9e 0a fa d2 50 1e c1 9d ff 1b e1 c4 0a b9 06 7b 0e a8 57 ff 0d da d2 14 93 59 cf 11 46 75 9f c1 7c 04 31 9f 98 cc 12 e5 e4 42 5f 1d 63 1d 1b fa c8 b8 be 9b 46 a1 da d3 4b cf f9 b4 ea fc 05 ad 3b 1d 52 46 47 b8 d1 e1 34 eb 34 41 fd de 60 f6 7a d5 3b 30 76 7b 19 2b ed 27 b3 5a a1 4b 6d 2f a3 b7 2d 80 a4 5a f3 ae 2a dd f6 b6 33 cb 4e 21 88 79 c3 e8 be e9 88 27 6a d0 76 cf 53 dc e3 76 77 bb 93 1d d5 6a c3 bb db ce 76 Data Ascii: k9nkm&ENlL`.~W{e'X&`82L76J}_-~453]l_R#=KP{WYFu\|1B_cFK;RFG44A`z;0v{+'ZKm/-Z*3N!y'jvSvwjv
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 0c 79 a8 aa 5b 35 5b f3 86 9e c1 16 a9 ee b6 a3 ff 44 a9 70 d0 c7 61 78 93 6b c3 d4 78 aa 15 81 89 66 57 1e e5 52 26 77 6b 12 88 9d 4f a0 48 a4 2a 81 96 42 0c c2 74 9d 7c 24 50 86 54 99 77 26 4c 99 b4 ad 97 6a 67 c2 7a 51 c4 ea 5b fa 78 a9 50 67 4f d7 ca 66 66 76 9a bd ca 66 4a 87 ae 8f 36 54 fb 85 4e a2 9a 7a 24 f6 4d d5 a8 03 19 75 9d e9 27 aa b6 64 49 66 66 4e b0 14 4b 8c 04 69 e7 4a 4a f4 2a 59 aa c4 4c b3 64 4b 6e 36 4e ab a8 7e a7 e4 b0 0d ab 70 c7 84 05 0e 4b b1 15 2b 4a 79 97 ae 1a db 4e 1d eb 66 8f 74 52 a0 c4 05 f5 7a 05 85 d8 05 20 9b b2 9b 34 b2 77 f4 b2 30 1b b3 32 3b b3 34 5b b3 36 7b b3 38 9b b3 3a bb b3 3c db 20 9e 14 b1 b7 a4 07 3f 4b b1 1f 4b 33 6c 71 b4 48 9b b4 85 d0 3a 5e 60 4c 43 30 ad d3 ba 7b 0f 0b 78 cd 25 b2 a3 95 48 50 9b b5 7e Data Ascii: y[5[DpaxkxfWR&wkOHBt\|$PTw&LjgzQ[xPgOffvfJ6TNz$Mu'dIffNKiJJYLdKn6N~pK+JyNftRz 4w02;4[6{8:< ?KK3lqH:^`LC0{x%HP~
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: fc be ef f3 5e ef 55 f2 ed c8 de ef 04 5f f0 06 af ef ba be ed 02 48 ca 28 97 78 76 b7 7f 0c 3f 75 cb 8e 83 14 5f f1 0e 5f 77 17 1f f1 18 9f f1 10 2f f1 1b c7 f1 1c af f1 0f cf f0 16 6f f1 0a 96 0a ed b5 7f 27 7f 63 25 bf 6f 6d e5 f2 be 16 70 2d 8f 83 2b 8f 0a 29 3f f3 30 3f ba 79 35 7e 14 5f f3 2c 4f f3 9f 85 f3 42 ff cf d1 a2 29 8b ed f2 ab 40 f2 0c 48 d1 49 9f 45 2c 3c f4 35 9f 2b a7 60 cd 16 af f3 12 21 f5 4f df f1 d3 a0 f4 48 df 0a 5c 3f f4 5a 4f 18 ff f5 be 09 8a a1 60 3f 94 10 06 41 f5 4b 8f 28 0a 81 43 11 f2 f6 d6 00 01 43 ef 53 39 14 1a 4e 31 21 5f 8f 75 07 31 f6 77 ff b9 02 b8 52 34 92 f6 6b 7f f6 73 61 c7 60 0f f4 88 c2 34 ff 1b 01 25 44 ba 15 1f 3f 12 e3 53 5b c4 04 ec 80 f3 4c 3f 41 e4 d2 1f 5f 2f f9 94 af f9 2a 0f 38 16 24 f7 7f 0f fa 23 64 Data Ascii: ^U_H(xv?u__w/o'c%omp-+)?0?y5~_,OB)@HIE,<5+`!OH\?ZO`?AK(CCS9N1!_u1wR4ksa`4%D?S[L?A_/*8$#d
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 40 27 e6 86 85 36 24 e0 38 f6 17 c2 11 be 90 8c 80 33 9f 10 35 c2 33 ef 21 90 68 4f 2b 1c ec 16 a7 46 ff 99 15 8b 66 f4 b3 a0 38 a6 e8 c0 e9 f9 0f 24 b4 73 e2 16 31 c8 c4 07 e6 2c 8f 55 ac 5f b1 68 18 c2 0c 4c f1 86 68 cc 21 e3 5c 48 c2 47 5e d2 7c 0a 84 e3 44 58 d8 c2 2e ce 71 7e 54 c4 5f e5 d2 18 bd f0 40 71 89 59 1c 24 21 2d b9 c9 40 da f1 62 05 34 24 fe d6 08 43 30 d2 2e 92 49 04 65 2c df 38 47 f9 bd 0c 95 6b 4c 00 59 f0 67 37 20 bd ac 02 a8 cc 9f ad 4a b9 48 1f 16 b3 34 aa 64 e5 0b fd f8 3a 46 6d 00 95 40 e2 99 2c f5 98 3e 2d 6e f1 99 40 64 24 37 77 09 bc 6a 16 13 9d 0f d9 26 b2 94 89 4e 0e 36 73 99 b7 2c a7 34 a7 99 41 c0 b8 b3 98 b5 24 27 34 83 d8 43 25 ea 73 9f 87 04 9e 06 4b 88 cf 25 12 f0 01 10 34 28 f3 88 45 50 48 12 74 94 ec 2a e1 5b 2e 58 cf Data Ascii: @'6$8353!hO+Ff8$s1,U_hLh!\HG^\|DX.q~T_@qY$!-@b4$C0.Ie,8GkLYg7 JH4d:Fm@,>-n@d$7wj&N6s,4A$'4C%sK%4(EPHt*[.X
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: d1 c7 64 fa 66 92 cd 68 3f 81 a5 6f 2f 28 65 1f 89 92 9c 48 8b dd 44 52 1e 59 65 29 25 63 10 a9 04 c2 87 54 cc 02 57 97 87 58 25 05 4b d0 f8 6c ec 15 4b 94 57 52 eb a5 52 bd d8 54 49 35 88 b1 16 53 26 95 71 ff 04 67 96 5a 30 64 f6 66 09 35 b5 6f 43 19 5c 72 96 71 26 85 79 1d 25 54 f3 23 13 71 19 56 de 07 61 7a a9 6a 6e 59 6f 41 e5 56 43 14 52 35 55 51 00 b3 97 71 10 98 86 d9 98 8e f9 98 90 d9 98 8a 19 99 8e 29 13 23 85 60 22 45 99 05 85 69 48 c9 95 18 b7 7d c3 a5 99 13 b5 66 4f 05 61 ed d8 51 3f 61 99 a2 b9 50 98 76 55 98 90 52 5d 09 94 71 26 8a 4f b9 9a 7b 90 97 cf 58 52 6c d5 95 69 39 99 99 39 07 90 11 9c 3a b0 14 bf f9 13 c2 79 1a c7 39 9c d8 94 52 7f 26 79 e7 65 5e 61 69 1a c7 49 9c 54 90 9c 8f 21 9c d4 89 4d 37 b0 9d 3a b0 9d 37 a0 2c ca 29 05 c7 e9 Data Ascii: dfh?o/(eHDRYe)%cTWX%KlKWRRTI5S&qgZ0df5oC\rq&y%T#qVazjnYoAVCR5UQq)#`"EiH}fOaQ?aPvUR]q&O{XRli99:y9R&ye^aiIT!M7:7,)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49797	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	599	OUT	GET /i/1616/PPJJ-1300-240.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 200258 Connection: close Accept-Ranges: bytes Age: 65153 Cache-Control: max-age=2592000 Etag: "675feb4c-30e42" Expires: Fri, 31 Jan 2025 11:06:42 GMT Last-Modified: Mon, 16 Dec 2024 08:56:44 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 5ce89f7690f26b6e3663de84c38b8eed X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT via: cache01.oversea-GM-FRA2
2025-01-02 05:12:35 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 e6 7f 00 f2 dd d3 a2 05 00 e7 6d 03 fd b2 03 f9 dd 6a ff cf 29 a0 98 06 d7 bb b2 fd d1 0d b6 9f 92 a8 8f 6c 5e 0e 01 a8 60 11 f6 ba 2b f7 8f 00 ff fd 45 f8 f0 d6 ff ef 6e 04 03 02 db 2f ff d5 05 01 9b 6d 59 ff f2 2f 66 50 0d da b5 48 d0 92 28 db ce b9 64 59 53 dc b1 2f cd ad 9d 9e c5 14 f8 05 00 fd f0 8b ee cd c3 a5 e0 a1 0b b2 ff f7 d9 8f e9 b5 ff a8 f1 f8 d2 b3 69 d0 b1 03 10 d0 fe 61 e2 31 b2 22 ff d3 90 07 f9 f4 b3 df 73 ff 1f b0 47 d8 d6 05 a1 d0 5f db cf cd e7 64 54 ef ba 48 07 a7 09 df ce 72 63 e5 f9 cb 96 8e d1 d3 93 48 cb 3d 6a a8 56 f5 dc fe f2 b7 b3 06 5f 29 09 d5 09 d9 f8 d8 65 9f 1e d7 fe fe 22 d5 4b 1b 57 57 ac b1 c9 ca 94 48 7a d8 8b d6 ce 4d ef 96 22 5b 9a 96 eb 8f 8f c6 f6 b9 b1 69 f8 c2 8b 75 23 71 83 0f 9a Data Ascii: GIF89amj)l^`+En/mY/fPH(dYS/ia1"sG_dTHrcH=jV_)e"KWWHzM"[iu#q
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 50 9c c6 79 9c 42 63 01 05 b0 9c 05 d0 00 0d f0 9b d0 19 9d 51 a1 15 5a 21 9d d6 79 9d d8 99 9d da b9 9d dc d9 9d de f9 9d 51 e1 9c e2 39 9e e4 59 9e e6 79 9e e8 99 9e ea 89 9e 71 d0 9e ee f9 9e f0 19 9f f2 39 9f 71 60 ff 19 96 d1 23 f8 99 9f fa b9 9f 94 d1 8a fe f9 9f 00 1a a0 02 ea 21 3f 55 a0 06 7a a0 3f 35 a0 0a ba a0 1d 12 8a 0e fa a0 a0 c8 a0 12 3a a1 14 5a a1 d1 86 a0 18 9a a1 1a ba a1 1c 9a a0 16 fa a1 0a ca 9f 22 3a a2 3c 62 9f 4a 45 9f 28 9a a2 f1 b9 9e 2c da a2 e7 79 07 f1 d8 90 32 0a 89 10 40 03 e0 79 a3 38 9a a3 d9 c9 9b 3c da a3 3e fa a3 40 aa 9b 52 50 2e 97 49 30 b4 34 4a a8 74 7e a2 e4 4a 2d 11 66 ad f9 54 1c d0 00 28 00 9a 54 5a 6e 61 85 88 e5 06 a5 28 b0 a5 2c c0 1a 54 0a 9a b4 99 17 1b 15 a6 64 5a a6 61 1a a4 68 9a a6 3f 3a 00 08 50 17 Data Ascii: PyBcQZ!yQ9Yyq9q`#!?Uz?5:Z":<bJE(,y2@y8<>@RP.I04Jt~J-fT(TZna(,TdZah?:P
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 54 00 f3 97 05 5c 30 03 f6 e7 6e 55 70 50 21 e0 06 52 30 03 49 70 55 32 d6 91 08 10 47 49 30 51 32 d0 6f 13 c5 07 11 d5 6f 0c b8 47 4e 00 52 ab c1 5b 2e f9 92 bc 65 81 88 43 15 a8 91 37 a4 61 04 f6 93 04 15 a7 0c 95 84 ff 28 28 b0 48 3f 09 94 ca f0 16 09 e2 48 28 90 04 23 27 83 33 88 4a f4 93 04 18 60 37 ce e1 1c 10 80 36 13 45 02 52 80 01 0c 65 83 aa 84 83 19 42 75 40 a6 63 66 85 85 3c 76 62 b9 e2 63 a2 d4 62 43 97 53 44 36 7a 69 c7 06 41 97 40 46 36 8b 83 98 53 72 d9 96 a9 67 87 4b 18 41 a2 54 97 61 96 25 7b 48 56 b2 b8 72 82 29 77 ca f7 96 4f 96 7c 39 86 00 70 98 69 62 f6 86 61 d7 56 28 f0 73 06 30 99 b3 f8 97 64 b5 07 48 e7 78 9a 28 01 5e 77 88 4a a7 72 76 38 99 19 42 07 e7 e4 8b 7c 29 86 8e 38 5a 74 a7 75 95 08 6c c0 76 67 c9 48 5a ae e9 66 aa 09 9a Data Ascii: T\0nUpP!R0IpU2GI0Q2ooGNR[.eC7a((H?H(#'3J`76EReBu@cf<vbcbCSD6ziA@F6SrgKATa%{HVr)wO\|9pibaV(s0dHx(^wJrv8B\|)8ZtulvgHZf
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: a2 0f 0e 24 06 41 e1 01 b6 32 06 ba 32 06 5c a8 2b 1c e7 0d 9f e5 71 31 60 45 46 10 03 62 20 01 6a b8 86 12 20 06 4c c4 00 57 34 46 68 c0 00 45 37 5c 76 48 45 45 e7 58 1c 80 30 e7 b2 01 99 a0 00 68 b0 00 2c 40 02 10 b0 ff 03 22 a0 05 54 e7 03 57 a0 00 df e5 26 5b 27 05 46 90 04 e0 f2 00 34 10 74 d0 b5 45 0d 70 07 34 90 01 e8 d4 00 4b 64 16 bc a5 2e 06 20 00 56 13 6f 27 a0 17 92 00 01 6e f0 59 08 82 88 7c 17 39 6e 90 75 27 00 30 df 76 2a 0d 40 02 4c f7 21 75 b4 7a 11 36 61 28 42 00 aa f8 21 76 60 7e 8f 87 47 94 37 79 8e 20 21 e6 47 79 fc a5 8c 97 17 01 c1 88 20 c3 d8 02 83 94 7d 8f 77 7d d6 47 7d da 78 69 9b 11 7d de f8 8d 35 86 78 e5 c4 8b 11 b6 1f ad 07 7c e8 88 8e d1 f8 21 e8 87 65 6f b6 24 f0 18 8f f2 18 8f 27 a0 7b eb 08 22 ed b8 7b fa 88 65 e9 48 65 Data Ascii: $A22\+q1`EFb j LW4FhE7\vHEEX0h,@"TW&['F4tEp4Kd. Vo'nY\|9nu'0v*@L!uz6a(B!v`~G7y !Gy }w}G}xi}5x\|!eo$'{"{eHe
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 9d bc 28 45 81 14 86 90 52 59 c1 57 67 9b f6 42 d8 39 cd 2c 4e 53 5d 0d ea 55 3e 4a 89 16 76 f1 c8 84 0b 42 1b 9a 4f 7b 30 28 dc 5f 21 4e b8 db 9e f5 a4 90 14 59 d9 57 8d 4a 5b 09 05 17 20 48 a6 fd 57 00 4e 17 42 11 04 ff 91 fd 9c 6f 21 a6 af 02 50 ac ce 30 84 ea 49 ad 0d e8 db da d1 10 8c 55 37 56 08 79 1a f2 e4 a4 8a 10 21 5f f5 d1 6c 39 c3 e4 d7 c1 7a c6 e3 21 9b 2a 6e 08 ab 1b 8d 6d c8 b3 11 2b 0b f0 23 7f 88 1c a8 53 39 a6 9d a7 6a 5f fb ff d9 a0 59 dc a6 28 d1 f0 2f f6 e2 6d 5f 04 5a 0a 41 7e 7b 90 13 60 04 03 5e 04 68 ba e0 45 fc c3 06 14 18 0c b9 32 5a 52 c1 00 1c d8 81 1e d8 81 df f2 81 22 78 5b f4 76 14 fc f6 2f 69 90 82 2a b8 82 2c d8 82 f9 46 28 bc 75 82 32 88 46 d4 c5 70 36 d8 00 dc 50 4a db c0 39 d9 e5 33 a4 c1 02 27 c0 71 af d1 1c 54 c3 1c Data Ascii: (ERYWgB9,NS]U>JvBO{0(_!NYWJ[ HWNBo!P0IU7Vy!_l9z!nm+#S9j_Y(/m_ZA~{`^hE2ZR"x[v/i,F(u2Fp6PJ93'qT
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: a0 41 83 38 d0 a0 76 0d 98 1c 5a e8 60 81 8c a2 61 d8 51 e0 00 b0 3d 40 dd 22 fd f2 97 5e 50 1c 93 b8 2b 09 e3 3a a3 49 9e 58 a1 78 fb cb 6e f3 a2 f7 9a a7 80 c1 05 c8 cb e4 dd f9 a3 bc b0 3b 45 ed f4 db 6e 7b 2a 18 84 ff ff a5 47 04 10 55 11 5d 6c 64 a4 e5 5c 5e 87 1b 82 82 e5 fd 28 a1 14 29 9e f2 d4 ab ac 6e fc bb 21 da c0 c3 c2 f7 49 aa 52 44 54 c3 18 28 c5 1e 36 7e f1 92 b3 2f 83 25 16 e9 89 4d da 2a 1b bf 94 57 b9 c2 f1 00 13 88 14 97 0e c5 81 39 a6 a9 cc 61 c2 03 1d e3 94 c7 51 29 c5 56 2e a2 e4 20 cb 02 0f 0c 50 b2 d2 d3 c0 02 a3 8b 82 05 4b 57 32 c2 a7 e1 e4 27 7f 33 ca df 42 82 5a 7c b0 03 00 58 19 cb 59 ce 72 bf 10 a3 67 c7 8c 56 6f a3 45 03 7d 0e 50 d8 b2 fe f9 d1 6c fe cc 8d e8 13 67 39 d7 b9 37 7f 59 8d c5 be 38 da c7 90 46 01 14 0b ec 61 f9 Data Ascii: A8vZ`aQ=@"^P+:IXxn;En{GU]ld\^()n!IRDT(6~/%MW9aQ)V. PKW2'3BZ\|XYrgVoE}Plg97Y8Fa
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 8d 6c d0 48 63 64 80 05 0d e0 40 12 1a 90 17 17 d1 40 0e 0c 10 83 34 17 90 80 21 4c 4c 95 00 5b 87 2e 55 95 b0 73 04 c3 62 d1 ad 80 04 b0 b1 03 65 e4 72 0a 52 50 80 18 cb d1 ca 06 14 80 03 62 70 42 c9 82 85 86 92 a1 e1 ff 04 d5 e0 82 11 98 69 04 39 4c 61 06 b9 b4 03 04 96 24 03 8a de c4 23 e5 9c 68 38 03 b4 92 23 77 24 9b 22 8d b2 42 53 e2 4e 94 dc 73 23 02 ed e7 59 e0 19 81 a0 dd 64 9e 56 5b 09 56 92 e2 65 aa e5 93 68 43 f9 f2 3c e5 76 a2 32 0b 14 cd 63 f3 8a 41 a1 b7 d0 aa 4c 19 6c 57 41 1e dd 1e 5a 37 e8 7d d4 ac 80 e6 ea 60 14 57 38 c5 11 2e d0 ab 81 e9 a1 57 63 38 b0 3a fa d1 a2 b3 08 56 71 b3 12 cb 9d 94 32 29 65 29 6a 34 3d 94 ad ae 20 42 16 71 29 82 b8 56 53 9b e6 0b a7 45 e5 69 00 68 37 54 e5 00 b5 a8 b0 8e b5 ac ab 43 9c bb de 55 6f 52 dd 9e a7 Data Ascii: lHcd@@4!LL[.UsberRPbpBi9La$#h8#w$"BSNs#YdV[VehC<v2cALlWAZ7}`W8.Wc8:Vq2)e)j4= Bq)VSEih7TCUoR
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 55 2b c6 16 80 b6 d4 a0 a2 98 a7 c6 c5 b0 81 62 1c c7 6c e0 c6 d3 90 07 76 7c c7 78 ec 0d 76 6c 4f 2a 68 0e 7b 3c 4f 2a 98 c0 dd 50 94 00 28 0d 73 90 52 0f 88 07 d7 a8 0e 0b dc c8 8e 7c 7f 45 f8 83 53 80 85 14 6c 84 91 08 01 df b9 83 37 07 6e 38 c7 01 93 0c 00 52 70 02 5d 33 0d a9 57 ca a6 6c ca 4d 48 92 75 40 02 2c 03 84 16 79 b7 fe 5a 0c 98 1c 84 77 9b 9c b3 ec 83 21 3b 0d 81 5b 07 c4 b0 10 5c 90 84 8d 38 0d c1 cc af 00 79 0c 27 70 02 52 a0 01 ca 0c 00 10 d0 cc ce dc cc db 80 c9 82 dc c5 d4 fc 0e d3 5b cd d8 9c cd da bc cd 31 41 a1 72 fc ff cd df 9c 95 dc 0c 1b 39 3b ce e6 7c ce 32 02 69 38 f2 0d 28 94 68 3a 04 16 90 56 23 32 71 7e 7f e0 19 f6 7c cf f6 fc 26 1f 72 1e 9a 81 02 36 81 cf 45 c1 25 24 32 15 e8 bc 15 e5 5c d0 08 9d d0 bc f1 a2 15 b1 ce de c0 Data Ascii: U+blv\|xvlOh{<OP(sR\|ESl7n8Rp]3WlMHu@,yZw!;[\8y'pR[1Ar9;\|2i8(h:V#2q~\|&r6E%$2\
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 83 59 05 83 f0 ad ae 3b bb b4 8b ad b0 3b b6 53 5b 44 ce 50 61 0a da a8 1a 16 af f2 0a 8a 5c 0b 7e 93 6a b6 8b 26 8a e6 c0 ba 5e bb 61 c0 6b a8 c2 8b b6 8b 60 a2 5e 9b 67 69 b0 94 70 21 00 74 3b a4 7d fb 75 79 69 b1 5e 87 8f 2c f6 75 da c9 b7 b3 ba ab 55 99 05 22 cb 09 c2 e8 0e 86 5b 00 b7 eb 0f 55 d0 be 0d 18 ae 42 0b 8f ef 4b 08 55 50 00 77 c9 a9 05 49 05 33 90 be 91 40 b2 8e c2 73 03 50 05 03 80 46 f9 62 2b 9b cb b2 36 cb 28 a7 2b a1 62 6a 34 0f 7c 08 80 13 ba b5 92 6c c7 8a ba 02 ca 06 a5 1b 97 8a 20 07 6b 5a bb 81 f9 be b2 2b c2 26 6c ff c2 fa 98 bb ba ab a7 c1 e7 bb 2d a9 c1 fe f0 bc e3 aa 08 f7 5b 05 19 06 9c c6 6b a1 ad 53 b6 42 08 c3 86 98 a3 fb 5a a2 27 9a 67 d8 eb 67 f3 76 bd db 9b c4 b3 f7 97 e4 7b 75 e0 6b 08 f2 9b 7b 25 a8 b8 b7 c7 ab c9 58 Data Ascii: Y;;S[DPa\~j&^ak`^gip!t;}uyi^,uU"[UBKUPwI3@sPFb+6(+bj4\|l kZ+&l-[kSBZ'ggv{uk{%X
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 3a ab 8c ed c9 24 8e 23 09 db 15 98 0c af b3 2c 7e e0 dc 05 bb 31 95 27 4d b4 ba f2 f2 cc 37 ef d5 96 ce 37 5f 33 d0 93 ea 3c a6 d1 95 5a da 35 d6 62 bf fa 1c d6 29 64 3f db 0d 5e c7 b9 3d d5 e8 a7 cf bd 7c 17 7b 92 27 d1 e8 2f 67 c7 9f b2 a0 89 fe d7 72 2b d3 74 fc 2d 9f 3f 69 dd c9 f8 52 fa 96 53 b3 ea 8c 67 3c d6 59 0d f9 24 d5 bd df d4 61 66 dc e0 4b 5f 6a 26 3c 04 e1 4a 79 ec 78 a0 88 f8 66 ab 54 f4 ff ad 83 9d 38 81 de 3c 11 38 04 75 23 78 bf c2 d1 2c 38 98 ad 5e d5 61 42 b4 20 c5 c0 48 11 8b a3 a4 a2 04 38 cc a1 0e 77 c8 c3 1e ea 10 78 87 f1 c4 1c 7a 24 1a 7b 25 43 47 15 2c d8 27 60 b4 0d 5b b9 40 85 bd 52 d6 1f 56 c0 89 27 76 42 8a c3 eb 84 09 a7 a8 0c 19 dd 68 43 33 da 4e f4 c6 48 c6 32 86 03 7a 66 34 19 81 ea e7 bf f0 dd 6d 36 f6 c3 94 a1 08 d0 Data Ascii: :$#,~1'M77_3<Z5b)d?^=\|{'/gr+t-?iRSg<Y$afK_j&<JyxfT8<8u#x,8^aB H8wxz${%CG,'`[@RV'vBhC3NH2zf4m6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49776	106.225.241.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	535	OUT	GET /z.js?id=1281318611&async=1 HTTP/1.1 Host: v1.cnzz.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	568	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/javascript Content-Length: 10194 Connection: close Date: Thu, 02 Jan 2025 05:12:35 GMT Vary: Accept-Encoding cache-control: public, max-age=300 etag: W/"11366216631888960513" Via: cache6.l2cn1802[85,85,200-0,M], cache45.l2cn1802[86,0], cache12.cn3693[101,100,200-0,M], cache4.cn3693[102,0] Ali-Swift-Global-Savetime: 1735794755 X-Cache: MISS TCP_MISS dirn:-2:-2 X-Swift-SaveTime: Thu, 02 Jan 2025 05:12:35 GMT X-Swift-CacheTime: 300 Timing-Allow-Origin: * EagleId: 6ae1f19817357947554455945e
2025-01-02 05:12:35 UTC	3961	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 69 3d 22 68 74 74 70 3a 22 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 2c 69 3d 30 2c 73 3d 74 2e 6c 65 6e 67 74 68 3b 69 3c 73 3b 69 2b 2b 29 7b 76 61 72 20 65 2c 68 3d 74 5b 69 5d 3b 69 66 28 68 2e 73 72 63 26 26 28 65 3d 2f 5e 28 68 74 74 70 73 3f 3a 29 5c 2f 5c 2f 5b 5c 77 5c 2e 5c 2d 5d 2b 5c 2e 63 6e 7a 7a 5c 2e 63 6f 6d 5c 2f 2f 69 2e 65 78 65 63 28 68 2e 73 72 63 29 29 29 72 65 74 75 72 6e 20 65 5b 31 5d 7d 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 7d 28 29 3f 22 68 74 74 70 3a 22 3a 22 68 74 74 70 73 3a Data Ascii: !function(){var t,i="http:"==function(){for(var t=document.getElementsByTagName("script"),i=0,s=t.length;i<s;i++){var e,h=t[i];if(h.src&&(e=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(h.src)))return e[1]}return window.location.protocol}()?"http:":"https:
2025-01-02 05:12:35 UTC	6233	IN	Data Raw: 69 73 2e 4d 2e 65 74 5b 72 5d 2e 72 74 29 2c 74 3d 6e 5b 70 5d 28 22 7c 22 29 2c 65 5b 76 5d 28 74 29 7d 69 66 28 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 63 3d 6e 65 77 20 44 61 74 65 3b 63 5b 55 5d 28 63 5b 4d 5d 28 29 2b 31 35 37 32 34 38 65 35 29 2c 69 3d 74 68 69 73 2e 43 2b 22 3d 22 2c 74 68 69 73 2e 65 74 3d 68 28 65 5b 70 5d 28 22 26 22 29 29 2c 69 2b 3d 74 68 69 73 2e 65 74 2c 69 2b 3d 22 3b 20 65 78 70 69 72 65 73 3d 22 2b 63 5b 45 5d 28 29 2c 69 2b 3d 22 3b 20 70 61 74 68 3d 2f 22 2c 73 5b 66 5d 3d 69 7d 63 61 74 63 68 28 74 29 7b 4e 28 29 7d 7d 2c 48 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 74 3d 65 5b 6f 5d 2e 68 72 65 66 7d 63 61 74 63 68 28 74 29 7b 4e 28 29 Data Ascii: is.M.et[r].rt),t=n[p]("\|"),e[v](t)}if(0===e.length)return!0;var c=new Date;c[U](c[M]()+157248e5),i=this.C+"=",this.et=h(e[p]("&")),i+=this.et,i+="; expires="+c[E](),i+="; path=/",s[f]=i}catch(t){N()}},H:function(){try{return this._t=e[o].href}catch(t){N()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49805	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	601	OUT	GET /i/2024/11/08/1300x200.gif HTTP/1.1 Host: hongniu.getehu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	588	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 241438 Connection: close Accept-Ranges: bytes Age: 0 Cache-Control: max-age=2592000 Etag: "672df28a-3af1e" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Fri, 08 Nov 2024 11:14:18 GMT Vary: Accept-Encoding Via: cache07.oversea-NL-AMS2,cache01.oversea-GM-FRA2 X-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS X-Request-Id: fb51a83f959a613e8f3e98cf81490c1f X-Request-Ip: 8.46.123.189 X-Response-Cache: miss X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT
2025-01-02 05:12:36 UTC	15796	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 53 23 2c ac 6f 47 c3 ff 5c 22 56 ff 9f ff 53 ff ff cd a3 d5 fe 70 56 5d 00 6e ff 00 50 f7 ff ab 00 50 0a 2f bc 6c 15 52 ff 10 ff d2 17 ff 5d 46 9a 4a 1e 99 68 1e 95 b3 fe 36 78 d9 32 04 00 ff fc 00 d8 d4 d4 00 54 00 cd ff 76 31 95 00 00 9b ff ff b3 25 77 25 00 00 dd 00 ff d3 58 00 8a ff 77 47 23 cf 0c c8 52 00 00 2e 23 26 fc d7 00 52 25 00 dd 8e 00 ff cc 00 ff ae 00 ff d2 ad 00 45 e6 ff 8e 00 b4 b3 b1 bc 46 23 dc b1 33 ff b1 8a 00 be 2d ff 33 14 76 23 2e 0d ef e3 56 99 60 9d 23 00 a4 d3 ad 00 d0 21 d0 db ff 00 6e 00 ff d3 85 e5 64 00 de 8f 36 65 29 47 37 9a ac b7 92 00 be 88 0e 9b 45 00 c0 44 00 12 0a 23 be 8a 3c 00 92 b7 ff f7 00 d6 b7 00 75 48 00 8e 8f 00 34 f3 00 dd b2 61 c0 00 00 ff b0 5e e3 8b 00 00 94 03 95 90 Data Ascii: GIF89aS#,oG\"VSpV]nPP/lR]FJh6x2Tv1%w%XwG#R.#&R%EF#3-3v#.V`#!nd6e)G7ED#<uH4a^
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 80 cf 24 f8 44 7b 01 45 5c 00 41 8a 75 9f 89 f1 4f 6b 74 c1 3a 6c 06 57 90 20 05 a4 48 01 28 0f 03 2e c1 b2 70 80 24 dc c6 71 5c 90 6b 44 66 3f d8 06 38 b8 83 07 1c 03 89 19 46 8b 3d d8 ef 04 00 10 c8 06 65 8a c0 24 ec 81 39 54 41 13 44 a0 29 28 44 64 ed 01 94 39 c0 09 38 40 3e 14 80 07 80 59 00 e0 83 3e dc c6 3c 34 01 10 f0 e6 21 18 8f 3f 34 45 3c e8 c0 07 b6 e0 3a b4 e0 0b 76 43 68 02 80 c8 14 00 1b 14 46 0e 5a 9a 0e c5 19 ad e5 c8 9a e1 10 3a b4 02 84 46 68 84 5e c2 7b b0 c7 3d c8 c3 38 d0 07 7b 28 12 7e b0 c7 8b 44 c5 3d f8 43 88 c6 47 0f 54 49 8d dc 47 78 8c 68 54 60 a1 78 a8 a8 3f 00 80 89 ba a8 3f 80 81 a5 49 c6 f6 28 08 8e ea 99 9e 88 59 1e b6 52 af 19 09 87 60 48 87 8a c7 3b 1c 00 8d b4 a8 88 a2 08 7f 94 ff c1 38 b4 08 7c 74 c2 7e c0 87 8c 1c e9 Data Ascii: $D{E\AuOkt:lW H(.p$q\kDf?8F=e$9TAD)(Dd98@>Y><4!?4E<:vChFZ:Fh^{=8{(~D=CGTIGxhT`x??I(YR`H;8\|t~
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: b2 d2 85 c0 d2 90 c2 ba 4f f5 34 07 f5 c4 cf ea 53 4f c7 ba 3e f5 c4 01 f9 c4 ac ed dc ac f6 a4 97 cf 2a ad f8 3b ad 06 95 3f 7f 61 d0 08 4d bf 05 fd 17 00 38 84 50 88 ad 87 b1 82 a4 58 32 0a e0 33 01 44 40 0c f0 89 11 25 d1 12 25 89 9b 08 2f 9a 89 b1 fa ca c5 e6 22 9f 0f a4 9a a7 0c 4a 10 08 b2 a0 18 2e 3d 60 08 46 08 90 49 80 00 e6 02 01 68 48 45 9d b8 09 ca 61 08 25 30 31 2b 58 05 aa 51 02 20 c5 98 21 bb 9a f6 ea 1f e2 49 19 26 0d 09 19 54 20 8d c0 2f f7 2a 01 55 a0 1c 13 a4 1a b6 69 30 45 5b 20 e4 e9 0d 49 80 51 1a 63 30 00 33 30 33 6d 00 0c 10 1c e2 81 06 1d c3 98 c3 21 02 22 c0 00 3d c0 00 e3 42 9f 8e 68 23 56 58 52 2f 4d 19 8c 7c 89 41 45 02 dc 52 52 1f f4 84 0c 04 37 51 a4 9b 55 38 d3 3f 14 00 11 05 d1 48 ff a5 54 10 bd 53 39 35 c1 36 f5 45 0c e0 Data Ascii: O4SO>;?aM8PX23D@%%/"J.=`FIhHEa%01+XQ !I&T /Ui0E[ IQc0303m!"=Bh#VXR/M\|AERR7QU8?HTS956E
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 21 77 00 04 07 83 7e 0c d0 59 1b 82 04 da b0 31 56 10 00 e1 02 7f 26 a0 35 44 70 02 9d 05 01 5e 00 02 22 50 83 e9 d0 2f fc 67 02 40 20 80 40 fa 59 fd e7 7f c5 d2 02 3c 40 04 dd 45 01 0c b0 01 26 40 2c 7b b7 31 25 f0 8a e2 b0 5a 30 15 06 fd 27 04 61 50 0d 56 50 a6 21 e3 2f 1e 60 37 36 23 82 0e 70 0c 1e f0 0d ab 20 36 70 f0 09 52 10 5e 73 1a 34 33 88 5d 32 18 06 56 80 06 01 80 0d 0e 12 04 29 98 06 e1 65 35 6e 93 22 e6 55 02 e8 b5 34 0f 00 00 6b 02 02 4b 20 2f 44 f0 31 e7 c2 03 1b 60 04 46 90 59 a8 0a 85 e5 10 09 0e f0 7e fd b2 01 0b c8 07 5c b8 01 5d c0 00 7d 73 57 a4 86 38 6b 58 15 87 03 61 0c 16 11 68 c8 67 79 46 61 1d 21 38 c8 fa 90 dc 50 2d 0b 80 60 4b c6 0d 9d 03 ad cf e3 39 1c 90 08 82 38 88 00 00 04 5f 10 08 ff 6d d0 06 58 70 3c 4d 20 0e 91 90 04 bf Data Ascii: !w~Y1V&5Dp^"P/g@ @Y<@E&@,{1%Z0'aPVP!/`76#p 6pR^s43]2V)e5n"U4kK /D1`FY~\]}sW8kXahgyFa!8P-`K98_mXp<M
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 91 29 80 40 cc 36 20 12 2c 68 11 33 c8 cb 4a c7 2c ec 42 e8 f0 4b e7 e8 8c 13 53 27 a0 16 e0 13 7b a8 cf fa ec 00 cc 41 1e 74 60 03 5c e0 8a 14 e2 10 3e f2 8d 18 ad 07 5e 81 d0 50 04 0e 90 21 16 15 a1 1e 3e a1 d8 d6 c0 34 ea 41 28 0a 20 16 ad 88 1a 90 41 36 26 42 0d 40 c1 0e 6d 15 0c b8 61 7f 9a b1 14 de 01 0d 86 c9 02 00 01 10 0c 40 18 6c 00 0c 84 c1 16 50 a1 17 76 00 0e 76 e0 01 56 61 08 94 63 39 96 23 91 96 20 16 96 20 91 e0 60 04 ce e0 3d ae ed 01 62 20 06 1e 80 5d 35 4d d3 b0 68 15 40 60 db 06 69 07 84 81 3e f0 83 3e 40 c1 97 d0 02 14 5e 20 0b 32 21 13 04 52 11 80 60 07 3c a0 09 dc b5 3a e0 40 93 88 c0 cb d6 e2 43 b6 81 43 e4 62 43 66 e8 74 34 44 97 2e 96 1b 0e 01 99 8c c9 54 3b 62 24 57 24 e1 4a b2 46 18 6e ff 64 5f a4 94 20 ae 64 45 d6 19 dc a2 e2 Data Ascii: )@6 ,h3J,BKS'{At`\>^P!>4A( A6&B@ma@lPvvVac9# `=b ]5Mh@`i>>@^ 2!R`<:@CCbCft4D.T;b$W$JFnd_ dE
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 1c 00 1a b4 5e 21 b4 41 13 44 42 12 50 43 53 a6 40 7e e5 17 5e 2e 41 55 7a 01 0f c4 c0 ef 20 98 fd 04 42 16 54 47 1d 90 82 19 c4 00 32 30 40 01 f1 80 18 08 90 09 ac 02 07 50 41 35 dc 01 07 f0 c1 78 10 c1 3c c4 03 2e f8 c3 4a f2 80 0e 14 c0 0e a4 41 16 e4 83 40 ec 41 15 20 c3 2f 94 90 7f dc c3 3b 14 11 13 91 83 25 a8 91 3f d4 18 08 a4 10 05 f0 c1 21 50 40 09 a8 41 13 15 91 89 f8 83 fa 3d ac a6 12 11 ac fa c3 3b 34 2c 60 58 49 9f 49 81 84 40 47 20 bc 6c 35 34 20 69 4e d9 cc 36 a0 95 65 19 8f 48 c9 90 88 d1 93 30 49 6b 1a 09 98 f5 ac 93 c8 e6 94 24 c9 21 00 83 72 f9 50 89 30 ed d2 82 2c c8 36 ad 5f 38 2d d3 46 2d d5 46 ed d2 4a 6d d6 5e ad d5 1a 46 19 74 02 a0 71 a7 22 49 52 27 6d e7 77 02 1a 3a 55 92 21 e9 e0 39 1d ff 5a 12 f6 c9 31 b1 c4 b7 0c 1a 12 3a 5d Data Ascii: ^!ADBPCS@~^.AUz BTG20@PA5x<.JA@A /;%?!P@A=;4,`XII@G l54 iN6eH0Ik$!rP0,6_8-F-FJm^Ftq"IR'mw:U!9Z1:]
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7e 3d 2c 62 35 d8 86 75 47 4a c5 58 41 25 d8 6e e5 58 84 f5 d8 ec 58 d8 83 4d d8 fd 21 d9 8c b5 d8 8d 45 bb 92 15 d9 8b 65 d9 94 65 bd 90 e5 d8 ff 12 d7 22 b2 bd ba d4 02 3e 11 a3 37 c8 00 0f d8 00 20 30 94 35 2a cc d4 e9 01 06 58 85 35 50 bf 4b c1 14 4e 89 c3 9f 8d 4c 05 f8 02 1d a0 07 42 d0 84 74 38 a3 08 50 41 06 20 94 08 20 14 06 c8 cc af 8d 80 08 60 80 d3 bc 15 d4 cc 24 10 e5 80 1d 60 86 47 60 06 5c 58 84 54 48 85 55 50 00 0f 98 01 55 fa 40 1b 00 04 2f 80 89 15 88 42 6d 28 81 1d 58 85 79 69 83 36 d8 a8 91 d0 9a 1f 73 01 77 70 01 49 40 04 50 00 05 42 78 05 63 82 82 4e 38 84 af 3d 84 0d 08 ce 21 00 dc 14 60 01 10 50 41 59 a0 83 3e e8 03 3a b8 80 ac f1 32 08 ac 86 34 c8 84 31 78 07 2e 44 86 2a 60 03 fc 5c 35 2f ff e0 cf 17 90 a7 31 f8 04 1d 70 1a 34 92 Data Ascii: ~=,b5uGJXA%nXXM!Eee">7 05X5PKNLBt8PA `$`G`\XTHUPU@/Bm(Xyi6swpI@PBxcN8=!`PAY>:241x.D`\5/1p4
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 04 7b a0 06 a6 50 26 da 50 02 1c c0 72 28 00 23 1c 79 77 27 f0 22 c7 e0 00 3f 50 78 6f 4b 78 87 07 55 a9 02 99 ab 02 99 23 20 54 92 59 2a 39 33 05 7d eb b7 0f 4a 5e 53 80 00 03 40 b8 b3 40 b8 26 53 34 7f ab b8 7e 2b 01 38 40 5a a8 07 2e 36 23 b8 85 4b b8 13 20 01 a4 35 2f c6 22 59 9b 5b 2f 9a bb 00 d6 b9 b8 7a 23 56 d0 91 37 8b bb b8 8d 9b b8 a6 fb b7 a8 0b 79 ab a9 9b d2 d2 2e bc b9 00 a6 a0 6f a6 40 9c a8 70 9c 24 e8 59 c6 27 01 b0 c8 19 f4 89 36 c8 39 3a ad 35 7d 20 53 55 ee c9 0e 96 00 a3 ba 6b 09 bc 35 80 17 71 19 7b 35 62 17 71 9d dc e5 a0 78 63 a3 14 da 2d e4 30 34 22 23 31 24 36 58 d7 35 17 cf 70 bc a7 d5 a0 38 d0 36 ed e7 11 f7 67 3a 05 c6 5d 9f f9 bb b7 25 36 ef e0 37 a2 a3 2d 53 e0 bb de cb 7e db 57 11 ff d2 59 60 98 43 49 94 d3 38 c9 40 61 86 Data Ascii: {P&Pr(#yw'"?PxoKxU# TY*93}J^S@@&S4~+8@Z.6#K 5/"Y[/z#V7y.o@p$Y'69:5} SUk5q{5bqxc-04"#1$6X5p86g:]%67-S~WY`CI8@a
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 50 68 a1 16 0c 47 17 0d c9 90 48 ef 25 e9 68 44 74 85 74 03 5d 17 48 a4 d6 21 a7 36 76 51 ed 66 43 97 74 3f 4f d5 78 16 8f aa 13 be 7e d3 01 47 6f 46 bf 10 49 f8 ab 44 33 8e 72 0b ee 43 4b 14 0d 3e 34 a5 9a cc 33 b8 b4 4c 7b 00 7a 17 35 a5 52 aa e0 d8 34 a5 1c b6 4e 1b 76 62 df f4 7b d7 f4 7b f7 f4 4f f5 d4 61 c9 f7 63 61 96 51 db 37 4d 1d 95 51 17 35 52 61 36 61 e5 d7 33 2a 55 d6 28 95 52 65 8d 53 c3 e0 53 01 98 63 31 d5 e9 3a b5 55 d1 95 5d d3 b5 80 5f d5 5c 17 f8 5b 7b d5 5b c5 55 57 23 18 5b 85 35 5b ab f5 59 8d 35 83 89 55 2d 9f 6b 59 af 60 59 01 b3 59 19 40 59 5b c9 57 bf 72 2b 81 f5 84 2f 38 5a 3f f3 33 2d f8 57 59 78 5a 59 f8 85 5b 98 82 77 35 5a 45 d5 57 d1 60 57 6f f8 68 04 58 23 04 18 55 45 35 88 db 15 ff 5e 8d b8 5e e9 95 5f 0d 76 89 11 56 7e Data Ascii: PhGH%hDtt]H!6vQfCt?Ox~GoFID3rCK>43L{z5R4Nvb{{OacaQ7MQ5Ra6a3*U(ReSSc1:U]_\[{[UW#[5[Y5U-kY`YY@Y[Wr+/8Z?3-WYxZY[w5ZEW`WohX#UE5^^_vV~
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 46 f0 0f 73 41 07 6a 39 d7 74 1d e4 01 69 96 70 34 41 04 20 44 19 98 43 3d cc 43 0a e8 40 01 ac c1 3c a5 47 71 19 d7 3f dc c5 41 56 d7 06 44 42 c8 89 57 7b 1c 1e 08 b0 86 90 39 d6 29 61 07 66 2c c1 66 e8 c0 37 34 01 1c bc a4 79 74 d7 f3 fc c3 09 b8 c0 e8 39 c0 9d 84 85 9d a4 83 07 ac 83 97 79 87 10 94 c0 1d 94 00 28 94 01 5a 14 80 3b 78 80 5b ae 43 37 94 83 ec e5 17 18 00 00 46 38 4f 69 20 23 04 cc 06 ed 38 08 7d 50 58 7d 50 58 85 25 1f 61 16 a6 61 fa 87 7d 1c 45 4b f0 07 14 2d 48 63 36 08 85 34 98 18 69 18 fa 8d 1f f8 8d 18 89 a0 58 14 0d 08 15 a5 58 86 1c 48 1a 01 ff 86 04 dc c3 3f b0 00 52 50 df 8d 9c 66 52 8c c3 8e 1c 05 20 b9 ce 8c f5 88 92 10 52 fe 05 59 93 88 01 2b e0 c1 1f 24 d9 b7 dc 0c 02 e2 8d 99 48 0a 04 b8 c0 3e 58 4a 9b 40 a0 26 59 ca 95 4d Data Ascii: FsAj9tip4A DC=C@<Gq?AVDBW{9)af,f74yt9y(Z;x[C7F8Oi #8}PX}PX%aa}EK-Hc64iXXH?RPfR RY+$H>XJ@&YM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49804	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	600	OUT	GET /i/2024/11/09/150-150.gif HTTP/1.1 Host: hongniu.getehu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	586	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 31752 Connection: close Accept-Ranges: bytes Age: 0 Cache-Control: max-age=2592000 Etag: "672e772f-7c08" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Fri, 08 Nov 2024 20:40:15 GMT Vary: Accept-Encoding Via: cache08.oversea-GM-FRA3,cache02.oversea-GM-FRA2 X-Bdcdn-Cache-Status: TCP_MISS,TCP_MISS X-Request-Id: 9164243c2591b1b831b9c81fef052cb4 X-Request-Ip: 8.46.123.189 X-Response-Cache: miss X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT
2025-01-02 05:12:35 UTC	15798	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 e9 93 02 da a9 00 97 68 11 ff 58 4b ff ca 15 ff fc 77 c4 4f 09 ff fb 57 df a7 96 15 0e 03 f2 a1 00 f6 97 00 9e 24 07 db cb 1a ff cb 00 db 70 00 d5 61 01 b1 6a 56 ff ea 4b ff af 00 ee 04 08 fd ff fc ef db a8 a2 a7 98 b5 c9 a8 00 54 10 ff 0f 12 75 2b 01 d9 cc 8b 76 eb 53 fb e7 00 9b 52 0c da cf aa 5a 23 03 fe fa d6 ff 8e 2d 6c 6b 50 ff f9 48 79 43 06 ff fe e9 f4 d7 8c 51 0b 00 f4 aa 08 00 d6 00 ff dc 4b ff ca 00 9c 40 01 ff 6b 26 be a8 09 be 96 0c 54 ad 34 34 9d 1a ff 35 1f f0 d8 0d b9 3f 00 38 de 20 e5 3a 25 fc ec c6 7b 4f 15 d3 96 10 dd 00 00 f3 b3 00 d5 b8 6e ff c9 36 b0 88 14 b0 ae 6b df b9 0d dc 90 3f ff eb 5f c9 5f 00 c1 87 12 ff eb 00 cf b7 14 b6 91 3f f6 c8 32 f9 92 00 ab 75 09 f5 dc cc d9 d4 d0 00 ae 00 fe fd Data Ascii: GIF89ahXKwOW$pajVKTu+vSRZ#-lkPHyCQK@k&T445?8 :%{On6k?__?2u
2025-01-02 05:12:35 UTC	15954	IN	Data Raw: ca 88 4b bc 81 0d d8 80 0f 98 cc c7 9c 1c 0b cc 41 06 54 01 5c f5 01 ce 51 a5 ea 59 41 99 cd 41 13 94 82 ea 44 52 15 34 62 1f 80 c0 51 f6 41 1e 68 03 71 16 83 33 28 00 31 7c 03 38 ac 60 1d 40 e4 2e f0 80 0d ec 42 5c 22 00 e1 69 64 04 c8 93 1a b4 22 0e 80 80 1b e8 42 1a ec 42 76 4e 99 77 3e d3 5b ca c1 42 ee 02 75 b6 02 5e d2 83 1a b8 82 1a d4 25 03 44 40 3e 20 40 7c 82 c0 29 d6 01 0a 9e 83 1d 64 02 2c 4c 80 28 1c 00 3c a0 20 2c 6c 01 29 74 43 1b 4a 00 36 8a a6 c7 10 c1 3d f8 da e6 2c e8 36 86 43 21 d1 26 1b e4 1e 6d 76 20 5e cd 41 0e 68 9b cc 34 07 23 cc c1 1f 56 e5 35 2c c3 30 68 83 0a 10 c3 32 38 03 31 24 5d 87 94 41 1a 20 80 01 f8 65 04 bc a8 2b 18 88 42 f2 00 8c 22 40 1a 38 81 0d c8 a2 0d d4 c2 5f ba 41 74 32 00 3d c0 68 2d a8 81 1e 68 24 7d 5a ff d9 Data Ascii: KAT\QYAADR4bQAhq3(1\|8`@.B\"id"BBvNw>[Bu^%D@> @\|)d,L(< ,l)tCJ6=,6C!&mv ^Ah4#V5,0h281$]A e+B"@8_At2=h-h$}Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49774	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	602	OUT	GET /i/2024/12/05/1300-200.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	615	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 199338 Connection: close Accept-Ranges: bytes Age: 0 Cache-Control: max-age=43200 Etag: "67516cd6-30aaa" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Thu, 05 Dec 2024 09:05:26 GMT Vary: Accept-Encoding Via: cache17.yzmp,cache03.hnlycm01 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: c103e72a7d7c15d1d4486ba6cbdf345d X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:35 UTC	15769	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 6a 1a db 6d 53 97 f8 00 f7 ff ff b3 ff fe 4c ff fe 6e 65 56 64 91 0f 12 a4 50 09 b1 8e 69 4f 02 af 1a 9f fb 55 1f 0f 95 65 a7 15 08 07 fe b3 03 ff d3 03 75 44 cd d2 b3 af 46 12 71 03 6a fa 69 2c b8 f5 65 65 dd cc fb b2 00 d4 b6 94 91 fd 93 02 ff 00 07 97 69 dc 33 00 89 f3 dc d0 a9 d4 ec b7 88 ee cf ac 97 6e 04 b3 f6 d4 b3 fd d6 28 90 00 b6 b1 af b3 01 d9 44 b8 b3 d3 ce b7 d5 f9 d4 4b aa 77 ef d4 66 df f6 b2 70 50 25 93 fb 72 08 f4 b3 2c 02 b2 40 f8 d5 92 5e ac f8 8b 70 71 69 41 2e 22 00 52 a7 dc b3 6a 00 98 c6 98 f0 ce 6d 07 dc cf b4 ad 94 d6 f8 d4 6e 08 57 ac db ef f5 ff 66 24 fb b2 ad ae 00 af 10 d9 fd aa 93 32 91 8c 8d ce 97 93 03 90 36 9c 66 ef 55 24 ab 88 53 f2 8a 6a 4b f9 b4 8d b5 ad 8f b0 71 d7 f5 b1 f4 d3 b1 Data Ascii: GIF89ajmSLneVdPiOUeuDFqji,eei3n(DKwfpP%r,@^pqiA."RjmnWf$26fU$SjKq
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 01 82 a7 f9 5f 09 84 0a 1b 31 ff 98 e7 2d e0 44 80 1a 3e 44 85 ca 88 80 0a 56 e6 05 9a 03 a3 2d e0 07 5a 20 36 ed 00 16 62 41 43 dd 66 09 70 0d 6e 62 1a 16 54 e0 00 8c 40 0b 06 27 0d d2 e0 07 b6 66 50 f8 e0 50 8c 5a 55 30 61 60 ac 43 09 e0 83 6f ee a0 6d b2 8d 49 bd 85 55 10 21 51 50 20 12 5a a0 05 2e c2 22 58 e0 05 4a 40 a2 8d 00 12 8a 27 16 10 42 6b ee 40 54 54 80 08 b0 e7 97 cd 14 1f 18 1b f1 0c db 7e d8 a1 7d a2 c5 30 8a e2 7d de a7 5a 04 c6 e7 08 86 e4 44 86 f1 08 a2 80 1a 0f de cc 94 c2 a8 82 82 aa 9b f1 b0 9b c4 a5 c5 6c a8 ce 04 a0 45 27 ea c5 59 79 c1 30 58 a3 6d b8 8e 85 26 4f c4 d5 8d f7 2c 4f 73 f0 21 c1 ad 85 25 ae a2 bb 5d 46 f5 84 07 c8 d5 55 bb 21 43 2b 32 8f f3 34 87 6d 4c cc 2a 8e e2 27 0a 88 c5 7d 87 5a b9 68 55 c1 68 58 b8 a2 77 6c 56 Data Ascii: _1-D>DV-Z 6bACfpnbT@'fPPZU0a`ComIU!QP Z."XJ@'Bk@TT~}0}ZDlE'Yy0Xm&O,Os!%]FU!C+24mL*'}ZhUhXwlV
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: a7 41 0b 4a 81 0a c5 28 06 2b ff 1c c4 03 64 08 f5 84 32 4b 64 cf 5a 70 4f 69 20 ac 47 84 b2 62 48 cf fa 74 4f 62 50 0c f3 1c 0d 90 e0 40 21 e4 4e 8b 30 c1 11 24 ac 10 1a 86 fc b8 41 02 5d 08 ef c4 01 6d 92 b0 45 80 ce 07 bc 1f 7c e8 86 6e f0 80 0b c5 50 0d cd d0 0b ed d0 09 6d 87 0d f5 50 0e 25 d1 0e 45 50 f0 f8 0a 22 72 94 59 b8 8e 6e d8 4f 2b 1c 80 09 8d 83 f4 90 0e 65 53 0e 1b 50 0c 2c 80 ce 32 4c cf fd 8c 51 c2 ea 81 2d 9c a2 2f 4c 0d 25 b3 01 26 7b 4e bd 92 4f f7 ec 51 04 d4 2b 2c c0 33 61 a3 10 1c ad 0a 1d d5 cf 1e 75 cf 1f d5 ab 20 b5 0f 6a ac c6 2f 75 91 50 10 86 67 a8 05 2d 48 04 79 50 81 39 30 45 54 4a 04 27 61 92 27 e9 02 56 94 d3 57 fc 82 55 88 12 04 20 82 3d d8 02 79 20 01 02 e0 06 7d d8 45 2d 98 04 0a 68 a5 1f 30 84 0f 38 54 43 68 25 64 40 Data Ascii: AJ(+d2KdZpOi GbHtObP@!N0$A]mE\|nPmP%EP"rYnO+eSP,2LQ-/L%&{NOQ+,3au j/uPg-HyP90ETJ'a'VWU =y }E-h08TCh%d@
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 04 c4 50 04 ab d0 12 ed 30 6d ff 00 35 02 d6 66 01 66 50 a3 2d 00 05 50 10 02 be d0 89 9e 68 02 4c 40 06 6b a0 89 4c 60 05 3d d3 05 56 b0 8a 4a b3 a4 84 61 11 48 62 11 de e0 0f be 20 13 1c f3 37 3f f0 09 69 30 0c 64 03 12 20 d1 0c 1c 61 02 c7 a8 8c c3 88 02 2c 81 36 c2 d0 0c 03 61 02 6f 03 71 7f c0 12 37 55 04 cb a6 71 67 83 36 29 30 36 0d e0 02 27 17 8e 2b a7 72 4a f5 8d e3 78 38 27 27 72 27 e2 54 e6 98 8e a8 13 74 2e b1 8e e6 98 55 5b 45 03 9d 63 16 9e 73 16 9c 93 01 f0 48 03 64 b5 04 54 75 8e eb 98 56 2e f1 36 69 10 0a 2e d0 56 01 c9 80 c8 d1 47 68 04 29 b3 d3 0f 0b 59 19 0a 80 75 54 87 19 94 a1 3b b1 2a 59 b3 c0 96 39 79 ab b8 5a 00 04 a0 ab 39 79 1f a6 11 58 d7 90 00 dc 70 ab 04 30 0e 82 07 19 15 a0 5a b5 1a 07 bc 9a 93 61 00 59 87 41 03 3d 90 93 c5 Data Ascii: P0m5ffP-PhL@kL`=VJaHb 7?i0d a,6aoq7Uqg6)06'+rJx8''r'Tt.U[EcsHdTuV.6i.VGh)YuT;*Y9yZ9yXp0ZaYA=
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 04 1b 4a c1 07 12 c4 0a 5c 80 ff 47 0a 01 93 a0 c4 92 fa b3 3f 29 51 0a a0 00 0a 5c 00 48 8a 2d 15 31 31 4c d4 f2 91 40 51 4b ba c4 4d 4e 89 4c c4 52 97 6a e9 95 b0 21 da 76 20 50 12 a3 50 fe e8 da 8c a9 50 b6 ed 87 28 c5 db 28 65 9a 28 05 54 3a 05 18 57 55 54 7e e5 18 17 41 55 68 45 1b 8e a3 57 60 85 10 24 a0 19 25 80 1a e9 6d de 6c 05 df 7c c5 57 9a c0 08 8a 60 df ae 21 f0 3c e2 16 fc 0a e0 96 f5 73 e0 e4 59 72 66 9f 9e 85 17 6c 26 5a 0f ae 59 1a ae 61 b0 25 5b a3 01 24 38 c6 00 7e 45 0d 9a 00 0a 38 b2 5d f2 d1 e3 bc 65 a0 c6 c7 00 b2 94 52 b2 b4 10 44 c6 e8 7e aa 5f 26 72 a0 64 21 32 d7 d5 27 e3 71 5c bf ce af 66 a1 64 4e 2e 5e d0 8a e2 68 40 5c 7d 12 58 3a 72 24 4a 26 5e a9 65 17 04 86 5d 29 25 ea 8c 2a a9 8a ae ea e0 4a 27 6e 01 dc 7e 45 5f 9b 80 23 Data Ascii: J\G?)Q\H-11L@QKMNLRj!v PPP((e(T:WUT~AUhEW`$%ml\|W`!<sYrfl&ZYa%[$8~E8]eRD~_&rd!2'q\fdN.^h@\}X:r$J&^e])%*J'n~E_#
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: e4 4e af 66 c2 33 20 43 26 f4 ff dc 7a b0 a4 7d 5c c3 2b 40 01 02 74 50 8b 30 c0 25 b4 90 24 c8 48 20 38 9e 8a 30 eb 4e fa e4 b5 62 6b 0b 48 43 41 6c 0f d8 b5 9d 66 f9 c7 35 64 c2 13 85 01 11 1c 03 18 1d 41 54 6e 81 06 50 01 02 b8 c9 bb 9e 09 15 04 d2 16 9c 81 1d 84 91 1d 68 c1 13 d9 01 f1 15 18 f0 05 5f ef ad a5 81 09 1f 5c ba a5 1c 65 41 9f 60 4a 08 f0 11 1a c8 c0 08 98 c3 08 d8 a5 14 a0 81 16 d0 43 0f 68 41 3d ec 41 1b f8 41 0d 2c 01 a5 15 01 fc 44 4b 2b 8c c1 0f cc 4a 63 a2 40 ba 4d 82 64 6e 52 11 5c d0 25 04 82 1e d8 5f 1e f8 40 b3 70 66 8e 39 8b b1 f8 00 8f 8d 18 25 50 02 0d 08 20 92 39 84 43 00 59 a3 b9 66 00 58 60 02 62 07 10 e5 e6 b3 35 a3 a6 82 ab 6c 4a 89 34 65 42 5b 15 e7 3b 14 84 0e 7a 03 c5 9c 46 36 78 c0 2b 79 00 3a 10 8c 36 68 cc 6e ac 53 Data Ascii: Nf3 C&z}\+@tP0%$H 80NbkHCAlf5dATnPh_\eA`JChA=AA,DK+Jc@MdnR\%_@pf9%P 9CYfX`b5lJ4eB[;zF6x+y:6hnS
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7a d5 cc 79 cd cb 80 c5 57 ce ff c4 85 c3 b4 4b ce d4 57 7a e5 cc 83 8d d8 bc 24 58 89 45 58 87 4d 58 84 2d 87 b4 ac d8 7a d5 d7 8d f5 58 7c 1d d9 8b cd 58 ce 24 d8 84 bd 58 86 1d 59 96 c5 57 4a c4 10 8c 7a 59 99 dd 9b 6b b8 80 46 b1 d9 60 c0 59 9d bd 59 9e cd d9 9e 35 06 6a 28 c3 04 f4 b2 39 9a 91 00 d8 59 9f 3d 92 d6 64 4d 57 43 5a a7 ed 59 9c 0d 80 f3 fc 24 9f f5 d9 0b 10 07 7a 32 42 10 44 da 0b f4 10 00 4c 92 a6 ed d9 ae 35 42 3a 7a da aa 35 5b b4 85 5a b5 3d 5b 9e 3d b4 d5 2c 41 9b bd 5a 38 8a 32 9d 2d a5 a5 5a aa 23 54 94 9d 05 24 65 5a 26 b6 7d a3 89 e2 90 23 c4 cd b4 65 5b c3 2d 5c b4 85 b4 5a fa 90 bb 3d c2 7e e0 b5 a8 cd 11 2b 44 dc b5 a5 dc 60 28 83 e4 ec 07 1b 40 81 9d bd 00 5f b3 07 e4 c8 93 c3 ad dc b5 4d 83 64 2a 50 6a d0 59 67 7a c1 c5 5d Data Ascii: zyWKWz$XEXMX-zX\|X$XYWJzYkF`YY5j(9Y=dMWCZY$z2BDL5B:z5[Z=[=,AZ82-Z#T$eZ&}#e[-\Z=~+D`(@_Md*PjYgz]
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 07 9d d0 0e 7b e0 06 c4 55 09 ff a6 80 3a a3 e9 0f 41 30 11 0c 91 b5 0d 11 3a 11 b1 b5 0c 11 3a 06 61 b5 1c 0b 58 1e 80 99 11 81 0c 2d 9b 12 fd 68 ab ce d7 9a 2f cb 9a 15 30 08 ac 09 00 5c 00 14 33 d6 7d 5b a0 7e db 37 5e 0c a0 03 cf d3 7f 17 84 7e cf a3 b7 56 d1 62 30 80 3d da 23 16 b5 10 9f 1a 50 00 fa 47 0f 61 90 42 b5 c0 9d de 59 3c 47 f1 16 ee 93 82 68 80 06 51 a0 b7 03 8a 41 e7 67 a0 3a 90 42 f9 05 9f a9 91 5f 92 51 00 3d 60 3b ad bb 81 89 f1 0b d8 19 bb c4 50 00 0f e0 17 77 b0 9e 28 56 82 2e 06 14 9c fb 82 f2 a3 05 69 a1 82 07 36 3f 05 40 0e c4 a0 0d 5c c0 05 46 60 a1 6f 00 64 5c 90 43 d9 60 1c c7 b1 03 3d 16 84 52 16 a2 d2 91 bd 4b 88 65 5c 70 09 72 50 43 07 c0 b9 2e a6 03 35 70 85 53 58 85 61 f6 1d e4 41 1e 65 76 a3 5b c8 1e 36 83 45 3a 71 86 92 Data Ascii: {U:A0::aX-h/0\3}[~7^~Vb0=#PGaBY<GhQAg:B_Q=`;Pw(V.i6?@\F`od\C`=RKe\prPC.5pSXaAev[6E:q
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 13 d8 60 80 1e 96 80 01 9a c0 ff 01 f4 80 70 7c 6a 2e 48 53 0f 2e c1 39 a3 60 3c 15 ed 42 21 f4 41 c1 c6 0d 31 54 2f 5a 40 0d 32 e6 61 d0 30 75 46 14 10 15 f3 5b 4c f4 31 1b 33 fc 78 37 78 7c 47 36 60 74 46 a3 0f 12 a5 a3 2f 97 87 c7 32 d1 12 f1 ca 13 3b f1 91 dc 12 58 28 e9 e4 a4 b7 f8 56 8e 54 80 ef e4 d2 52 15 4d ae 3f a0 b4 3f d0 c8 3c be 17 7c 27 25 7c 23 85 4a 29 cc 50 d0 97 4f 02 a5 c2 a2 f2 89 16 ac c1 a6 a8 44 4a c4 4e e6 37 c0 fa 6b 44 ee 37 7f 89 e4 45 7a c4 4a e8 cb 19 7f b2 4e e9 54 1b b9 51 1a d1 ee 4e f1 f4 ed c8 11 50 bf 71 1f 1b f8 81 eb 11 51 0d 35 53 3b 55 53 29 78 53 31 38 83 33 f8 82 5f 55 83 ab 41 83 37 f5 83 2f c0 18 34 95 84 2f e0 83 45 18 85 ab 61 85 ab c1 18 56 d8 18 5c 38 86 4f 78 86 5d 78 84 5b 38 86 65 18 85 35 55 87 45 78 86 Data Ascii: `p\|j.HS.9`<B!A1T/Z@2a0uF[L13x7x\|G6`tF/2;X(VTRM??<\|'%\|#J)PODJN7kD7EzJNTQNPqQ5S;US)xS183_UA7/4/EaV\8Ox]x[8e5UEx
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 41 86 9c cd 85 15 dc 82 d9 01 8b d9 d9 2c 90 cc c4 33 71 d6 1f 98 4b be 98 00 5b 5a 8b 18 64 74 71 00 5f 0a 4d 16 43 33 74 82 4c 56 e1 3d e9 32 61 c3 75 94 01 0a 54 83 4c 3c f1 a4 9d 03 7a 23 c3 31 9d 86 15 3c 03 69 60 e9 3f 78 c3 79 18 c0 0f d8 4b bf 78 c3 db d0 85 9e f6 b9 b0 23 62 84 e4 ad 44 e7 c5 2c 58 cc c7 38 c8 25 be 90 40 0d 2e 41 c1 c8 37 18 39 b5 5f 80 91 37 c0 64 88 08 e1 ea 1e c6 70 fb 63 58 3b b8 57 fb d6 48 0c a3 8a 14 e5 92 0c 7d 71 86 55 57 44 6c 56 bb 91 77 b5 5a 6b ff ab bb 27 6a 56 7f c4 bc 1b f9 ea c2 48 3f f0 c0 bd 07 40 8a 03 a1 90 04 c9 90 dc 3b f0 5a 2f ee 86 3b b8 b3 43 28 f8 0a 18 c5 f2 bc a7 60 87 0d 3c c2 1b 79 5e e3 d9 f2 cc 82 69 df 3b f2 06 79 62 78 64 2e 10 3c c8 4f 3c 44 1a 82 f4 12 a0 ad 8c eb 2d cb 68 62 3f 39 3e fe b6 Data Ascii: A,3qK[Zdtq_MC3tLV=2auTL<z#1<i`?xyKx#bD,X8%@.A79_7dpcX;WH}qUWDlVwZk'jVH?@;Z/;C(`<y^i;ybxd.<O<D-hb?9>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49775	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	601	OUT	GET /i/2024/10/28/10ss8i9.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	594	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 86874 Connection: close Accept-Ranges: bytes Age: 12968 Cache-Control: max-age=43200 Etag: "671f9ec8-1535a" Expires: Sat, 01 Feb 2025 01:36:27 GMT Last-Modified: Mon, 28 Oct 2024 14:25:12 GMT Vary: Accept-Encoding X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: cb2aad37fcc22d09cf7c79ff99e1b256 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT via: cache06.hnlycm01 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:35 UTC	15790	IN	Data Raw: 47 49 46 38 39 61 18 01 18 01 f7 00 00 00 00 00 ff ff ff f4 91 94 d8 a8 aa c3 a8 a9 48 38 39 8c 30 3a 9a 3a 43 b6 87 8d e8 0e 2f 88 15 2a ed 74 89 e8 20 48 38 08 11 a9 29 41 78 28 38 df 58 73 f2 98 a9 f8 a8 b8 4e 08 17 71 14 28 9a 15 37 e8 a8 b8 53 18 28 ef 3c 71 f8 c8 d8 ca 97 ae 28 08 18 f8 08 9d d8 a8 cb f7 0b c8 d8 58 d2 18 08 18 f8 e8 f8 2c 18 2d 39 28 3a 9c 33 a9 b8 68 c6 b9 79 c8 ae 58 c8 d8 b8 e2 a1 54 bb bb 68 d9 c4 a8 cf e1 c8 eb 8a 45 a7 a8 68 c8 ba 78 d8 cb 9e e0 bd 7f e4 e8 d8 f2 a8 68 d8 a7 78 c8 89 50 b9 a8 78 da 53 4c 5a a4 8a db 7c 6e bf 08 08 4a 08 08 18 28 28 38 c8 c8 e2 e8 e8 f8 38 4a 97 87 96 cd 08 1d 64 17 35 85 5a 6f a9 b8 c0 d7 a6 b4 d6 cd d8 eb 8c b4 e8 b6 cf e8 69 af e4 0d 5f 98 14 82 b4 8a cc e7 17 a1 d0 b8 e8 f8 4c c8 ed 98 e8 Data Ascii: GIF89aH890::C/*t H8)Ax(8XsNq(7S(<q(X,-9(:3hyXThEhxhxPxSLZ\|nJ((88Jd5Zoi_L
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 2c 32 24 4f 42 25 70 b2 28 8c 42 24 83 b2 28 00 c0 24 90 b2 28 40 42 29 a0 c0 fb c5 9f f7 18 9c 0d 0f d8 a0 b1 e4 81 85 62 28 f6 ae f7 d4 70 0d 63 cf a8 f2 f2 8e ea 68 4b da 32 30 1f f1 11 0b c3 56 31 b1 75 35 b1 a7 12 ac 55 f1 83 24 ac c3 3e 24 91 3f 88 c3 32 f0 67 18 c7 d7 d6 de 1f 9a 6d ed 16 87 2d dc c6 17 5b 11 43 35 50 03 50 01 95 83 0a a4 79 cd c2 1d 32 ad 1c e7 31 64 1e 02 1a f4 c3 de f6 ff 43 69 fa 03 3a 14 c0 f7 ca 82 b2 a9 21 3c 09 1c 8c fa 59 f6 f8 00 24 0c 34 41 17 b4 41 1f 34 42 27 b4 42 2f 34 43 37 74 41 97 82 fb b9 1f 3c 18 5a 02 a7 6a 03 56 a2 03 f6 b2 e1 d9 68 0d c7 b2 25 f2 32 0e df e8 4a 02 67 28 96 2a 3d e0 82 3d a4 c3 5e 15 00 d4 c6 02 12 f5 2d c1 b6 26 c1 de 97 38 14 51 3f 68 81 3f 30 83 dd 11 24 66 aa af 20 ba 6d d8 a2 6f d8 1e 83 Data Ascii: ,2$OB%p(B$($(@B)b(pchK20V1u5U$>$?2gm-[C5PPy21dCi:!<Y$4AA4B'B/4C7tA<ZjVh%2Jg(*==^-&8Q?h?0$f mo
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 63 6a e1 2a 9d e4 b8 25 64 7f 85 64 19 96 58 54 cd 64 7d a8 07 4f 40 a9 a7 82 1e f0 75 e0 75 18 c4 c0 9d d0 09 ad 0c ad b4 a1 1d 11 07 19 5b e5 86 8b be e2 74 dc 28 c6 d3 45 ac 5f 5a 36 3f 5c fe 97 67 f5 17 a7 d0 e2 c6 7b b5 00 89 1d 43 90 29 0a 75 d0 18 0d 30 d8 b5 4d 06 72 1d 07 82 2d 05 6a 86 72 90 31 57 58 cc 4a b6 e1 e0 a5 cc 71 c4 2d 6d 96 db 00 35 64 71 26 d8 44 ae b5 d3 d8 1d e5 6d e4 97 ff 7e e4 73 4e 4f 9f 56 69 18 ce 07 4f c0 2d 7d 70 05 c0 31 d3 74 50 d3 d6 0d e2 11 08 5c 06 12 41 08 15 41 48 cd ce 58 e8 05 61 78 06 27 de d9 c7 e1 6a 6b 95 e2 e3 4c 51 2a ab 06 ce 68 06 5e 2e 14 c7 ab 68 67 60 06 f3 1b 06 82 42 07 c3 e4 ca 02 e0 68 db ac 50 c5 11 65 1a ca 8c b2 d6 e2 3b ae 48 6b 30 06 55 d8 29 da 20 61 45 56 c6 b9 2d 6c 24 f5 60 36 0c 53 0d 6c Data Ascii: cj%ddXTd}O@uu[t(E_Z6?\g{C)u0Mr-jr1WXJq-m5dq&Dm~sNOViO-}p1tP\AAHXax'jkLQh^.hg`BhPe;Hk0U) aEV-l$`6Sl
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: e9 32 9e e8 88 5e e8 32 6e 03 55 00 08 80 90 eb bb 1e 08 55 a0 06 80 20 05 ba 2d 08 83 20 08 c4 7e ec 6e 70 0f 09 90 00 18 40 0f 80 6d 05 82 e0 06 a1 10 01 02 10 01 d6 1e 01 18 b0 ec 0c a0 ed d7 de ed db 9e 00 df 8e 01 dd 4e ed ce ee e6 6f 70 0f 16 b0 ec ea be ee ec de ee ee fe ee ec 5e 0f 6e c0 06 6d 40 ef 7e 40 ef 6c 90 ef f7 ce 06 fb ce ef f9 ee ef fd fe ef ff 1e f0 fa ce ef 7e 70 f0 08 ef 07 6a e0 07 80 00 ec 6a e0 f0 ba 1e f1 12 0f 08 81 40 f1 bd 1e 08 81 20 05 19 af f1 18 5f f1 13 ff f1 1f 0f ec 6d 00 08 23 0f ec 82 20 f2 0d 3f f2 0d 1f f1 c0 0e f2 20 5f f1 1e df f1 32 ff 2f 05 bf fe f0 73 30 07 b9 5e 05 38 5f 05 3c df f3 3b 5f 05 1e ef f2 24 ff 06 6c 60 05 c9 2e 00 cb 0e 01 6e b0 f4 4c df f4 4e ff f4 50 0f f5 f7 60 05 ba de 06 6e d0 0e da ce 00 db Data Ascii: 2^2nUU - ~np@mNop^nm@~@l~pjj@ _m# ? _2/s0^8_<;_$l`.nLNP`n
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7d db f1 c1 0d da 40 0d fc dd 0f 0c dd d0 13 dd 0f 12 9d 0d 0a fe e0 0d 5e e1 15 be e0 1b be 0d fc 00 e2 23 1e e2 db 00 10 d4 40 0d aa 1d e3 33 5e e3 a5 1b c9 a7 9b ba a5 40 0a a0 3d e4 a9 3b e3 05 a1 da 4d fe e4 53 3e bf 4d de e4 29 7e a1 ad 7d a1 d5 e0 e5 5d 1e e3 51 de da 37 3e ba 09 9a ba 75 9e ba 3f 3e 10 2a de e2 91 5d d9 85 5e e8 97 5d d9 e7 60 d9 9b 7d e3 33 de 0a ee 01 14 16 80 de cf 7d 01 dc 80 ea cd fc db dd 00 ea e9 3d ea a9 fe ea a9 1e 03 b4 9e de a7 9e eb cd fc 1e ac 80 e2 d9 c0 0d da 21 ea cf 1d 1e b8 de ed df 1e ee e3 de 0d 04 40 dd f7 dd 0d 2e be e2 fd 40 0d ff f4 be e1 d3 c0 0f d2 80 0d fc 1e f0 05 3f f0 0b 3f 0d 0e ff f0 0d 1f f1 05 ff ef 1b 5f e2 f9 de e2 f5 fe e2 2d 1e ef 97 be da 7f 1e c9 45 5e f3 49 7e e9 2b 1f e3 27 1f e8 2b be da Data Ascii: }@^#@3^@=;MS>M)~}]Q7>u?>*]^]`}3}=!@.@??_-E^I~+'+
2025-01-02 05:12:36 UTC	5548	IN	Data Raw: a8 40 0c dc fb cc e7 fb b4 9b 7b b4 db 7b 9c f7 7c c0 f3 fc b5 cb b9 bd cf 39 9f af 80 81 cd 84 00 7d 65 fd 0c d1 21 bd 04 2b 22 bb c8 83 7d c8 07 bb e4 c1 44 55 ac 02 e9 91 5e d8 87 bc 23 79 0c b1 38 e6 44 37 26 5d 98 3b bb af 3b b9 1b 7d 09 0c 3a be e7 b9 b5 9f 00 a1 6f bb b7 87 fb cf e3 f9 0c 90 3b cf 1b 3e c0 c3 3b e2 f3 b9 b6 0f 7a cc c7 7c b7 f7 f9 0b f4 f9 b4 d7 b9 bb eb 3c b4 e3 79 bc 8b 7b e5 13 7c 9d d3 3b e6 9b 80 12 57 9b 5c e8 72 71 39 e6 2b b9 4d d9 e3 c2 b8 7c bd da bb be ef 6c 82 d0 12 0c e9 cd 43 44 ba 3e 9a 1f 08 da ef 6d 63 ea 72 63 82 4c 22 7c 02 e2 8f 7b ff 09 c0 80 0c 18 ff f1 b3 00 0b 18 7f f2 2b ff f1 cb 00 0a e4 bd 9f a7 c0 0b 04 40 f5 e3 fd 09 90 00 0b 54 3f 0a 90 40 df 6f 7b e0 a7 80 09 54 7f 00 bc 00 e1 bb c0 cd 13 7e fa c7 b9 Data Ascii: @{{\|9}e!+"}DU^#y8D7&];;}:o;>;z\|<y{\|;W\rq9+M\|lCD>mcrcL"\|{+@T?@o{T~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49779	183.204.210.219	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	609	OUT	GET /i/2024/08/11/u98s7t.gif HTTP/1.1 Host: 69vvnstttaaa888.dzlndygh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	579	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 97404 Connection: close Accept-Ranges: bytes Age: 828269 Cache-Control: max-age=2592000 Etag: "66b8929f-17c7c" Expires: Wed, 22 Jan 2025 15:08:06 GMT Last-Modified: Sun, 11 Aug 2024 10:29:51 GMT Vary: Accept-Encoding Via: cache39.jhmp03,cache07.zzcm05 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 04fd5529d0987a43e4c25a9585004b54 X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT
2025-01-02 05:12:36 UTC	15805	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 3d 00 50 4f 46 21 21 20 de 29 29 cc 29 2d b2 24 25 2d 28 22 10 10 10 8d 09 11 29 29 29 76 75 67 d7 18 25 10 18 18 18 18 18 08 08 08 18 10 10 18 18 21 94 91 90 91 18 1a 3a 39 39 42 42 3c 1a 18 10 d6 21 29 35 34 31 d6 29 29 29 31 31 67 67 57 92 27 28 10 10 18 cb 1f 23 77 0a 0d c0 c6 c1 a8 15 18 de 21 29 c7 bd c4 ce ce d0 f7 f7 f7 ff ff ff ba b9 ba 9c a5 a4 9a 9c a0 aa aa aa 00 00 01 ef ef ef c7 c7 c9 b6 ad b5 e7 e7 e7 ce d6 d6 de de e1 d6 ce d5 ee f7 f7 d6 d6 d9 f7 f7 ff e7 e7 ef ad b5 b6 ab ad b5 bb bd c6 ef e7 ef 05 10 08 b6 15 1f cd 96 08 c4 78 2a d9 51 18 de 46 22 cc 34 22 ff eb 00 e7 5c 18 e8 74 17 ff f7 00 dd 35 21 cc 6f 0f ad 50 0f c6 3f 18 b4 8c 07 94 2f 0f 80 7f 81 94 4a 0a e2 51 23 5a 5a 5b ee 91 10 b3 70 09 fa d4 Data Ascii: GIF89a=POF!! )))-$%-(")))vug%!:99BB<!)541)))11ggW'(#w!)x*QF"4"\t5!oP?/JQ#ZZ[p
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 59 cc e1 11 dc a8 06 19 32 f0 11 d5 61 01 63 a4 38 df 1c 78 11 8b 12 02 e3 0b 25 7c 5d ec 56 58 8d 3a b4 50 12 2f 5c a1 2e 54 41 c2 fb e1 e2 7e ae c1 cf fe 72 c7 ae 4b 31 29 32 be 53 dc 5b ff 24 a6 80 a0 4c 2e 0f 61 1b 0d 03 41 66 26 8c 9c 70 0d 74 28 e1 2e 12 d0 07 69 b4 f0 16 08 78 5e fa da 01 88 81 58 30 85 27 4c a1 f7 c6 38 c3 6c 98 f1 8c 24 ac a1 0d ef d7 06 1b 5e 2f 30 3b 14 00 bc 26 33 c7 4c fc 0e 2c 14 13 22 11 39 65 90 01 09 91 71 66 3b e0 42 96 f8 b1 07 22 c0 0a bb e8 83 30 84 b1 0b fc a9 41 18 67 80 df 23 be 10 3d 60 10 c4 18 26 94 22 30 d2 e8 3d d2 a1 91 93 a0 cc 64 1b 1d 39 07 2b 20 2d 3a e7 99 a3 68 a0 34 9e 20 f6 6f 32 bc ba d8 d7 6c 04 28 67 f5 c2 40 47 04 01 07 20 52 c8 06 1a e0 24 6d 28 84 3a 86 69 3a 6b 9c e3 04 87 10 44 24 ea 67 46 82 Data Ascii: Y2ac8x%\|]VX:P/\.TA~rK1)2S[$L.aAf&pt(.ix^X0'L8l$^/0;&3L,"9eqf;B"0Ag#=`&"0=d9+ -:h4 o2l(g@G R$m(:i:kD$gF
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: d4 d2 8c 5c e4 de 96 a3 6b e0 33 40 37 8b 60 3a b7 58 a7 95 cc f4 04 f0 4c 1d 0f 1d 83 20 6b 1d 07 fa de c4 e5 94 45 01 09 cb 5b aa 63 e5 6b 4c 75 38 34 8a 4a ab 43 35 0a 61 68 b7 9a 63 9f 73 a0 c6 56 29 fd e4 39 6b 7a 86 9c 8e c3 81 bc b1 90 f4 92 7a 20 d5 10 48 21 ac 81 ea b5 21 51 69 ae 66 62 44 a1 07 3b 87 c9 ba 1a f2 3d 31 47 07 c2 0b 39 cf d9 d2 d8 84 25 28 3a 7d a0 56 8c 4f 69 8c 68 0a 4a 75 70 88 59 8f f9 c8 6d 78 22 23 19 57 2c a5 2c 52 99 c5 7c 2e 86 f3 f5 4e 7f 16 58 d7 72 3e 30 a6 05 fe eb 2c 9a 23 00 e3 16 b6 d1 c6 a1 d2 81 b0 f6 1d 84 93 b7 dc 8c 3d 8d d6 a0 13 99 4a c3 f6 21 bc ac 2e 01 db 11 7b 74 70 73 c0 77 ab 60 ec 7d dc e0 c7 ff 1a f7 9e 57 9b b4 00 4e 23 10 86 9e d7 c3 03 51 71 8a d7 dc de ea 0d 60 ce f7 25 b9 78 3e 57 12 a8 c8 76 2c Data Ascii: \k3@7`:XL kE[ckLu84JC5ahcsV)9kzz H!!QifbD;=1G9%(:}VOihJupYmx"#W,,R\|.NXr>0,#=J!.{tpsw`}WN#Qq`%x>Wv,
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: c6 8f 20 43 8a 74 a8 11 08 47 05 15 2a 8c 5c c9 b2 25 45 05 41 4c fa 98 a9 d2 a5 cd 9b 2d 05 08 61 42 24 e5 46 28 40 7b e2 1c 4a d4 62 4a a0 40 a7 28 35 e9 44 40 d1 a7 50 1b 12 f9 69 52 a6 cc a8 58 b3 16 44 99 54 29 93 9f 11 b5 8a 7d ca 35 a9 0f af 60 6b 8e 5d 9b f3 ac d5 29 6e bf 5e 65 4b 77 24 93 a4 40 9c c4 84 1b 74 23 4d b5 75 03 4f ac 30 25 2f cc bc 77 cd 5e e8 99 52 a8 e0 c7 0f a7 36 de e8 a4 70 d3 c9 42 14 78 85 cc 39 72 49 c3 8d 89 00 05 db b9 f4 42 a5 96 6b 0a 68 6c 59 88 5e 8f a6 63 43 44 7a f9 a8 d7 d4 85 83 c0 96 1d fb 6c e6 d0 4b 47 cf 4c cb bb 37 ca 82 89 4f c6 cc 9b 7b 77 71 d9 65 53 bf 6d fe 9c 77 62 b9 50 2a 73 ac 4c bc 7a e7 cf 3c a9 82 ff 1d 0d d7 b9 77 c1 47 75 8f cf 5e 18 74 e3 f3 9c 6b 3a 61 1a 9c 3b 70 dd f0 21 1f 45 4c 3f fb e2 d5 Data Ascii: CtG\%EAL-aB$F(@{JbJ@(5D@PiRXDT)}5`k])n^eKw$@t#MuO0%/w^R6pBx9rIBkhlY^cCDzlKGL7O{wqeSmwbPsLz<wGu^tk:a;p!EL?
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7b b7 15 50 10 7f 0b be 8c 31 bc c8 9b 05 06 61 bd c8 ab 02 65 f0 1f 0a 51 be 2d 00 0a a3 01 03 26 31 06 03 f1 b9 23 b0 bf a4 31 23 a9 23 07 9c a2 20 e7 e1 bc 0d 11 17 c4 0b 0b 1f 80 10 0c bc 13 0a d0 b8 26 a1 01 fc 2a bb db cb 24 5e 00 bd f9 4b b0 05 3c 23 23 40 13 0c 21 b6 05 e1 09 10 7c b0 35 f2 13 0d cb b9 30 cc b0 04 f0 ba 47 42 10 ba 51 c1 0c 61 2d 24 f0 07 33 9b 03 7f 30 b9 b2 e1 1a 09 91 b8 3f 61 1c 84 30 23 41 2b 23 4a cc bf 11 7b 1c ae 11 21 4b 41 08 9e 70 b9 4d 3c bd 3f 11 06 56 9c c5 22 9b 14 72 f0 c3 04 a1 c1 a1 b0 bf 23 c4 06 0d dc af 49 3c c3 15 82 08 90 ab c0 03 b1 11 da 2b 38 0e 3b 19 4a 81 1d 3f 41 c2 06 8c c2 f8 4b c4 22 5b 06 55 6b 23 03 8b 15 04 e0 10 6b a2 bf 12 7b bf 4a 9c 10 86 ff 90 c8 07 1b 14 32 3c c0 4b 1b 02 8b 3c c3 3b fc c7 Data Ascii: {P1aeQ-&1#1## &*$^K<##@!\|50GBQa-$30?a0#A+#J{!KApM<?V"r#I<+8;J?AK"[Uk#k{J2<K<;
2025-01-02 05:12:36 UTC	16063	IN	Data Raw: 94 02 fa 40 f7 75 41 38 85 44 67 31 ff f9 eb 8a 7e c1 9d 65 46 c4 18 e5 95 22 5c 68 2c 8a 20 e0 b7 b2 92 fa fe d2 67 b9 3c e2 49 11 7d e0 5c 2d 44 ad 96 fe 0a 32 5f 68 cf 57 1b 56 c8 ad 9a 9d 3d ed 68 8f 16 a2 ac 14 28 48 2d 10 ee 72 0f 54 d9 33 08 f7 e9 a1 7d 7d 0b 49 15 17 fb 47 36 a7 7b 69 64 fd 2b a0 a4 94 0e d2 c4 c7 fd 55 18 40 c8 1a ef de f7 ca cb 4c e7 61 73 bc da 73 d6 95 14 6a 3e 63 5a 45 55 de 34 af 88 07 24 aa 79 9f ef 18 d9 1f f9 ca d4 63 ae c2 84 73 7d c8 4c 8f f3 a0 a5 7e 4f 43 97 fd d6 e4 8a 36 ca a7 5e a0 67 05 43 eb 75 cf ca 9a 73 0c 5e 6b 7f e1 f0 29 f6 3c 3c 16 0f f9 95 e3 dc a2 d6 26 c2 b3 9a d1 67 eb b3 bb cf da f0 94 d8 0b 2d 50 5b c4 7e ff 7f 4b 6b fb 75 a5 51 50 cb df bd 1a 2f 87 fc 30 c1 6d f4 ed 5a 3d 4b c0 00 7f 62 69 11 58 be Data Ascii: @uA8Dg1~eF"\h, g<I}\-D2_hWV=h(H-rT3}}IG6{id+U@Lassj>cZEU4$ycs}L~OC6^gCus^k)<<&g-P[~KkuQP/0mZ=KbiX

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49777	113.219.144.65	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	593	OUT	GET /i/LD/SH131.gif HTTP/1.1 Host: tycjb777.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	531	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 1430876 Connection: close Accept-Ranges: bytes Age: 80923 Cache-Control: max-age=2592000 Etag: "6734946b-15d55c" Expires: Fri, 31 Jan 2025 06:43:52 GMT Last-Modified: Wed, 13 Nov 2024 11:58:35 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: e856d5459d39449e6b937b628995ddab X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT via: cache05.hunct
2025-01-02 05:12:35 UTC	15853	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 a3 52 1f fa 9f de 64 0a 11 49 96 d3 51 58 61 f7 d6 2b 5e b1 1c d7 f1 fc ab 8c 6a 98 11 19 fe 29 6d 2b 73 8f fe 6f b8 f0 ce b6 de 63 0b 67 ab d2 9b 62 a3 f9 db f9 92 cd fa 59 6d d4 ff f5 6e 32 b0 b8 db b9 ac fe fb 91 eb 10 1c 55 b2 ee ff fd b1 f4 72 e6 4f ce dc 4b 94 ba ff 4e ac 6e d0 ef 26 8b 94 48 6e b3 cf ac 96 07 f0 f9 d8 b1 24 f8 d6 4c 90 27 cf f8 d3 70 d6 91 4b fd f2 4d ff 33 94 32 49 5f 1c ff a3 32 91 b0 28 2e 55 5c 24 b4 d0 95 26 fa d6 8f 1b 69 fe dc cc b8 6d 94 f7 f1 b5 27 65 43 2a 31 51 8e f2 b2 4f 4d aa bb 25 aa dc fe 50 91 f0 b5 6a d7 d2 cb 6a 92 d8 fe ac c1 51 8d f1 be 93 f9 8b 45 3c 03 00 06 55 ff b8 bb b1 fc 8a ba da fd 8a c7 8a 68 4d 92 92 92 b6 6e 3b d3 45 44 b9 25 4a fe 69 8e 2f 28 2a b8 97 86 da af Data Ascii: GIF89aRdIQXa+^j)m+socgbYmn2UrOKNn&Hn$L'pKM32I_2(.U\$&im'eC1QOM%PjjQE<UhMn;ED%Ji/(
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: a5 0b e3 15 de 5b a6 e5 33 80 cd 70 a5 8b d9 74 9f 70 92 9f d8 10 ce fa 65 8b e0 60 cb f9 25 67 e1 d0 8d dd 9c 8d 77 81 97 a9 1c 4e e2 18 4e 0e 9c d8 1e a8 c1 79 45 8e 1a 30 44 1c f4 e6 e7 48 4c e1 c0 8a e2 d4 57 07 9c 58 14 2c c2 02 68 ca 7c 89 8a f9 84 98 0b dc c0 7b c1 0e eb 40 20 03 c6 8e 13 d2 67 89 d9 ce 7d 4d 98 ef 50 20 48 e8 c3 f0 5c 83 3f 08 c3 20 1c e8 87 89 59 f3 dc 40 6e e4 4e 0b 44 c1 0a 54 41 15 00 02 32 d0 40 e5 34 84 1a c8 a0 0c ee 41 15 0c c5 89 39 4e f5 f0 c6 0e 36 04 89 02 e1 10 36 44 07 00 c1 44 dc 4f 12 de c0 48 14 50 47 a4 45 15 86 c4 01 b5 c4 95 c9 e1 5b bc 63 99 74 46 43 40 40 2c 24 42 2c 74 02 93 41 00 09 35 84 23 e4 43 e4 fc 81 46 a8 ff 20 52 1c 05 20 fc 01 9c 3d c5 56 6c 45 4c a4 01 05 50 80 9e bd 90 96 fa 99 0b 05 da 05 cc 90 Data Ascii: [3ptpe`%gwNNyE0DHLWX,h\|{@ g}MP H\? Y@nNDTA2@4A9N66DDOHPGE[ctFC@@,$B,tA5#CF R =VlELP
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 24 44 84 ab 51 ae e5 6a 00 e6 e2 86 02 64 ae 06 20 2f 02 3c 9b 02 e5 9a bb 11 81 27 78 1b df 51 d0 1c 4c 1b 0b 80 d0 09 7d 82 0b 54 1a 52 20 9a c1 11 9c 04 19 02 02 a0 3d 65 09 41 82 61 9c fc 3a 51 10 08 18 e8 11 30 57 18 1c 27 70 c1 19 c4 41 0b d0 07 bc e9 81 d5 99 81 d8 c1 9b 6c 20 c2 6c 68 9d f1 8a 41 19 64 9d e8 0a c2 21 24 a2 19 30 03 f5 72 af e1 2a 2e e2 12 1e cd 41 00 04 50 31 32 a0 42 17 a3 c2 fc 02 93 2c f4 1e 2f 44 13 30 f4 1e 1c eb d2 f1 e1 1f 20 13 b2 fd 31 32 20 33 1f 33 e4 0f 24 73 53 3a a4 01 f6 a1 43 33 e5 0f fe 48 08 66 30 9f 01 7a 86 2b 0b c4 40 7c b2 3d 85 20 06 3a b3 02 32 33 20 30 c4 35 b3 a0 dc 88 36 66 7b 8a 77 30 21 0e 2a a1 13 7a b3 36 ff e3 21 22 3a 80 51 6c b3 7b c0 b3 69 d0 33 3e f3 33 a8 88 34 b1 00 45 43 23 a2 66 b8 33 13 52 Data Ascii: $DQjd /<'xQL}TR =eAa:Q0W'pAl lhAd!$0r.AP12B,/D0 12 33$sS:C3Hf0z+@\|= :23 056f{w0!z6!":Ql{i3>34EC#f3R
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 0a 80 30 36 74 e3 35 2e 00 01 7d 73 60 45 a8 84 10 36 a5 54 ca 84 4c 58 38 97 00 05 15 66 61 19 86 08 a0 a3 04 05 00 03 cb 63 62 3f b6 87 25 06 86 75 28 86 65 88 86 68 08 67 6e fa 06 13 e4 09 24 e0 09 60 e0 07 72 ea 09 50 40 02 30 00 03 6e fa 86 65 08 87 69 0a 86 82 8a 85 22 a6 85 a0 13 3c a3 30 0a 30 50 00 99 13 3b d2 b3 64 08 c0 09 d8 53 02 8c 28 18 1d 40 05 d2 f0 65 5d 90 07 5a 26 08 97 e8 65 ef b3 89 5a 36 66 f3 73 6c 03 e4 3f 59 b4 3f a7 9a 00 a7 3a 40 fc 53 40 6f c6 8a 30 20 06 b0 88 8b b0 58 03 6e 08 00 09 e0 00 05 b0 67 24 a0 8b 1e e4 41 77 50 68 c2 28 8c 6a 20 11 5b d0 68 13 21 11 c9 d8 8c 84 b0 11 33 e4 8c d1 a8 43 0a b1 12 28 01 44 7b a0 13 47 a4 8d ff 45 14 44 a3 06 44 6d 40 44 e3 88 37 2e 90 47 7c 81 70 4e 91 14 48 11 4b b6 d6 17 76 84 04 60 Data Ascii: 06t5.}s`E6TLX8facb?%u(ehgn$`rP@0nei"<00P;dS(@e]Z&eZ6fsl?Y?:@S@o0 Xng$AwPh(j [h!3C(D{GEDDm@D7.G\|pNHKv`
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 6b 89 10 c0 0d a6 e0 06 ca 2b c3 32 8c 0d 72 a2 7d 44 e1 0c ce 27 c4 e6 06 54 d7 70 c4 44 d4 13 18 41 0c a6 40 c5 52 2c 55 31 61 0b b6 00 0f 5c 55 c6 62 87 77 6c 6c 10 7b 07 78 76 2c c8 7a 0c 11 7d 8c 57 1d 31 7a 22 d1 78 a0 d1 05 6a a2 7d 76 42 13 19 c8 7d c4 47 c9 a6 cc 88 ce 00 09 3e 02 cb 66 60 15 55 91 5a bd 8c 7e 66 40 7e b0 71 24 5c a2 25 64 31 d2 3e ea d2 d2 4c c9 9c cc 7b ba 67 05 2a 08 18 d9 80 83 92 b1 cf 1a 42 84 10 82 19 29 62 02 06 e2 52 e0 80 00 42 00 72 06 4d 81 86 40 be 6c 08 1b 13 4d d1 16 8d 08 73 28 87 22 6d 26 ba 07 cd 20 c7 d2 c0 e7 81 32 21 6b 08 80 af 26 02 56 3e 2d 29 fa 0c 02 44 e0 31 e4 ed d6 b6 32 2a 43 e9 00 3e d6 1f 43 d6 1f 13 a1 ff 13 36 d6 64 b7 f2 64 eb 91 30 0e 41 15 9c e2 d6 b4 41 d6 1e 41 1f 44 16 64 3f 56 18 98 60 d6 Data Ascii: k+2r}D'TpDA@R,U1a\Ubwll{xv,z}W1z"xj}vB}G>f`UZ~f@~q$\%d1>L{gB)bRBrM@lMs("m& 2!k&V>-)D12C>C6dd0AAADd?V`
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 3c 86 16 24 9a 29 22 6a ae ea 04 12 68 d0 06 11 45 50 20 85 0f a0 90 53 30 c5 07 25 a3 a5 c5 81 ef 09 01 31 60 82 07 c4 42 7e 8d 82 00 a0 9a d4 f9 5e 15 fc 01 37 7e c1 1f 00 42 15 ec 01 09 4a 41 3e 38 06 3b c4 c1 37 de 9a 5c ac 10 b0 31 ac 5e 00 9b 14 d1 a3 1a d8 81 1d ec 41 85 4c 40 b2 31 1b 3e b2 c3 0c c8 01 2f 41 25 1a 1c 0f 0e f0 c0 09 b4 4e 67 30 02 0a 20 24 18 79 91 4f 36 a4 2f 9d c6 4a 52 92 76 b4 2c bb 89 db 3c 21 01 1a 80 c1 48 72 64 71 14 47 bd 29 92 21 f1 c0 25 30 07 0f 38 07 74 a0 40 17 4d 46 1e 55 d2 3c 79 07 3f d4 83 39 3c 41 6a 9c 87 c2 71 01 12 8c c2 28 90 47 15 00 80 1b 58 ad 6b 28 a5 2c 9d 81 0d 38 82 23 c4 c3 18 a4 4b 36 29 25 43 d6 c6 79 78 ff 2c ce c6 40 d2 b9 47 26 51 01 1b 24 25 88 28 53 f4 09 1d 58 3a 81 8a b8 40 8a 10 80 12 8c 88 Data Ascii: <$)"jhEP S0%1`B~^7~BJA>8;7\1^AL@1>/A%Ng0 $yO6/JRv,<!HrdqG)!%08t@MFU<y?9<Ajq(GXk(,8#K6)%Cyx,@G&Q$%(SX:@
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 4d a0 07 7a 78 00 7a d8 86 91 2d d9 1c d8 06 95 5d d9 4d 58 d9 6d 68 d9 95 cd 81 07 48 d9 db 80 8d 9a 4d d9 e2 90 48 54 da d9 0e d0 8d 9e ad c8 8c bc 48 a0 9d c8 81 83 25 a2 0d 25 89 34 85 7f ca 25 97 64 49 24 f8 25 ed 78 38 ef b0 49 51 20 26 ef a8 02 02 18 05 40 60 03 9d d4 49 38 88 02 38 20 03 ec 70 91 29 40 01 04 10 bb fe b0 28 a7 34 b9 13 e9 27 18 b9 84 aa ac ca 61 38 01 c3 84 82 9a f3 90 9b 0b 91 13 01 4b 26 40 01 25 49 11 1c 70 92 8d aa 03 00 90 11 81 f2 13 a5 d3 11 28 90 03 29 81 3a a9 43 91 11 b9 04 23 49 05 12 c1 01 49 d8 cb 8b 12 12 1e f0 ba af fb 91 6b 1a cc a5 2b cc 82 2a 91 04 41 84 3a a8 3b 48 21 00 49 91 bb bb b3 bb ca 44 5d 39 71 02 0f 89 01 28 ff c0 01 26 58 82 25 28 54 34 a0 00 30 58 84 24 98 95 13 00 14 28 28 aa 42 29 01 5a 39 01 bb 6b Data Ascii: Mzxz-]MXmhHMHTH%%4%dI$%x8IQ &@`I88 p)@(4'a8K&@%Ip():C#IIk+*A:;H!ID]9q(&X%(T40X$((B)Z9k
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 3f c2 c2 41 aa 20 04 69 d9 b6 c5 52 05 72 f0 03 08 e0 2a 55 c0 0f eb 00 05 aa 57 2a 60 00 76 fa 62 30 00 50 3f 4a 60 3c 53 50 54 3b 75 09 85 c9 04 49 a8 08 8b cb b8 8c 3b 10 84 89 06 14 aa 38 79 97 97 2d 41 01 0d b0 2f 88 e0 0f 88 80 04 75 80 04 e9 d0 03 0b c3 78 0d 93 9a bb b0 0b ca 70 00 d3 f0 00 d5 f0 01 be e0 9a 1c f3 09 07 20 02 29 53 36 44 76 9b 81 60 03 04 60 7a b8 99 32 00 80 06 27 70 02 1a 80 38 45 b9 06 c5 49 05 fa 60 58 82 b0 7b bd a7 06 23 c5 59 73 50 34 a0 c0 08 a0 e0 34 4c 73 9d 16 80 7d 87 40 bd a0 50 9e 5b 30 08 01 10 00 df 1b 00 5f 10 be e0 1b 04 d7 c0 0d ca 75 09 c3 e0 0f e9 f0 03 10 10 18 64 d0 87 4e 80 04 03 2a 5b e4 67 7e b8 45 05 5d 60 37 ff e4 30 06 3d 10 0f fa 40 00 ed b7 02 35 b0 53 8c a3 33 f6 17 a1 53 80 7a 6e 28 0a e0 07 7e a2 Data Ascii: ?A iRrUW`vb0P?J`<SPT;uI;8y-A/uxp )S6Dv``z2'p8EI`X{#YsP44Ls}@P[0_udN*[g~E]`70=@5S3Szn(~
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: f3 30 65 33 72 5b 13 b5 5e cf 60 02 c0 72 47 53 b2 ee 16 f0 20 d7 71 5f 93 ef 24 13 3c 13 f3 74 51 ef 78 ed f6 6d f7 36 6f f7 2e 38 eb 76 79 f1 36 7a 95 f7 6d d3 45 6d cc 25 3d f9 e1 3d fd c6 71 24 67 ba fe 6f 00 9b 2b 3f f5 93 72 f2 4f 7c b5 6b 7c 15 47 ba 1a 67 3e a1 0b 6f cc 21 06 fa 80 11 c4 80 11 6a e0 81 28 20 15 20 02 0f 2f 20 be 10 20 0d 24 70 21 16 c2 1f 04 61 20 6a a7 16 e0 41 12 fc a1 16 06 22 44 03 21 0d 0c 75 77 10 ec 21 e6 83 04 1c e0 0d 30 67 22 56 10 1d d2 b0 23 d6 21 15 64 50 03 1a e0 07 cc 20 49 2d c0 0c 98 44 09 a0 a0 2b 4c 72 08 46 21 28 a2 e7 10 9a d4 46 84 a0 24 31 f6 df 08 a5 78 f0 c9 05 d4 40 0d 20 80 0d d4 60 17 bb a0 1e ba 94 85 e6 e0 ff 0d 84 27 81 c2 70 0c 1d 42 0e fa e4 4f 9c f8 4f 04 a0 2d 24 41 4e cf 42 09 3e 0e 50 2c 92 34 Data Ascii: 0e3r[^`rGS q_$<tQxm6o.8vy6zmEm%==q$go+?rO\|k\|Gg>o!j( / $p!a jA"D!uw!0g"V#!dP I-D+LrF!(F$1x@ `'pBOO-$ANB>P,4
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 5c 86 1a 74 46 1c e8 43 0f e8 43 8e 92 d8 a6 9c 81 0d 74 81 3f 98 82 0f 1a 45 0f da 80 bc 20 21 92 16 43 3a cc 58 94 05 58 09 98 10 05 28 41 96 9c 41 57 88 6c 96 a0 41 09 78 42 09 d8 40 31 a1 85 ab 96 00 0c 88 1a 19 10 00 19 e0 8a 05 8c 41 3a 64 83 9c 06 86 39 d8 d0 31 34 5a 0d 2f 47 1e e2 c0 31 f0 03 21 f0 69 1f aa d9 29 9c 42 27 44 00 63 20 51 3d fc 81 9f 85 80 8c c8 02 fd c8 82 0b 38 f1 0d 48 62 0d be 03 a6 82 c3 34 08 f0 c5 55 81 01 af 41 02 fb c3 02 37 30 0f ac 2a 29 5a 5a 0d a8 45 ac 3a 80 fd c5 40 2e d6 62 2d a2 80 ae ca c1 3f be 1b 02 76 81 ad 50 41 0f 8c 43 22 11 46 39 1c dd 41 10 c6 60 80 99 bc f4 80 b5 02 9b 0d 60 63 26 64 ab af f9 07 01 83 41 7f f5 ff 17 b8 32 45 21 7b ab 06 5e 02 18 4c 01 27 20 40 bb ea c1 39 6a f2 2a 9d a3 89 74 88 89 cc 52 Data Ascii: \tFCCt?E !C:XX(AAWlAxB@1A:d914Z/G1!i)B'Dc Q=8Hb4UA70)ZZE:@.b-?vPAC"F9A``c&dA2E!{^L' @9jtR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49813	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	356	OUT	GET /css/images/bgg.png HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	312	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: image/png Content-Length: 7395 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 22 Aug 2023 23:57:32 GMT ETag: "1ce3-6038bc218b300" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:35 UTC	7395	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 40 00 00 01 94 08 03 00 00 00 73 e1 0b a1 00 00 03 00 50 4c 54 45 00 00 00 0c 34 88 17 49 a9 16 4a ab 3b 6a c8 3c 6d cd 40 a7 e8 42 ac eb bb 5f 7e 2e 5d bc cd 48 46 26 58 b9 dc 83 6b 33 63 c4 0d 41 a1 57 71 a4 0e 4a b5 3f a5 e9 ce 62 72 fc 94 3c 1a 2d 6c eb 5c 63 31 2f 62 c6 59 69 0b 47 b4 43 b3 ec 0c 47 b5 3c 9e e7 e1 62 2a c8 4b 25 b3 45 2f ad 3f 2c 0b 2e 7b 0b 43 aa 43 b1 eb cd 62 72 fc 93 3b 0b 47 b4 e6 5e 6a 41 ad eb ad 53 50 ee 85 46 e4 76 35 54 7e b0 73 6b a4 47 7f ef 19 55 c6 1d 58 c9 20 5b cd 15 51 c2 0e 4b bb 11 4e be 42 7a ea 3e a9 eb 27 61 d2 0b 48 b9 f8 5b 5d 3c 74 e5 23 5e cf 3f 77 e8 e9 3d 27 32 6c dc 45 7d ee 36 6f df fc 93 3c 2a 64 d5 fe 88 52 38 71 e2 ff ff ff 2f 69 da 2c 66 d7 1d Data Ascii: PNGIHDR@sPLTE4IJ;j<m@B_~.]HF&Xk3cAWqJ?br<-l\c1/bYiGCG<bK%E/?,.{CCbr;G^jASPFv5T~skGUX [QKNBz>'aH[]<t#^?w='2lE}6o<dR8q/i,f

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49812	88.99.67.51	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	608	OUT	GET /655358e6aaad94a5e9fe6a141b3bc5ef.gif HTTP/1.1 Host: we.zz17377.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	915	IN	HTTP/1.1 200 OK Cf-Cache-Status: MISS Cf-Ray: 8ef5220a6864974f-FRA Content-Type: image/gif Date: Mon, 09 Dec 2024 12:52:33 GMT Etag: W/"6756e7f7-6b1bf" Expires: Wed, 8 Jan 2025 12:52:33 GMT Last-Modified: Mon, 09 Dec 2024 12:52:33 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SbRqVCVSm94fVWmJT4pC6hbCdLDAkXZUYGNbNz5mt3mi5I2tQOcSTA3U8QInKCruvw95IhZW36MokggfgXTIqSJIQ%2FlkwfN0WeYzsZIzsi5jgnfTsbhD8%2BM2lhOsL14bUhp1yOU31J8Qrg%2F4D9mM"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=5385&min_rtt=5379&rtt_var=2030&sent=5&recv=6&lost=0&retrans=0&sent_bytes=3097&recv_bytes=983&delivery_rate=744751&cwnd=252&unsent_bytes=0&cid=1b4a4432901fbe93&ts=529&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close Transfer-Encoding: chunked
2025-01-02 05:12:35 UTC	271	IN	Data Raw: 38 30 30 30 0d 0a 47 49 46 38 39 61 14 05 c8 00 f7 00 00 43 33 26 cf ab 94 fc ae 25 fd d4 94 a4 0b 05 d6 bb ab 2d 22 10 fe b2 02 fe 00 00 fc d7 70 23 11 0b ff f3 90 94 93 91 fe d4 00 2f 22 22 6e 6b 6a f3 2a 74 f7 4e 24 f8 dc d6 d8 cd b7 18 01 fa f7 d7 b2 ff 50 6a ff ff 28 60 93 b0 fc d0 4e 00 91 da b3 ff 00 53 44 2f b4 ab 93 b5 8e 73 ff 2c 07 61 ae cf 9e d4 f7 f2 6d 98 f2 90 6e ff fa 71 69 44 32 8f 67 0e 9d b1 e2 f3 b7 46 b3 99 8f 02 62 ed f9 b2 b1 9d d3 a6 6a 55 42 95 70 23 f3 72 4c f8 8f 01 00 ae 22 f5 92 23 90 6c 4e d6 b3 73 f0 6c 28 50 4a 49 f6 93 91 f5 b5 6f 51 72 a7 f7 b3 d3 db ee f6 fe fc 4e fe 45 10 46 27 13 f3 b2 8f ce 97 8a f9 6d 01 cd 00 00 d5 ff 00 73 4e 0a 72 68 4e d3 90 08 8f 75 6f 92 8d 71 da dd f1 ee 21 88 d7 b0 4c d0 94 6f 66 b1 71 af 71 Data Ascii: 8000GIF89aC3&%-"p#/""nkj*tN$Pj(`NSD/s,amnqiD2gFbjUBp#rL"#lNsl(PJIoQrNEF'msNrhNuoq!Lofqq
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: db ac 2b b4 b0 02 95 91 03 00 99 22 b3 8c 28 b3 8f 4d da d2 02 fa 2d 2b b0 70 4f d4 92 4d d4 b4 05 d9 73 04 00 75 11 fd 4d 4d f2 8c 50 d6 d0 91 dc ef dc ae 73 26 00 70 c0 00 51 b2 6e 6a 03 94 6e 99 b4 ad 72 d6 4b 05 5f eb 69 dc 33 22 d8 8e ac af 76 68 0e 13 5f 63 c8 fb 02 b8 fc 06 0d b0 c6 27 09 71 2c 05 8d 4f 2d d8 6b 6d fc da f2 84 af b5 0a 89 b7 b5 8e 06 fb 92 b2 d5 6d 4c 4d 4a 04 e3 ce 68 a6 29 4c 93 8d 50 96 d6 77 fc 08 2e 74 a6 02 2f 70 b5 d8 4d 29 00 88 14 00 44 9b 92 91 b3 8b 55 46 d3 70 29 90 ae 94 71 6a 2c 2e 43 50 0b d0 ff 46 1f f5 10 ea 0e 73 31 27 52 1d a4 5a 25 5e a9 41 0b 79 05 02 02 8c fd dc d9 28 d5 4e 4e 48 09 01 46 51 6c b2 4f 4b 94 8e 2b 32 b0 fc b7 af 4d b0 4b 28 ed 0a d1 d5 6f c1 cf 49 79 e3 da 51 ac 92 b8 89 7a d9 6f cb 81 38 af c7 Data Ascii: +"(M-+pOMsuMMPs&pQnjnrK_i3"vh_c'q,O-kmmLMJh)LPw.t/pM)DUFp)qj,.CPFs1'RZ%^Ay(NNHFQlOK+2MK(oIyQzo8
2025-01-02 05:12:35 UTC	538	IN	Data Raw: 0b 30 bb e4 54 cb 22 67 99 16 63 0a f0 ac 11 99 0a dc d2 da b3 23 65 19 b4 4d 2f 77 26 f2 92 59 f2 cc 65 61 a5 29 aa a6 9c b5 75 3a 6a 8a f1 8e 3b 69 74 8b 76 7a e3 ce 70 e9 8c e3 4c 97 56 26 5c a9 2d a3 cd 2e 6d 64 07 d9 76 cb 74 cf bd 6b dd ca 7a c8 32 c6 56 2e ff 27 53 52 5e b5 97 6e dd 81 97 c8 53 af 74 03 9e 37 9f 2b e3 ed b6 b9 90 47 2e 39 ac 20 e3 0d ed 80 7c bf 33 f9 e6 d3 86 64 8f e7 af 72 3e 79 4c 1d 73 cb a6 22 76 cc 70 04 12 1e 04 d0 c1 11 0e b2 77 96 31 ce 88 6e 3b 82 46 bd e8 f6 ee 1d ca 1b e2 bf ac 7e 45 23 87 f1 ed 04 13 9e 83 87 a5 1b e1 a1 45 ea b8 44 21 06 bc f7 5c 8e df e2 56 d0 20 4f bf 12 af 29 7e 6d 76 df 8f 9b d6 36 92 12 53 c5 e4 67 52 45 f8 b8 df 76 a3 cc 25 f6 3a ce 85 d8 5d 5b a6 89 fd f8 55 cf ad f1 59 b3 fd cd 73 54 69 ba 4a Data Ascii: 0T"gc#eM/w&Yea)u:j;itvzpLV&\-.mdvtkz2V.'SR^nSt7+G.9 \|3dr>yLs"vpw1n;F~E#ED!\V O)~mv6SgREv%:][UYsTiJ
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: 32 74 b3 0b a1 5c 79 3c 4e 41 f1 53 b6 62 94 66 a6 d2 19 5f a6 89 67 be a4 9a 9c 3c 72 19 80 cd 4f 43 30 f9 c9 f8 ba 06 c1 ec 41 89 61 f8 cb 5a 34 cd c9 a3 0e 4e 84 53 79 62 d9 4e 0c 66 ff 22 54 a9 46 68 89 24 9c 13 65 f9 4a 52 62 87 72 d5 71 91 72 c6 c8 90 83 8e 64 60 dd d3 1f b0 16 b7 44 de 91 f2 8b f8 b9 68 41 29 fa c7 8e 0a 25 74 66 d4 68 b3 3a 2a 2d 86 3a 80 76 0c 35 57 82 9a f7 c0 da 11 8b 8c b5 04 cc d2 0c e0 46 45 70 60 99 25 a8 29 17 ca c0 04 1a 14 60 1a d1 48 47 33 8e 60 83 d8 95 48 73 24 2d e3 75 68 c4 44 fd e9 d0 78 f8 b4 91 bf 1c 69 2f 5c a1 cd 5e 48 f3 1f 53 30 b5 43 b5 85 68 5f 90 c2 89 68 9c 7a 42 bb 6c af 47 1f da e4 e1 62 c4 b0 40 3e 6e 2d 0b a4 08 5a 24 46 b3 55 a2 cf 7e 1b 45 aa dd 66 b9 8c 8e e1 cc a8 0d cd e1 fc a4 06 9a 4c 96 ed 7a Data Ascii: 2t\y<NASbf_g<rOC0AaZ4NSybNf"TFh$eJRbrqrd`DhA)%tfh:*-:v5WFEp`%)`HG3`Hs$-uhDxi/\^HS0Ch_hzBlGb@>n-Z$FU~EfLz
2025-01-02 05:12:35 UTC	5930	IN	Data Raw: 6f da d1 46 1e 0b 62 32 59 1f 27 1a 32 23 96 36 aa e8 46 54 6f 1d 31 47 a6 fc 54 92 ac 6c 5f d4 55 2d 8f b2 35 11 c5 5e 6d 7a d2 57 6c d1 3d 17 d6 6f d5 fc 74 49 49 80 c2 54 28 4c eb 00 17 4d 0d cf da 30 5f 7e fb f5 f7 5f 80 ff e5 b6 db 80 dd 35 78 df 80 13 56 78 61 7f bb 93 cb 06 bb 72 18 60 0c 0f 6a 10 83 91 42 d4 40 41 8d c2 16 18 20 87 55 5c 31 6c 8c 6b a0 29 64 0e 60 5a 39 02 34 68 0a 00 6c 09 14 60 06 82 09 06 18 e8 00 83 3c 46 18 2d 8c 31 c2 98 02 35 c0 3c 08 e0 9c 3b 02 60 e2 0e 20 d2 99 22 8c 3b 5e 08 63 04 cb 7a c3 e1 8f 00 82 03 ff a2 80 e0 46 60 9a 89 e9 28 05 20 3a 49 f0 7c 69 29 87 2b 9d d1 98 16 6d 60 e0 88 16 b6 eb ae 3b e6 1c 60 ee 1d 1f 2a 48 c7 83 12 ea d8 c6 9f 25 06 a8 0f 9a b4 1c d8 ed 85 04 ba 29 62 21 92 d0 6a 81 07 12 08 a8 25 0c Data Ascii: oFb2Y'2#6FTo1GTl_U-5^mzWl=otIIT(LM0_~_5xVxar`jB@A U\1lk)d`Z94hl`<F-15<;` ";^czF`( :I\|i)+m`;`*H%)b!j%
2025-01-02 05:12:35 UTC	7116	IN	Data Raw: 06 db 1a 95 28 bc 54 86 43 98 1a 5c 81 c6 55 b1 2d 52 8c 47 ce 9b a1 8d 52 e5 c3 2a a9 0a 44 ec c9 8f f3 98 91 02 77 d9 0a 2f ef c1 54 ac 3a 48 ac 2b 4d 0b 5c 13 31 16 ad 2e d6 10 2e f2 51 1a cf da e0 45 38 14 2c e7 55 6b 19 d6 a2 a3 21 93 a8 48 40 ad 61 79 e6 c1 63 1f b9 d8 01 e5 39 d2 01 ed 8a 64 b9 d2 51 1a 88 61 b2 93 9e ba c6 27 3d b5 c9 39 92 47 62 9e 3c e5 27 f5 e8 c8 55 52 e4 22 19 e1 d8 26 b4 d1 0d 46 60 83 ff 11 18 c0 46 37 12 21 32 92 d8 72 24 3c 59 45 16 64 f0 84 1c 8c e1 0f 39 48 c0 1f 76 b2 92 55 b8 22 07 8c 40 c1 12 5a 31 89 23 30 00 1b 34 a0 01 36 f2 a0 cd 3c 14 60 0a 58 b3 40 1f e2 b6 37 1a dc e1 0e 40 70 83 d2 b0 36 85 1f 90 a5 6b 1e d0 01 d8 e2 51 02 bb 94 60 9e 72 51 84 0f 66 a4 c3 19 f8 a5 03 73 1b 0c dd 26 30 01 bb 09 14 31 89 e9 4b Data Ascii: (TC\U-RGR*Dw/T:H+M\1..QE8,Uk!H@ayc9dQa'=9Gb<'UR"&F`F7!2r$<YEd9HvU"@Z1#046<`X@7@p6kQ`rQfs&01K
2025-01-02 05:12:35 UTC	8302	IN	Data Raw: 78 80 04 04 92 20 07 d2 20 0b 12 21 0f 52 21 13 92 21 17 72 20 3f e1 90 f8 87 c4 0e 89 36 10 a4 11 1a 92 20 cb 0f ba 8e 84 ce 30 f2 20 6f af 57 36 62 19 54 c1 21 0b 52 92 76 c9 f4 96 01 00 12 52 f6 4a 92 04 96 ef 40 48 41 26 67 92 14 3c 92 26 69 d2 23 79 80 07 c8 af 1d 81 8c 5f d4 0c 25 77 6b 19 2a e1 1e 8b d2 1e 13 af f8 34 a1 07 da c0 c9 c0 8f 98 2e 52 27 a3 52 2a a3 12 26 e7 6c 2a af 32 2a 49 e2 13 b0 12 2b fd c0 fc aa 6f 5f b8 52 2a d3 ac 22 6a 52 2c 75 b2 13 80 b2 21 3a e1 2c d1 f2 2b 4b a2 11 cc b2 2d a7 92 fc de 12 26 8a a0 07 6a 60 fd da 8f 2f 99 c0 10 fa c0 9e ff 4c c2 06 0a 2d 0f a0 80 9f 12 c0 ff ce a1 02 50 40 06 20 8d 68 22 ed 9f 08 4a 72 3a 00 69 8e 40 16 6c a1 18 8e c1 16 32 4d 16 86 42 14 44 c1 0d b0 c1 02 f3 00 6c c4 e2 07 58 6d 02 c8 62 Data Ascii: x !R!!r ?6 0 oW6bT!RvRJ@HA&g<&i#y_%wk4.R'R&l2I+o_R*"jR,u!:,+K-&j`/L-P@ h"Jr:i@l2MBDlXmb
2025-01-02 05:12:35 UTC	3501	IN	Data Raw: 36 7f a5 4d 9f 46 9d 5a f5 6a d6 a5 b1 71 48 b8 4c 01 87 16 2d 00 8c 5c 96 5b b6 c4 88 b7 ac 62 cd 3d bb 85 0d 00 0a 74 3f 55 40 9a f5 8c 88 4f 39 14 99 d1 99 a2 d5 e0 00 e0 5a 9c 78 db b8 53 03 dd fb da bd 2d b5 5f 9b 0f 1f 7a 7c d8 52 fe 3c 7a ff f3 e5 d3 a3 5f 9f fe 3c 1d 05 3e 38 b7 80 ed 83 fc 7a f8 ee db b3 ff af bd 36 a8 e3 ee a9 aa a8 32 8e 28 2b aa 61 b0 41 07 1f 84 30 42 06 1d 58 50 42 0b 2f 64 d0 8a ee ba fb 6b 99 df f2 39 ae a4 85 18 7a 8a c3 dc 0c 68 a0 1d 0c 2f ac 82 a9 a5 b0 2a c9 45 19 75 a3 2e 25 3f 30 34 a1 1f 2f 56 e4 b1 c7 0b ad f8 ed 37 0f a5 22 f2 31 f2 d4 eb 0f c0 2d e2 fb 2f bd 36 64 24 aa 1f 3a 9a a4 92 bf ff d6 c3 f2 c9 a5 54 42 a3 9a 06 1a fc 92 c1 30 bd 04 b3 4c 31 cd 24 f3 cc 33 bd f0 43 29 66 50 d2 02 cd 31 bf b4 62 4b 3b 57 Data Ascii: 6MFZjqHL-\[b=t?U@O9ZxS-_z\|R<z_<>8z62(+aA0BXPB/dk9zh/*Eu.%?04/V7"1-/6d$:TB0L1$3C)fP1bK;W
2025-01-02 05:12:35 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 24 0a 91 3b c6 49 43 5b 7c f4 03 3f 70 02 21 bd 45 9f 73 06 30 dd a1 b9 ad db 56 ac 02 27 a8 2d dc c2 2d 7b d4 84 a7 2d 0f 4d 68 14 71 7c 5a 27 b5 d2 80 cc d2 6e 65 89 84 14 46 46 b9 33 ac c5 47 e8 bc 47 33 45 5d 32 f5 02 2f f5 5c 94 b8 52 67 6c d3 d6 b5 21 07 98 81 37 20 bd 50 91 30 8b fc 01 2a 30 02 01 f0 02 01 f8 83 7d f0 3c 1c 23 3d 7d aa 81 0b 14 01 95 4c 5e 81 40 c9 00 40 49 d5 7b d4 e8 15 85 e7 bd 83 00 c0 01 1a 90 31 4b 7a c9 0a 08 27 6b 90 00 77 f0 87 00 58 82 6c a0 82 e6 23 82 3a ff b0 97 28 48 b2 7c 91 be 39 a0 0c 60 80 03 4a c8 8f 93 41 ab d0 34 10 ef db a5 ac 04 02 40 00 04 3a 38 06 4d d0 84 63 90 04 40 00 85 0f 53 26 5f 0a 19 91 49 01 82 30 08 0e 20 4c 81 81 e0 9d 31 9d 92 a8 ca 77 50 00 45 08 00 69 18 80 19 60 8a 32 Data Ascii: 8000$;IC[\|?p!Es0V'--{-Mhq\|Z'neFF3GG3E]2/\Rgl!7 P0*0}<#=}L^@@I{1Kz'kwXl#:(H\|9`JA4@:8Mc@S&_I0 L1wPEi`2
2025-01-02 05:12:35 UTC	11860	IN	Data Raw: 91 5f 0a a4 40 11 44 d9 ce c4 45 33 09 9a 5f 44 cd a5 01 c6 f0 91 9a da 44 9a 3e dd 91 5d 0c 0d 07 18 86 db 94 cd f6 51 46 d6 ac 4d d5 70 1a d8 bc 1b a8 85 5a 46 f8 98 70 0c 4c c1 81 1b b0 45 86 e1 39 81 59 f9 db bd 19 81 43 f0 85 49 e1 95 c1 8d c7 ba c5 9f 12 25 8c ee 31 83 0f f8 54 c4 ad 60 15 2c 9b ba e1 98 8b 40 01 0c 76 d4 4d e1 cd 1e f8 c0 11 9a 9e 40 b8 d5 bf 35 80 13 04 4c b5 a1 46 fc 8c c6 0f 9a 40 10 f6 55 80 dd db 4d 01 58 be f5 95 17 88 db 6f 6c 47 2b dd 87 f2 fc 87 db 68 42 8c 04 1f ef 7d 86 bb 9d 4f ff 57 e1 0d 13 ca 55 c2 69 1c 8c 60 e1 01 e0 0d 5c fd e1 49 19 01 14 7c cf a2 99 80 59 dd db ac c1 d5 75 fc 87 e2 bd 0b fb 78 e1 1f fa a1 5c a5 94 b1 18 15 20 6e cf 1e f6 c3 25 ca 95 24 1e 80 0f 68 a2 c6 39 83 22 78 dc 93 44 09 64 d1 00 0a d0 00 Data Ascii: _@DE3_DD>]QFMpZFpLE9YCI%1T`,@vM@5LF@UMXolG+hB}OWUi`\I\|Yux\ n%$h9"xDd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49811	88.99.67.51	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	608	OUT	GET /7bd578c706a9f8fb6f46da207b46e618.gif HTTP/1.1 Host: we.zz17377.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	926	IN	HTTP/1.1 200 OK Age: 2155860 Cf-Cache-Status: HIT Cf-Ray: 8fb8120dbbfd65a6-FRA Content-Type: image/gif Date: Thu, 02 Jan 2025 04:40:21 GMT Etag: W/"675530c7-4758" Expires: Sat, 1 Feb 2025 04:40:21 GMT Last-Modified: Thu, 02 Jan 2025 04:40:21 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RKhpBKb3FASy5zTKLDFeZIXstyeBooPCrYzATjzNH2lVdIasjpF2TMn948lUGv56aik3UmS76U2StnKOHX8auDdZ3iFjyDfwwr%2BDDn8EUDuYRfjytTRtQVbnd5hkPOB%2BRpcU%2BQ32EyHsj1Sptyo4"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=5276&min_rtt=5255&rtt_var=1497&sent=5&recv=7&lost=0&retrans=0&sent_bytes=3096&recv_bytes=859&delivery_rate=761295&cwnd=252&unsent_bytes=0&cid=bdf3f03cc4d2c655&ts=20&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close Transfer-Encoding: chunked
2025-01-02 05:12:35 UTC	260	IN	Data Raw: 34 30 30 30 0d 0a 47 49 46 38 39 61 96 00 96 00 f7 ff 00 c8 c7 c7 9f 91 6f 51 45 36 37 24 14 fd fd fb 08 07 06 e2 0e de fe e9 b0 bb b9 b8 b9 af 8f ff e6 ba fe 29 05 2c 2b 2b 86 85 84 f9 d4 ce 5f 13 d9 8d 79 61 44 2e 17 ea c6 94 47 45 42 e3 e2 df ff f3 ba fe 68 26 ff 89 60 a9 4c 24 ee ed ed ff ea c7 3a 3a 3a c6 bc b3 7c 79 79 e3 e2 e2 ff e5 d6 21 21 20 46 37 25 db d8 c5 58 57 56 27 18 17 1c 1c 1c 12 10 10 ff ff f4 c1 b3 82 d3 c5 98 a6 9c 93 68 67 66 a4 a4 a4 35 35 35 9c 9c 9b ff 63 18 ff aa 8c ff 5e 22 46 3d 33 ff fe dc ff fd c2 ad ac ac ff d3 a2 3a 31 28 d5 d4 d3 ff fd cb ff fe e4 07 23 33 35 2b 23 67 56 49 ff ff ec 78 64 52 ff 59 1e ff 56 1c de dd dd 46 25 25 f3 f3 f3 ff 43 07 ff ec e1 93 93 92 ff f7 db c5 c2 bf ff fe d3 ff 7e 10 ff 72 4c ff f2 d5 a1 30 Data Ascii: 4000GIF89aoQE67$),++_yaD.GEBh&`L$:::\|yy!! F7%XWV'hgf555c^"F=3:1(#35+#gVIxdRYVF%%C~rL0
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: aa a5 37 17 1b da cd a1 db d4 b5 ff dc ac 29 1a 0c 2f 2f 2f ad d1 cd 10 8f f5 13 06 04 c4 4a 18 e5 0c 6c 42 88 a0 0e 30 3f c2 b9 96 25 4e 74 98 87 83 5a 51 42 f9 c7 0f 0a d8 fe d9 d1 ab d0 e6 f1 77 69 61 08 fa 9e 48 17 12 c4 c1 a7 b7 b4 b2 18 12 12 5b 2a 7f 6c 45 39 ff e0 b3 45 1c 21 ff 46 18 e1 d7 bd 3d 38 33 96 95 8c ff 50 14 a4 81 1e ff f6 c1 a9 1d 74 4e 38 1f e4 d9 a6 3a 35 30 7d 73 66 51 3a 35 f3 f2 e3 2b a8 6e 0d 29 0b cd cb c9 fd de a3 df dd d3 ec ea db 6c 5c 60 25 33 3b fe f5 ee 33 1d 1c 2a 23 1e 18 10 0b f6 f4 e9 ff f1 cd e3 58 1c f3 ff fd fe f4 e4 df f1 ff 4f 26 27 fb f7 f4 64 3b 2d 99 97 96 af aa a1 e8 e1 c9 f4 fe f4 ed f1 ea ff ca 9e 2e 28 22 74 27 0f cd e1 cd 47 2c 2e 28 2d 30 fb 5a 02 26 35 23 ea fd ff 31 1e 0b a3 a9 bb e7 e5 e4 a9 a4 a1 19 Data Ascii: 7)///JlB0?%NtZQBwiaH[lE9E!F=83PtN8:50}sfQ:5+n)l\`%3;3#XO&'d;-.("t'G,.(-0Z&5#1
2025-01-02 05:12:35 UTC	538	IN	Data Raw: e4 bb ab bc 80 c1 d4 fc ea b3 81 dd 78 f7 6b f7 c4 7b e7 ff 7d 37 c0 7e f3 ad f7 cd 7b ff ed af 3e 85 03 8e f8 e2 8c 2f 3e c1 2f e4 68 88 90 3f b0 a4 fc 9d 76 b0 c1 e0 63 77 b2 1e 3d a8 db 99 3a f4 63 10 72 d3 dd f7 e9 a8 e3 8d fa dd 79 f7 cd fa e2 83 23 ae b7 ea b1 0f 3e bb ec ab 33 6e 7b e3 bc 37 6e 02 3d fe ec 55 6d 11 e0 01 41 e4 02 9a 7f be 27 f2 1e a2 4c 24 13 1f a8 18 f7 dc 2e c3 6e bd e2 7e 17 ee fa eb bb 1b ee fd df db e3 7e bb ed 01 6b 8f 7b ef e8 eb b3 0f 34 13 10 90 31 41 94 5b de 76 ca 9a 1b 62 48 a0 53 85 b9 00 2c 0e 11 18 26 91 a4 f3 8d 38 e4 90 be 02 a2 ef 75 06 4c a0 f5 14 c8 c0 06 22 2e 1c 26 80 4e 41 b4 44 b2 a6 15 21 15 43 31 c2 05 61 41 24 66 85 69 5d 9b 6b 5a 00 a7 86 c0 05 96 b0 77 27 6c 5c 0a 0f e8 c0 16 ba 50 7d e5 f8 46 cf 08 62 Data Ascii: xk{}7~{>/>/h?vcw=:cry#>3n{7n=UmA'L$.n~~k{41A[vbHS,&8uL".&NAD!C1aA$fi]kZw'l\P}Fb
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: 2c e7 2b 36 70 4b f4 b1 f2 97 08 45 a8 3e 4c 90 a3 62 c2 80 78 46 b3 d5 d1 96 d9 a9 6a c5 60 4b 3a dc 0f 6f 8c 21 87 1d 28 c3 0a ae e8 80 0b 66 d1 80 15 1c 61 16 47 58 41 03 5c e0 02 79 74 60 12 b3 e8 86 3c 66 31 8b 49 c8 a3 01 34 95 87 3c 46 0a 8c 1e 60 e0 a7 02 28 c4 2b ae a1 d0 84 96 b2 13 fb 80 40 1d ea f0 83 9d 92 d4 a4 28 55 e9 2c 5c d0 81 0e d0 74 12 13 70 05 2a 7f c9 cb b5 78 95 2c e5 90 87 15 43 48 24 cd 5d cb 1f 0e 48 5a b5 2c 80 2b e2 7d ee 05 8c c0 97 3e ae 01 1a 1c 38 24 03 2e 78 88 0b de e1 90 76 b4 e3 ae 6a 78 48 0d f8 ea 0f 7a 00 cf 1f 96 80 80 27 96 b0 04 df f4 32 2c 46 f5 e5 06 90 b1 0c 31 58 b6 0e ea 70 c8 28 c6 f1 10 16 64 c8 1f 49 f8 ab 43 c8 71 0b 82 92 32 2c a9 84 ec 69 bf aa 96 12 3c 21 12 8a 18 c4 09 08 24 24 38 ff d0 81 09 70 d0 Data Ascii: ,+6pKE>LbxFj`K:o!(faGXA\yt`<f1I4<F`(+@(U,\tp*x,CH$]HZ,+}>8$.xvjxHz'2,F1Xp(dICq2,i<!$$8p
2025-01-02 05:12:35 UTC	5930	IN	Data Raw: 50 42 99 92 04 68 0e 99 75 d6 28 66 95 b5 a5 1b 78 70 26 e1 97 54 e1 55 a7 38 a2 88 42 b5 09 08 24 2e 0a cb 56 e3 23 84 33 a3 40 44 0f dc 96 61 e9 86 68 fd 49 81 da 6a c3 10 a6 c1 a0 b8 75 99 1d 16 c5 95 39 3a 64 0a d0 67 2b 16 d6 d5 65 8e ab 08 e8 06 9e f1 e8 f5 c7 de 7c 3d 41 07 91 29 ff bd 65 08 59 93 6e da e0 10 6e 60 e7 56 5c 5f da ff 55 cc 19 7c b5 e6 44 a3 c0 8a e2 90 2d 4b 80 ec a8 28 5a 58 a6 c1 95 04 20 99 80 ab 72 41 79 8c 27 d0 e0 c3 41 97 5d e6 61 ba 99 67 ae 59 1f b6 fd a9 61 5d 0a e6 e9 db 1d 5d ae 42 80 83 7a 21 58 c0 13 4f 30 28 21 e9 08 0e 09 18 72 ca a7 0c 61 00 85 51 a2 b2 cb 4c 1e ce 3a 0a 53 ea 96 98 04 12 ca 59 23 8a ae 0f d9 e0 32 01 5e 7a a2 c1 15 e4 91 47 12 39 b0 99 c0 17 10 aa c8 64 00 12 b6 ad 7b 50 64 c0 05 17 84 e1 8b 27 fe Data Ascii: PBhu(fxp&TU8B$.V#3@DahIju9:dg+e\|=A)eYnn`V\_U\|D-K(ZX rAy'A]agYa]]Bz!XO0(!raQL:SY#2^zG9d{Pd'
2025-01-02 05:12:35 UTC	2546	IN	Data Raw: 20 3d 3d 12 b2 90 6b 3c 52 0e aa e8 c7 34 b5 82 06 28 b0 a3 21 23 29 c9 e9 c1 a5 62 8a 5c 64 9a c2 95 02 44 e0 70 92 9e 9c 64 e6 50 40 83 4b 62 92 91 34 c8 c3 88 b4 f8 c9 55 e2 11 37 29 18 65 29 af 57 8d 68 54 40 ca 6e aa 64 25 2e b9 68 99 1e c8 0e 35 b1 3c 60 20 1c 29 03 37 e5 b2 98 39 b4 4c 26 ba c5 b9 5f f2 30 5c 15 08 00 27 3b 69 cc 69 7a b1 32 55 80 40 e0 48 c9 4c 1e 62 31 1a 01 b8 61 14 a9 59 4c 5a f1 20 00 b1 a0 81 01 b7 89 c9 60 3a ed 07 d1 1c 22 3c e3 29 cf 79 d2 b3 9e f6 a4 15 08 7a 50 8f 73 06 82 54 ea 8c 65 32 68 19 08 14 40 20 0c 88 48 44 22 b2 20 4e 49 66 21 0b 89 20 c1 0b 51 90 8c 0a 44 23 9d ff dc 66 2b 02 4a 83 8a 26 43 86 28 f8 28 48 43 2a d2 91 92 b4 a4 26 3d 29 4a 53 5a 52 19 4a 21 10 81 8b 46 32 b4 79 d1 8b 06 a2 a6 d1 b8 29 4e 73 aa Data Ascii: ==k<R4(!#)b\dDpdP@Kb4U7)e)WhT@nd%.h5<` )79L&_0\';iiz2U@HLb1aYLZ `:"<)yzPsTe2h@ HD" NIf! QD#f+J&C((HC*&=)JSZRJ!F2y)Ns
2025-01-02 05:12:35 UTC	1894	IN	Data Raw: 0d 0a 37 35 38 0d 0a 66 48 d9 fa b1 86 7d b8 02 19 95 98 81 02 ac db da 44 ac b1 00 40 0e b2 44 74 16 3f 5b ac f6 1f 3a 48 c3 8a 17 02 e4 dd 21 2e a0 1f 0e ad 75 67 30 05 13 3f ee 71 41 06 f2 2a 37 2c 5f 97 28 4b 22 b7 90 41 30 1a e0 5d eb 96 f5 07 3f 06 f0 93 23 cc 66 ff ae 31 ff 0d 3a 50 00 41 96 dc 10 bc 05 d9 c3 fd 00 b1 75 15 40 e5 7f a4 39 a0 6f b5 f3 95 5b 4c 97 12 94 42 0f 8b 40 c2 8e dd 30 03 32 1c 4d a4 59 b6 48 3f b2 60 e4 1d 1b 91 6a 16 09 f2 87 ff b1 63 05 28 81 0c 2b c5 4a 5a 5f 22 35 2f f8 a0 d3 8b 98 c1 08 98 01 8d f8 35 d9 23 f1 4b 83 8e e7 9c 69 20 1b ad 1e 21 56 00 9f 41 3d d3 1d f5 83 10 33 d0 80 ae f9 4c 89 60 e8 63 02 20 e0 87 fc 08 0d 91 37 cf c0 0d 9c 16 08 9d 25 a2 e9 3c eb 58 03 6e f8 74 a8 99 14 bf 38 e4 c0 0d 0a 70 43 13 b4 c1 Data Ascii: 758fH}D@Dt?[:H!.ug0?qA*7,_(K"A0]?#f1:PAu@9o[LB@02MYH?`jc(+JZ_"5/5#Ki !VA=3L`c 7%<Xnt8pC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49789	183.204.210.219	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	610	OUT	GET /i/2024/07/26/12872no.gif HTTP/1.1 Host: 69vvnstttaaa888.dzlndygh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	580	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 162820 Connection: close Accept-Ranges: bytes Age: 156642 Cache-Control: max-age=2592000 Etag: "66ab3a20-27c04" Expires: Thu, 30 Jan 2025 09:41:54 GMT Last-Modified: Thu, 01 Aug 2024 07:32:48 GMT Vary: Accept-Encoding Via: cache78.jhmp03,cache08.zzcm05 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: cde06fab3f3407353c48ca315be418ac X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT
2025-01-02 05:12:35 UTC	15804	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 ff 00 d3 aa 97 03 fe ff fb d7 02 54 1f 0b ef 64 5d b3 8f 05 fe 2a 11 23 23 22 ff fe 00 00 fb 02 ef cd b8 f3 dc 6f f8 b2 08 d8 d8 d7 bb ff 11 d4 bb 49 fe 15 cf 94 05 02 ef 56 ec d4 f4 0e f9 d3 2a f7 90 0b f9 b1 94 dc cc bb fa d2 51 ff 99 e5 73 06 d4 f9 da 96 2f 46 f5 d7 ae 06 28 fe f9 ff fc 4a d0 b1 30 fb b4 af b2 75 6b ee 00 98 f8 71 09 ad ac ab f7 b3 2a 07 dc 59 fc 47 28 ce 99 88 01 cf 99 ff fb 30 b3 88 75 dd d0 69 4e ff ee ed 02 60 d3 92 09 f0 53 01 57 2e 73 91 6e 02 6a ff dd 17 9f 9d 70 6e 6b 6e 4b 01 fc 31 27 9f 2d 52 b9 99 88 20 4c 2f 1a 65 50 b6 6c 05 68 97 8b fa b6 4b d0 71 09 90 90 8f d2 8a 79 f9 6d 2e fa 8c 8b 4e 57 e2 28 0f 0a 4e 4b 4a b0 51 03 4a a7 76 93 66 51 f8 8e 27 a6 e4 e7 dd cc 54 ac da aa fb b2 6f 90 71 Data Ascii: GIF89aTd]##"oIVQs/F(J0ukq*YG(0uiN`SW.snjpnknK1'-R L/ePlhKqym.NW(NKJQJvfQ'Toq
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 80 46 2d 80 8a 81 d5 fe 81 18 4c 13 a8 65 ad 37 b1 cb 09 e0 e1 1e cf 32 5f 88 1b c0 f5 12 48 2d 01 62 f4 80 a5 59 9a 21 c8 a9 4d cd ad 30 db 2d 62 58 81 21 f4 32 09 00 01 32 5b 5a 0f dc 6d aa 28 73 2f 3b 73 d1 f6 e2 2f fe 94 30 1a 2e db 08 15 12 28 1c e3 ba 0d 0c e0 9d 32 88 c3 1b 58 9d 8e f2 68 3e 30 03 3a 33 c3 65 4e c3 3b b0 c3 33 7c 6e 35 5a 63 38 98 ff 80 21 d8 00 5b d9 00 14 14 4e c9 1d 01 55 4c 48 f0 3e 8e 51 cc 84 0e dc c4 4d f8 15 4f 98 c3 ed 12 03 31 88 40 19 5c ce 5d 3d 34 50 58 8e ce 45 85 9b fa 23 eb a8 e9 9a 0a 5d 4b 30 6f ad 7c 02 43 ef 54 d6 d4 c1 f5 ca c1 14 94 34 d2 40 01 e3 f6 01 f0 54 00 03 50 80 09 30 00 69 d1 32 f9 66 8f 4c cf 4c 78 1c 96 33 d0 ef 2f b0 43 13 14 80 5b 72 a5 4e 07 83 a6 86 83 38 ac 01 ab 76 2a ab 32 80 2e e4 43 20 ac Data Ascii: F-Le72_H-bY!M0-bX!22[Zm(s/;s/0.(2Xh>0:3eN;3\|n5Zc8![NULH>QMO1@\]=4PXE#]K0o\|CT4@TP0i2fLLx3/C[rN8v*2.C
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: dc 67 c3 88 16 08 dc 6e 38 80 2c d8 dd 98 7a 87 83 28 d0 69 e0 02 2d 40 1c 2d 68 dc ba 05 84 a7 d0 82 16 20 68 d0 25 68 71 be 8b 55 d0 81 85 c2 82 23 d8 c3 cc 01 be 16 f8 dc a1 08 82 ac c5 0a 27 7d 52 34 8d d1 5c c0 d3 6a b4 84 0d b6 04 e0 95 de e8 9d 80 5c 48 8c f6 d0 de 0d 06 48 35 b5 5d 75 b4 81 90 3e d4 fb cd 0e 40 e8 dd fa 6d d4 c6 48 60 5c 64 60 92 ff ce 60 06 76 60 25 5d de 2e ad 67 72 b9 51 cd 80 82 dc a5 c5 3e a5 5e bc 32 03 e3 dd 69 f6 bd 46 fe c9 5d df 00 55 5a 24 5d 91 dc e0 1b ed e9 27 95 d5 ec b8 6a e8 cd d2 8c ab 60 3e 7d c4 5c f0 ab 04 1e a1 f2 65 df 96 46 d2 ef 7d 52 ab 1e e0 02 a6 0d 4e 05 6a 92 2e dd a0 86 51 5a c4 60 bb 9e c5 9f 56 de 0e 1e e0 18 bd 5a a2 08 86 e7 2d dd 19 0d 48 80 dc 60 fe 69 45 1b 98 d1 e8 cd 2c 4b d0 02 91 26 d5 0d Data Ascii: gn8,z(i-@-h h%hqU#'}R4\j\HH5]u>@mH`\d``v`%].grQ>^2iF]UZ$]'j`>}\eF}RNj.QZ`VZ-H`iE,K&
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: d6 37 ce a4 37 00 80 05 db 50 1e ac c8 02 2c d6 28 09 82 05 50 50 57 90 a3 1f fe 5a 07 42 b0 01 0b d0 07 9c 00 22 f2 b0 0e 6a c0 09 24 d0 22 36 f0 17 de 90 99 1b 92 63 3f b2 04 84 f0 05 12 d2 39 80 21 9f e0 60 c0 36 70 04 52 80 01 2a b2 09 e5 d9 c4 04 60 b1 ca 38 21 d4 c0 65 56 6c c5 0a ba 24 5d 33 26 46 bb 07 cf 90 14 8a 12 25 2d 5a 00 59 e0 0c 54 92 28 ff ec 60 43 79 d6 04 33 90 14 cf 50 41 bf 00 02 85 36 1c 5c e0 c6 46 7b 90 33 b0 00 df 00 02 07 c2 2a 93 b0 0d 4a 7b 00 6a 4b 67 34 0a 20 19 d4 03 0a 44 41 ec c7 3f f9 11 08 53 02 28 0c 00 03 7b 00 08 80 70 1c 49 8a a3 84 d2 7c 35 5a 28 e5 50 52 f2 73 03 44 bd b7 a6 8c 13 a8 ac ca 32 41 cb 9c 3b a6 2d 61 06 29 71 2d 74 10 30 67 3a 6d 1f 81 6d 05 91 10 7a ea 6d be fc 0e c0 3c 11 16 91 b9 23 61 43 c5 bc 12 Data Ascii: 77P,(PPWZB"j$"6c?9!`6pR`8!eVl$]3&F%-ZYT(`Cy3PA6\F{3J{jKg4 DA?S({pI\|5Z(PRsD2A;-a)q-t0g:mmzm<#aC
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 39 75 97 53 d9 6d e9 b8 ae 87 d9 93 4f 0c 21 3e e2 97 ff 7a 8b 7b 05 8e fe f8 6d 04 62 4a 6f c2 4f dd b8 6f 9d d2 74 13 bb 91 2b 9b 2b 4c d7 95 1b 39 1c 42 33 96 1b d9 ae f9 50 a8 08 81 94 01 59 4d 71 8a b0 01 f9 1a 56 19 74 dd d2 90 03 f9 74 46 f3 23 70 20 b6 0f f9 b3 77 d8 74 7f 00 98 4d 13 de b8 10 90 3f e2 76 62 97 01 54 03 09 8e fb b8 7b 20 35 40 a0 ff 0f 9c 19 fb 5e 33 9a ad 87 10 aa 59 56 09 c1 17 85 e4 00 10 4d 7d d8 e7 3a 00 40 04 fa 0f 3c aa 8c e2 d0 a7 04 2f e6 c9 9a 77 5c 7c 49 7e cc 83 3c ee e5 3c ae 63 3d ac f7 7a d5 03 9f fd 67 00 c3 f5 3d be 33 0b 86 0b 3f fd 91 5e cf b3 a0 df 73 ea e0 53 21 0d ed 7e f5 d5 b9 18 f2 c0 77 80 14 b4 c0 3b 32 5a a3 49 f8 7f 45 58 a6 57 e1 a6 29 58 61 65 3a 62 25 3c 60 3d 38 62 3f bc ed 4c fa a4 2f 34 a5 cd ee Data Ascii: 9uSmO!>z{mbJoOot++L9B3PYMqVttF#p wtM?vbT{ 5@^3YVM}:@</w\\|I~<<c=zg=3?^sS!~w;2ZIEXW)Xae:b%<`=8b?L/4
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 99 c2 32 05 ac c0 95 68 18 e4 6e cb e6 ae 00 96 cc 32 2d c7 f2 e2 66 a0 09 fc 32 30 23 83 3a 7c 6e 31 8b ae 02 58 40 ac 10 c3 1a e4 89 02 c4 db 74 a5 ae ea ea e0 e9 f6 5b a2 c2 ee 39 13 43 a1 54 43 61 76 8a a4 08 6f a1 98 b3 7b a3 0a aa da 13 16 36 26 00 b4 f3 f2 c2 2a 7f 4d 01 b4 7a 54 1f 34 90 47 31 10 12 60 c3 39 68 af 38 88 03 36 f8 33 b9 8c 2f 83 31 ff 6b cb 01 6b cb b5 43 68 3a 81 13 a8 9c 1c 7e a6 2e 60 83 b5 0d 89 17 6c 01 12 dc c0 0c dc 80 45 27 1d 50 64 82 c1 b8 b8 8b 07 05 db 31 85 bd e0 d0 da c1 eb 23 ca 78 b8 f6 c4 2a 14 5d 03 83 f4 4e 08 99 47 a7 c2 8b 27 41 04 8b f4 52 cc f4 5b cc ab 07 21 5d 4d 67 f0 4f e7 e2 2e 3e 39 50 33 c5 2b d2 a2 c7 08 35 2c 8e 30 9c d9 04 c9 78 e7 92 a5 f0 4e 9f 62 0b 0b ec 2a 82 c3 08 cb 05 0a 00 e3 31 d2 e7 4d fc Data Ascii: 2hn2-f20#:\|n1X@t[9CTCavo{6&MzT4G1`9h863/1kkCh:~.`lE'Pd1#x]NG'AR[!]MgO.>9P3+5,0xNb*1M
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ad b1 4f 8c 13 b2 81 da ce 47 17 1b 6f 49 c9 27 72 f2 7d 51 80 e5 08 81 ad cd 6f 25 73 86 18 03 e5 f5 ba bd ce 25 92 02 d3 0b cd 20 18 73 4e f2 8f e2 30 6b 48 61 1b 56 f0 aa 92 a5 0d dd 25 1f c0 08 4f 97 ee d4 07 f9 0f 2e 74 0c 28 ed c3 8a ff 16 99 23 b7 f1 6d 25 2d c0 c9 a1 d9 d7 cf 4f b1 1b 3f a0 6b 8f c8 47 b7 7a c7 23 48 c4 8f 7d bc e3 3f b4 00 58 83 04 01 91 1f 95 5f 83 c4 77 0d f1 7f 81 04 48 8d 37 12 1c a6 26 e1 70 10 6f b0 26 59 a0 10 d8 60 01 15 60 2b 13 c3 10 dc 40 00 b6 82 11 17 67 62 22 72 0e b5 25 57 09 b1 3c 79 62 38 1e 16 11 e3 f0 0f 92 56 2f 26 40 01 1e 27 0e 9d b4 82 f4 72 7b 0b b1 71 3c d3 82 1e 17 11 22 f0 7e 3c 53 10 e7 e3 2c ce d1 7c 5c 10 6d ff c0 5c d6 47 48 83 44 70 4a 48 70 75 74 7d d4 d5 58 6a e2 5c 5c 50 02 aa b3 15 e4 c7 1d f3 Data Ascii: OGoI'r}Qo%s% sN0kHaV%O.t(#m%-O?kGz#H}?X_wH7&po&Y``+@gb"r%W<yb8V/&@'r{q<"~<S,\|\m\GHDpJHput}Xj\\P
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ac 61 19 44 67 bd 2e 20 02 ba 6b 36 64 75 9a c0 9d 7a 2e 4b 50 02 a2 62 c5 be 38 ae a1 c8 27 d3 16 42 1c 00 0c e6 e4 a9 e3 30 4a 21 cc c9 cd 8c e1 1b 06 02 19 70 27 e5 be 24 c2 f8 0f 21 84 87 e2 22 50 19 94 a5 1b 2c 4a 59 c6 62 e6 72 85 dd ff dc 69 23 18 42 76 80 05 22 be 47 e8 5a 26 28 8c 66 5c 7e c1 87 06 cb 2d ac ec 84 d6 6a 20 0e a0 2c 82 cc 32 ba ce 2c ae 6e cb 5a cd 31 86 cc c6 c2 43 ca e6 a1 c6 34 c3 68 54 23 ec f2 65 ec b4 c7 5f 50 0f b2 9a a2 2c 0a 0b c7 f8 a2 ed fc 0e 2b 84 26 ca 8c 46 09 f3 2a 3b 62 ed 86 90 c1 08 5d 8d 2f a2 c5 1a 32 03 30 96 a3 62 fe 0e 88 6e b0 5c 5a 6a 68 ca 0e d0 06 af 2b 86 a3 01 31 e2 8f 50 c6 2c 16 0f 8e a0 b0 5c 74 6c 0a 63 e6 f1 68 82 66 24 8f 9e b8 0c 67 1a 80 0a 0f e6 5c c6 cc 5e 70 ec ed 82 62 62 e0 70 62 f0 6a cd Data Ascii: aDg. k6duz.KPb8'B0J!p'$!"P,JYbri#Bv"GZ&(f\~-j ,2,nZ1C4hT#e_P,+&F*;b]/20bn\Zjh+1P,\tlchf$g\^pbbpbj
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 02 e1 02 2e 50 6e c0 1d 92 88 9a 03 05 61 12 fe 86 db 25 87 03 aa dd 59 f4 d9 0d 4a e1 6d 7c 0f da 1d d0 bf 28 61 16 4e e1 16 6a 60 05 d6 dd 64 dc 5d 97 2c 40 8e 15 9e 43 00 5e 47 cd 4c b1 cd 97 0b 99 a1 ce e4 8c b3 51 9b e2 d9 de 54 68 88 ff 84 f0 0c 47 49 db 7e 4d 1e 31 98 c3 82 00 d1 87 34 cd 88 14 11 16 58 01 14 e8 40 e8 15 82 12 70 81 15 90 9e ba 01 15 ba 49 01 97 e4 c4 1d b4 9e bb b5 03 3d 10 8b 19 fc 48 16 b0 04 c0 c9 07 f2 b0 c7 de b0 4d 96 d8 11 17 f1 1e 95 88 22 df 90 62 dd a5 5c 25 ba e2 2b ba 1b 43 e0 15 2c 02 c9 03 3c c0 1a 74 5c 7b 18 a0 01 80 20 3d 35 83 bf ec 4f fd 00 e1 09 06 63 62 a8 13 b7 70 61 32 6a a1 16 8e a0 f8 94 60 0a 92 40 34 4a e3 34 46 23 0e ae e0 0c ba 60 61 70 20 fc 54 da 32 62 9a 32 82 e3 07 ee 20 0f fa 0b 06 2d 63 06 1e 13 Data Ascii: .Pna%YJm\|(aNj`d],@C^GLQThGI~M14X@pI=HM"b\%+C,<t\{ =5Ocbpa2j`@4J4F#`ap T2b2 -c
2025-01-02 05:12:36 UTC	15944	IN	Data Raw: 0e 23 04 9b e0 86 24 7c 39 35 93 9a bc 7b 43 9f d3 04 c2 73 1a 0e 1b 05 05 00 42 4d dc 44 4e ec 44 4e 4c c2 41 2c 06 42 f8 02 52 2c 45 53 9c b9 39 bc 42 22 1c 42 2c fc 82 88 0b 9b 36 78 c3 a8 c1 39 49 b4 bb 38 9c 1a 5a ac 45 9e bb c5 5d ea ff b0 51 34 45 60 44 c5 2f b0 89 46 6c c2 9a 40 01 35 00 32 97 5b 87 51 b0 09 64 fc 30 33 c3 c1 9a e0 41 22 60 c5 1d 5c c3 a5 c1 07 6d 78 33 ed c3 a0 66 a8 26 3a 23 1c 96 50 bd bd 61 3d fd a8 ad 59 e1 28 e3 b8 ac 58 b1 9b 41 73 2c 72 98 96 6f 22 87 e9 30 07 5e e1 9b d9 e0 15 ef 10 be ed 10 2d e4 3b 3e 4c 1b 8d 7f 8c 22 7d ca 02 4e 53 02 ea 03 35 96 d0 81 1f f8 81 6e 64 17 c0 e8 be fe c3 10 47 62 08 f1 ab 9e 60 a8 2e 8d 9c 87 8b b4 b5 23 a8 ae 06 38 91 f8 db 3f ea d1 88 f7 ea 97 8d 82 1d 2c d8 18 a9 e8 48 f7 5b 98 89 94 Data Ascii: #$\|95{CsBMDNDNLA,BR,ES9B"B,6x9I8ZE]Q4E`D/Fl@52[Qd03A"`\mx3f&:#Pa=Y(XAs,ro"0^-;>L"}NS5ndGb`.#8?,H[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49785	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	601	OUT	GET /i/2024/12/05/200-200.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	615	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 190607 Connection: close Accept-Ranges: bytes Age: 0 Cache-Control: max-age=43200 Etag: "67516cd6-2e88f" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Thu, 05 Dec 2024 09:05:26 GMT Vary: Accept-Encoding Via: cache34.jnmp,cache04.hnlycm01 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 4d865f147794bdba2cb716723b70fce9 X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:36 UTC	15769	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 e6 7f 00 ff f2 92 e9 04 ee ff fc 02 55 01 76 d6 b1 fd 6a 0c dc 6b 02 90 03 e6 ee 87 05 b2 e0 a1 9e f2 d5 fd 9d 63 a7 03 ef 16 a5 8e ab ff fd 6b 70 01 ad dd 5c ef ef bb 24 4b 00 90 94 5d 13 ff f7 50 d0 ab 54 33 00 8b 4f 03 b3 b4 a2 d0 f4 ce 2d fa da 45 f9 d8 6b ad 5d d8 94 01 ce fe d5 02 ff b6 03 71 59 96 05 02 23 dd cd f6 ff fe 2b a7 6b 62 ff 67 67 22 00 52 ff 09 08 f7 d7 d3 bb 01 d0 d6 d1 d7 0d 00 4e cd b6 cb 5d 4e 6f f2 d7 b2 8b 0d f0 be 8c 56 d6 b3 35 f1 d7 93 cc 6e b6 f2 b7 fc cf 91 f1 9b fd fb b2 83 29 be 24 f4 b2 2b d2 f6 b6 c8 cf 8e c8 2f 2f 4d 7c 2b af 94 2b c3 b0 10 eb 76 27 8c ef 86 fc f4 8d cc d0 97 31 80 fd 92 4b 2d 7f 35 2d 69 10 00 69 de c2 8f d6 ff fd e6 ca 54 05 6b 57 8f 23 f1 dd cc 2c 6d 2f 15 00 5a 05 df c3 Data Ascii: GIF89aUvjkckp\$K]PT3O-Ek]qY#+kbgg"RN]NoV5n)$+//M\|++v'1K-5-iiTkW#,m/Z
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 77 d6 14 69 a5 a1 96 25 6f b8 10 04 58 7f 40 a0 83 7b b4 b5 08 80 03 71 12 02 81 10 e6 a1 f2 86 0e 24 41 c0 c7 91 81 fd 31 85 0e f7 15 45 59 a0 53 08 d1 df 27 44 fe 61 64 65 50 8c c8 46 82 4d 1a 35 d5 0c 51 c0 49 51 5c 73 59 c7 19 04 99 32 b2 05 38 11 19 c4 47 98 87 1d 95 24 78 20 22 66 88 9f 00 38 b6 ca 9c 09 04 6a c8 14 2e a8 a8 63 4c 82 90 26 88 10 87 4d f5 ea a2 8e d6 82 c8 b1 d9 58 1a d3 14 7d 4c 9a 5c 4c 33 6c f1 6c 00 15 8a aa 1e 84 7b 45 17 00 a6 83 98 06 80 b6 2e dc 27 5e 21 dd 4c 73 e6 24 db 55 32 45 30 ea 39 70 64 25 33 95 22 a0 ad 8a f8 6a e7 a2 b9 d5 92 14 2e 93 6d 24 44 71 53 21 91 17 67 db 3a 09 09 24 03 67 5b 25 a6 a2 36 f4 2d 66 32 80 69 6f a2 ac 72 c2 eb ff 46 ee b9 4b 2f 66 85 74 34 2f 4e 1b 4b 35 88 0e 45 32 2a 8b 5a 88 e0 92 8b 51 82 Data Ascii: wi%oX@{q$A1EYS'DadePFM5QIQ\sY28G$x "f8j.cL&MX}L\L3ll{E.'^!Ls$U2E09pd%3"j.m$DqS!g:$g[%6-f2iorFK/ft4/NK5E2*ZQ
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 90 6b 08 1a fb 47 8c 52 55 a2 f9 04 ea 19 8e ca 4c a4 3a 97 a9 23 65 65 50 15 a9 82 a2 2e 33 9f 48 94 ed 4f c7 48 87 db 2e 31 b7 bb ed 6d ff 0b b0 3a 48 02 7e d5 59 16 90 a2 fb 02 85 5c 4f 2c f7 7f 6d b4 6f 4c e9 ba 52 53 ea 53 bd 0d b5 6e 81 91 59 4c 16 ec f5 c5 dc 24 65 7c 5b 50 57 d0 96 34 98 18 40 6a 4a c9 08 d8 62 2a 96 96 a6 55 e7 02 9a 19 82 31 2c 36 a3 e8 64 68 7e 51 50 d4 99 f2 f3 af f9 95 43 56 4d 2b 52 5a 4e b2 0b 78 c8 6f 29 b9 59 c3 fe c9 76 9f 79 48 aa 55 97 f8 5d c0 fa b7 94 0d a8 f0 03 07 a0 88 3e 11 b4 ac 14 2a c5 01 97 10 d1 02 53 15 bd fa 14 e6 7e 31 ca 5b 3a 78 31 a5 ba 55 e7 8b 03 cb 60 c0 56 f9 0c 28 68 af 46 d1 6c da ea a2 d4 c7 ef 65 67 8a 9b c9 c4 a1 12 79 8c ce fd ab 0a 16 4a 53 62 36 98 c1 32 9d 31 8d 69 3c c9 e9 72 94 a6 e8 ac Data Ascii: kGRUL:#eeP.3HOH.1m:H~Y\O,moLRSSnYL$e\|[PW4@jJbU1,6dh~QPCVM+RZNxo)YvyHU]>S~1[:x1U`V(hFlegyJSb621i<r
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: a9 5e d4 b5 68 bd c5 59 e6 42 09 e4 be 94 3d 2e 01 87 55 d5 f9 d3 b3 50 a3 a9 25 79 06 4c 49 c0 56 73 7a 84 a6 f0 7d 8b 37 df 71 1d fa 0e a2 87 3f b8 e7 04 f8 01 4c ef 94 82 07 a0 80 29 32 57 0a 53 0a 31 96 18 a9 9c 21 7f 97 b0 40 23 6e e4 8f fd f4 c3 25 0d b3 12 98 5a a7 34 a1 10 2a 84 2a 6a 46 eb 0a 73 1b b4 51 6a 4f 21 f1 82 72 d4 02 28 6a 55 e6 83 67 70 c3 60 f0 d3 8f cb e4 8c 59 3a 62 59 ae a8 73 15 93 95 ca 64 48 a1 0f 1a 9b 28 2c 05 61 05 3f 67 a9 d8 65 44 82 43 4b dc 89 11 61 93 9a 78 a2 06 1d 3c c0 41 52 3a 80 99 d4 3e 53 c2 05 29 68 25 63 aa 4f 97 5e d4 b7 24 dc 88 20 2e 64 62 63 44 b2 a0 ee 20 09 2a b0 bb d8 7b cc 26 48 c0 5d 45 ff 90 0c a2 0b 0d a1 d2 c2 a0 88 c4 70 42 89 5c 33 96 92 14 d8 45 6d 16 c1 23 44 be 24 71 47 42 d4 72 10 57 50 00 bc Data Ascii: ^hYB=.UP%yLIVsz}7q?L)2WS1!@#n%Z4*jFsQjO!r(jUgp`Y:bYsdH(,a?geDCKax<AR:>S)h%cO^$ .dbcD {&H]EpB\3Em#D$qGBrWP
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 97 76 88 1c 4c c6 5b e0 03 9f 9b 00 65 2c c4 1d fc c0 46 ac 8d 1d 90 c4 64 bc c4 35 96 bd 0e 40 01 6e 4c 01 1b 10 c5 9c 08 6a 75 4c c6 f0 19 c2 0b 56 ca f1 16 6c 96 d0 01 33 a0 c9 65 4c 01 00 70 c6 12 e8 71 f2 b7 03 99 fc c0 14 00 c7 7a 47 86 81 d9 01 1a eb 02 ac 7c cb 05 50 8c 2c 40 c6 14 d0 00 c5 58 c2 bf bc 00 c8 c8 01 b5 4c 01 34 ac b1 08 30 00 4c 66 c8 cd bc 01 d6 f7 c9 1b dc cc 42 dc cc 91 8c c4 bf bc ff c4 46 86 c9 ac 4c cc 9d 2c 01 e6 7c ce e8 8c 00 be 6c cb 0e e0 03 e8 fc ce 53 27 01 16 fc b0 70 26 08 6a bb 08 08 90 00 23 40 01 fc dc cf 0e c0 01 50 bb 90 9a 38 6a bf db cf fc 0c b8 bc db bb 49 09 01 d0 aa 02 6f 60 d0 32 d0 d0 71 60 d0 51 d0 d0 00 00 d1 d1 8a 02 06 4d 01 50 20 02 3a 30 03 50 1b 6a e0 9b c9 fc ec 00 08 d0 70 9c 88 c7 06 1d bf 81 dc Data Ascii: vL[e,Fd5@nLjuLVl3eLpqzG\|P,@XL40LfBFL,\|lS'p&j#@P8jIo`2q`QMP :0Pjp
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 19 b9 c6 7c f1 c3 95 8c 70 0c 56 36 e3 bc 5a 3a f3 99 9b 2b 84 2b 2b d9 43 1d 51 65 35 ff 34 3c a3 3e 82 39 cc 3f 48 e1 9b df 64 65 23 a6 12 4a 1f 22 b3 33 cd f4 c4 66 56 40 a2 54 6c 86 33 d0 c4 e2 3b c3 37 4f 65 3e d3 13 cb c3 48 3e 33 51 ce 7d 54 85 87 a6 cc a6 30 13 d9 4d fc e4 af 00 6a 04 a7 45 9c d7 cf f5 61 71 11 1c 33 8d 04 0c 40 51 03 0c 80 7f 0d 6c 26 2c e9 f9 87 01 4c 94 a2 12 c0 28 2a 34 fa 4a bf 99 e8 84 1f 05 29 f8 36 73 ce 4f 1a 93 7d b1 ec 26 2b 1f 80 80 0e a4 20 05 a5 4b 41 07 76 fa 80 46 62 62 90 87 f0 24 49 0b 71 84 cc 19 a0 a6 3f 98 02 04 96 0a 01 ae d4 cf 00 e1 82 67 24 39 61 a1 3f 48 e0 01 1d 48 2a 53 97 8a 83 14 20 c0 00 12 70 05 67 86 aa 27 93 1a 15 01 29 d8 ca 56 9d fa 55 33 e4 4c 1f 61 24 24 1e 05 ea 08 ac 0a 29 08 f1 50 80 1b f6 Data Ascii: \|pV6Z:+++CQe54<>9?Hde#J"3fV@Tl3;7Oe>H>3Q}T0MjEaq3@Ql&,L(4J)6sO}&+ KAvFbb$Iq?g$9a?HHS pg')VU3La$$)P
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 1d 4d b3 2e 4d 8f 21 e0 93 9b 98 a5 35 1d d1 15 7d 8b 90 cc 0b 23 cd ab 5a 5c d3 3e da d3 67 80 9f 77 fb 8e 66 0c c4 18 7c 5b 9c 00 19 f2 44 cd 72 50 d5 56 5d d5 08 2d 07 34 ab cd f3 31 85 04 4a d5 59 ad d5 15 5d d5 a2 bb 07 31 bc 0d 74 6c 56 c1 c7 9e 58 dd cf 58 fd d6 07 4d d6 58 18 d4 43 ed 15 dc 5b 95 6e 20 d6 fc ac d5 56 bd d0 58 1d d2 8d 5a d7 41 fc 0d fe 20 01 37 99 d7 57 9d d8 7d 7d cb a9 ba 14 c8 70 48 34 8a d8 8a 3d d9 5a 7d 98 00 1d b0 26 6b 87 21 00 02 70 70 8b 94 fd d9 e1 89 01 28 4a ba d3 cb 89 51 2a d9 9f 7d d5 e1 a9 02 90 1c d8 4f 7d 71 e5 bb 14 2a 0d 19 87 ad d7 15 ed 7e 0d 60 d6 02 77 ac c1 67 ff 9c 74 60 d4 fb ac d5 b8 ad a0 ee 61 b2 56 41 2e c1 67 04 2c f0 db c0 2d d6 a9 99 9f 82 bd 57 c1 a3 7e 79 0d dc fb 4c 07 e8 9c 9f 78 15 cc 50 bd Data Ascii: M.M!5}#Z\>gwf\|[DrPV]-41JY]1tlVXXMXC[n VXZA 7W}}pH4=Z}&k!pp(JQ}O}q~`wgt`aVA.g,-W~yLxP
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 4c a1 06 53 f8 f2 78 a8 c1 88 10 01 1b 55 21 0a 76 99 90 85 87 1a 0a 90 90 02 90 e2 ac 95 98 a1 69 4a 79 51 50 fc 29 1f 88 98 cb 77 4c a2 57 5b 28 64 9e 17 32 ac 24 fa 5a 8a c8 da 62 5c b0 15 52 23 5d 4b 89 01 70 50 14 cb f9 43 53 e6 52 80 77 f4 e4 32 b5 58 2b 3c c0 71 52 ab 12 f2 29 a0 e8 2c ff bc ec 40 18 17 25 63 3e 2e 12 2e 6d eb 3a 5d 78 3d e0 66 55 25 a8 69 79 88 d9 49 dc 96 6e d2 45 df 6c 2b 31 4f 7e 8c b7 ba e8 5d 60 1c 79 38 89 ee c2 eb 05 a5 fd 83 7b 6d 11 5e f4 66 57 1f 87 29 ec 71 91 9b de fe a2 37 b7 b7 80 07 65 2f 09 8f 5a 08 70 16 3a 0d a6 7f 4b 91 96 fc e5 d5 a4 0b 8e 30 33 e1 75 3a 13 5c 37 b3 f9 a8 85 37 1d 05 8f 33 f2 a3 a2 93 d8 f0 24 e6 39 8b fb 26 a9 ae 76 c0 93 84 57 7c b3 5a 70 50 c4 be 51 ee 94 e4 28 5f 10 87 c2 c4 da ad 9b 8c 4d Data Ascii: LSxU!viJyQP)wLW[(d2$Zb\R#]KpPCSRw2X+<qR),@%c>..m:]x=fU%iyInEl+1O~]`y8{m^fW)q7e/Zp:K03u:\773$9&vW\|ZpPQ(_M
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 58 f1 05 ff 92 8a dc 9d d6 46 99 14 08 68 f2 8f 10 90 40 08 48 f9 87 07 04 21 92 6f c8 01 b2 12 61 43 46 90 a5 75 91 83 25 20 85 80 b3 55 ca 49 67 cd 48 c4 fc 62 24 08 1c 9e 12 8b 44 8b 8a 19 80 58 88 86 40 30 92 8c 24 1b 4b 24 90 03 26 46 72 07 0f e0 d0 25 15 11 09 04 e8 00 00 2e 10 c2 97 24 26 10 0f 19 07 05 91 14 a5 2e 4a c1 1d 53 46 72 06 12 58 c1 29 5a b9 03 58 e6 60 67 9b a0 a6 08 d2 f0 06 00 c0 12 00 7c 98 01 02 84 d4 31 2d 0c 62 00 84 e8 51 71 8a 09 98 7e 02 e0 a1 00 48 00 d1 3c 22 93 6d 92 0b 91 0e 80 28 00 64 d0 48 96 34 34 a3 1a 6d dc f6 24 61 d1 5b c8 63 06 73 81 95 ea f0 27 89 73 6a 34 a2 08 88 c8 03 66 3a 53 0e 38 14 a2 0b a0 a9 4e 1f 50 cf 97 e6 60 25 9c 70 d7 10 d9 00 d2 97 3a 00 0a 83 5a a5 22 fc 92 c7 3d 89 f1 0d 19 75 80 54 25 8a 0d f4 Data Ascii: XFh@H!oaCFu% UIgHb$DX@0$K$&Fr%.$&.JSFrX)ZX`g\|1-bQq~H<"m(dH44m$a[cs'sj4f:S8NP`%p:Z"=uT%
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 37 09 af f6 6c e0 02 f4 6e f8 83 af ee 84 8e 06 6c 1f 07 86 3e 94 f4 c8 f4 6c df d4 c2 d0 01 52 cf f6 2c d0 01 48 1c 04 70 30 f8 f3 4e f0 68 f0 06 6b 8f ed 08 20 28 40 64 d1 c6 3e df c0 de 01 7d f0 06 b6 ff 06 6e 7f c6 33 8e e0 74 7f fb b6 cf 01 2e 70 ed be 6f fb 33 20 01 ce 54 25 ec 4c 03 c3 ef 02 09 a0 03 50 80 ea 50 10 fd cf ef fc d2 af 03 2c 00 05 c3 bf 03 da 9e 27 99 8f 02 b6 ef f8 7f 30 fc b6 bf 03 2e 20 fe e6 7f fe b6 df 06 97 0f 0b 66 60 eb c3 df f6 91 9d 06 be cf 07 39 e0 03 fc 2b ff be 0f 05 08 e0 03 74 00 08 68 6f 83 83 3a 1d 6a 75 7f 8a 8b 8c 7f 4c 3f 38 39 7f 38 1d 95 96 95 2e 84 6f 3b 97 1d 1c 69 6f 00 84 00 50 1d 33 a2 a1 9a a1 39 6a 26 8d 8a 65 26 0f 3a aa 1c 0f 0f 08 b9 ba bb ba b7 1c aa 33 06 7f 6a 8c ae 08 b4 6f 32 1d 7f aa 6f ff 09 1d Data Ascii: 7lnl>lR,Hp0Nhk (@d>}n3t.po3 T%LPP,'0. f`9+tho:juL?898.o;ioP39j&e&:3jo2o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49823	172.67.148.80	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	608	OUT	GET /00165139bb76d845bfa39bde42b929c5.gif HTTP/1.1 Host: go.imgmimi.xyz Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	955	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 29 May 2023 08:54:04 GMT Vary: Accept-Encoding ETag: W/"6474682c-4770" Expires: Sat, 04 Jan 2025 11:56:45 GMT Cache-Control: max-age=2592000 CF-Cache-Status: HIT Age: 2394950 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cJBeoX4M6Q0iNowFqC9jLM2QJgv9ViDKlRpzjExoxEWJwvBC3vlGbfYGtDFUXdNYGKmkQmzzkayqg%2FC%2Fxfl7ieIm7%2Fy51921WNB2e3wk%2FzK1pqDt%2BG7xs3emAkvmd7qzKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841447f3c4238-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1757&min_rtt=1755&rtt_var=664&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1186&delivery_rate=1642294&cwnd=244&unsent_bytes=0&cid=f0641c5d78ff7316&ts=138&x=0"
2025-01-02 05:12:35 UTC	414	IN	Data Raw: 34 37 37 30 0d 0a 47 49 46 38 39 61 96 00 96 00 f7 ff 00 71 cf f4 ef ae 75 ef b4 87 d2 27 0b ff ff ff f3 6c 53 8d d9 f6 05 52 c9 d3 47 2e 2e 0f 08 04 03 05 db c6 8c a8 a1 8a ff ff d8 cd b1 73 fd e6 99 32 ae ea ff f6 aa 51 26 14 0c 6e cf 24 92 da 8c 75 4e 6e 4e 30 13 87 d7 ce 72 32 e3 8a 35 c5 00 00 13 55 a7 d7 8a 4c e5 cb 88 d6 01 00 fa de a4 ea 96 4a 6a 2b 12 aa 97 6b ff fe bc f6 dd 9c d1 35 21 ff fe c5 a7 00 00 ff ff e6 e9 4c 2e c7 b9 8d 91 4f 2a b3 8f 54 ff ff cd f0 04 04 eb d5 9a ce 00 00 d0 eb f4 58 c8 f2 a8 55 2b bc 00 00 fe ed ac 47 16 09 33 2d 27 b6 67 31 72 66 4e fe e7 ac fb e4 a4 d5 90 67 ec dc a5 55 46 31 4a 48 43 e1 c3 7c 26 6b ce 46 b9 ec fe ed b3 d8 d0 a9 ba a8 74 b1 4c 15 47 37 27 f5 b2 a5 ff fe b3 b5 f6 fe fe f5 bc ff f4 b3 e6 cf 96 99 8e Data Ascii: 4770GIF89aqu'lSRG..s2Q&n$uNnN0r25ULJj+k5!L.O*TXU+G3-'g1rfNgUF1JHC\|&kFtLG7'
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: 41 ea f6 f8 10 a9 f8 ee e5 b5 f5 d5 93 6d aa d7 85 7b 64 f0 5c 41 d1 65 17 da 75 6a dc 73 4b 76 71 60 8f 16 0d ec e5 ab 02 3e b4 8f c7 e0 74 42 1e 6c be e4 18 43 77 be 30 22 7a e8 ff 0a 73 e8 f5 ff ff fd e7 b2 ea 8a 75 f5 ec b3 e9 e4 d8 f5 ec e8 ca 1a 11 1a 0f 0a f7 d6 9d dc 6b 52 ee d2 8a fd ed c4 c6 65 44 fb de 9d 67 95 d0 21 78 e6 ed c4 ba f7 f5 bc 90 59 44 6d 34 79 7c 61 36 d4 a2 5d fe df 91 19 a2 e1 f7 ee bb bb 5f 1f fc ee df df 19 13 f6 eb ad eb 7a 16 f4 dc 93 ea e7 c4 b7 87 39 e4 de b6 c6 df ec f6 e6 b5 f8 db b2 86 3b 1c fe f4 ce 01 04 0d b4 11 0c ba 1b 13 f5 f5 c5 73 49 6f ef 4a 1e d2 0a 01 f4 f6 f4 b1 79 63 fd d4 9f 14 21 38 fc e5 bf fd bf b8 f6 cf a4 ec d0 a6 dc a1 90 00 37 c3 f7 f4 cc 19 1b 1e cb 61 56 c6 09 02 a5 25 3d 07 21 13 df eb f3 1f 5e Data Ascii: Am{d\AeujsKvq`>tBlCw0"zsukReDg!xYDm4y\|a6]_z9;sIoJyc!87aV%=!^
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: 4f 4e 4d 4c 4b 4a 49 48 47 46 45 44 43 42 41 40 3f 3e 3d 3c 3b 3a 39 38 37 36 35 34 33 32 31 30 2f 2e 2d 2c 2b 2a 29 28 27 26 25 24 23 22 21 20 1f 1e 1d 1c 1b 1a 19 18 17 16 15 14 13 12 11 10 0f 0e 0d 0c 0b 0a 09 08 07 06 05 04 03 02 01 00 00 21 f9 04 05 0f 00 ff 00 2c 00 00 00 00 96 00 96 00 00 08 ff 00 ff 09 1c 48 b0 a0 41 1a 34 34 24 5c 98 50 83 c3 86 0e 23 4a 9c e8 10 c1 aa 49 12 6e 3c 01 75 24 84 1a 0b 66 6c d8 80 d2 46 4f 06 0e 01 02 6c d1 03 a7 14 0e 59 8d 06 ad 48 70 e4 c8 a4 9b 1c 66 84 a0 a2 47 00 10 10 52 3e b8 5a 11 c2 d7 4c 70 e0 9e cc c0 f8 44 82 99 a7 66 14 78 eb 27 01 87 48 09 4e 7d 1c 31 c8 b5 ab 57 af 0c 15 32 44 a8 b0 2c c5 b3 12 db 34 9b 61 e6 89 17 b7 93 a8 68 f1 a5 46 cd aa 15 46 f4 80 70 e3 2c 19 88 0c 57 64 81 a8 62 04 c7 0c 1b 39 Data Ascii: ONMLKJIHGFEDCBA@?>=<;:9876543210/.-,+*)('&%$#"! !,HA44$\P#JIn<u$flFOlYHpfGR>ZLpDfx'HN}1W2D,4ahFFp,Wdb9
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: 82 54 e1 8b 76 2a ca 80 11 a8 90 ff 08 77 a0 41 12 61 b8 c4 25 4e 69 80 4b b8 c3 16 01 98 91 a1 4e 22 0b d3 0d 2d 03 b7 78 c1 20 5a 61 a9 f6 65 8a 31 1c d0 c3 6c f8 b3 0e 95 d9 73 06 d0 aa 9f 0d 5c 05 0a 0d c2 0e 56 de a0 43 ac 46 e5 aa 8d d8 91 8e 62 da 9a 3f c0 02 bc 6d 1a af 84 08 e0 07 0d 02 d0 82 43 7c 60 04 23 d8 01 18 34 f0 05 37 10 a0 11 ef f4 c0 23 2c a0 19 ed ad e0 4b 6a b0 81 1a cc 20 07 11 b8 43 12 92 28 68 18 c2 70 ca 28 6c d5 ab 06 d0 0b 65 32 20 32 24 6c c2 0d 6e e0 81 1b 5c 31 8b 5e 38 8b 05 22 c8 85 2c 6e 51 84 f9 bc 24 01 5e e0 0f ed c2 13 c3 93 81 89 82 62 f2 07 56 b0 e6 16 50 a0 06 8f 30 45 6c c3 62 a5 00 ae f8 2a 6d 0a 49 64 03 ec 20 0a 84 0c 21 00 dc 08 45 21 db 10 27 0d 94 a0 0d 11 b9 9b 7f c6 23 81 a8 d2 86 49 7f f0 67 40 05 3a d0 Data Ascii: TvwAa%NiKN"-x Zae1ls\VCFb?mC\|`#47#,Kj C(hp(le2 2$ln\1^8",nQ$^bVP0ElbmId !E!'#Ig@:
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: 8c 37 82 65 20 04 92 40 79 84 c0 06 ca b8 0d 06 50 8c 23 08 0b 32 40 33 75 18 79 d4 18 70 f9 10 46 f6 57 84 29 30 0d cb f0 88 8f 98 06 69 50 05 c5 80 05 9e e0 88 de b8 0d f4 50 0a 29 d0 61 b0 17 8a e3 e5 24 50 38 76 99 54 52 16 74 41 ac e8 68 04 93 7b 28 f7 05 9f d0 00 b1 c0 4e 9b 30 1c a2 60 8b 29 d4 08 6c e0 4e 17 b8 5f 58 43 07 03 e3 0f e1 d0 7c 25 78 8c 31 80 82 e6 f8 22 31 50 06 b0 40 82 24 08 0b 94 f0 22 51 00 0b d3 28 04 65 00 01 fe f6 0e 09 00 05 f0 d7 06 ed c7 07 6d 40 0f de 98 09 62 50 02 08 c0 7e 08 98 06 99 10 2e 04 ff 40 0f a9 f0 0c eb 27 0a 05 70 1a 36 50 5d b2 a7 52 16 24 68 80 06 0e f1 a8 3b 03 b3 68 5a c8 85 0b 81 00 75 50 05 75 b0 0c d4 60 07 6c d0 02 8d c0 8f 76 40 0d 6d c0 06 02 b0 2c e6 90 90 74 e4 24 4e a2 20 78 30 87 b0 10 05 15 e9 Data Ascii: 7e @yP#2@3uypFW)0iPP)a$P8vTRtAh{(N0`)lN_XC\|%x1"1P@$"Q(em@bP~.@'p6P]R$h;hZuPu`lv@m,t$N x0
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: c1 ac 7b 01 7d 50 08 89 40 0b 30 ac 01 b9 2a ab 8d 98 09 9b 10 6f 30 5c bf 09 72 b9 34 fc 04 3e e0 08 47 70 ba 38 bc 21 62 4b 41 08 63 4d 0f 23 80 0a 50 09 10 d0 07 71 db be 14 d0 38 8f a3 ab 8e c3 96 2f 22 09 13 70 07 43 1c b7 71 9b 05 85 e0 07 56 5c c2 84 6b 05 9f ff c0 98 be f9 22 9e 60 05 2f 4c b8 82 9b bc fd 0a 0e 33 bc 6d 00 52 13 80 50 13 aa 71 c9 03 08 41 c8 92 2c 22 cb 25 ae 72 03 80 10 1f 16 70 04 0a 42 72 03 73 03 85 d0 07 ed 1b b7 13 30 97 e6 e8 88 51 80 08 46 ac 8c 2b f8 9b 13 10 cb b1 6c b7 59 50 0f 03 30 05 9f 30 cc c9 bb b8 03 a0 01 9b c0 96 8c 10 c0 c6 2c 6f 93 0c a3 03 60 3b f3 e9 0f e0 70 04 37 70 03 74 20 0d 47 e0 03 37 f0 c3 3b 76 3b 38 16 ca 2e d0 0e d6 70 03 e0 f0 5d 9d d1 0a 58 81 ca ad f0 04 fe 20 c6 18 f4 0e e4 2b cb 11 ea 88 7b Data Ascii: {}P@0*o0\r4>Gp8!bKAcM#Pq8/"pCqV\k"`/L3mRPqA,"%rpBrs0QF+lYP00,o`;p7pt G7;v;8.p]X +{
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: ff 87 ea 80 bd 0e c9 a4 f0 e9 8c e0 3b dd ec 24 7f 00 a6 1f 09 a7 c0 96 a7 00 0d 91 90 0d a5 8f 06 d7 99 82 d7 10 08 a7 10 04 dd de ed 41 70 07 50 0d 10 56 a8 89 63 c4 e8 59 26 02 09 15 a6 b1 a4 41 03 0c 63 11 23 5a 31 c7 47 dc 13 05 c0 fa f5 d3 08 4c 23 47 7f fd 6e 3c 01 47 47 9a b7 72 74 9e 48 f3 07 aa d5 1e 39 ad 2c 58 a0 03 ae 5f c6 8e 1c 69 78 70 a1 46 9b 02 8e e5 36 0e 25 3a 14 98 3f 2f 47 8e 9c 04 05 ee c9 cd a2 44 fd e1 41 15 64 c2 01 6c 58 15 2a 3c 76 ea d4 3b 68 88 08 b0 b9 16 e8 54 bd 03 07 22 1d b8 7a 35 08 26 3f 2e ac c0 68 43 60 db d6 ad db 32 a5 3a 83 40 a2 c4 8a b4 e8 7c cc 69 b4 9f 3f 7f 4f 6e d0 31 09 4e 5a c9 72 47 2a ec 59 97 c3 47 39 6d 37 8e dc 24 dc 8f a7 9a 7e e5 14 78 89 1a f5 23 48 2f 35 c1 81 f3 92 b1 e8 69 7f ca 50 a1 ca 3a 01 Data Ascii: ;$ApPVcY&Ac#Z1GL#Gn<GGrtH9,X_ixpF6%:?/GDAdlX<v;hT"z5&?.hC`2:@\|i?On1NZrGYG9m7$~x#H/5iP:
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: 64 74 18 b8 30 44 47 7b a0 8b 1e 84 34 a4 ba e8 68 49 3f da 83 7d 38 22 6a 87 71 04 0a de b0 84 25 bc c1 04 2d a0 69 0b 4c 00 53 98 be 41 a7 6f a0 69 03 50 f0 53 14 10 20 11 06 9c 11 03 08 c0 00 3a 18 82 08 8e 58 42 0b 7c 00 08 13 fc 53 05 0c c8 01 11 12 71 84 7d 90 c2 07 0c 40 81 0a 1c 41 8a 5f 14 a1 08 2d b8 81 34 54 90 03 27 10 a1 1f e1 f0 aa 2e 18 10 35 d7 e0 f0 9a 77 1c d0 01 8d 68 9a 8a ee 03 05 0d e0 ab 4d 6f ca 04 1d e8 40 13 4c a8 c1 0e 74 b0 83 1a 30 81 09 4b 60 c2 10 04 6b 02 39 a8 eb ff 30 39 48 02 09 04 61 d9 38 d4 a2 06 85 15 44 0f 48 f0 d9 cf 0a 42 10 9a 1d c2 12 66 6a 02 36 a8 54 48 0a 45 c1 11 6e e0 04 50 f8 43 0e 6c b0 8f 08 fc 41 84 24 20 a6 02 45 f0 c7 03 54 90 98 06 00 c2 1f 45 18 01 c8 80 70 04 27 34 00 31 b0 dd c7 6f 6f f0 56 bb be Data Ascii: dt0DG{4hI?}8"jq%-iLSAoiPS :XB\|Sq}@A_-4T'.5whMo@Lt0K`k909Ha8DHBfj6THEnPClA$ ETEp'41ooV
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: 01 db 07 9b 6a 01 36 c0 07 00 39 8c 70 20 00 14 30 81 6e e0 3e 02 50 81 58 48 02 55 20 05 26 80 87 c6 9a c6 1e e0 b3 e3 11 84 11 60 80 29 74 32 57 34 81 9a 93 a9 37 28 02 15 f8 05 5a 04 19 33 cc 9f d0 f3 82 49 98 01 1c 98 01 5d f4 02 ff ec 73 34 01 24 80 f8 6b 00 52 10 30 9d 32 01 be 52 81 70 a8 00 78 20 ba 21 d0 41 4d d8 01 26 18 81 08 60 82 31 c0 33 c4 58 00 4a 5b b5 24 98 c6 40 34 c4 3a 18 83 43 18 85 05 e8 80 58 e8 ae 5f 50 05 98 1a 03 53 78 81 0c 63 80 75 f4 07 40 78 c7 37 18 02 99 6a 81 38 6c 01 52 68 81 05 68 05 ac 5c 00 26 88 03 12 68 85 b3 fb 00 13 70 02 a8 b2 b8 1f e0 ab 22 f0 01 9b 0a ae e4 42 ba 8c 84 1e ec 03 99 04 90 00 2f 90 80 15 c0 01 2a c0 81 49 c8 9c fc 61 b4 15 44 81 7d e0 ae 79 80 87 25 f8 85 5f 30 c2 4e a4 bf 16 f8 2e 2f 5b 06 4d a8 Data Ascii: j69p 0n>PXHU &`)t2W47(Z3I]s4$kR02Rpx !AM&`13XJ[$@4:CX_PSxcu@x7j8lRhh\&hp"B/*IaD}y%_0N./[M
2025-01-02 05:12:35 UTC	1369	IN	Data Raw: 10 a2 00 a9 b6 26 e8 00 67 68 5f 14 42 d6 1b 88 85 50 68 de 17 78 05 7e ba 31 6f 38 dc 0e f8 c9 31 50 29 92 3d 82 21 08 d5 5b 48 d5 3e 5b d6 0c 7b 01 9d 5c df 17 68 81 61 38 8c 1b 88 83 1d 58 80 39 7d 80 b7 72 82 4d 7e 00 1f b0 80 1a e8 80 1a 68 05 1b a8 62 09 50 03 38 20 e3 04 c8 45 30 56 e0 a9 1d 0d bc 1a 8d e9 9c 84 10 98 01 5b d0 82 85 9b ce e9 1c 05 c3 2d 64 41 90 03 0b a0 02 ef 4c 80 e5 1a 83 0d ee e0 12 1a 17 7f 48 04 13 08 e1 1d 70 80 75 e4 58 3a 58 80 43 c8 b0 23 f3 bb ce e3 d8 23 80 87 b9 bb 05 20 70 82 05 70 80 51 00 d7 05 00 02 f3 82 dc 26 08 85 8c 3b 8c 27 e0 85 25 70 82 23 d8 01 53 58 62 20 10 2b 57 b0 b3 46 be 05 62 d6 5d 2f 00 85 10 b0 05 0c 08 01 33 f0 05 49 05 43 23 19 0d cd 91 00 2d c8 00 1c 08 01 bb 03 10 ff 0b 80 e1 5a 5b 00 32 d8 83 Data Ascii: &gh_BPhx~1o81P)=![H>[{\ha8X9}rM~hbP8 E0V[-dALHpuX:XC## ppQ&;'%p#SXb +WFb]/3IC#-Z[2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49783	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	604	OUT	GET /i/2024/10/28/1300-200_1.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	619	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 221556 Connection: close Accept-Ranges: bytes Age: 25136 Cache-Control: max-age=43200 Etag: "671fa4f9-36174" Expires: Fri, 31 Jan 2025 22:13:39 GMT Last-Modified: Mon, 28 Oct 2024 14:51:37 GMT Vary: Accept-Encoding Via: cache89.jnmp,cache06.hnlycm01 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 48092af3c016301cd544feee61e42e9a X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:35 UTC	15765	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 00 00 ca 75 78 94 7f 80 d9 c4 c5 c7 44 52 a2 99 9a a7 2f 3f eb ab b3 fc 04 2c fc 0d 34 db d4 d5 d0 08 2a fc 1b 41 fc 32 54 fb 51 6d fb 6c 84 fc 84 98 fc 9b ab fc b1 bf fc c0 ca ba b4 b5 c3 9c a4 ab a6 a7 8c 75 7a b6 ac af ed d4 dc 9a 86 8d fc ca dd fb d9 e6 e4 cc d6 28 21 24 fb f4 f7 18 16 17 e4 d4 dc a2 8b 97 f8 04 8c fc 04 94 fc 0d 94 f4 04 94 f4 0c 94 fc 04 9c cf 04 84 c1 04 7a fc 0c a2 f3 0e 9e fc 14 a4 fc 1c a7 fb 26 ab fc 37 b3 fc 4e ba fc 66 c4 fc 04 a4 f4 04 9e ec 04 9c fc 86 d2 fc 9c dc 76 6d 73 fc b4 e6 16 0c 15 f6 ec f5 0d 04 0d 5c 54 5c 67 5f 68 35 2f 36 dc d4 e4 4c 49 56 3d 3b 50 04 04 0d 09 0c 17 13 1b 30 22 30 54 18 25 40 6d 7d 88 ba bc bd 08 16 1c 49 6e 76 8b 90 91 a1 b4 b6 04 0c 0c fb fc fc 0c cc b4 1c cc Data Ascii: GIF89auxDR/?,4*A2TQmluz(!$z&7Nfvms\T\g_h5/6LIV=;P0"0T%@m}Inv
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 21 17 b2 22 37 b2 23 27 f2 2e ec 42 1f f7 c2 7f b4 5d 66 b4 5d 25 fb 42 61 55 b2 65 24 46 7d 6c c3 12 e5 42 fd 0c ad 2a 24 49 29 4c d2 92 f0 02 25 0d da 92 a0 f2 92 e8 c2 24 6d 02 2c 73 df f7 c9 f2 f7 dd 05 2c e3 b2 2e e7 0f ff 64 25 57 fa f2 28 f4 72 fe d0 c2 30 8b 32 2e 34 ec f9 9c d7 59 3c a7 8c 4c a1 33 ca ac 8a 30 a1 8b 6c 05 98 01 12 8a 90 99 12 8e 19 1d 15 c5 88 d0 03 1d 49 83 1d 41 21 86 c0 04 89 bc 51 89 64 84 32 1c 8c 59 20 0c 72 49 6c 97 1a cc 2d 44 ac ef 38 ff 57 3c 1b cc 37 4c 83 13 ca 93 db ee 33 3f f7 b3 3f ff f3 e2 16 6e 3f e8 a7 dc d2 43 13 ec ed 82 2a 68 23 2a e8 b7 25 b4 3f 51 5b e0 76 4a 82 0a b4 e1 2a ae 20 22 ae e5 5e ee e3 76 4a 46 23 ee e0 32 9b e6 f2 03 e9 3a e2 e3 6a 74 45 27 6e 47 5f ae 46 43 ae e6 62 2e e4 5e 2e e6 f2 83 10 7c Data Ascii: !"7#'.B]f]%BaUe$F}lB$I)L%$m,s,.d%W(r02.4Y<L30lIA!Qd2Y rIl-D8W<7L3??n?Ch#%?Q[vJ "^vJF#2:jtE'nG_FCb.^.\|
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: e6 c1 a5 e6 6a 1e dc c6 c5 66 6f 94 e6 6e bc 66 c6 e8 46 b6 1d 5c c1 45 db 67 84 8c 52 f1 a3 03 9b 1a d5 55 67 2b 3d dd 76 46 c9 e6 85 67 e5 7d 85 5d 78 dd e6 1d de 78 06 de 76 5e 67 e6 e5 67 7e 6e 5e 7f 7e 85 a5 09 68 e6 1d 68 a7 09 df 90 7c 85 ed 05 e8 82 e6 e7 76 36 de a5 59 1a 53 28 05 89 0e 5f e6 1d 54 ee 7d 5e e6 3d 5d 85 86 e8 8e 66 e8 a5 9c e7 a7 a1 49 e6 5b df 4f c9 54 9c d4 54 a0 14 4a 51 ad 07 49 81 97 06 64 06 52 28 05 fc bd 5f 4a ab 55 01 2e c0 ff 05 30 9d ff c6 69 00 e4 55 fc 12 9a 66 b2 19 39 93 a7 96 b1 06 61 c0 05 5d a0 85 ba 4c 60 9a b1 18 b0 40 a7 9a 69 2f 2c ba c0 ec 90 0f 97 f1 98 ba 84 8f 2f b3 33 0f 04 34 05 7e 4c 66 4d cc 18 3e 41 69 50 93 13 fc 4b 5b 58 cc 13 ac 26 7a 20 4c 15 8e e1 02 7a 57 ee 69 d7 07 5e 07 34 09 85 79 f5 cc 50 Data Ascii: jfonfF\EgRUg+=vFg}]xxv^gg~n^~hh\|v6YS(_T}^=]fI[OTTJQIdR(_JU.0iUf9a]L`@i/,/34~LfM>AiPK[X&z LzWi^4yP
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: e8 94 1c 70 0f 9d 00 0c c4 51 0f 94 25 1b 11 ca 3e de 93 5a 9b 65 5a db 30 d1 14 30 d1 f5 f0 3f 46 1a 3f bd 5b 5c c2 60 11 08 e4 42 42 d3 21 0e f2 8d 1e 32 20 20 e2 42 14 e2 d3 42 1d bd e2 05 bd 2b d4 42 19 61 08 c2 80 09 45 0b 5f c3 ec 22 86 20 23 a4 e0 54 53 2d 0b 94 13 90 67 71 a7 f5 35 cd fa d5 04 56 f0 05 5f 10 06 fc 7b 44 53 50 05 50 20 d6 46 72 05 5d 00 d6 6c dd d6 6e 1d d6 57 c0 5f 53 10 06 5f c0 05 62 a0 44 73 0d 05 60 10 d7 fd bb bf 7e fd d7 80 3d d6 52 d2 0f ff 5f 6d d7 42 62 bf 88 7d 05 54 f0 05 62 80 d8 f6 3b 05 5f 5d 05 8d ed d8 f7 3b 24 6f b0 bf fe 90 04 62 f0 05 55 60 05 59 e2 07 fd e0 25 4d 10 26 f4 30 d7 9c 6d 05 0b 6c 1f 6a 12 20 0e 16 61 6c 12 c1 13 e6 03 60 80 05 54 40 db b4 bd 06 b8 4d 05 b8 fd 05 6b 00 d6 bd cd db 5f a0 06 c2 3d dc Data Ascii: pQ%>ZeZ00?F?[\`BB!2 BB+BaE_" #TS-gq5V_{DSPP Fr]lnW_S_bDs`~=R_mBb}Tb;_];$obU`Y%M&0mlj al`T@Mk_=
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ae e1 15 5e 16 1b fe d5 f5 a8 98 1a a8 01 1d f6 a9 1e d5 2c a1 48 83 68 0b cd 22 51 0a 38 6c 0a 75 72 20 36 5c b4 f8 84 54 cf 5a e7 48 99 96 69 f9 21 49 bf c1 f4 e4 b8 6a e3 8c 38 e6 16 47 8f f4 fa 12 27 90 23 5b b2 27 bb 47 c8 76 41 4c b2 90 e9 e1 90 8d 94 1f 12 19 42 3e 60 6d 57 72 4b e3 16 7e 78 6d 07 ea ef d4 68 6a 44 72 60 93 df 54 93 43 c1 4d 8b d2 70 19 77 4e fb 2f 72 29 17 72 45 59 b7 77 5b b7 6d 1b 94 31 2b 4f 11 f0 4e 44 b9 4f 28 57 4f 2a c8 4f c3 24 af 50 90 ff b9 b3 4d 4d 2e a8 dd 22 35 08 2a 80 1d 40 00 04 76 70 76 77 50 77 3f f5 98 37 25 77 3b 05 2f 99 19 99 7f 77 9a cb db bc 2b 21 e2 28 53 5a 1e 4e 9b bf d9 e3 ce 68 31 a3 65 9b a1 d7 5e 98 15 0b 75 6e 33 b9 45 bf 39 b3 e2 a6 c5 9d b7 57 0c c7 97 34 47 f3 0b 29 ee 59 f3 39 34 c9 d0 bd 08 3a Data Ascii: ^,Hh"Q8lur 6\TZHi!Ij8G'#['GvALB>`mWrK~xmhjDr`TCMpwN/r)rEYw[m1+ONDO(WOO$PMM."5@vpvwPw?7%w;/w+!(SZNh1e^un3E9W4G)Y94:
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: a6 ac b6 00 3e 32 f6 b6 c3 3c 48 cb 71 8d d0 f6 4a 73 04 c6 25 f8 8e af 6e 93 d9 99 ed 43 36 67 b3 3a 70 33 ba 12 f7 bd 9c c2 b4 86 b3 67 ea cb 32 d5 ef cf ac 02 37 ac c2 32 1d 53 cf f8 8b af e1 82 2e 10 43 bf a8 1a a0 a9 da a8 69 83 a9 21 21 34 c0 ab a2 39 c3 37 94 8d 8a c5 43 00 64 40 af 1d a5 3e 67 61 d5 6c 21 35 60 30 c2 d2 94 30 bc 43 4e f5 84 32 b8 43 4d c2 d1 7e 53 1f 0b 6b 1b db 84 02 45 4b c3 07 f8 01 3d a8 f0 b4 9d 14 48 20 1b d8 94 44 71 26 db 83 97 8d b4 39 ff a7 4d e0 30 48 7d 83 3b 90 1b 33 74 aa 29 68 b6 11 b7 6c 8f 11 a2 27 78 02 4d 37 b1 77 e2 74 8a e7 f4 e1 58 a2 7d 8a 5c 52 21 f5 50 b3 c5 8c 77 05 7c 7a f1 1a c7 78 8e f7 27 c9 45 75 8f fb f8 8f 03 79 90 53 48 87 58 f5 85 64 6f f6 36 1e 57 87 90 57 8b 75 93 3b f9 93 a3 90 ef 8d d1 9a 18 Data Ascii: >2<HqJs%nC6g:p3g272S.Ci!!497Cd@>gal!5`00CN2CM~SkEK=H Dq&9M0H};3t)hl'xM7wtX}\R!Pw\|zx'EuySHXdo6WWu;
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 86 e7 38 b1 72 04 b8 30 b6 09 69 ac 37 2f 7e d5 eb d8 6a 47 53 a4 81 23 63 6e bc 62 34 ee 37 c5 43 0a 73 91 bc 16 b2 85 60 7d e3 ae 88 f0 76 24 98 89 bb 63 64 0d a9 87 c9 63 8e e3 38 67 ed 63 d8 33 89 68 65 9c 83 34 64 b9 a3 18 99 5a 1c 70 ed bb 47 86 19 89 7c 2a 9b 4b 99 9e eb e4 4c ce 86 75 95 f1 9f e1 15 7b b8 49 b4 19 d8 b6 79 c9 9a 1c e5 7e f5 71 b7 ea 71 b7 d2 ba b3 4a e5 ad 9b b6 24 4f d8 1f 35 e0 10 d9 c1 c3 f6 1b 87 b5 e5 9f 42 aa 64 08 66 13 cf 2b c3 21 e6 8f ff a8 bb c1 e1 06 5d 2e 08 7b 21 08 6d 08 07 78 50 06 70 10 87 6b 0e 07 70 18 3c c3 6b 09 88 a3 97 d7 b1 05 d3 1b e7 78 2e 1e a3 18 0a 9f 55 8a cb d3 bc f7 ee 4b da e2 59 d3 fa d5 d2 fa 06 e1 2a 0b 77 00 0b e2 92 da e4 e2 67 eb 19 05 81 26 99 b5 db 5a ca 34 68 af 9d ae f0 a4 b5 24 20 4d f4 Data Ascii: 8r0i7/~jGS#cnb47Cs`}v$cdc8gc3he4dZpG\|KLu{Iy~qqJ$O5Bdf+!].{!mxPpkp<kx.UKYwg&Z4h$ M
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 80 36 44 43 bd 00 81 17 b8 6a aa 47 91 c4 c1 09 ba b7 10 b4 b7 46 42 20 10 1d 79 7b bf f7 0f 93 30 92 94 30 09 8b f0 0f fd 80 92 03 41 0f 92 40 09 22 29 10 8c 30 92 8d d0 64 ff a0 08 8d e0 7b 8c ff 70 92 17 d1 08 8f 30 09 89 80 7b b8 87 10 89 e0 92 b8 a7 93 11 d1 64 9c 40 1d a6 d0 32 fa 26 5a 2d 03 6a f4 86 6b ce e7 18 64 95 56 66 86 24 93 f1 33 e2 b1 95 da a3 38 5d 09 27 40 a5 3d ea e7 3c 90 26 3c f8 47 96 2d 05 7f 7f 66 22 2f d2 23 6e b9 3c 2a c2 3c f5 c7 22 f8 27 68 e3 87 90 98 e6 80 10 d9 4e 7c 09 0b 08 e8 1c 08 f8 97 06 e8 97 7e b9 94 d4 61 4f 9f f6 90 11 59 81 ac 97 1b a9 46 3f 56 35 6b e8 c3 81 9f 75 1d 1e e8 81 22 38 82 cd b0 99 b3 d0 0c 9d c9 99 2c 18 9a 2d f4 0b b3 40 9a c3 f0 82 a8 79 4b 8c 67 34 be 84 77 34 58 0b ee 00 0f 08 53 3c 71 f7 74 eb Data Ascii: 6DCjGFB y{00A@")0d{p0{d@2&Z-jkdVf$38]'@=<&<G-f"/#n<*<"'hN\|~aOYF?V5ku"8,-@yKg4w4XS<qt
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: cb c2 96 6f 54 18 25 55 ce 2b 2d d0 c2 2b bd 52 cc ba d2 8c 8c 82 26 f4 6f c4 f0 42 c4 b8 4f 2d dd a2 14 5e 02 1b f0 a8 5e be c5 fe a0 01 c7 e4 af 22 ce 25 16 e8 05 22 e2 8f 2f db 6f 5e bc 05 25 ff 8c 83 39 0a 47 56 8e c2 bc a8 8f 2b 55 01 bd ce 8b 31 19 86 27 fc 25 1b ea 04 4f 28 c6 2a 68 88 cb 5a a9 cb bc 0c 02 61 e9 29 66 49 71 cc 0c c5 30 30 30 6e 66 31 ea cc 34 4d 33 26 85 e1 18 14 82 16 e4 61 1d 6a c1 16 6c 6b cf 72 80 1e 76 60 88 fc 20 07 3a e0 1b 6e 00 24 7a d3 23 26 87 72 74 03 37 c4 46 6c 86 13 41 c8 06 37 78 40 09 84 33 10 7d 60 1d 2c c0 71 e8 c6 2d a8 c3 56 9c 83 18 fe 01 57 18 67 d6 92 e3 57 ec 68 58 1e 27 d8 22 a7 23 b0 50 d4 aa cd d0 ac 29 11 11 91 a4 d2 93 9a 68 10 08 4a 0d 38 20 0f 68 70 01 9f 04 02 0e 01 0a a0 96 23 39 ea f0 6f 74 cd 26 Data Ascii: oT%U+-+R&oBO-^^"%"/o^%9GV+U1'%O(*hZa)fIq000nf14M3&ajlkrv` :n$z#&rt7FlA7x@3}`,q-VWgWhX'"#P)hJ8 hp#9ot&
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 22 cb 32 99 1a 45 a9 19 e4 08 60 69 3e c7 25 50 1a 07 f2 91 07 06 07 a3 55 a0 e1 64 da 70 e8 86 07 be 26 71 38 c2 a4 b5 0d 08 ce c6 09 1e 87 dc 3c 8e b9 b5 60 a8 89 d5 75 70 c7 ff 91 1a e7 84 66 ff 45 29 27 e8 7c ce e8 84 07 2f 88 ce aa f9 e0 b1 60 14 11 2a 13 75 f2 42 b2 e9 c2 28 24 61 77 e2 1a 50 31 e1 13 ee d4 4b c1 14 14 4a 61 f4 34 48 8a 58 21 16 d2 42 7a 80 03 2f 68 0d b6 45 93 b4 81 21 35 41 9b f8 74 cd 51 6d 1b 37 99 cd 56 69 95 57 91 9b 1b de 0f 1c c6 21 72 96 95 1d e6 a1 03 29 28 9d 48 50 2e c8 82 5d f9 e1 1f 56 90 05 bd 03 5f 8d 43 28 74 00 61 11 01 22 0e dc 10 0c 81 22 7e a8 87 2e a2 23 2a 1c 74 59 d6 73 29 1d 72 11 9d 0f d8 8b 0f 18 e2 28 8e a2 89 0a 4c 26 76 56 67 71 e2 be 44 63 74 8d 62 10 ac 43 3c 9c e2 10 0d 11 07 21 0a a2 dc 49 2e 6c a6 Data Ascii: "2E`i>%PUdp&q8<`upfE)'\|/`uB($awP1KJa4HX!Bz/hE!5AtQm7ViW!r)(HP.]V_C(ta""~.#tYs)r(L&vVgqDctbC<!I.l

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49814	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	357	OUT	GET /css/images/logo.jpg HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	314	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: image/jpeg Content-Length: 13298 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Sat, 19 Aug 2023 09:13:50 GMT ETag: "33f2-6034310370f80" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:35 UTC	13298	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 de 01 39 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC9"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49784	113.219.144.65	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	593	OUT	GET /i/LD/SH132.gif HTTP/1.1 Host: tycjb777.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	529	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 122363 Connection: close Accept-Ranges: bytes Age: 61674 Cache-Control: max-age=2592000 Etag: "6734946a-1ddfb" Expires: Fri, 31 Jan 2025 12:04:41 GMT Last-Modified: Wed, 13 Nov 2024 11:58:34 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 9266bc5e1e790e5877e98562658ec8d3 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:35 GMT via: cache07.hunct
2025-01-02 05:12:35 UTC	15855	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 ae ae b0 71 71 72 c9 dc ff bb d4 fd 91 92 92 f2 d9 fe bd 63 10 d7 e7 ff fe cc d7 59 43 06 2a d5 ff d2 b1 24 9f ac da aa 5b 6b aa 80 04 5a 9e ae eb d2 31 20 b6 f9 fb f6 4e 71 fe 52 ff 00 01 fb f5 6f 5f 14 14 fc f9 91 fe fa ae 10 10 12 94 f4 ff 9f 1f fe 4c 4b 4d a0 64 9b c6 71 fa 54 fe 2c 21 22 24 9d 95 54 b7 51 fc c8 98 23 eb eb eb f2 dc 48 ff 95 c9 02 07 06 fe 26 6a 8f 1e 18 88 fe 6f 69 67 a2 21 5f 6c ef f7 ff f3 da b4 d2 ff ca fe 17 28 ff c6 00 17 32 54 d1 8f fe da d9 d9 c3 c3 c3 dc c5 28 2b 59 cb 43 f1 ff dc cb a8 e3 ef ff 6e 23 40 fe b2 b5 f1 d6 6d ff fe ed f0 b5 2a 4f 6c ce 6f f5 ff ad ff 94 d5 b4 b0 ff 4b 73 d5 ab 71 ff 6f b8 4a bd ff fc 8f 91 71 88 d2 f9 ec fd ae f2 ff 4c d8 f8 c4 8f 10 33 33 35 fe b2 d1 b0 70 Data Ascii: GIF89aqqrcYC$[kZ1 NqRo_LKMdqT,!"$TQ#H&joig!_l(2T(+YCn#@mOloKsqoJqL335p
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 99 2c 07 a1 88 38 de c7 06 00 2b 02 47 02 09 8e 05 39 8f 90 44 0e 69 64 91 2d d4 22 4f 8e f7 39 61 0c 92 47 46 19 e4 8d 0c b2 01 e5 95 43 12 c4 20 08 2d 20 39 23 83 1c 60 49 25 93 4c 46 83 e5 99 43 fe d8 e5 9a 6c b6 e9 a6 9b 21 92 79 5f 06 00 bc 69 67 97 43 3a 21 a1 2f 77 da 59 20 83 75 b6 39 e4 97 06 86 69 27 3d 63 ca 89 a3 13 7d 36 da 82 9a 68 a2 19 a7 a2 f7 f1 19 e9 90 5d 26 7a 1f 01 78 46 da 42 00 11 72 49 e4 9a 84 02 18 a6 94 98 6a 4a a9 84 99 5c 3a ea a3 40 3a ff da e7 3c 75 88 28 4c 06 22 66 10 ab ac 6b 2e c8 a0 32 bc f6 1a 61 00 77 96 7a 9f a1 76 aa ba 6a 84 81 06 bb a6 0e 3a 38 6b 27 ae 0c 9e 10 40 0d c6 1c 40 43 1d 28 0e 2b ed a7 7b 06 ab 2c 54 8d d9 69 ac 7d c8 be 39 ae 3f 57 01 50 07 00 ee c2 5b 07 01 04 20 25 a2 95 df b6 60 cc 93 d1 b6 d0 ef Data Ascii: ,8+G9Did-"O9aGFC - 9#`I%LFCl!y_igC:!/wY u9i'=c}6h]&zxFBrIjJ\:@:<u(L"fk.2awzvj:8k'@@C(+{,Ti}9?WP[ %`
2025-01-02 05:12:35 UTC	16384	IN	Data Raw: 0f f3 80 01 2c 8c 01 2e 70 01 18 40 10 df bb c2 2d 5c c3 36 7c c3 5d 60 10 ee 4b c3 35 dc 05 21 e0 bc f7 10 be e1 7b 0f f9 90 be e7 29 b4 1b 9c c1 4a bc c4 4c ac c1 11 c1 01 00 50 0f 3d e2 03 fe e0 0b e2 9b 25 fd 50 03 12 9c bd 51 3c c5 55 7c c5 3b a2 c5 0c a1 0c 3b 52 01 17 d0 03 17 70 01 9b 70 01 a9 40 10 f7 7b 01 62 70 c6 69 8c c6 71 8c c6 72 5c c7 18 70 01 3a bc 23 70 2c c7 30 1c 02 df 2b c4 e1 eb 03 18 10 02 13 8c c4 56 2c c8 31 ff 0c 11 ee eb 23 68 fc c5 ca 5b 03 27 8c 10 8d dc 23 8f 9c c8 3e 22 c9 0a e1 be 5d d0 03 3d 50 01 9e 5c 02 15 e0 0d 32 ec 03 3d d0 08 a8 fc c9 aa 0c ca a0 dc 08 6a b0 00 a8 dc 08 0b b0 c8 04 e1 0b f2 2b ca aa 8c c6 96 e0 be 5a c0 ca ab fc cb be 1c cc 76 6c c8 47 9c b6 5f bc 2f c8 9c cc c8 fc c8 0e a1 0c c9 bb 23 5a 50 02 3d Data Ascii: ,.p@-\6\|]`K5!{)JLP=%PQ<U\|;;Rpp@{bpiqr\p:#p,0+V,1#h['#>"]=P\2=j+ZvlG_/#ZP=
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: d6 f1 0f 35 40 00 de ab 44 fc 2b 10 ff 1b c0 c5 4b c0 06 7c b7 3d 50 11 3d 70 01 13 5c c1 12 fc 0f 17 70 01 6e 80 12 17 20 06 14 8c 01 b8 4b 00 3c db 0f 2e e0 4d 1a cb b9 2a d1 0f 3e b0 14 01 40 02 24 b1 c1 ef 5b 11 24 10 00 51 db c2 2f 7c 21 24 31 c3 07 ac 12 f9 50 02 15 51 01 3d 00 c4 42 1c c4 02 a1 06 02 31 02 15 b0 c1 25 81 01 11 fc c3 02 51 0b ff e0 03 13 2c 10 17 00 c4 17 40 c5 56 8c c5 15 5c 01 02 61 c2 af ea 0b d9 11 c6 d6 31 c5 e9 da bf ff 70 0f 5c cc c5 9b 10 c5 02 11 c1 5a f0 ba 00 d0 ae fe 60 c6 68 fc 0f 6a cc c6 ff e0 c6 70 3c b3 00 b0 bb 15 d1 08 9c d0 c4 15 21 bf 9c 50 11 25 e0 c3 24 b1 00 10 ff 50 02 9c 50 02 10 b0 c6 23 e1 c2 24 e1 c3 20 60 c6 7c e1 c5 34 db 0d 18 d0 08 29 51 02 5c bc 12 00 20 10 e8 cb c9 8b 5c 02 6b 0c c2 3e bc c8 8d 70 Data Ascii: 5@D+K\|=P=p\pn K<.M*>@$[$Q/\|!$1PQ=B1%Q,@V\a1p\Z`hjp<!P%$PP#$ `\|4)Q\ \k>p
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 02 e1 bc 93 2c 10 da 2d dd 77 ad cb d3 2d d3 04 ce 10 4a 1b d3 30 8d e0 0d 21 c4 ff 00 05 0e 30 02 49 bd dc 30 ed dd 45 5c e1 13 d1 df 18 a1 05 17 30 e2 17 80 01 5d a0 06 83 10 02 d1 e0 03 e6 dd 05 2e 6e e2 2e ae 06 9b f0 c2 44 81 bc d2 1d d6 81 cd 10 d1 70 01 12 90 e1 1b ee d9 9c 2c 10 3e d0 e0 b1 9b d5 ae 3d 11 41 9e de 44 0e c3 0c 71 e4 0c b1 07 19 71 e1 86 7d c8 db 0d d6 20 8e 11 3d 3e dd 30 dd 08 2a fe 0f 59 1e e1 d3 1d d2 03 51 11 f6 9d 11 01 50 01 59 1e cd 84 50 d7 a3 f0 03 47 ae 06 68 5c c5 be f0 1d 96 bc cc 65 80 08 4e fe 0f 6d fe e6 71 2e c2 74 6e d6 77 ee e4 96 90 00 40 5d 11 88 50 06 89 ff 2d 11 88 ec e4 b0 3d 14 a2 1d 00 94 3d 11 cb 4c e3 be 3d 11 3f 90 e3 02 b1 e3 69 ae d4 ff ad 11 fe 90 da 0d c1 df ee fd 0f f9 40 11 65 00 21 a0 ce 10 a2 ce Data Ascii: ,-w-J0!0I0E\0].n.Dp,>=ADqq} =>0*YQPYPGh\eNmq.tnw@]P-==L=?i@e!
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 61 65 de 83 6d 0c 27 4a 7c f8 61 b8 b5 50 3f 1c cd 52 28 ca c3 44 21 e4 c5 58 8b 20 84 e8 04 a1 62 ec 56 21 37 c1 ba d6 ff 61 47 fc 6f fb c3 ee df 09 07 2f e9 db 6f a3 82 67 d1 62 37 28 78 c1 7d fc f9 ff 55 c0 c9 72 b7 dd 5a 86 82 a0 11 b1 20 c8 0a a3 d9 c4 82 af 84 3d a8 3a 28 9a 9d a4 83 0f 82 ff 12 fc 67 c1 06 1f 82 90 a7 c3 26 fc 8f 3d 86 22 23 2f 3b f9 f8 22 6f 01 ab 20 e0 64 45 16 5b 84 00 02 7f 42 60 ed c5 f1 fc a2 af b9 92 84 da cb 46 1b 96 7b c8 c1 f1 a4 fb 87 84 7f 94 61 a8 a2 be f8 9b ca 20 bf a2 23 d2 c8 83 90 64 8c c2 8e 40 3c e8 ab f2 08 92 a0 44 de 38 49 00 ad 74 2c b9 e4 12 6f c8 1c b3 cc 04 d4 c1 c8 1f 5f 18 ea e7 a4 f2 4a b0 61 2e 82 fa 11 6f ad ac 1a b9 20 a6 87 2e 60 88 93 f3 da ca 73 4f 8c fc 3c 08 50 2b 1f fa ff 6a a0 01 b5 e4 b2 ab Data Ascii: aem'J\|aP?R(D!X bV!7aGo/ogb7(x}UrZ =:(g&="#/;"o dE[B`F{a #d@<D8It,o_Ja.o .`sO<P+j
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 04 23 70 61 07 38 f1 47 03 c3 f0 84 27 20 20 86 08 a0 61 0d 6d 78 43 1c e6 50 87 3b e4 61 0f 7d f8 43 20 06 51 88 41 9c a1 0c 6b 38 43 18 86 c1 0a e0 30 09 38 8c 60 02 19 3e 01 84 53 a4 62 15 ad 78 45 2c 66 d1 04 30 44 80 09 8c 00 8e 6a 40 c4 89 31 94 20 04 1f f8 c4 33 7a f1 84 6a 7c e2 13 d2 f8 46 36 aa 31 82 6f 5c 23 1d db 38 c7 3a e6 f1 89 26 a8 23 0c ed 18 c7 07 f2 11 8d 2f f4 22 20 f5 b8 c5 3f a6 f1 09 66 3c 24 1d f1 38 48 48 16 32 90 68 2c 64 04 65 f8 c5 86 50 c2 08 49 f4 22 0a 3d f9 49 50 7e d2 1e f6 c0 42 28 4d b9 c9 7f d8 a3 93 a7 fc 24 16 48 c9 4a 4f f6 a3 1f 9d 34 41 42 60 e9 c9 02 fc 03 01 9e 7c 82 2c 59 59 80 2e 1a c1 95 6e 7c e2 2e 41 e9 ca 5d 3e a1 00 58 60 26 33 0b 40 4c 14 3e c1 1e ff 78 42 33 ad 89 05 63 ff de 32 90 4f e0 81 11 28 b1 10 Data Ascii: #pa8G' amxCP;a}C QAk8C08`>SbxE,f0Dj@1 3zj\|F61o\#8:&#/" ?f<$8HH2h,dePI"=IP~B(M$HJO4AB`\|,YY.n\|.A]>X`&3@L>xB3c2O(
2025-01-02 05:12:36 UTC	8204	IN	Data Raw: 3f 76 bc 84 98 c4 59 b6 ac 6d 36 0e c6 1d ee ce 4e 81 d2 ca ee 04 b6 ed fd 6f 67 07 3c b4 e3 76 b5 ff b9 e1 2c 70 1c 4c 39 0f ce fe b7 9e ff dd 59 ae f2 b7 cd 05 f1 37 c1 f3 3c 70 80 87 16 b5 d0 95 38 49 0e 2a 64 67 b7 3a cf 56 16 39 ae 73 db 6b de fe 9b b4 6a 95 b3 56 31 8e f0 ec 66 1c 07 c9 d6 77 bf fd ad 69 86 8b 1c c2 f4 e8 38 3d 30 ae eb 85 de 3c 26 4f 0e b9 6c 4d 9b d8 87 bb d6 d4 06 f1 29 c3 5f de ea a5 33 fd df 41 60 f3 43 fe 19 f0 20 d4 f7 c5 56 e5 b9 d2 52 eb ec 25 3b d8 c9 15 bf b9 c0 9d ce 70 26 50 7a 0a ff c0 86 06 a6 30 05 05 04 3c ee 73 a7 bb bd 15 10 6c 86 d8 c3 ee f6 46 ee d7 03 9e d4 20 c4 9d ef 4d ee 7a 41 16 6e 77 bc 5f ca ef 73 ff 37 72 8b 8a f2 58 4e 35 e0 bb 3e 08 a9 03 3e d8 bb 03 f8 1f 3a 08 bc bd a7 6a e1 87 1c 5e ee 19 97 bb e0 Data Ascii: ?vYm6Nog<v,pL9Y7<p8I*dg:V9skjV1fwi8=0<&OlM)_3A`C VR%;p&Pz0<slF MzAnw_s7rXN5>>:j^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49817	154.91.91.56	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	611	OUT	GET /cdbcb1b08e2d9dc97758d1ca7b53357b.gif HTTP/1.1 Host: vnsimg.hfzkgw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	299	IN	HTTP/1.1 302 Found Server: NgxFence Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Location: https://vns3.ezrent.hk/cdbcb1b08e2d9dc97758d1ca7b53357b.gif Strict-Transport-Security: max-age=31536000; includeSubdomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49786	3.5.146.228	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	609	OUT	GET /150x150w.gif HTTP/1.1 Host: sezhang.s3.ap-southeast-1.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	447	IN	HTTP/1.1 200 OK x-amz-id-2: KAS2ZiqmWTYjeeDuHzmEdHRW/42RYAggL9W1BzTACBMaIlmv/o33uQj6BJF1LIzyi4PK+x0UTLbi7kenzdxK7scPEYESUXExbyZwkObHrMo= x-amz-request-id: PR4G87R79KZH12SP Date: Thu, 02 Jan 2025 05:12:36 GMT Last-Modified: Sat, 23 Nov 2024 11:59:46 GMT ETag: "816e33f667b33b9dc57759242fb983e0" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: image/gif Content-Length: 91488 Server: AmazonS3 Connection: close
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 fc cd 4e fe 10 10 f3 b8 4b b7 87 2e 89 56 0d f8 d5 d5 ff ff ca ff f7 77 22 11 05 aa 72 09 ff e7 a8 97 65 0c a6 00 01 fa d6 87 ff f7 56 35 22 09 d9 06 07 c9 03 05 08 00 00 ff ff 00 ff f7 68 ff f7 aa ff 00 00 d1 c6 38 ff de 95 99 87 52 8a 58 1f f7 ce 77 9b 92 23 b9 00 01 aa 98 6f 8f 78 48 ba ba b9 f6 99 9a 8e 01 01 ed 08 08 da cb 90 d7 cd 71 f6 af 39 56 34 11 75 69 4a d6 cd a7 f4 d3 00 cd 9a 48 9a 66 23 0f 08 00 f4 b6 b5 68 43 14 d4 95 02 64 39 0d c8 a6 55 f5 9a 01 d4 bc 88 d2 b6 b5 d6 ca 51 d9 a9 36 76 49 16 eb bd 60 fa d8 79 f8 6e 72 b9 a7 6d d2 cb c8 45 26 06 d5 95 95 74 67 33 97 75 36 45 28 10 ff e7 9c 18 10 02 fe 38 00 ce 6c 6c a9 74 23 77 57 23 f4 d5 3a e5 d8 ac f8 cc 69 fb 00 10 a7 69 25 cc ac 66 6c 63 18 ca 97 Data Ascii: GIF89aNK.Vw"reV5"h8RXw#oxHq9V4uiJHf#hCd9UQ6vI`ynrmE&tg3u6E(8llt#wW#:ii%flc
2025-01-02 05:12:36 UTC	577	IN	Data Raw: 0a a0 c0 84 3a 34 e0 83 ed 3c a2 a8 12 9b d8 a0 c8 75 71 a7 87 e8 a3 e1 56 d7 d2 93 3e 92 55 87 1b bf 18 97 52 88 81 15 86 47 5c e7 01 04 78 01 52 b0 f0 85 23 8c 81 00 ff 58 ae 13 b6 f0 81 46 a0 e2 61 47 60 c1 16 5e c1 85 d0 b4 53 11 e0 ad 03 55 0c 5f 31 69 48 e9 43 17 17 2b ba d6 05 4e 0f 86 8c ef 08 c9 15 af 44 78 b5 f7 d8 be ee e5 d1 0b 0a c0 70 85 2c e0 c2 09 40 10 c2 a4 ac 00 0a 64 07 02 d9 03 a0 01 1e e0 d0 88 2d 54 73 01 5b 37 03 1e fa 10 86 29 a0 e0 15 1f 88 86 22 f4 b0 82 15 c0 81 1c f1 00 03 ff 0a c2 63 bd d4 b7 87 be f3 9d fd 8a 61 df 91 aa 89 f0 ef 44 38 4a ee 15 11 0f 4b 58 02 0e 67 d8 c3 19 e2 a1 07 02 58 e1 16 2f 50 48 5b a0 01 91 30 00 98 b0 07 d8 f4 4c ad 40 40 88 90 03 4b 00 05 55 f6 4c 7f 35 00 f5 20 0c dd 27 03 82 10 48 83 e0 01 8b 70 Data Ascii: :4<uqV>URG\xR#XFaG`^SU_1iHC+NDxp,@d-Ts[7)"caD8JKXgX/PH[0L@@KUL5 'Hp
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 08 22 18 5b 1c 85 8b eb 07 2f aa e5 5a ee 95 86 68 88 8f 26 d8 2e 69 10 0b 41 10 08 58 b0 05 31 f0 0c 52 04 1b cd e5 87 56 70 2f c7 38 06 b1 c0 05 52 50 02 4e 10 39 3e 70 0b 38 80 0d d5 20 00 0b 30 06 7a 90 07 2c 70 06 e1 a0 00 51 f5 0f 66 b0 09 91 b0 07 9b 30 00 47 f0 05 0a c0 0b 0b 20 0f ab 00 07 6a 80 0b 1f ff f0 41 53 30 00 d1 40 7b 4b 87 8f 7c 37 8b a6 06 72 b6 b8 5a 44 09 94 44 c0 05 5b 30 06 53 c0 05 04 90 00 09 00 03 6d d0 3f 0f 80 09 79 b0 05 6d 30 03 9c d0 06 09 60 08 19 10 08 86 30 0b 4e 80 04 fe 70 0b 0b 60 0d b4 23 0f 04 70 04 6d 00 0a 31 80 08 5a e0 05 09 f0 0e 66 30 00 70 b0 07 7b 40 0a 0b 40 50 a4 b0 02 04 60 06 e1 20 03 6b 50 0f 7d f0 77 56 40 0a 8f f0 8a b1 68 5a 44 99 66 df 36 1f 69 06 72 05 d1 8f fd 48 94 b5 68 94 6c 68 05 eb a3 07 85 Data Ascii: "[/Zh&.iAX1RVp/8RPN9>p8 0z,pQf0G jAS0@{K\|7rZDD[0Sm?ym0`0Np`#pm1Zf0p{@@P` kP}wV@hZDf6irHhlh
2025-01-02 05:12:36 UTC	1024	IN	Data Raw: f3 c3 8a 36 79 90 07 5f 10 05 72 80 03 00 7c a2 b1 e1 a5 cd be 4f 72 60 08 34 e0 01 1f a0 9e ff 00 04 af f0 01 34 10 62 9a 0d 50 08 e0 e6 61 08 08 96 72 0b c9 c0 c4 10 ac 10 27 80 bc 44 94 5d 29 14 1b 96 32 4c d8 6d 9e da 95 00 12 e7 2c 57 ea 55 61 1e f7 bd b5 08 d8 cc 85 10 b8 08 d1 f0 08 ca 30 4c 82 57 1d bd 26 04 74 90 07 ea e2 2c 0a 21 04 32 26 c4 b4 63 f5 a8 22 e6 0a e1 e3 09 10 03 00 87 dd 9c 7f 10 00 f9 99 a1 39 4c e9 3c 10 cc be 10 b4 05 58 27 a0 4b 82 07 12 c3 df fb 09 a1 cd 6e 9a 85 b6 af 10 75 40 d4 64 d6 21 8c 31 26 f6 45 69 ce ff cf 53 62 1e 3f eb 1d 5c 9e 29 10 89 db 21 70 95 7c cb df fd 48 54 6c 3d 05 fe 33 16 58 99 a6 fe 40 6e 5f 12 74 d7 46 a4 10 b5 5f 57 d3 2f ff a4 03 10 2d fe 0d 24 32 70 a0 15 83 08 07 aa 7b 60 d0 20 0d 87 04 23 4e a4 Data Ascii: 6y_r\|Or`44bPar'D])2Lm,WUa0LW&t,!2&c"9L<X'Knu@d!1&EiSb?\)!p\|HTl=3X@n_tF_W/-$2p{` #N
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 1a d5 75 70 9c 46 f8 07 65 c4 a7 05 66 73 87 24 3e 94 ed 7e 54 96 d4 50 b3 b3 9a 7a e4 8b 0a 0f 14 18 c9 0b 2d c0 f2 8a 80 79 77 10 08 32 5a 07 82 75 06 c2 1d 02 b6 5d 5e 07 98 df 87 36 e8 f7 11 e6 9d 74 90 5d 51 96 b5 6f 47 4b bf 6a 04 aa bb bd 48 eb b7 ed 9d 94 1e ad 27 d2 da f2 dc 2f 8a c0 a0 da e7 31 a8 61 97 bd fc b3 e2 88 2c 77 fd d4 75 d6 51 fe 77 e0 81 39 9e 5f 39 37 cf 1d f8 69 ef d7 7f ec 96 47 d8 1f 7f 8a 68 0d 74 6f e8 5e 45 6a 77 bb db e9 4e 7c 06 99 47 04 c4 d7 c0 05 0e 44 7c 93 42 c6 d7 1c d5 ac 45 71 ef 72 8e d0 53 f7 3c 26 ff 8e 48 1d d0 68 95 62 47 01 02 95 40 04 fe 03 02 23 c0 9d 0a dd 67 b4 32 e1 ae 80 89 6b a1 0c 6b a7 c2 7f 48 2c 77 10 00 06 0f 57 e8 90 14 b6 70 1e 37 9c 88 03 bf 37 10 07 d6 6e 5c 61 12 47 08 12 58 c3 88 a0 cc 08 0e Data Ascii: upFefs$>~TPz-yw2Zu]^6t]QoGKjH'/1a,wuQw9_97iGhto^EjwN\|GD\|BEqrS<&HhbG@#g2kkH,wWp77n\aGX
2025-01-02 05:12:36 UTC	1024	IN	Data Raw: dc 08 1f 13 27 84 9b c7 46 c8 4a 23 0e 82 20 c1 de 0a 38 84 66 9b 21 b0 d2 4f ae e3 2d 3b c4 b2 37 86 40 d0 6f b6 4e fb dc 9b 05 2f 37 ee 9f 15 ea 60 9e 0e ea 56 c8 08 ed 06 e9 70 b6 1f ce fd f9 ea 79 9a 66 ee dc bc b7 db 65 a0 cc 13 a2 71 36 23 de fe e7 6a 84 fa 3e 64 cb 74 0f ea 1c 67 ba 77 7e e8 f3 0e fe 01 5d 78 d2 85 33 1c eb 43 6e 7f 6c 90 5d e2 c6 9a 73 08 e2 06 5c f0 10 7e a8 cc fb ee 47 3b bd 9f 02 c6 95 1b 62 f3 e7 91 fe d9 ec e5 2e 3b fb 84 e2 3e c4 52 ec b1 17 fe 1f d1 25 62 60 78 bb 7f a7 93 df 79 38 2b 04 f0 b3 de 41 7e 10 9c c0 41 a0 61 fc 3b c8 2e a4 b7 9d 43 40 8c 67 66 03 5a 04 9a f6 03 05 fe ec 67 0d 93 db f5 06 c7 ff 9b 41 e0 cf 67 c5 9b 60 c3 f2 07 3a 06 1a 24 79 0d 99 87 70 02 77 90 08 38 22 38 3d b0 9b 41 72 d6 3a 04 2a cf 84 c3 2b Data Ascii: 'FJ# 8f!O-;7@oN/7`Vpyfeq6#j>dtgw~]x3Cnl]s\~G;b.;>R%b`xy8+A~Aa;.C@gfZgAg`:$ypw8"8=Ar:*+
2025-01-02 05:12:37 UTC	1749	IN	Data Raw: 00 00 08 ff 00 ff 09 1c 48 b0 a0 c1 83 08 13 2a 5c 88 f0 d7 0a 43 95 56 54 6a 74 ef 95 06 86 18 07 46 89 d5 48 59 c6 8f 20 43 8a fc a7 81 cb 2b 2e 96 82 51 54 d8 24 98 25 6b 5a ae 54 23 96 43 9f 82 2b c8 68 40 83 16 44 4e ab 57 1f 1f 44 79 25 85 07 0d 4b 3a ad 8c 5c ca 74 69 14 43 a1 42 65 91 b7 4a 01 a5 55 d0 06 4e 61 f1 af 15 8b 5f df fa f5 53 03 ae 99 30 19 32 0c 41 43 43 43 09 86 06 fa fc f0 c2 a3 e7 5e 2b 24 78 5f 4d 91 93 c1 03 0f a3 29 2c 91 a0 a1 2a 18 0b 3d 75 9a 2a 5e 6c f0 c4 bf 18 8f 1c 23 01 83 e6 17 a5 50 8d ea 35 0b 67 4e 5e 90 7b 24 37 60 39 61 c0 40 16 71 e2 34 e1 58 80 25 0f 26 4c 04 08 2c 48 b0 62 8f 9f 1c 1b 74 90 3b a3 05 97 8e 52 b2 2c 29 21 ec a1 11 97 5f 47 58 60 61 51 c9 31 e3 e7 8b eb a8 93 2e 10 c9 89 53 28 1e c9 01 f5 22 c8 17 Data Ascii: H\CVTjtFHY C+.QT$%kZT#C+h@DNWDy%K:\tiCBeJUNa_S02ACCC^+$x_M),=u*^l#P5gN^{$7`9a@q4X%&L,Hbt;R,)!_GX`aQ1.S("
2025-01-02 05:12:37 UTC	9000	IN	Data Raw: e0 61 0f ef c0 46 3c 34 21 85 68 0c eb 67 84 3d c8 46 27 2b e2 83 84 f8 1f 61 10 cc 15 48 e0 85 62 50 e3 0c 8c 30 1d 01 cc 78 ca 3c 4c 01 ff 07 3e 80 82 0c b8 60 20 5e 38 0a 09 c5 84 c2 18 16 00 85 dd 2d 41 0f fc 42 e2 bc 5a 31 c1 4f 98 01 0a 2b 90 01 36 b4 71 85 7e 34 43 0a 8b 70 5d 36 a1 68 d8 d9 59 ba cb 1f 2e 1f 7a d1 f1 05 74 e8 60 01 81 8b 81 1e 00 b0 82 05 b4 61 0b ec 3d 01 6c da 73 0f 33 2c 20 06 2c 00 ab 0f f6 bc 85 09 fe 63 0d 7b 20 c6 1a d8 c0 06 62 78 82 0d 6d a8 07 22 88 f1 85 35 c0 01 0e 2b c0 f5 19 0e d0 e8 7e 18 c0 03 54 88 34 fa 64 b7 d1 a7 62 5a 20 2d 90 c6 a0 48 ac 8c 52 70 a1 12 dd 20 c6 02 94 e0 07 1b b2 06 14 36 4c 06 11 12 83 8a 18 08 21 01 af fe aa 22 ac f0 b8 17 20 e1 1f 03 c0 c4 3f b0 a1 05 38 6c e2 0b d4 a0 44 02 a0 e0 84 3b 91 Data Ascii: aF<4!hg=F'+aHbP0x<L>` ^8-ABZ1O+6q~4Cp]6hY.zt`a=ls3, ,c{ bxm"5+~T4dbZ -HRp 6L!" ?8lD;
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: a0 07 3c 00 0e 5a f0 02 8d 60 0d b8 b7 04 4b 10 08 72 10 06 44 04 58 ff f0 08 0d 65 41 ca 49 0a 04 00 0a 66 30 b8 2a ff 64 38 f9 81 09 32 f6 5f 28 b3 2f 3f 1b b8 bf 02 c0 c8 f7 0f d0 96 65 98 d0 06 12 fa 0f dc 39 05 d5 20 05 8f 10 50 54 d0 99 04 f7 00 98 60 08 39 a0 07 d4 40 0d 1b 30 2e 78 60 0e 4e 50 07 24 70 06 6f 3c 00 ef 10 09 53 10 05 f1 f3 6b 8c c1 2a ce 02 0a 09 00 0b 2f 90 25 23 f9 0f ea 20 10 28 92 3b d9 65 05 8f 20 05 35 a0 04 52 10 03 0c 55 1d d4 28 0d 62 16 8b ba 85 00 d7 2b ab 5b d0 06 a8 80 04 57 70 05 32 a0 0c b1 a0 03 40 07 5c 8f 30 05 78 40 98 78 00 b2 32 20 07 86 c7 02 28 80 01 70 40 0c 03 30 05 ed 01 04 8f 50 48 42 c5 52 c8 d5 c5 e6 f7 08 78 c2 18 7a 90 09 02 91 5d 0f 50 07 32 d3 05 fa a0 77 e2 40 09 af 60 8c 1a 20 0d 29 16 bd ac 18 8b Data Ascii: <Z`KrDXeAIf0d82_(/?e9 PT`9@0.x`NP$po<Sk/%# (;e 5RU(b+[Wp2@\0x@x2 (p@0PHBRxz]P2w@` )
2025-01-02 05:12:37 UTC	1024	IN	Data Raw: a7 01 0b 73 5f 82 bb 23 3d d4 08 e3 f9 11 67 cf 66 03 a8 a8 b1 b3 82 2b a5 19 9f 0f 3f 37 3d 5b ae 0f 50 08 b4 24 da 92 90 fb b4 c8 a7 21 0c e9 7c 24 17 17 ff 53 d4 bc a2 93 e4 a1 00 b0 3e db 10 c0 34 0f c2 c1 17 23 40 11 40 08 ed 07 b5 71 69 a1 20 04 40 85 20 a6 47 3e f2 80 d0 fc 5a dc 97 30 b9 3f c4 50 85 63 65 8c 8e 1b 3d ca bb 9d 64 0b 16 5e 6e 20 d9 e2 cd 41 eb c0 e4 e6 91 83 29 f2 75 a0 9b ec 11 07 a1 3f 4e 9e e2 4e fb 35 da 81 bb 99 b5 a0 08 67 70 d3 61 f5 d3 07 11 be 7c 3d db d0 82 29 70 7a b2 ad 4e 55 32 0b fd 60 8a e2 01 94 eb 89 7d 51 82 f8 f2 19 31 39 f0 81 57 a1 72 ca fe 88 29 9a 1e 4a 58 65 60 33 d1 60 c6 79 eb f3 3e 89 4b 5a 6a 13 6f 41 e0 bb 45 8e c2 2b 57 02 8b f2 92 03 6c f0 ce 33 72 c0 e8 23 37 d3 39 f8 70 0b 99 7d 84 7b 71 9f fb 33 9f Data Ascii: s_#=gf+?7=[P$!\|$S>4#@@qi @ G>Z0?Pce=d^n A)u?NN5gpa\|=)pzNU2`}Q19Wr)JXe`3`y>KZjoAE+Wl3r#79p}{q3

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49778	61.54.86.170	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	612	OUT	GET /yhgifjiami/xyh/150x150.js HTTP/1.1 Host: yh88812345qwerasdf.lzaotw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	690	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:35 GMT Content-Type: application/javascript Content-Length: 287975 Connection: close Server: openresty Last-Modified: Fri, 27 Sep 2024 16:11:41 GMT Vary: Accept-Encoding ETag: "66f6d93d-464e7" Expires: Wed, 11 Dec 2024 00:18:48 GMT X-CCDN-Expires: 1674194 via: CHN-HAluoyang-AREACUCC1-CACHE27[5],CHN-HAluoyang-AREACUCC1-CACHE35[0,TCP_HIT,3],CHN-SH-GLOBAL4-CACHE157[22],CHN-SH-GLOBAL4-CACHE69[0,TCP_HIT,20] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 2a3ff2833b56e5939a3254c12ba3b76e nginx-hit: 1 Age: 917806 Cache-Control: max-age=43200 Accept-Ranges: bytes Strict-Transport-Security: max-age=63072000
2025-01-02 05:12:36 UTC	15694	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 99 d4 fc 9d 6e 08 b3 00 00 95 b2 f0 da b2 00 d1 00 00 f7 dc 8d f9 00 00 45 22 02 05 00 00 f9 d7 d5 ac 8e 0d f6 8d 8c 5c 9b f4 00 ff f6 28 10 01 0b 98 f3 ae 97 8a 7a f7 fb f6 d6 b3 e7 5b f9 d7 88 87 01 85 7a 08 61 ee 76 74 73 93 00 00 ff 50 95 f6 b5 b1 f6 73 72 d9 d4 d3 dc 98 00 5d 92 af d7 71 71 4b 8c 84 90 88 74 ff ee 75 9a 64 a2 d2 b5 b2 f8 b1 92 f6 6c 4c 30 22 04 f3 4c 2a f1 04 ef fc d7 f8 d4 b4 6f 8c 74 71 64 6f 9b f3 b4 70 d2 b5 91 d8 d1 b4 b6 ad 91 b5 b1 b2 51 69 e6 e2 08 69 f6 88 fb fc 29 86 01 68 5e d3 0a f1 01 a5 96 f6 51 49 4e 4c 49 d4 29 28 f6 8e 71 ae 94 6e 6b 4a 05 6f 01 00 fd b1 d0 d6 4f 4c c7 d7 f6 6d 67 58 cf b0 1f d2 98 77 f7 2e 25 6a 4e 2b 6c 51 4a e0 cd 95 f6 b3 f9 8d 72 47 d4 ef fc d8 4d 2c 2f 2a Data Ascii: GIF89anE"\(z[zavtsPsr]qqKtudlL0"LotqdopQii)h^QINLI)(qnkJoOLmgXw.%jN+lQJrGM,/
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: e0 67 11 d0 89 62 6f 69 3d cf f0 0b ff f0 0c 2d 90 57 5a 72 63 b6 f8 0f d6 20 99 c6 b7 6e 57 d0 a0 1d 45 91 5b e9 12 02 79 90 29 71 49 cd 26 6d e8 46 87 75 b9 8d 29 39 73 a0 49 86 6c 69 0e 00 7a 9a 63 d0 04 4a a0 0e bc 91 87 ef 06 18 4a f0 0c cb e0 a3 58 d9 8a 2a b1 9b 20 39 5a ea f0 0c dc 09 7e d9 25 10 4a 80 91 97 b8 a3 da 68 75 59 29 7e f6 d9 72 3b 09 a5 dc f0 9f a6 f9 90 62 d0 04 ad 12 01 bf f0 a2 cf d0 01 1a 38 10 2f 0a 2c 6b fa 4c 81 e7 a1 04 ff e1 0d 98 e7 95 61 fa 12 85 29 89 48 f7 0f f3 d0 02 cf 54 10 87 ba 5a 73 0a 72 24 b9 9e 25 d9 8b 77 f4 a4 40 59 9a 7b 6a 9a 56 9a 65 89 09 0e 57 a1 46 2e 11 75 bd 76 05 90 35 0e e9 d9 9d 04 11 03 06 f4 12 ec b9 95 c1 20 10 e0 90 ab e2 13 9b 04 b1 0c 22 62 76 24 29 8b eb 29 10 0f a0 76 4f 2a 9d 2f b0 80 63 70 Data Ascii: gboi=-WZrc nWE[y)qI&mFu)9sIlizcJJX* 9Z~%JhuY)~r;b8/,kLa)HTZsr$%w@Y{jVeWF.uv5 "bv$))vO*/cp
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 83 b1 86 7f 50 c7 79 e0 01 4b 41 00 18 f0 87 7f 08 86 63 49 80 7d 54 c7 7f 88 01 7e 0c 86 1f 68 ae 63 19 07 ff 7f 90 01 fd 51 46 89 0c 86 18 80 02 11 00 06 75 d4 c8 04 88 81 75 9c 87 22 28 c9 71 98 87 60 b0 06 06 d3 23 a9 70 0c 4e d1 27 21 f4 ac d9 c3 10 be 99 81 67 d8 49 6b c0 80 65 d8 49 19 b0 06 6b d0 28 19 e8 85 2d 6c 01 a1 54 87 9f c4 00 43 ec 85 67 58 06 a5 5c 8c ea e9 9f dd 71 c8 7f f0 87 65 00 07 1e 28 13 04 88 81 7f 00 87 67 68 48 a7 54 87 67 80 c7 ab 5c 86 22 80 82 0e 78 ca 71 e0 81 09 4c 80 2b 98 87 67 20 4b 11 48 00 11 78 ca 65 28 81 09 5c 4b 7f 00 87 94 5c 4b b0 94 81 9f d2 a3 32 81 c9 1f 64 b4 6d f0 3a 9b 14 47 90 09 99 22 08 87 5f d8 49 98 50 07 ca 2c 86 3a 2c 86 7a c8 cc 94 4c 00 25 e8 00 cf ac c6 4b 91 81 c8 fc 87 5f c8 23 c4 91 8a 43 14 Data Ascii: PyKAcI}T~hcQFuu"(q`#pN'!gIkeIk(-lTCgX\qe(ghHTg\"xqL+g KHxe(\K\K2dm:G"_IP,:,zL%K_#C
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 17 84 2f b4 40 82 d1 e8 c0 0d e9 f9 0b 71 4c 20 1c 12 f9 02 29 f1 08 3d 66 58 64 95 5f fc 5f 2e b9 a1 45 19 cc 6e 06 cf 70 c7 17 af 58 b5 16 10 d0 0f 59 61 e5 51 4a a0 84 3b 34 13 94 62 30 9d 32 5d f1 0f 3b b6 0c 5f 19 f3 20 be ce 70 33 15 a6 13 94 1e 78 e6 29 9e d1 82 2f fc c3 10 e1 7c e9 3f a4 e1 01 69 94 ed 17 32 98 48 33 40 f9 0f 31 fc c2 92 ff b8 98 27 37 d9 c9 89 b4 e0 1a 9c f4 a7 44 94 d0 b2 fb 4d 64 18 fa 92 88 39 94 41 8c d1 71 e3 95 55 f4 ea 5c e4 50 4b 19 fc 02 a2 5c 9d 68 33 5a d0 cb 25 90 93 9c a7 ff 2b 84 12 0a e1 87 75 ce e3 17 df 14 a9 12 ae 63 af 7f 04 11 6c ec bc 9f 07 82 28 d2 48 4a aa 64 e4 bc c6 37 ff e1 8a 0e 04 e3 a5 80 bd d9 75 e4 f0 80 96 b2 33 4f 4a 00 e7 2f 62 30 58 49 9e e1 67 4c 05 65 3f 27 22 55 73 bc d4 73 51 24 46 5a ae 38 Data Ascii: /@qL )=fXd__.EnpXYaQJ;4b02];_ p3x)/\|?i2H3@1'7DMd9AqU\PK\h3Z%+ucl(HJd7u3OJ/b0XIgLe?'"UssQ$FZ8
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 6f ea ae 6b cf a5 10 d0 82 d6 ac 6f 95 ab bf 70 aa 99 6f 22 00 16 df ac 4b 25 09 02 09 67 34 81 0f 87 38 04 1f 2c 3b 88 17 23 00 10 46 40 60 02 8d 39 63 64 0e a4 ff bf 3b 16 21 4c 07 a2 49 1f bd 95 b6 df 4d 6c 25 65 2a 8e ee b6 d5 c0 67 19 c4 18 96 b9 39 99 9a 74 c6 6d 9d 42 9f 09 02 56 21 83 95 20 a7 b8 e5 59 ae 90 cb 25 1a ef d1 67 91 a5 5d c5 61 04 88 84 95 4d 7b 3e f4 2b 1b 1d 61 00 bf b4 aa 06 f1 6f 41 0c 1d e1 ca 32 99 c3 06 49 07 2a 5f 7b ac f5 9c 82 69 5a c6 a3 a3 09 9b eb 7f f0 d3 1c 53 90 ea 6c af 7b 8a 5f d7 45 ae f6 b3 d9 a5 51 70 2f 73 9c 22 1d 53 10 54 ea d8 ec 64 c5 da 0f ac 6e 66 15 4c 4f 4d 90 87 69 52 87 65 3d f0 37 3f cd 58 12 85 7b d4 06 f9 2c f9 c0 4b c9 b0 1e f8 01 53 20 48 3a 28 09 6a 20 bb 95 20 ae 80 c2 15 a0 30 22 81 68 a1 09 83 Data Ascii: okopo"K%g48,;#F@`9cd;!LIMl%eg9tmBV! Y%g]aM{>+aoA2I_{iZSl{_EQp/s"STdnfLOMiRe=7?X{,KS H:(j 0"h
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 1a 82 80 2b 64 a2 09 0b e0 c3 15 38 06 c2 91 45 86 82 c8 63 09 4b 92 a7 3f a8 d8 04 87 74 c1 db f3 62 62 42 93 11 d3 24 8f 1b 23 14 df e8 ca a8 38 0f 69 36 d9 0d be 92 66 12 95 ff 89 0c 85 ff 6a cc bf a8 f9 2d 63 72 11 85 74 41 9e 09 bf 72 42 e5 89 0c 16 95 e1 a6 2e a7 89 4e 61 46 53 64 dc 94 1e 08 db 79 b2 fc 9c 73 9a 26 69 1e 34 f5 72 99 27 71 b3 64 50 24 19 30 e7 e9 32 48 42 53 97 e6 34 a1 24 d3 27 49 64 ea 92 5b c7 2c 28 9c ae 19 cc 10 52 70 92 0e cd 94 24 63 52 b2 97 9c b3 9f ba 13 a6 da 4c 6a 51 32 06 f3 3e fa 0b 5a 7e 26 09 34 80 0a f4 84 e6 8c a4 36 dd b9 b2 86 d8 e7 3e c8 43 1e fc fa 29 50 4d 91 54 a4 c8 d4 cf 3e d7 56 90 78 1d 15 33 ba 09 29 4a bd e9 ce 37 92 14 a3 c6 04 68 54 d1 79 3c 75 8a d0 8d c7 9b e8 47 d5 09 4e 9a 4a cf 2b cf 7b e6 31 83 Data Ascii: +d8EcK?tbbB$#8i6fj-crtArB.NaFSdys&i4r'qdP$02HBS4$'Id[,(Rp$cRLjQ2>Z~&46>C)PMT>Vx3)J7hTy<uGNJ+{1
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: f7 9a 3f 30 3e 56 f4 91 cd 50 08 8a 51 08 8e 71 93 dd 84 57 55 c7 95 06 b3 05 d0 b4 0d e6 40 69 1a 88 0c 33 57 7d c1 60 59 e0 a6 52 37 d5 47 42 79 69 4d f0 05 f9 c5 02 2c b0 04 3e 94 94 a3 c8 94 df 24 02 fe 28 54 91 c4 79 da d2 04 fc ff e5 5a 58 29 55 f1 d0 04 ec f3 95 a6 59 9a 64 89 17 f9 e7 03 cd 78 2f c5 00 57 75 d5 02 7d 03 30 2d c0 4d dd 74 80 9b 89 30 5b 80 0c 30 19 94 93 45 0c 4d 05 78 d5 f7 72 bd 20 77 c7 e0 6e 3c a7 98 0a f7 00 1a 73 55 9b 84 82 94 39 8b 71 57 4c fd 48 30 22 80 99 06 70 85 57 a0 4e a8 46 0c 4d f0 9f a0 17 49 43 e4 70 60 89 8c 2a 3a 96 be 85 5e ab e9 9a 18 09 9f 00 64 2f f5 f0 91 c1 30 0f 45 10 05 c8 d3 32 f9 a9 94 c1 f0 03 0c b3 05 33 a5 13 c4 d9 58 f0 b0 04 c6 b7 69 c1 20 0b 24 48 4c 79 b7 5e 94 03 9d 04 63 78 1a 03 88 09 c0 02 Data Ascii: ?0>VPQqWU@i3W}`YR7GByiM,>$(TyZX)UYdx/Wu}0-Mt0[0EMxr wn<sU9qWLH0"pWNFMICp`*:^d/0E23Xi $HLy^cx
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 0e f3 98 01 0f 04 c1 8f 28 04 90 78 8c 13 5c bf 20 30 9a 2a 70 ac 67 00 8e 39 29 81 9b 78 33 53 0b 11 cd 79 0f b8 7b 14 47 60 45 af aa 35 76 01 2f 0b 5a 87 c4 63 a0 56 80 8d 4c 8a 2d 09 31 05 e6 39 bc 11 60 01 04 b0 3e 4e 5c 32 e3 12 81 31 6c 81 66 68 01 27 f3 0f ef c1 07 25 00 41 54 7c 0c 39 b4 c3 39 9c c3 3b b8 11 7d 23 86 78 98 13 75 68 21 5b c4 9a f9 5b 08 b4 80 88 67 a0 16 39 cc a2 c0 59 af 98 d8 81 70 f9 85 66 1b b9 5f d0 07 a6 82 c4 58 8b 20 53 48 c0 ed 50 0d 16 28 84 2e dc c4 47 03 ac 4f 4c 9d 6b c4 38 b2 a0 2e 77 99 81 ff f1 3b 45 90 28 04 fb 30 84 bf 91 01 f3 9b 07 e8 eb 10 6e 3c 8a 0d 28 29 38 a0 ac 47 b8 05 96 6c 49 70 a9 23 4f 01 95 e5 a8 0b 8b 7a 2c 39 68 82 42 28 37 0f a3 2c b2 62 80 0d c0 25 6f 93 b1 b6 28 bb 21 8a 80 0d 53 45 c8 78 0c 3b Data Ascii: (x\ 0*pg9)x3Sy{G`E5v/ZcVL-19`>N\21lfh'%AT\|99;}#xuh![[g9Ypf_X SHP(.GOLk8.w;E(0n<()8GlIp#Oz,9hB(7,b%o(!SEx;
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 62 df 8d d8 63 de 22 e6 10 69 ef f5 f5 f8 ee 4c 27 44 d4 ad 61 f5 be 83 e3 e4 c1 90 81 35 26 6c 94 18 ac 16 e6 dc dd b0 c7 3d c1 5b b1 db 7c 53 61 d6 e6 db dd 18 79 dd 61 56 d2 c8 3d 23 2c 2c 21 da 2f 77 d3 02 9c 10 ad 0a 17 6f 65 44 dc 6d af 38 a0 85 26 34 c1 74 d6 a7 82 07 7c 3f f9 38 fa be 8c 65 cc a0 da a8 e6 7a b6 bd 8e 9f b0 b3 db c5 91 35 fb a6 42 4f f9 86 cb ee c4 b3 e3 f9 ef c3 98 bd db d1 f0 d1 b7 56 b6 68 e3 26 bd 17 aa c2 d9 3a 50 fd ea 25 10 02 d8 d7 fe e4 df b7 ba ff 0c 22 30 e7 80 07 08 e6 fe b9 e5 cc 8f 3b bd dc e9 97 6c 4d ec af 03 3d 51 e0 6e 22 e2 56 ca 6f f1 96 a3 78 74 47 db 6e 6c c5 66 68 2f 56 7d 7c a5 0a b0 d0 69 28 c0 03 21 a0 7a b4 80 01 4a 50 0f b4 77 72 e0 50 7b 33 10 28 e2 f5 00 2e c7 1f 0c e6 1f bd e0 78 de 84 4f 18 85 3d 51 Data Ascii: bc"iL'Da5&l=[\|SayaV=#,,!/woeDm8&4t\|?8ez5BOVh&:P%"0;lM=Qn"VoxtGnlfh/V}\|i(!zJPwrP{3(.xO=Q
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 81 df ba b8 11 92 83 29 43 19 2c 80 db fa dc 00 0f 9f 44 45 3e f2 0b a0 77 74 b2 06 11 82 42 70 b5 19 8b 01 36 e1 33 c5 81 a1 07 77 98 5e 11 a8 57 3d 08 c1 04 14 93 69 1a 30 42 b8 be 11 79 84 34 06 80 47 f9 46 a0 8c 8f c9 48 0b 77 bb 5d 1b bb 45 21 e7 50 e5 08 19 a8 d4 61 48 92 12 f4 b8 84 33 a0 70 43 48 9e 22 15 60 b4 c1 14 01 ac 0c bf 26 e3 86 24 6a 61 81 96 32 40 f3 1c 08 b4 1e 44 4f 09 4a 30 c7 15 61 71 af 17 ed 08 73 c1 58 82 08 05 20 98 c2 84 04 19 a3 83 c7 f9 50 a2 26 ec 08 c4 0d 5e b2 c9 54 e4 c7 8d f0 95 e9 4c 9a 8a 5b 6b 04 90 85 91 fc c4 4d c0 40 a4 1b 0a 59 19 9d 80 30 89 a4 59 64 a6 9a 07 34 29 ba e1 1f 4a 90 45 11 2a 49 2f 07 1d 2d 8b 9d 5a 15 30 9b 33 0f 54 ff 76 e6 79 dd 29 0c 32 96 d0 1b d8 3c 6b 1b f0 50 94 1e 63 d2 29 97 75 c9 9a 6d c8 Data Ascii: )C,DE>wtBp63w^W=i0By4GFHw]E!PaH3pCH"`&$ja2@DOJ0aqsX P&^TL[kM@Y0Yd4)JE*I/-Z03Tvy)2<kPc)um

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49801	116.162.210.150	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	598	OUT	GET /img/tyc-4hu1300x200.gif HTTP/1.1 Host: monkey.p2ld58.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	621	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 784465 Connection: close Accept-Ranges: bytes Age: 1 Cache-Control: max-age=7200 Etag: "676da7df-bf851" Expires: Sat, 01 Feb 2025 05:12:36 GMT Last-Modified: Thu, 26 Dec 2024 19:00:47 GMT Vary: Accept-Encoding Via: cache08.jnmp,cache08.hnchangsha-cu15 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: edf6bd2938af76aab3ca62bb6e68d1ac X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:36 UTC	15763	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 00 00 25 22 22 ff fe b3 6a 44 2f cc b7 72 fe d5 fe ff ee 2a e5 0b a8 ff fe 91 ff fc 4d a2 ad fa ff fd 6c ba b2 aa aa 0a a1 98 77 68 48 fb 00 ff b2 fe fa 66 64 e5 01 f7 ba aa 6a 03 98 fd 01 65 fd cd af 94 ff 51 f3 10 68 01 01 d2 ff 90 03 64 d1 cc 8d ff 6f fe aa 77 66 fe 98 01 ff 90 ff 28 11 0a b7 ac 95 20 9a 01 67 02 73 a4 62 9f 72 66 4b b4 89 42 52 44 31 94 88 6d b3 9b 24 60 22 a0 fa db dc ff d8 02 71 12 d2 f4 d8 af 44 22 11 63 65 fa fc 71 30 30 22 11 ab 22 00 ff 00 00 12 01 66 b6 09 d0 1c 06 96 cd cc 77 8d 66 32 ff ad ad 89 55 44 da dc ff ff ff 00 af d3 f9 fb b1 04 6b a0 f7 d4 04 03 d2 4d 02 db 69 05 62 98 58 12 50 b1 e6 59 b0 34 cc 00 d5 ae d1 96 8d 89 5a 4f a1 ce bb ad f9 d6 6e f8 d2 4f f5 b5 4b ac 00 0e f4 d9 91 52 4d Data Ascii: GIF89a%""jD/r*MlwhHfdjeQhdowf( gsbrfKBRD1m$`"qD"ceq00""fwf2UDkMibXPY4ZOnOKRM
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7d 00 c5 98 de 14 9c 01 f7 4d 1f da 5c ff df 5a 8e 66 c3 90 66 e2 1c 8c 71 dd 8d db 39 65 6a 22 d7 67 b2 a5 df bc 66 6c 2a 17 f5 89 66 6e 51 57 15 e0 a5 6c 46 17 cf 70 80 75 91 0f 70 8e 60 70 92 20 f8 84 97 71 1e 67 78 0d c3 02 92 8e 38 b0 10 88 8c c4 00 9c 5d 1b 9c 80 2f 2c 83 04 d4 4e 7f b1 df eb 0c c5 49 a8 17 00 3c 04 f4 ac 8e 06 ec 44 39 48 c0 36 a4 44 32 0c 83 06 88 84 17 28 a7 44 74 44 f4 00 80 f1 7c 97 f6 d8 83 ed 50 18 f8 11 a7 07 5e 57 b8 19 c3 25 4c 41 13 91 c1 0b 7a 01 2f 54 c2 1e d4 20 24 c0 01 2b 68 82 37 80 c2 2b ec c2 83 ee c2 2e 74 02 91 09 46 14 48 c2 19 94 00 39 0c 81 3d 02 43 29 40 41 87 16 61 3f 28 50 13 76 42 0a 69 61 0a ad a1 16 48 11 32 12 86 61 5c 50 05 79 63 b8 49 c3 13 e4 46 0e f5 94 6b f8 10 1d de 01 1f ce d9 6f fc d4 4f 69 82 Data Ascii: }M\Zffq9ej"gfl*fnQWlFpup`p qgx8]/,NI<D9H6D2(DtD\|P^W%LAz/T $+h7+.tFH9=C)@Aa?(PvBiaH2a\PycIFkoOi
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 46 60 82 0e 40 9f 82 80 03 4d 90 81 3b ff 30 88 3f 38 9e 2e 70 ce ba e8 9f 09 cc 06 2e c0 1f d1 2a 88 41 08 8b 33 30 88 04 6c 9f 0a 30 88 3c 00 0b ae 14 0b 50 e8 0e 53 e0 0b 2e d1 40 03 82 21 e4 f0 c0 e6 a0 35 c5 70 0c c8 98 31 46 43 41 07 61 c1 15 44 c3 3d d3 33 3d fb a0 2e 62 8c 29 54 a2 27 52 42 2a b4 c1 f6 e8 c2 2c 6a c2 ff 10 b3 4e bb 32 28 a2 b2 30 31 a0 17 55 42 24 ba c1 2b 02 d1 1b 44 51 f5 d0 c2 04 0a 22 fe f0 41 2f fc c2 eb 28 90 31 24 c3 13 5c 43 18 9b 33 24 55 52 17 6b 8d 6f 80 10 27 e5 50 d4 78 d2 34 74 c1 38 8c 41 08 12 91 2c 7d 0c 3c 2c 34 48 2b 47 1f ab 35 30 85 11 1b 5a 33 42 53 06 42 d4 43 33 1d 24 6c ec a6 6c c4 c6 44 82 02 6b 92 00 10 f0 b6 4a aa 40 29 51 92 51 83 06 0d d8 86 6d 60 26 0d 40 26 46 48 11 c5 28 8c 22 43 13 5f aa 35 53 c2 Data Ascii: F`@M;0?8.p.A30l0<PS.@!5p1FCAaD=3=.b)T'RB,jN2(01UB$+DQ"A/(1$\C3$URko'Px4t8A,}<,4H+G50Z3BSBC3$llDkJ@)QQm`&@&FH("C_5S
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 40 e6 b6 44 c8 85 89 47 19 45 b4 60 11 ff 05 38 99 dd f8 02 7d 40 a3 df f8 02 3a 8a a3 15 d8 07 36 ca a3 40 9a 81 95 d9 99 44 5a a4 46 7a a4 48 9a a4 23 b8 09 9e e0 6a 8d f8 4b ea 89 68 8b d6 6a 69 b7 2d c6 20 3d 38 39 62 c5 50 15 ba 84 1b 2d 89 0c c5 00 9b 12 22 9b 97 b1 9f d7 52 86 b8 a9 26 81 f4 2a bd d9 a6 6e fa 9b c0 49 67 b4 96 6a c4 19 60 90 74 9c cc a3 9c 95 77 15 cd c9 48 8f c1 7c 30 95 8f ce f3 76 13 f6 a5 9f e7 4a d8 99 3d c6 b1 56 8c da 9d c4 a6 87 37 09 9e 86 c8 7a e3 b9 1e df 31 05 31 f0 a4 28 36 1e b5 d7 9e 46 85 57 f0 e1 0b 2f 9a 94 e2 76 58 d5 50 0e 50 00 00 cc 04 95 c6 10 67 69 22 0e 26 60 02 6d 10 0d 96 75 7f 02 5a 4f f4 c0 1f 0a 95 34 51 76 03 51 93 64 0e ba 5a 62 69 24 09 d7 04 fb 94 34 28 64 96 4c 53 43 35 84 ac 23 f4 7e 3e 04 25 1f Data Ascii: @DGE`8}@:6@DZFzH#jKhji- =89bP-"R&*nIgj`twH\|0vJ=V7z11(6FW/vXPPgi"&`muZO4QvQdZbi$4(dLSC5#~>%
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 49 1f 9b 2f 07 11 32 0f ef 94 38 a3 89 ff 3a 9d 73 22 9d d3 39 23 a5 22 f5 60 75 f6 b1 0f 43 45 3f a3 d0 c3 4a 64 20 17 b5 23 a7 69 18 4c c0 3b bd 8e 49 e4 33 3c c7 53 ec a6 a4 3c 6d b2 26 37 75 26 d7 70 53 d5 f3 3c c1 44 53 43 35 7c dc 53 ee be f3 49 ec ce 0e ed 13 c1 e4 a1 3a 0f 35 a4 84 92 28 31 25 48 e5 ca 56 3b 62 40 0f 71 5e 8a e8 29 09 87 22 26 4f a6 2e 6f 19 24 00 d1 66 88 cd 60 4a 2c 33 4f 58 c0 41 1c 36 54 81 3a b4 1d 56 94 1e 9e 20 2f e9 a1 1d 7c a5 05 c0 c5 a8 06 47 1c 82 ef 04 ce 85 04 70 c5 45 bd c3 15 cb b2 1c 8c a1 16 d5 4a 9f 72 94 ad da aa 56 95 f2 56 0d 13 48 89 34 d4 68 20 19 99 14 5f f3 55 5f f7 35 1a bd 8f 4a ff 15 60 03 56 60 07 f6 6b 36 c1 11 3c 21 41 f0 03 5f d4 71 4b db 91 4c 4d 6e a3 e0 63 47 be 03 35 a9 e4 2f 43 84 3e a6 a1 36 Data Ascii: I/28:s"9#"`uCE?Jd #iL;I3<S<m&7u&pS<DSC5\|SI:5(1%HV;b@q^)"&O.o$f`J,3OXA6T:V /\|GpEJrVVH4h _U_5J`V`k6<!A_qKLMncG5/C>6
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 9a e5 49 ea a3 07 e2 c4 e4 14 24 62 2a ff a5 6b 61 e5 42 92 a4 5a 69 d7 11 2c c3 4a 00 6a b3 a2 85 08 f2 a8 08 fa a5 3c 06 02 2e 7c 01 2e e0 c2 03 36 2a b6 da 02 b6 be 42 66 ea 23 67 5a 5b 69 b6 29 91 ea 29 7a a4 26 90 7a c0 c4 25 49 99 ba e9 12 36 61 e7 1c 43 81 3d 61 14 de 81 bd 56 e1 15 ea ab 6d da 26 6e 7a a1 70 0e 67 6e a6 61 f0 fc 93 9b c4 ce 88 49 18 8b 6c 22 71 26 8f f1 d8 88 1a aa 58 73 0a dd ee 30 54 1c 02 1d 44 0d dd 1d 56 6c f4 70 2c 1d 2e 49 1e 4a d4 46 69 a7 92 e4 0e 48 85 88 78 02 19 49 95 e7 ca 66 9d 7f 36 22 7b c2 a7 d8 41 d9 cb 2a d5 51 91 ca 4e ad 1d 79 e2 e7 db 9d c1 96 79 99 1e d0 c8 27 ba ec d0 72 40 80 aa 59 35 7c 28 9d 99 8b 89 32 ed 86 1a 4b b9 bc a2 84 2e 8b 87 82 10 3a 2e 6d 54 5d ad f6 6c c3 87 9a 00 45 41 c3 35 88 43 39 44 68 Data Ascii: I$bkaBZi,Jj<.\|.6Bf#gZ[i))z&z%I6aC=aVm&nzpgnaIl"q&Xs0TDVlp,.IJFiHxIf6"{A*QNyy'r@Y5\|(2K.:.mT]lEA5C9Dh
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 97 1c da 7b 2c b7 a9 90 d8 7b 2d 10 a3 2d 71 71 80 c6 14 31 5c 89 7b 11 87 db 39 16 17 ca b4 2d 5c 35 00 d7 04 01 5c 92 6b db b0 fc b8 88 3a 02 b7 25 b9 80 26 11 97 a0 5c 6f f0 0f 8f f9 0f 97 60 9c c9 95 5c 63 fa 04 03 70 ce 05 81 0d d4 dd 0c 01 10 00 c9 ac 86 72 b8 ba b8 3c 10 8d ff b0 98 c8 50 10 94 70 05 e3 5d de e4 4d de a3 1b ce ca 75 05 5d 0d ce a5 1b 06 42 00 df f2 3d df e9 dd dc cf 9c 5c 15 d5 10 92 a6 05 34 0d 15 96 f6 9d 7e 38 92 24 95 9d 64 b1 14 d2 1b bd aa 13 9e ed 33 d3 fd 3d 74 08 9b 26 3d dd 77 1b 42 80 d6 f2 9e 5a 44 17 35 55 89 04 3b d1 11 ba d0 97 31 46 50 13 80 d1 c2 34 3a b9 0c d0 fa e1 45 13 76 64 04 94 0d 1d ae e8 8a a1 75 89 47 22 4d c0 d6 fa ae 5a b9 95 49 c2 0f 07 da 1a 1e da a2 c4 18 3b 30 dd 24 34 3d e4 44 fe 6a 4b 95 35 da 92 Data Ascii: {,{--qq1\{9-\5\k:%&\o`\cpr<Pp]Mu]B=\4~8$d3=t&=wBZD5U;1FP4:EvduG"MZI;0$4=DjK5
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 0e 4c ab 0a ca 9b b5 58 ab 94 c8 00 b0 2b 83 0c f2 f9 ba b6 d6 04 5c ba 3b fd 62 58 51 43 9f 5c 65 0a ca b8 65 a4 0b 74 ef d3 53 24 15 a2 27 75 e0 ec d3 52 27 2a 21 74 00 72 e3 0b a0 ef f6 25 ec 16 26 66 a3 a3 61 a2 a3 97 58 c2 43 d5 a0 d5 f8 8c 3f 9c 38 8b a5 54 03 97 8b ab 18 25 ff c6 3a dc 50 7c bd 0c 97 39 05 63 fd 60 fa 34 a9 53 8c b5 b3 fd b8 8f c3 0d fa 72 73 5c de f4 69 2a 52 25 b7 0c 83 7f 94 fa 17 15 a6 59 9d eb 36 0b ee 74 05 2e 75 8d b1 a2 85 f8 5a 0b 55 35 f4 05 90 69 d7 aa ab bc 22 b7 1a cb af e4 19 c4 a3 78 49 01 09 b2 80 04 a0 43 1e 96 e1 25 01 40 16 68 d5 1e 5e 92 24 ef da 78 b9 9c 05 51 c2 ae ef 5a 93 c7 43 3f ea 5c 86 86 60 05 c3 c3 5c c5 9c 8a 90 ca 3d cc a0 22 fe 60 22 34 81 2c fc 81 28 9d 8c 8a f2 21 9c a3 ce b1 95 2c 16 94 ea 1f a6 Data Ascii: LX+\;bXQC\eetS$'uR'!tr%&faXC?8T%:P\|9c`4Srs\iR%Y6t.uZU5i"xIC%@h^$xQZC?\`\="`"4,(!,
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 78 8c cb f8 0c d8 34 75 db f8 8d e3 78 8e eb f8 8e f3 78 8e d7 c2 86 c8 62 1b 31 a9 16 38 99 16 80 33 b9 c6 ed 55 e1 d4 7c ab 30 53 bc f3 3d 17 ee 8d 0c 5c 7e eb f0 0d df f5 95 2b 9c 3a d3 37 53 38 8d 3c e3 37 7f 27 d5 b7 1e 6e 40 93 79 63 0b f8 88 39 08 ce 20 6e 62 4a 76 8d d6 a8 ff e8 da 68 9c 27 f1 32 3c 78 66 c7 f6 44 77 f6 e9 1c 52 45 e7 2b d1 89 36 67 05 2c e3 44 29 69 7b 69 a1 eb 2b 6b b7 b6 9a 4f 41 04 ce 36 1b 77 4a 8a 43 3a 67 25 c3 23 b0 f8 8c 5b fa a5 63 7a a6 6b 3a 58 d4 78 8f 7b fa a7 83 7a a8 8b fa a8 cb 4c 2d 78 c2 96 13 38 77 a7 c3 9c 18 f9 4b 68 01 91 27 b1 9a cb 7a c4 ed 35 5e 33 6b 0c 9f 77 ae 9f 62 3b 1b df 89 15 51 7b 17 b6 5d ba b3 ad cb 77 96 a3 ba 4f 11 36 15 69 1c 10 a3 08 8e 94 79 99 0b 78 8f e2 db b2 f7 9e 53 e1 e8 b9 1e 78 9b Data Ascii: x4uxxb183U\|0S=\~+:7S8<7'n@yc9 nbJvh'2<xfDwRE+6g,D)i{i+kOA6wJC:g%#[czk:Xx{zL-x8wKh'z5^3kwb;Q{]wO6iyxSx
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 9f 5f d8 ca 5f 22 04 ea 95 fe 73 49 7d ad c3 71 c2 8b 33 60 ba a4 c2 05 c6 ea 6d 02 cc af 18 4c ec ca c0 96 63 60 0d 66 cc 61 42 d6 58 39 26 af 46 eb 7e e5 0a 15 3e d7 cc 6c 6c d7 fc 87 c6 a6 6b b2 fb 39 c3 d6 d6 f1 fa e1 37 78 83 3f 14 f5 b2 86 83 c7 06 6b b0 88 75 20 b8 43 12 fe ff 39 19 d6 f4 3b ac e1 c6 96 4d 50 7f f5 66 8d 75 5a 5f 96 2e a6 5a 7b 5c 6f c1 e8 6f 33 76 6e 33 b6 47 2a 20 50 08 4f 47 3f 70 63 77 2e 00 d6 7e 8c 85 fd 6e d5 a6 02 98 5a f0 7f 50 64 d8 1e f1 02 a8 84 5f b6 93 4a 38 f7 4a 70 4e 75 5f 77 76 6f 77 77 7f 77 1e 87 ee ce 5e f7 53 40 f7 4a 90 d2 63 ef c5 d7 fe e7 7d 37 65 79 6f 76 85 ae 71 d5 ce f7 02 70 94 13 67 58 49 10 51 7c 77 67 26 48 03 be e8 e4 70 cf ce 81 df ce 02 68 e3 12 29 6d 53 0e db 3d ce 77 55 86 09 ed cc 77 23 0f 49 Data Ascii: __"sI}q3`mLc`faBX9&F~>llk97x?ku C9;MPfuZ_.Z{\oo3vn3G* POG?pcw.~nZPd_J8JpNu_wvowww^S@Jc}7eyovqpgXIQ\|wg&Hph)mS=wUw#I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49800	116.162.210.150	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	598	OUT	GET /img/tyc-sihu150x150.gif HTTP/1.1 Host: monkey.p2ld58.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	621	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 220928 Connection: close Accept-Ranges: bytes Age: 0 Cache-Control: max-age=7200 Etag: "676da7de-35f00" Expires: Sat, 01 Feb 2025 05:12:36 GMT Last-Modified: Thu, 26 Dec 2024 19:00:46 GMT Vary: Accept-Encoding Via: cache63.yzmp,cache01.hnchangsha-cu15 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 35346afe12b56374720b2d95256783d2 X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:36 UTC	15763	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 97 8a 69 65 46 38 ac 84 75 66 54 43 a4 7b 6c fa ee b3 9b 73 65 9f 9f ff 29 15 0e 16 16 15 34 1f 16 49 33 25 fe 00 00 ff ab b0 8f 69 36 be a5 64 84 5b 4d 53 37 29 ee d6 8e 59 54 42 b9 92 82 e0 96 27 66 54 3b b2 8a 7a 2a 2a 2a 35 31 29 fe 69 68 c3 ac 6a 99 16 51 7a 71 63 ba ae 83 ff fd d7 c9 b8 89 cf c3 7d ad 75 50 85 79 58 f7 d0 73 58 51 3b 86 77 66 97 01 01 fe fa c6 93 69 59 ff d7 d7 d4 d4 ff ff ff ff d8 c9 96 64 64 ff ff fe e4 99 90 88 28 20 93 73 6c 59 eb dc a7 40 27 1b 90 84 5d ca 95 4f c7 8d 6d 74 58 32 b5 a7 79 33 2b 22 00 00 ff 79 53 43 76 67 47 8b 63 51 49 42 33 ef b1 47 cb be 7b e2 4e 2d 84 61 53 22 22 21 72 51 42 bb 9d 5d a2 94 6a c7 b4 72 a6 76 36 35 33 31 70 4b 3a 7b 59 4b cf c5 82 94 6d 60 6c 64 53 a7 9b Data Ascii: GIF89aieF8ufTC{lse)4I3%i6d[MS7)YTB'fT;z***51)ihjQzqc}uPyXsXQ;wfiYdd( slY@']OmtX2y3+"ySCvgGcQIB3G{N-aS""!rQB]jrv6531pK:{YKm`ldS
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 26 64 3e a6 64 46 66 10 40 c7 3c 18 25 65 4e 66 44 5e 64 66 d6 c3 66 5a 26 74 d0 ff 41 3d 48 26 4a 82 26 74 1c c1 63 56 64 57 4e e6 29 94 82 65 ea 82 2e 58 a6 64 aa a6 69 6e 42 0e 44 a6 67 9a 26 74 54 c1 68 3a a6 57 3e 8d 63 6e 02 74 d4 80 6f 42 87 2e 64 26 72 5a c3 1b e0 42 08 c8 61 10 3c e7 63 42 e7 73 42 26 74 e6 c6 6d 4a 27 76 1e 01 5e 1c 67 74 52 67 10 a8 dd 93 f0 06 77 4e a7 41 d6 c0 46 04 c8 4c 3e a7 da d5 c0 11 78 67 2d e4 46 f0 e5 06 79 6a 81 79 d6 86 0c a0 26 79 4e 27 78 6e 44 0d 8c e7 73 6a 67 7f 3e 26 80 6a c1 7f e2 45 7a 62 a7 77 7a 02 1e cc c3 37 84 c0 74 36 e6 73 42 68 10 48 28 85 3e a8 85 46 e8 85 4e 68 86 56 28 86 76 a8 86 7a 28 87 7e a8 88 86 28 89 6e a8 89 82 e8 89 8e e8 73 7a 02 3c 34 c2 04 3c a7 83 c2 e8 74 c6 e8 3f ce a8 8d ca 28 8e Data Ascii: &d>dFf@<%eNfD^dffZ&tA=H&J&tcVdWN)e.XdinBDg&tTh:W>cntoB.d&rZBa<cBsB&tmJ'v^gtRgwNAFL>xg-Fyjy&yN'xnDsjg>&jEzbwz7t6sBhH(>FNhV(vz(~(nsz<4<t?(
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 8e 5c 23 50 08 04 95 1a 03 45 a0 03 3a e0 4b ff e0 4c c9 41 18 84 0e 98 80 c2 e8 94 13 a1 10 56 21 45 c4 93 0f c5 4b 19 63 d0 29 03 aa b3 84 a8 33 eb 4c 11 f2 68 c0 91 d9 bc 3f f3 ce d1 22 10 eb 18 3d 4b e1 cc 45 90 90 35 73 15 85 ec 43 19 42 96 6a 8b 95 8b f1 01 1e 90 03 af bc 90 c4 90 81 73 c4 4b ef db 84 da 2c 42 bc a4 4a 13 08 87 32 00 9a d0 f3 b3 46 c8 80 27 a0 03 bc 4c 50 95 ec cf 2f 58 80 82 49 88 a0 58 47 1e 28 03 a0 bb 49 e2 91 0f 0d 95 be c6 93 27 4e e1 22 c5 d4 94 00 c8 c7 ee bc 0c f3 02 4f 49 a0 43 3b b2 23 1a 00 c1 0a c1 20 50 48 81 b6 81 08 8a f0 9e 65 41 96 89 90 0c c9 70 0d 33 30 8e 44 d3 84 05 85 c6 b2 24 a0 0e a0 83 09 c8 cb 70 48 03 37 58 00 5c f9 47 cc d0 81 37 c0 4b e0 ac 4d 2b d8 84 58 c8 00 4a 19 88 7d 29 a3 0b 5a 82 45 90 c7 e9 83 Data Ascii: \#PE:KLAV!EKc)3Lh?"=KE5sCBjsK,BJ2F'LP/XIXG(I'N"OIC;# PHeAp30D$pH7X\G7KM+XJ})ZE
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ec 50 66 89 0e e0 88 04 70 32 00 1b e4 fb 5e a5 73 a8 10 f4 66 c6 42 15 f7 90 29 3b f2 ae b8 58 a6 4b 2c 78 bb 85 d1 38 f3 c2 dc b9 44 6b 6b d1 0d d0 a0 89 22 c2 b7 56 b7 1c 84 36 a7 2a 65 be 48 f1 09 97 3d 8b b4 20 50 92 f8 ea 41 f0 c9 ed 8c 6e a5 2c 4c 4d 5c d3 0a 07 48 ca fd 49 a9 4e dc 26 7b 84 8d 1f 87 97 5e 98 94 bf b0 95 5f 3d 55 7f 69 6e f0 03 91 14 03 39 b0 ab 6e 21 ed b7 1b 6e 93 ae 41 13 ce f3 e4 eb 71 9c 91 89 d4 0a 20 e3 f0 4f 5e c0 45 31 07 05 bd 0c b5 7f 68 78 18 59 27 c6 36 8a a4 a0 0e f8 d8 50 2b 90 ec c8 3c fa c4 57 de 6e a7 78 6c 7f d2 4d a8 0a 6e 90 08 c1 69 2a 1a f8 4f 37 c6 54 73 4f eb 2d 00 85 2e 70 e9 31 e0 06 76 e7 21 d0 a1 a2 71 74 8a 2d 90 03 c5 7a 9f 77 97 90 a8 9d cb 5f b7 79 33 09 92 5f 31 b0 1f 20 a4 72 db a4 ff 58 de e8 17 Data Ascii: Pfp2^sfB);XK,x8Dkk"V6eH= PAn,LM\HIN&{^_=Uin9n!nAq O^E1hxY'6P+<WnxlMniO7TsO-.p1v!qt-zw_y3_1 rX
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 2e 90 7b 6c 5a d3 fd 0e fa 98 3d 3d e6 2b 3b 9b ce 41 17 fb 73 56 4d 70 47 c3 dd ce 30 57 30 17 5e 9d ee a7 0b 24 c1 a2 d6 b8 84 73 e1 04 2a b4 74 de 0c d6 3a a3 23 8d 6c 6d 57 b9 f1 51 0e 73 b1 af 9c 6a 53 a7 fd e6 aa c6 06 9b 49 ed 6c ff 7b bb ba 01 0b 5f b5 ab 17 bc 70 2d 47 c5 d1 8f 8e 4a de d5 bd 71 51 af 5b ec e7 86 70 2e 52 d0 1b 6a 48 42 d1 0c 6e 40 96 91 9e e5 dd f3 3e cb ba c6 74 16 80 7e 16 33 fb c3 d9 d0 91 bc c0 a3 6d 73 9b 23 3e 2a e4 76 f3 c2 b7 6c 15 06 bf da d5 a6 0f bd b4 4b 6f 69 32 57 d8 15 23 34 7c 9f 4b 3f e1 e0 5b a5 f9 ff 88 b4 da 45 9e 7c 5a 77 7a f9 63 16 be 55 88 ae ed bb 4f 7f c1 ce b7 fe 9a 8d 8e ee 71 fb a3 fd 4e ef fe af 31 d9 83 49 5b ef 15 60 82 3d 47 aa f5 5f e3 2d 9e a7 a9 40 a8 25 5f aa b5 9f da fd 5f 85 7d de e9 f5 9d Data Ascii: .{lZ==+;AsVMpG0W0^$st:#lmWQsjSIl{_p-GJqQ[p.RjHBn@>t~3ms#>vlKoi2W#4\|K?[E\|ZwzcUOqN1I[`=G_-@%__}
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: d6 82 24 f6 49 2f 6e 62 11 03 18 53 05 ab 97 a1 91 20 60 83 08 18 cf 9d 9e a2 80 05 78 ce 73 4c c0 42 19 be f0 9a 2b cc d2 27 45 8a 29 eb 72 d9 b6 95 10 e5 64 45 30 04 6f 90 99 50 27 28 d4 09 3e 1c 82 21 78 40 55 aa 4e 75 aa 55 cd 6a 56 93 4a 55 ae 56 f5 37 99 c4 a2 02 e3 b2 a0 2f 26 67 02 55 48 a9 05 c4 48 a6 31 ed 61 9f d6 41 95 4c 11 30 06 97 2c 20 0d d1 29 02 45 b1 d0 85 ee 14 c5 48 f3 c1 a3 4d 68 90 01 3c 92 2c 26 11 50 c3 18 6a 58 04 1e 1c 0f a1 c5 8c 2c fe 32 4a 55 39 68 95 07 72 58 82 1c a2 c3 d9 90 84 24 b3 99 5d 42 17 40 db 85 8f 22 ce 9b c1 29 ab c5 d8 5a c1 50 8d 89 13 e7 82 a9 2e 4f 58 d3 9b ff 52 34 10 58 48 c3 ac 14 a0 86 2e b8 24 67 f8 aa 4c 65 74 05 1b 11 e1 73 01 7c 54 ca 12 0c 51 c4 14 6c c3 a9 0b 15 84 21 1a 8b 55 1e 54 17 ab 9d cd ae Data Ascii: $I/nbS `xsLB+'E)rdE0oP'(>!x@UNuUjVJUV7/&gUHH1aAL0, )EHMh<,&PjX,2JU9hrX$]B@")ZP.OXR4XH.$gLets\|TQl!UT
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 10 13 11 9e 1a 91 11 5f 60 1c 34 0a 17 5f a0 06 8a 20 1f fb c5 19 c8 d0 06 fc da 06 ae 60 0b 5f 09 92 56 47 11 db 49 ac 02 40 09 5a 87 4a 10 30 6a 5b e0 04 5e 77 6e 34 f1 08 44 50 1e 34 d1 49 eb 22 24 ec f7 0f f1 77 ad 49 31 7f 59 61 10 fc 38 6a 04 f5 5b 19 ea 59 7f 04 42 0b 30 8c c3 18 0b 76 b7 ae ff 70 03 2f 0b b3 c0 d7 48 2c 3a ae 2b ff 8a 11 5f 20 2c 57 a0 06 b1 10 0b 7f f0 03 bc f5 96 fb 2a 07 5d b7 0d 56 27 5c 04 60 b4 ce 80 75 d1 06 8e db f0 81 5b 00 01 3c 10 89 dd e7 03 60 d0 06 34 f1 12 a0 92 00 39 41 19 98 21 24 bc 77 6b b9 87 8b ce 29 56 de 85 a5 04 05 56 5c e5 59 10 b0 53 68 f0 15 7e e0 07 3a 52 75 6c 00 a8 7c 60 10 f9 49 00 16 00 91 18 f1 77 18 c1 09 0a 01 52 13 70 11 dc 13 2b 68 e0 06 b1 b0 09 9b d0 0c 6f 30 13 45 82 0c d3 60 3b ae 20 07 ae Data Ascii: _`4_ `_VGI@ZJ0j[^wn4DP4I"$wI1Ya8j[YB0vp/H,:+_ ,W*]V'\`u[<`49A!$wk)VV\YSh~:Rul\|`IwRp+ho0E`;
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: c4 49 a3 a7 4f a0 ff 10 e0 1a 3c 54 e8 51 04 19 03 19 30 f0 8f 80 ff 53 dc 4e b0 2c 89 80 cc 4d 17 43 30 87 6c d9 42 a5 52 0a 1f 10 34 41 e8 da 75 f8 59 51 03 03 44 64 97 f8 9f 9b eb 03 e7 76 31 38 21 d6 c0 85 06 13 0e 1c a3 24 21 9a b6 14 ff 45 a4 88 20 f6 95 22 8a 0d 8a f9 fe e7 9f 1a 35 b1 ae f0 5a d0 1f b3 e6 cf ba f8 02 b4 01 48 eb e2 0f a2 50 e3 89 b0 7f c6 19 0c 81 56 24 71 cf 3d 34 ae c0 a2 36 02 c0 70 06 8c 0c c1 10 80 80 14 e4 d0 8a 09 92 7c a0 c2 09 da 72 db 22 2c 33 98 f3 c1 87 39 d0 4a c1 8b 25 ae 3a 68 ae 08 f6 33 68 80 85 4a 30 68 a1 f1 0c 1a 63 af 81 d4 1b 4a 35 05 c6 18 60 09 96 36 1a e8 0f 35 1a 8b 25 ca 58 62 e1 af 3f 64 30 8b 45 b3 01 57 1a b0 04 96 be 18 e3 35 a1 58 63 ed 9f 56 84 52 20 b6 d8 16 f8 22 8d 4a 0c ba 0d 0c 30 2e 10 e0 02 Data Ascii: IO<TQ0SN,MC0lBR4AuYQDdv18!$!E "5ZHPV$q=46p\|r",39J%:h3hJ0hcJ5`65%Xb?d0EW5XcVR "J0.
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: b0 c1 d2 a1 99 11 3c bf 98 35 c4 63 31 f2 ba 8f fb 40 03 9f fa 87 44 7a 30 63 f0 9a 61 74 28 d2 c2 31 7c c1 17 b9 28 08 82 b0 0b 0d 2a 98 87 70 02 45 23 46 a5 20 1f 18 52 8a 70 e0 0e 64 90 c2 7f a0 86 09 04 3d 3a 40 c8 87 d8 84 37 88 00 0e eb 82 22 60 82 1e 64 82 1e e8 c2 81 1a 1d 1e c0 12 e4 52 1c 50 e9 02 31 68 2b e5 e8 8a c1 c2 16 58 ab a2 a0 43 1a bb f4 0b 2c 64 2c fc d0 b4 cd 8a c7 70 70 15 50 98 11 89 52 38 1c 9b c5 a0 74 84 62 d2 28 cf 23 15 d6 2a 8d b6 29 03 d0 fb bc 42 54 8a 66 e0 85 03 7a 08 7d e2 86 79 18 80 27 90 01 19 b8 c3 3c 34 2a 55 42 19 48 4a 44 4d 60 82 22 30 84 81 42 8b 01 f0 ab 81 ea c1 11 99 22 e5 f0 0a 4a 04 b7 7f 40 06 73 54 aa d4 49 9a 04 b8 94 a6 11 92 69 58 00 ff fb 30 2c fd e1 1c 26 0a 04 51 78 0b 0f 82 3c ed 53 0a 7b 21 08 2a Data Ascii: <5c1@Dz0cat(1\|(pE#F Rpd=:@7"`dRP1h+XC,d,ppPR8tb(#)BTfz}y'<4UBHJDM`"0B"J@sTIiX0,&Qx<S{!
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 2a 27 e0 d4 34 2e 16 56 de 11 cb 98 8b dd 96 74 02 d7 ed 3b f1 53 84 3f f6 4d f8 81 04 b0 d4 96 0a 97 7f f8 1f b0 47 17 0c 85 80 c7 62 e2 b1 bb 02 d8 c1 05 3f d0 01 25 b0 8f c8 c1 02 ef 9e 8e 22 d4 a1 11 5e f1 73 3d 9a 7f 70 79 4e 1b 95 55 b5 44 34 f8 01 7c 55 e6 83 35 4c 2f f3 71 f2 2d 0b ff 32 0c 7a 56 06 03 27 d0 84 ee 7c 0a 23 5f 43 84 06 6c a3 e0 6d 19 78 83 71 88 2b 55 68 29 aa af f6 47 40 03 49 b6 c2 9d 68 e6 ba a0 6a af 19 87 9d e1 99 f2 1b 15 ef 58 7d aa 66 eb 4d 5b 53 03 d6 dd b8 99 ee 0f a6 1c 27 45 86 b9 eb d2 98 1f 55 e8 d8 06 77 31 0a 8c 49 73 b3 cf dc c0 3f ac 91 00 08 43 3c fe 11 2c 68 82 60 87 82 09 11 16 fc d7 61 50 c3 0e 09 25 fe 9b 30 06 c1 3f 6a 77 08 e2 a2 46 ed 1f bc 04 b8 24 3d 52 b0 e0 47 80 2f 45 d2 0c 11 b4 c5 e5 96 73 ff 22 28 Data Ascii: *'4.Vt;S?MGb?%"^s=pyNUD4\|U5L/q-2zV'\|#_Clmxq+Uh)G@IhjX}fM[S'EUw1Is?C<,h`aP%0?jwF$=RG/Es"(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49824	163.181.131.208	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	611	OUT	GET /b9fb3076983380cf2d30af608afa0f94.gif.js HTTP/1.1 Host: vns2.ezrent.hk Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	674	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/javascript Content-Length: 116713 Connection: close Date: Thu, 02 Jan 2025 05:12:36 GMT Last-Modified: Thu, 29 Aug 2024 10:16:45 GMT Vary: Accept-Encoding ETag: "66d04a8d-1c7e9" Expires: Thu, 02 Jan 2025 17:12:36 GMT Cache-Control: max-age=43200 Accept-Ranges: bytes Via: ens-cache12.l2de3[507,509,200-0,M], ens-cache8.l2de3[512,0], ens-cache7.de7[1128,1127,200-0,M], ens-cache7.de7[1129,0] Ali-Swift-Global-Savetime: 1735794756 X-Cache: MISS TCP_MISS dirn:-2:-2 X-Swift-SaveTime: Thu, 02 Jan 2025 05:12:36 GMT X-Swift-CacheTime: 43200 Timing-Allow-Origin: * EagleId: a3b5839b17357947556815214e
2025-01-02 05:12:36 UTC	14258	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 d4 d0 ca cf b0 68 ff ff fd d2 c8 b1 69 66 53 d7 16 26 f5 ca 2d d5 ac 50 7b 7b 62 ff e7 01 db 2b 29 17 14 10 45 44 37 57 57 47 f8 e6 cd f8 e9 dc fa ee e7 af 96 6c 34 33 31 b0 a6 91 e9 79 65 ec 86 6c e6 66 57 74 73 5b 85 84 68 c7 af 96 fe f8 d8 dc 37 33 ff ef 4b f3 d8 bd 97 62 18 df 46 36 df 4d 47 b6 86 2e fe ec 90 da a7 2f d2 bb a4 94 68 30 ee d3 b6 e8 8f 91 ff eb 30 e6 b9 49 a8 75 2d 8f 73 4d ff fb f6 b4 71 4f 6d 51 2a 8d 18 0d 33 20 11 e8 b6 2e 33 31 29 cb 97 2d e2 54 49 24 24 23 fb db 00 fe e6 74 f3 db 8e f9 db 67 f9 de 79 ff f7 f6 b6 87 12 a8 9c 8a c9 9c 49 e9 c8 65 ff fe e4 87 57 26 28 28 21 28 28 28 fc f4 e5 f3 c5 c6 fc dd 57 85 7b 65 f7 e6 bc f3 df c5 40 3a 2f f6 41 38 75 45 19 ff fe ed 64 5a 4c ba 98 5c ea 95 Data Ascii: GIF89ahifS&-P{{b+)ED7WWGl431yelfWts[h73KbF6MG./h00Iu-sMqOmQ*3 .31)-TI$$#tgyIeW&((!(((W{e@:/A8uEdZL\
2025-01-02 05:12:37 UTC	13140	IN	Data Raw: b5 38 c3 8b 4b 0a 12 d0 bf 8a 16 3c 5d fb ec fb 4a bb 3d d4 10 04 b5 89 cb 87 a8 1a eb 58 22 8e 73 a2 87 23 5f e1 2a 7b d8 ae 25 48 7b 92 12 46 2b c0 a1 dd 55 fa 28 1f ba d0 02 78 b5 d0 8a 75 06 35 60 bf 38 2f 78 45 87 ce 9c 65 4a 26 8e e1 9a d7 5e cb c6 2e 3a a6 15 e1 d5 c2 77 c1 7b 86 9a d6 62 14 fe 1d 45 76 fd db 8a 56 fc 77 14 da 3d 30 38 fc 5b 0b 80 d6 20 13 e1 05 c7 41 f2 8b 5f bd 28 01 1c 03 6e c5 19 c2 5b 8b fa 64 0f 63 f9 b8 2f 78 7b 1a 51 17 65 4a 7c 82 fc db ff 52 13 aa b8 28 66 cf aa 23 ea 47 25 04 20 63 2d e0 43 08 d2 8b b1 8c 05 50 8b ec d9 44 47 36 f1 c7 2f 72 2c 80 5f 7c 58 c8 46 3e b2 00 d0 e9 1d 04 69 0f ae a3 10 b2 16 d0 91 e3 33 8a e5 c9 48 be f2 91 b5 00 3f 00 e4 58 0b 12 e1 b2 8c 01 90 0f 30 5f 19 1c cc 14 e7 e8 fa 21 01 23 8b 01 9a Data Ascii: 8K<]J=X"s#_*{%H{F+U(xu5`8/xEeJ&^.:w{bEvVw=08[ A_(n[dc/x{QeJ\|R(f#G% c-CPDG6/r,_\|XF>i3H?X0_!#
2025-01-02 05:12:37 UTC	13140	IN	Data Raw: 95 03 38 6e 04 5b 60 00 12 4a a1 09 ee 8e 1c 97 0e 31 40 77 54 bc af 86 b0 e4 26 67 e1 4d fe 20 cd a0 2e 53 41 d8 18 c1 de bb fd 4c 31 ff 8c e5 a0 52 83 21 72 e2 76 91 29 0e 66 cb d6 2a cb c7 5d 7f 63 06 04 98 0e 04 ff 2d 02 6d be 05 ed d0 0e 64 fd 0e f2 20 d3 62 4a 85 ce a6 67 42 e9 6c 71 10 02 aa a8 8a ff 00 db 7f fe 7c c1 d2 e1 2b d3 32 cd 84 e8 bf d1 d1 0a 35 9b ca 92 49 63 80 03 40 fc 03 3f 78 88 f8 3d 0f 6c 3e 66 4d 90 ec 13 17 e3 46 60 04 9f de 06 13 3a 02 29 f0 03 6d 90 05 59 00 0b 1f 97 0e 1a a7 04 13 2c 94 1e 80 c9 84 b0 d0 b1 be 3c 61 a1 32 b9 5d e5 cf 04 1c ba 9e 1e e8 c3 16 97 34 06 3d 90 7a 01 20 ec c0 80 03 12 a6 03 46 10 0f fb 1d 67 c9 9e ec 10 d6 7a 46 10 08 d0 9e 02 04 3f 03 29 50 62 ff 90 05 41 c0 c8 7d 46 08 49 ae b4 04 21 cd e3 be 47 Data Ascii: 8n[`J1@wT&gM .SAL1R!rv)f*]c-md bJgBlq\|+25Ic@?x=l>fMF`:)mY,<a2]4=z FgzF?)PbA}FI!G
2025-01-02 05:12:37 UTC	2920	IN	Data Raw: ea c2 81 5e f8 95 56 b3 05 7a cb 81 00 e0 1a 3b 29 84 0b b8 00 04 38 82 e5 c3 00 04 40 00 0c b0 86 42 d8 0a a9 50 a3 19 c8 02 f4 d2 9b 15 50 82 03 73 82 39 b8 00 71 10 82 21 f0 b6 ba 50 c1 15 44 a1 b7 62 0c ff a3 31 1f b0 93 08 c9 10 3d e0 d2 21 4b 13 29 d8 ab 3f 06 10 07 d9 5b 39 b8 fb 07 04 e8 01 9d 20 3e 9d 88 18 00 94 b9 1c 78 06 03 12 2a 60 78 02 1d c0 ae 00 c8 00 96 9b 3d 02 68 42 04 70 c2 23 20 11 58 28 91 36 98 01 a8 40 2f f8 59 01 b3 13 02 70 e3 88 45 5a c3 ce 6b 21 a2 51 ab 37 6c 21 33 c4 17 17 1a 45 6d e3 2d 4c 13 2e 71 b8 45 95 83 3b 95 43 00 1f 5c 0d 6d 80 0a e1 73 83 00 48 c0 01 b2 05 a1 ca a9 1b e0 9a 3e e8 81 49 cc 3f 71 68 00 5c c4 82 27 00 06 80 7a 8e ea 3b 80 cf 52 01 2c f8 ad 24 eb 9c 7f 21 1c fb 42 c5 d6 4a a4 7c 58 34 24 19 32 4e 39 Data Ascii: ^Vz;)8@BPPs9q!PDb1=!K)?[9 >x*`x=hBp# X(6@/YpEZk!Q7l!3Em-L.qE;C\msH>I?qh\'z;R,$!BJ\|X4$2N9
2025-01-02 05:12:37 UTC	14600	IN	Data Raw: 3d 41 df ca 38 9b bf fa ca cf fd 9c a1 83 cc 9f dd a9 95 50 29 1c 00 a3 bf c4 23 28 7c e5 b7 86 fa 9b 80 e8 1f 00 76 17 37 21 20 01 13 88 7f 13 80 fd d5 06 b9 17 8a f6 98 30 01 ed 47 a6 16 00 08 02 04 e6 10 bc 80 e0 20 42 83 08 30 1c 59 68 0a 09 44 53 17 30 3c 44 92 24 c9 2d 0c 58 6a 09 aa f5 aa 03 c8 0e 03 1a 30 50 22 84 84 89 94 26 e6 48 68 29 e3 e5 bd 7e 0b fc e1 fb 67 e2 1f ce 9c 3a 77 f2 ec e9 f3 27 d0 a0 42 87 12 2d 3a 74 85 c0 39 17 e6 20 44 70 e4 c2 11 0c 17 0c 62 40 70 e5 16 d6 5b 24 ae 0c c8 aa f5 82 38 71 82 18 90 9d 42 e2 2c 89 09 b5 94 d4 e8 41 22 a7 b8 1a c2 86 0c a9 81 af 5f 3f 7f fe e6 18 ed eb f7 2f e0 c0 82 71 22 2d a8 d0 a9 54 ab 08 0e ff 1f 5c 4a 50 29 41 81 58 c2 8a 25 ab 84 ac 8c cb 97 25 08 91 51 a3 86 90 cf f7 68 fa c3 8b b7 f4 3d Data Ascii: =A8P)#(\|v7! 0G B0YhDS0<D$-Xj0P"&Hh)~g:w'B-:t9 Dpb@p[$8qB,A"_?/q"-T\JP)AX%%Qh=
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 84 72 c9 e2 71 8d 2d da 98 ad 58 e8 ca ab 20 af 38 e0 6b 75 6a 2a 31 ec 1c c7 e2 43 db 10 42 24 59 03 16 1d f6 93 8f 6a 75 4e 6b 2d bf 7d 62 eb 6a 49 b0 42 a4 65 4f 8a ee 54 6b 4e 48 dc 92 eb ae bc 36 30 41 12 e8 0a 23 64 0f ff cc 61 a4 30 12 7c 24 ef b4 a2 f6 73 f1 3f dc 0d 71 4f 0d d4 f6 7b b2 94 00 7f b4 ad 7f c2 21 40 ff 20 c2 09 0f 10 29 af 0c 42 8c 00 03 9b 56 27 44 26 16 67 1c da c6 d3 d6 d0 9a 12 e5 6d 57 aa a9 28 2b 3d 25 70 c3 0d 25 6b 80 7d 2d 9a 13 16 18 28 2c 0e af 0c 4c c7 40 c5 08 70 26 83 04 e0 65 d2 c1 05 ca 0a 61 b2 d0 ea c1 76 cf 68 a6 2e b0 34 dc f1 81 61 92 cb fc 41 ed 53 5f cb e5 34 06 53 4c 69 2d c8 11 3d 90 40 c2 2b 6f 24 99 8f 0c 5c 40 f8 4a 26 b4 34 80 41 4b 24 97 36 72 dc 95 c7 77 77 7f c2 dd 7d 41 4e 8d 51 6d d3 8e 0d 37 98 f5 Data Ascii: rq-X 8kuj*1CB$YjuNk-}bjIBeOTkNH60A#da0\|$s?qO{!@ )BV'D&gmW(+=%p%k}-(,L@p&eavh.4aAS_4SLi-=@+o$\@J&4AK$6rww}ANQm7
2025-01-02 05:12:37 UTC	11512	IN	Data Raw: 5b 30 21 ba 89 9f 80 ad e6 b2 24 c5 a0 08 a5 15 91 c0 3f f4 00 52 65 84 61 69 1b 35 99 82 03 a0 e2 b5 cd a7 15 41 0e 15 31 e6 04 38 c0 05 48 c0 00 8c 9f f0 69 89 10 2c c5 80 34 40 99 c8 14 51 40 e7 8f 15 58 74 36 28 68 ca 94 87 8c e6 52 24 64 13 32 91 fe 29 41 78 0e ff 4a 52 84 52 b3 cc 1f 71 79 28 46 62 00 71 89 a8 46 08 97 38 22 00 15 75 62 a4 30 d4 a5 6d 0a 01 24 c1 14 cc 01 42 69 4a b2 10 45 84 61 85 73 ce c7 8e 7a 48 8f 02 a9 cc 18 a3 ea e4 83 3a 14 a9 84 4a 56 dc d5 05 9d 09 8a 50 12 85 93 9a e3 05 44 e9 11 60 0c 89 55 e9 a2 20 80 b4 51 4e fa 1d 41 d3 dd 5d d0 4d cd a6 ec dc 14 24 c1 2b 22 5e 0b b5 cb af bd 87 d5 98 d6 8e b6 8b 2b c1 29 e7 75 17 fc dc 83 7f 4a a0 94 b9 1d 5e 08 4a 86 26 c5 a3 0a de 47 d8 97 87 62 0d 63 18 ea e5 4c 1c 12 18 a6 15 99 Data Ascii: [0!$?Reai5A18Hi,4@Q@Xt6(hR$d2)AxJRRqy(FbqF8"ub0m$BiJEaszH:JVPD`U QNA]M$+"^+)uJ^J&GbcL
2025-01-02 05:12:37 UTC	15904	IN	Data Raw: ec 3f d3 12 15 17 6c c3 dc 72 36 bd 2b 39 f3 a8 41 be 68 92 5a 98 36 14 11 84 4b e4 c1 5a b9 9d 05 08 42 8e 69 17 6b 41 a3 dc 71 a1 17 5a a4 e3 99 b7 78 59 8a db 29 1e e7 da bc 79 9b 40 7c 68 c4 7e b0 bc 48 dc 40 10 7c 2f 67 cc 0c 4c 1c 20 4c 12 06 16 d1 c2 8e 60 b9 49 11 07 81 c9 1f 53 39 88 19 c4 9a 84 38 12 bd 70 9d 5a 6a c5 3a ac b6 27 59 be b5 ea ba 5a e4 c3 e5 f2 36 3c 61 a0 b6 5a 24 90 68 85 0a 64 be a5 30 8c 5f e8 47 2d d0 02 79 ab 9d 0b 94 c2 42 94 80 64 d4 c0 f1 23 bf ff e8 a9 56 f8 c7 7f d4 05 87 ec 01 b5 ab 08 71 d0 05 8b d4 85 ff 51 b8 c8 f1 f0 88 33 f8 87 4c f8 c8 33 38 83 1e e8 81 2b 50 a5 0b c8 80 01 48 c9 09 e0 aa 57 48 c9 01 98 82 ef b8 82 09 98 c9 1e 20 01 97 bc 02 be 90 43 50 12 8c 5a 98 02 9f fc c9 67 c2 43 e6 13 82 7b a0 90 e4 79 20 Data Ascii: ?lr6+9AhZ6KZBikAqZxY)y@\|h~H@\|/gL L`IS98pZj:'YZ6<aZ$hd0_G-yBd#VqQ3L38+PHWH CPZgC{y
2025-01-02 05:12:37 UTC	14600	IN	Data Raw: 88 e3 2d c1 51 c2 2b 5c 59 9c 30 c9 44 31 29 e9 47 bb ac 66 c0 04 2a 50 5e cd 8b 9a 67 da 65 c2 65 2e e0 69 16 a9 a0 09 95 b0 8a 8e ea 83 08 00 80 e6 3d b6 56 03 01 6a 08 83 99 48 e9 1c bc f6 b9 29 78 6d 6b 64 9c 42 90 60 76 81 22 bd ae 88 ec 9c 8f 81 8c 28 54 da d1 4d ff 1b 04 d0 a9 c6 f4 19 a4 c2 5e 6c 15 34 a5 aa 04 b4 00 c0 86 64 51 31 f1 da d3 77 50 d4 d0 7f 94 48 4d fd 70 c8 3f be 17 46 7f e8 03 7a f9 70 02 04 5e 61 bd 1a bc b0 a3 fd 80 c0 00 a0 29 92 5f 0c 61 08 a5 aa c1 05 c0 51 83 57 cc 55 10 9f ab 2a fa 0e 72 05 99 36 60 7f 40 fa 87 91 14 bb d8 9d ce 27 36 4f 0a 2a 25 6b 77 20 12 cc 01 03 1a 78 c5 65 3b 15 58 06 ac 82 08 7c 80 8b 42 6c 76 45 d1 e2 a3 1f 58 db 6a ac 1a aa aa 10 61 a4 15 11 bd 0b 3e a2 96 18 63 5a 44 33 50 fb c7 10 56 fb 33 00 cc Data Ascii: -Q+\Y0D1)GfP^gee.i=VjH)xmkdB`v"(TM^l4dQ1wPHMp?Fzp^a)_aQWUr6`@'6O*%kw xe;X\|BlvEXja>cZD3PV3
2025-01-02 05:12:37 UTC	255	IN	Data Raw: d8 7c 22 56 fe 6b 26 67 ba 1c 7c 0d 59 91 65 52 7f dd 00 34 98 5a aa 45 83 9c 4c 59 80 5c 83 72 28 00 ae ed 5a af fd 5a b0 2d 80 72 58 03 d9 5a 83 ae 15 4a 72 55 4b 52 68 ca 3c f0 1b a0 0d 5a 5e 68 b7 c5 79 1d 70 59 29 70 31 b9 73 e9 b1 a9 73 5a 90 e5 d7 73 10 9c aa 9d da ab c5 5a 95 08 5b c3 3d 5c c4 2d 80 88 4c 5b b5 d4 84 c0 a5 bb b8 95 4a f6 21 33 3d 99 3e 71 51 b3 bf d3 db 97 44 9a 16 a3 c2 c0 b5 5a 81 25 dc c2 4d 5c d2 4d 5c 88 64 dc 9c 74 5c aa 95 d8 16 23 a1 8a 5d 9c 19 43 21 cb d5 44 a7 cb 5b e2 04 b2 ce 3d 9d c0 0d 5d d1 5d 89 d2 fd 5d 44 c3 65 48 d4 d5 c8 aa 65 5d a1 1d da d8 4d 4c d9 c1 5c db 6d c9 1f c3 dd 16 13 38 aa ed 5d c1 00 5e eb f5 da 85 1c de e3 2b 5e c8 55 43 d8 6d 1c d9 4d ba 37 ac dd fe eb 24 ca 84 de ec 42 52 ea fd 87 80 00 00 3b Data Ascii: \|"Vk&g\|YeR4ZELY\r(ZZ-rXZJrUKRh<Z^hypY)p1ssZsZ[=\-L[J!3=>qQDZ%M\M\dt\#]C!D[=]]]DeHe]ML\m8]^+^UCmM7$BR;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49826	216.180.236.138	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	352	OUT	GET /img/Fky_1300x240.gif HTTP/1.1 Host: ig72.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	1092	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 1675 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83c6d79cf83f8-LAX Content-Length: 296725 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:09:17 GMT Etag: "67617e53-48715" Expires: Sat, 01 Feb 2025 04:41:22 GMT Last-Modified: Thu, 02 Jan 2025 13:07:12 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s8VATrQfJ9bqMVM%2FDNztB%2FgFOGJj6ye7B6EVcZpA%2BhhVSCJptKzmh7gJLdbjcTEDFtJYfL%2FxP39YZigDMNvOUKIfLtV%2FYSoafJ60CDKb3cxHMYQa5QdT65ShvE%2FJI5cSOQ%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=916&min_rtt=778&rtt_var=131&sent=378&recv=28&lost=0&retrans=0&sent_bytes=528857&recv_bytes=2422&delivery_rate=339716608&cwnd=452&unsent_bytes=0&cid=03e34a64faf96153&ts=11316&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:35 UTC	94	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 00 00 14 64 a5 29 a0 df ff da 24 ff ff b4 f9 b8 b2 fc d6 d5 64 56 a0 9a 56 22 94 32 ff 94 64 aa 18 8d b2 6b 49 20 28 6d d5 b0 ef fe fb d8 f3 fc d1 b6 2a d5 f4 61 98 a8 2f 34 b6 ff ff 6e fc b4 d3 af 91 5c 0b 51 72 51 b3 65 63 56 61 90 f0 ff fd 90 b7 Data Ascii: GIF89ad)$dVV"2dkI (m*a/4n\QrQecVa
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: f2 af 96 5a 1e 19 d6 d4 f7 8c 55 ff 4b d0 f4 a5 dd 9b 63 e5 54 54 26 ae f9 4e 94 fb 6f ae 67 33 cd f2 96 8e fe d4 46 db 74 6b 2e 29 ff fc d8 6f 5a a0 28 0e 28 6f 3e b5 f6 d0 24 12 d6 8d 2b 9f 16 11 6c 45 cb 6d 32 fe f6 d6 8f 6f 67 fb fe 94 d1 f0 8d 77 d8 8d 71 50 2b fe f6 b4 33 90 72 d0 74 f2 fd 2d 9c 6b 90 6f fc d8 d3 d4 6a b7 f6 af dc fb d8 32 69 4d 33 4f b1 8e f9 fd b7 f4 a5 d0 6f 62 cf 95 d6 b1 8f fb 6d 94 d7 b1 d2 b2 6e 44 a7 98 2e 42 f7 ff d8 92 8f 70 6e d2 cf 90 4b cd 76 28 4b 55 fb f7 b3 4c 8e 8b fd 1b 15 1d b0 8f d5 d5 d3 b3 d2 b1 6e b3 b1 d8 d4 b4 b2 b5 91 91 90 b2 d0 3f b6 d5 b6 b2 f3 b6 b1 b2 58 27 ce 8c 4a 45 f5 b2 6e d3 69 57 d6 d3 8f 90 90 d4 d4 b2 f9 b3 d3 d5 3e 8f f2 8a 6d 40 70 8c d6 90 b5 f4 b0 91 b0 ef 4a 71 ad 73 cd f0 94 28 d4 6d 0e Data Ascii: ZUKcTT&Nog3Ftk.)oZ((o>$+lEm2ogwqP+3rt-koj2iM3OobmnD.BpnKv(KULn?X'JEniW>m@pJqs(m
2025-01-02 05:12:35 UTC	538	IN	Data Raw: 68 a1 8d 32 da 27 a3 91 e6 e9 e7 a1 80 66 6a a8 9e 97 76 7a 27 9c 68 8e d9 66 9a 60 92 39 a5 9b 51 82 e9 01 98 ac 8a 6a 66 9e ab 9e ff 59 66 ac af 86 ba 0b a8 b0 f2 b9 ea ab 6d d2 da 66 99 bb 00 6b 26 9f c1 a2 49 ec a7 77 de ba 68 b2 80 26 bb ec b3 ce 46 0b 2d 2f bd f8 39 cd 9d d5 ee 72 2d b5 dc 56 eb 6d b7 e0 7e 2b 6e b8 e4 8e fb ed 34 e3 06 ab 6a ac ac b6 ea 6e 94 6e f6 00 88 0e f4 26 d0 86 0e 6d dc 9b ef be fc f6 9b c0 bf 09 00 12 30 20 31 14 6c f0 c1 25 1c ac f0 c2 0c 37 bc 70 c2 0e 47 5c b0 21 86 dc 71 07 c5 2b ac a0 43 02 1b 6f ec 84 c0 15 df 41 05 15 14 5f 6c f1 c9 16 53 81 f2 c9 14 b7 ec f2 cb 30 c7 fc 32 0f 16 dc 31 90 40 00 28 c4 c3 42 11 20 14 41 43 3c 5c f0 90 44 14 19 41 11 48 1c 35 60 34 4b 26 a5 24 d2 49 2a d1 42 92 d4 2b 41 dd 92 11 30 a5 Data Ascii: h2'fjvz'hf`9QjfYfmfk&Iwh&F-/9r-Vm~+n4jnn&m0 1l%7pG\!q+CoA_lS021@(B AC<\DAH5`4K&$I*B+A0
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: 3c 83 18 0e 32 51 dd 32 00 a3 62 b4 48 17 2f aa 91 8b ff 84 28 a4 20 cd c8 47 48 2c d2 8f 76 54 a4 ec fc e8 89 44 8a 62 14 11 a1 a4 29 d0 c1 8a 56 54 43 fc ac 21 3f 44 4c a9 07 58 02 a3 07 c4 28 c6 2e 49 09 55 5a 72 53 ab ec 14 25 36 c9 ea 4c b5 12 d3 99 42 45 c7 34 c6 8a 8d 9f f2 53 9d d0 94 26 36 e2 89 8f a5 02 d6 9b 8c 25 aa 42 aa 69 90 7a d4 23 1b 27 55 aa 3d 16 ca 55 90 bc d4 9b d8 44 49 4b 05 32 4e c6 52 e4 a5 12 25 28 63 f9 f1 56 84 94 d5 3a 1a 19 c8 39 d6 6a 5d 5a c2 a3 9d 82 45 26 52 9e 69 94 ab 82 95 9f 72 45 a6 57 2d 0a 4e c7 fa a4 9b 56 e9 81 51 26 12 96 c5 f2 63 ae f2 74 ab 60 c9 89 95 c1 f2 e5 28 8f c5 4c 40 f5 42 5b d0 e4 56 34 b3 75 ad 6d 4d b3 5c d8 f4 56 35 cd 15 ae 6d 76 ab 9a bb c8 16 bb c6 59 ac 72 f6 72 17 3d 58 87 0e 00 d1 83 5b e0 Data Ascii: <2Q2bH/( GH,vTDb)VTC!?DLX(.IUZrS%6LBE4S&6%Biz#'U=UDIK2NR%(cV:9j]ZE&RirEW-NVQ&ct`(L@B[V4umM\V5mvYrr=X[
2025-01-02 05:12:35 UTC	5930	IN	Data Raw: 0a 9d 7b 4f bf 07 6f 1b 2e 03 db e0 83 0f 9c 0b b3 81 ce 3a 6b 9a fb e5 98 63 5e 3c 26 1b eb 60 b4 d1 c6 61 6c 94 f1 18 70 8a d1 d1 46 1f 6f 94 d1 9a 17 7f 58 24 88 20 fa 80 23 08 56 42 61 92 49 38 58 11 44 90 11 a8 ac 52 8c 55 7c a9 46 19 5f b8 e4 32 9f 6a aa 99 60 82 65 84 f9 e6 81 43 e0 80 43 10 54 1e 39 84 04 12 0a 29 24 ce 42 16 d1 a0 86 45 6a d0 b3 95 56 28 a0 a0 86 42 6a e8 93 4f 3e 29 28 83 08 07 0a 25 ff 82 82 56 88 58 94 d1 24 92 21 06 1a 62 1a c8 c6 9a 4b 33 b5 06 c6 4d 3b 3d 66 d3 4f 43 3d e6 03 4e 47 35 95 54 54 6f 54 75 55 70 8e 99 62 88 1e 60 1d e2 d5 1e e6 99 e7 9c 5b 6f 9d 82 0e 3a 7a e0 d5 d7 5e 79 3d c5 d7 1e 86 fd b5 d8 62 3d e8 c1 83 53 94 f5 60 1d 0f a2 95 56 5a 68 a7 9d 16 5a 72 a6 dd 25 da 6c b7 9d 36 5b 0f bc 05 97 5b 0f 78 29 d7 Data Ascii: {Oo.:kc^<&`alpFoX$ #VBaI8XDRU\|F_2j`eCCT9)$BEjV(BjO>)(%VX$!bK3M;=fOC=NG5TToTuUpb`[o:z^y=b=S`VZhZr%l6[[x)
2025-01-02 05:12:36 UTC	7116	IN	Data Raw: 64 d8 5f 27 99 b3 52 4b c5 b8 04 d3 4c 1f fc 52 53 0b bf b4 b0 67 31 5c 5c b0 53 3b 47 15 55 54 34 0f 3c 40 80 f1 c9 1f ff 80 0f 05 98 a1 94 53 5b 44 25 95 57 5c 75 b5 7d 57 db 64 e5 bd ea 62 a9 ae 11 5c 69 b5 de 3a 3a e4 a7 e5 96 59 6a 99 15 9a 6f be ed a6 57 61 86 21 46 d2 62 7b e9 75 ff 0e 61 8e 45 86 d2 6f 66 77 99 87 0c 83 39 ba f8 1f 49 40 03 1a fd 99 e4 3a 98 99 c7 69 72 71 9b 94 a0 e7 35 b3 89 09 6d 90 53 1c e2 c4 6e 30 89 79 48 7c 4c 72 92 e1 0c f0 35 b6 89 8e 06 5d f2 1c f2 a0 e6 35 28 1c c6 6f 2e d3 1c e4 90 47 3d cf a1 21 72 c2 83 43 ed e8 70 85 38 1c 60 36 1c 32 9e 18 ce 2f 30 fb 03 21 60 86 38 1e cc cc c6 1a 18 7c 8e 35 86 11 45 05 19 a8 36 55 44 50 6c 74 b1 a0 03 01 68 43 b4 39 50 4c a6 58 27 0d 69 a8 4e 32 a1 d3 31 7e 50 05 1f a9 e8 44 28 Data Ascii: d_'RKLRSg1\\S;GUT4<@S[D%W\u}Wdb\i::YjoWa!Fb{uaEofw9I@:irq5mSn0yH\|Lr5]5(o.G=!rCp8`62/0!`8\|5E6UDPlthC9PLX'iN21~PD(
2025-01-02 05:12:36 UTC	8302	IN	Data Raw: 8f ae c8 8a 92 e1 8f 5e 84 08 62 84 90 6c 04 d4 10 69 47 18 c9 51 7e e4 50 1e 29 49 9a 64 93 2a 49 92 22 89 49 82 49 49 62 6d 4c 50 09 d7 ee c4 96 54 09 4e 52 69 4e cc 24 4e 80 09 50 ea c4 d7 bc c4 96 02 45 97 06 25 97 f0 04 50 66 e9 96 f2 04 4f e0 44 d7 1e d1 da 5e f1 d4 1a 69 91 98 89 db 98 e9 14 50 aa a2 a6 09 e2 e2 2d e4 78 51 e4 7e 11 18 db cd e2 86 b1 17 2b 2e e4 96 41 0b 98 45 e3 a2 c5 9e 3a ae 5a 52 8e 18 7d f1 18 83 91 1a 13 2e 1a ff 89 f1 17 af 81 e5 22 0a 5d f0 49 dc 8a 71 1a 85 11 1c a1 b1 1a a9 91 17 a1 f1 1c 89 d1 a1 00 2e e0 5c 0e 53 56 aa 1b 63 ae 04 0c a0 e6 66 ca 02 70 2a 06 fa 20 e7 5e 0e 5f 00 86 0a 22 00 13 5e 46 01 22 60 18 72 21 1b 34 01 0c 40 22 21 17 12 e9 8c 2a e9 aa ce a8 94 ee e8 16 e0 e8 2a 60 eb b6 4e eb 36 c6 08 b2 4e ac 0c Data Ascii: ^bliGQ~P)IdI"IIIbmLPTNRiN$NPE%PfOD^iP-xQ~+.AE:ZR}."]Iq.\SVcfp ^_"^F"`r!4@"!**`N6N
2025-01-02 05:12:36 UTC	3672	IN	Data Raw: a9 60 18 94 57 5c b5 42 b2 d2 5c 96 88 21 18 a9 2d 5d 76 0e 03 82 61 3e f4 ff 17 00 91 2a 51 04 39 5c e4 c8 f9 81 ff e9 18 b8 61 d9 74 65 1b f6 10 5c 04 34 0b 2a 2e a8 60 4f 98 38 65 ca 38 72 f4 d8 51 9c af 55 17 17 9c 5c 80 c1 e2 4a 95 15 31 54 44 33 e0 5a 48 9a 1d 69 56 73 89 32 a5 c5 81 e0 20 46 64 c8 b0 e1 af 63 72 12 ed cc 99 14 e9 d2 96 4c 59 ae 54 aa b4 a9 4a aa 68 22 c9 39 a6 e9 64 85 01 cb 44 7e b5 09 32 ec d7 91 93 4e aa cc e8 15 e4 5a 65 d5 56 e9 84 6b 51 a3 d8 90 1c 49 c6 45 a9 f2 ca 80 09 60 43 56 38 89 66 2e d8 6a 4b 76 2e 18 33 40 dc c7 90 6e 51 72 bd 46 d7 a3 2f c3 27 2b 61 9b c9 56 59 be ca 28 23 59 3b 06 1a f4 30 d0 e0 ac fd 12 8d 3a f4 b1 79 44 5c 97 21 e2 20 36 91 56 a0 1e 3d 12 04 27 48 10 38 ac 04 8d 10 74 68 04 6e 36 82 04 3d 1a 01 Data Ascii: `W\B\!-]va>Q9\ate\4.`O8e8rQU\J1TD3ZHiVs2 FdcrLYTJh"9dD~2NZeVkQIE`CV8f.jKv.3@nQrF/'+aVY(#Y;0:yD\! 6V='H8thn6=
2025-01-02 05:12:36 UTC	10674	IN	Data Raw: 5a ae ad ca aa 94 3d b1 8d 00 af 25 5b b3 25 88 ae fd 5a 4d 60 5b b6 dd 82 b6 85 db ad bd da e7 91 83 96 c8 1f ff 2b 20 11 b4 88 fd f1 9d a5 95 c0 f1 04 5c 06 f3 20 10 42 b0 e5 e3 ae 65 10 86 c4 4d 39 9b 58 06 7b f0 4e 7b 58 dc c0 1d 4f 5f e8 04 b8 c0 00 85 b0 06 24 2b a1 14 0c a1 d2 11 8d d6 98 8d 17 24 02 12 c0 4f de 80 50 dc b8 8d 1c cc 8d 2f 43 85 30 fb c1 31 a3 0e 0d 40 42 25 6a 0e 18 a2 00 54 60 c2 26 84 03 28 fc 03 29 bc 33 29 aa c2 2c a0 8f e1 d5 8f 3f 13 b4 11 fd 42 31 04 a3 31 34 d1 34 92 23 1a 2d 00 fd 68 51 18 7d 10 3a 2a 90 71 a0 51 77 e0 a3 6e 38 9f 63 40 04 8b 19 b5 29 28 35 9f 30 11 50 eb 01 3a ff 38 5f 56 73 24 42 2c d2 2a 68 83 2a 20 d9 25 81 06 50 3a 92 5b e0 35 29 c5 5f 7f 18 d3 12 b0 52 72 28 b6 18 38 36 5d 59 17 2d 89 5f 20 69 36 2d Data Ascii: Z=%[%ZM`[+ \ BeM9X{N{XO_$+$OP/C01@B%jT`&()3),?B1144#-hQ}:qQwn8c@)(50P:8_Vs$B,h* %P:[5)_Rr(86]Y-_ i6-
2025-01-02 05:12:36 UTC	11860	IN	Data Raw: d0 75 e3 38 46 58 37 ca 1c f1 31 5e c1 51 1b 31 92 26 c5 ea 1d 9f 86 ee ac 41 ef ac ff 01 af fa 75 6a 8a 21 28 fb ce b2 0a cb b0 40 a1 06 50 a1 6c 08 af 6c ca e6 b1 22 8b 2b f9 46 03 32 8f 02 0a a1 6e da e6 2a fb 86 6f 28 8f 08 0a e0 70 0e c7 2c 0f 81 f3 e0 80 0f ce 66 b5 de 72 0f 50 60 64 fd 60 65 f9 60 71 28 01 0e 16 69 72 aa 44 74 9e 84 74 6c 96 00 7e eb 2f 61 8f 74 74 6b b7 76 eb 45 08 c2 47 9e 61 22 2c 62 b2 fc e6 76 2c 69 f8 1a c2 32 71 e9 4c ac 6b 69 43 22 19 ba 01 1a b6 c1 33 cb 4b 34 b1 b6 fe 92 53 28 52 73 28 da 80 c3 e0 82 c3 62 33 2b ee 2c 37 33 10 39 83 a2 bd 56 33 28 ee 27 3b e9 6f 3b e7 6b bf 4a 00 0b e8 16 0b e6 e2 bf 72 ec bf ec b6 6e e9 16 1a d4 96 6b ff ab 0b f8 b6 0a bc b3 6b 83 33 6d 05 b7 6e ab 80 6e 9f c1 3c d3 f6 bd e8 76 71 db 36 Data Ascii: u8FX71^Q1&Auj!(@Pll"+F2n*o(p,frP`d`e`q(irDttl~/attkvEGa",bv,i2qLkiC"3K4S(Rs(b3+,739V3(';o;kJrnkk3mnn<vq6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49820	183.204.210.219	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	616	OUT	GET /jiamigif/tyxsc/xmspggTT2-1300X240.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	583	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 281740 Connection: close Accept-Ranges: bytes Age: 1 Cache-Control: max-age=2592000 Etag: "67711016-44c8c" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Sun, 29 Dec 2024 09:02:14 GMT Via: cache11.jhmp03,cache08.zzcm05 X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 2c111be354105f5b9621e5b76a81de67 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:36 UTC	15801	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 ff 00 d6 ce d0 fc d8 aa 1d 20 fc aa 6d b1 fe 22 04 d2 aa 97 a2 a0 f4 25 05 04 ff 68 67 ff ee 4e cd 66 00 ee b6 2e 6e 48 26 23 74 ea fd af ae b0 d2 f9 51 00 00 1c 8c ed 0c 50 a6 ef d3 29 ff ff 00 b5 8e 29 cf 96 8e f9 b5 09 6b 9a e7 d7 d7 f6 d7 b6 76 69 6e a7 70 49 45 d9 b8 de d4 93 2b d5 ab 2d f7 d8 90 dd cc ba 93 4d 06 b6 93 8e f4 90 03 61 5d f5 f9 90 8d 6e 8a ac fc 2e 1e da 8e 0a 4a 04 da 0d 2a 5a d4 b2 4c b3 b1 b6 f3 d9 71 f9 d0 08 b1 72 28 b7 8b 72 5f 93 45 92 6c 2a f9 f0 32 d2 91 70 0e 47 70 b6 90 4c 13 62 03 fe 45 23 ee 76 01 91 70 6d 70 2a 08 f3 b5 91 8e 4e 2a b1 73 6e b1 4f 05 8f 2b 06 d5 94 4c 44 2e 2b 8e 50 49 b0 6f 4d 92 6a 4d f7 4b 42 f3 b7 6e da ee f7 d4 4d 08 fa 90 70 b2 6b 0c 6d 2f 2a d9 46 45 f0 b8 4a 4a 45 Data Ascii: GIF89a m"%hgNf.nH&#tQP))kvinpIE+-Ma]n.JZLqr(r_El2pGpLbE#vpmpNsnO+LD.+PIoMjMKBnMpkm/*FEJJE
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 6a 8e 66 68 06 e6 95 30 0a a3 70 01 17 c0 80 68 6a e6 52 7a 00 6c 82 98 a4 48 86 0f cc e6 07 28 5f a7 59 49 32 7c 00 6f a2 66 a6 6d da 6f 0e e6 15 5e c9 98 d0 26 6f 32 81 bd 40 09 65 92 a6 59 2e 0c 75 62 44 c7 7c 0c e8 8c 0c 4e 6d db 1f 8e 14 2d 54 0d c9 a0 5b bf 49 8e c3 a8 0d 9e 81 14 11 1c 44 22 de cb c6 f8 db 7a 72 67 41 34 41 d3 10 03 11 88 cd 0e c8 c4 0e 30 84 0f 10 83 52 5d 04 1c 8e 04 2d 44 89 b9 89 e7 b5 28 0d 7c 7a 27 ae 48 9b c6 ac 8d be 79 e6 7a 16 68 43 04 8f 54 4c 45 c2 19 85 23 2e 16 72 a4 a2 5c 38 81 27 ba a7 87 12 8d e4 84 28 64 8d 63 53 f4 62 e7 9c a8 d8 84 cd e7 3c 0c 8b 12 4d 33 cc 95 52 80 96 38 ee e2 2e 92 16 1a 04 4c f0 5c 28 55 18 03 64 c9 82 13 2c c4 d2 40 96 d5 bd 05 24 ce 8e af e4 a8 61 00 43 8f a2 ff 41 7b 62 82 90 a6 e3 dc 1c Data Ascii: jfh0phjRzlH(_YI2\|ofmo^&o2@eY.ubD\|Nm-T[ID"zrgA4A0R]-D(\|z'HyzhCTLE#.r\8'(dcSb<M3R8.L\(Ud,@$aCA{b
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 1b ac 00 29 37 1c 01 6d 63 0b 58 68 c4 46 94 03 39 e0 9a 1a e0 36 0b 88 82 1f 68 82 2f 68 06 65 20 04 c2 e2 9b 3e b0 29 44 68 4f 23 40 1b b9 3c 9c c1 91 d0 08 5d 0c af 11 86 46 fc 82 f7 32 c6 c0 ba 27 d2 39 00 06 90 20 fe f8 d0 e3 c0 45 10 ad 80 b5 ba 82 b4 b2 86 f9 c8 85 31 98 01 3f 30 89 a5 aa a7 f4 f9 82 e7 5a 2b d6 88 04 21 39 51 e8 82 00 2e 51 2e 8f ab 00 b7 e2 8f 22 fa a1 60 22 13 a9 ba 81 20 9d 81 2b b8 01 eb 61 81 3e 50 52 3f 60 01 18 a8 9e 65 f4 03 a7 8a 9f f5 d1 52 fe eb 25 f6 81 ba f5 41 1f 1f 2d 2d d8 38 80 b4 7a 2d a0 8b 1e ff 49 22 99 9b ae dc 1a bb eb 12 12 11 d8 b8 d2 ea 83 e7 01 89 d2 92 07 d8 60 1d 99 1b 03 38 c5 45 1b d2 38 e2 82 47 97 2b c5 e7 4a a1 7b dc ab 03 12 d3 d1 7a 82 08 a1 2d 76 44 07 1b f2 21 d8 ff 81 80 1c ba a7 cb 33 9f 1e Data Ascii: )7mcXhF96h/he >)DhO#@<]F2'9 E1?0Z+!9Q.Q."`" +a>PR?`eR%A--8z-I"`8E8G+J{z-vD!3
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: f1 3a 33 6a 73 e9 81 19 33 77 3b 3b 6a a3 bd 63 71 bd 15 a4 9b d3 03 b6 d3 09 60 e0 0c c3 a3 35 3d 17 3c 6b d3 73 4b 07 40 5f 90 a4 b3 65 a4 e1 88 5b db 99 2c 3f 4a 74 69 17 8e 99 61 a4 62 3a a6 64 5a a6 97 85 5b 2a a5 2c 81 f2 59 32 5a a6 6e ba 39 20 80 40 28 10 3f 74 7a 68 ce b7 a6 b1 e1 a5 6f 4a a6 d0 a8 1e 1d 94 95 76 8a a7 81 b5 a7 6e 1a a7 c1 b1 40 88 8a 2c 72 07 a4 84 1a a4 9d 01 02 d0 85 19 60 e0 96 19 54 a9 00 f4 a7 97 1a 28 64 92 7b df 55 08 50 40 79 93 f7 45 2b d2 91 3a 89 7b 4d a0 08 3f a0 23 23 30 24 c2 20 92 46 19 5f a8 17 ab f4 35 5f 48 02 0b 2f 09 0b 2d b0 0e b4 00 00 b0 a7 ab 6c 70 5d 24 52 26 54 42 46 5c 10 46 30 51 08 64 64 43 3b 50 00 c2 d0 5e c8 37 24 1b e6 43 23 70 a7 d4 1a a8 b8 89 a0 96 9a 41 7e 54 21 ff 3e 60 05 2d 56 11 57 40 0a Data Ascii: :3js3w;;jcq`5=<ksK@_e[,?Jtiab:dZ[*,Y2Zn9 @(?tzhoJvn@,r`T(d{UP@yE+:{M?##0$ F_5_H/-lp]$R&TBF\F0QddC;P^7$C#pA~T!>`-VW@
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 58 62 42 44 e4 42 b2 14 00 78 b3 47 48 24 51 13 95 20 80 c0 4a 29 69 43 06 e4 43 98 f4 48 dd c0 ab 66 cd 2c 15 75 40 6a 87 93 40 10 08 e6 e0 48 18 69 1b e6 e0 94 a4 11 13 91 f3 3c c4 2d 55 b5 84 55 a3 e8 53 52 85 e3 5c 45 0e 76 a0 0f e4 8d de ec ad 50 08 05 4c 03 05 15 a8 e0 11 9c e0 9b d6 31 50 e8 04 15 1c 41 51 1c a1 de fc 6d 1f c5 49 52 8a 89 4e 42 40 18 6a c1 02 94 21 1d 9c 21 97 38 60 2a c1 c4 e3 9a 60 08 c8 84 01 0a 21 55 4c e5 2c 11 84 57 ca d5 21 c8 8f 07 9c 2a 57 e0 ca 57 da 75 57 7c 25 33 8e 68 58 98 48 8d 8a 00 2a d5 80 01 a6 e1 dc a6 c5 07 9c cc 0b ed 83 3e 5a 66 06 e2 c5 a7 82 e0 07 40 6b 1a ec 23 12 68 83 01 10 ab 68 e0 e0 0b 6a 80 01 fc a0 09 8c 20 06 a6 c1 a7 5a 26 19 6a 20 32 93 a1 08 d4 40 62 be 40 03 b0 e5 ff 59 62 80 07 7c 4f 0d b2 a0 Data Ascii: XbBDBxGH$Q J)iCCHf,u@j@Hi<-UUSR\EvPL1PAQmIRNB@j!!8``!UL,W!WWuW\|%3hXH*>Zf@k#hhj Z&j 2@b@Yb\|O
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: c6 6d 94 45 4d 4b 01 98 40 31 68 c3 0f d0 0a aa 54 42 28 50 d4 c9 61 2b 46 e5 14 48 16 80 05 6c cb 4d 75 64 b0 c2 02 4f d5 40 b7 e4 5c 11 7c 41 33 94 c3 34 70 41 13 70 41 d0 69 d9 2f 6c 98 4c 7a 81 17 d4 4b 4d d4 8b 18 28 9d 55 35 09 d8 69 d5 30 2c c3 02 58 dd 54 0d 88 54 dd 84 d7 99 69 4e 8a dd 93 34 a5 0e a8 1d da a1 1d 3a 0c 81 1a b0 c0 0d 54 25 1e 0c c0 1c c0 5d 14 10 56 19 d8 9d c7 4e 01 15 74 c1 63 09 81 15 9c 01 23 9c 01 24 a4 ec 19 74 03 24 c0 c3 df a9 01 b8 dc 00 e0 69 c0 59 9e 81 c9 2a de 0d f8 41 7c 32 40 10 7c ec cf 4e 41 60 7a cd e5 59 4d d5 cc 86 d7 b8 62 d4 8c 0c 2f 48 42 e8 99 0d e9 8d 68 88 de 96 63 a2 5e ea c1 0d dd e8 81 1e c4 c1 01 70 c1 01 84 a6 52 b1 e4 52 49 ab de f0 cd 1d f4 0d ef 0d 1f da aa ed ee c5 ff a6 f1 24 d4 db 4a 8e f3 ad Data Ascii: mEMK@1hTB(Pa+FHlMudO@\\|A34pApAi/lLzKM(U5i0,XTTiN4:T%]VNtc#$t$iY*A\|2@\|NA`zYMb/HBhc^pRRI$J
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 01 04 8d 82 4c 20 02 6b 4c cd 03 b0 1e 76 1b 01 0d 68 8c 7a b8 03 09 88 00 09 18 59 09 40 b5 af 40 35 b1 f8 98 4b 20 0b b3 98 47 17 38 03 7b 14 85 c1 00 06 17 18 48 5d b3 8b 5c cb 59 5f 03 b6 42 58 8a 10 08 00 3d ea 01 66 2b b6 1e 38 4b 0b 08 57 68 1b 0e 62 9c 81 81 04 56 80 7c 02 6d f3 22 0f 38 17 aa bd 84 70 63 0d d9 88 0d 95 dc da 36 b0 81 ea 50 8d 26 60 37 0b 28 82 e8 e1 34 0b 20 02 b4 49 9b 1f 28 04 64 c1 22 b7 dd 0e 83 83 db a5 4c ca a6 ac 5b a6 8c ca a8 dc 80 13 c0 5b 36 98 4a a9 11 0f 86 63 4b f9 68 39 fa b0 b9 00 99 b8 b4 14 cb ad 34 dc 62 aa cb c4 dd ca 61 f3 85 59 90 5c 5f 78 39 f5 a0 dc c9 0d a6 0a e1 10 c2 fd 4a f4 20 10 c8 f5 dc f3 e8 b9 47 91 14 14 59 9f d2 dc 3b d6 54 80 aa b3 c8 c9 28 02 d6 54 3b d6 34 ba 34 ff 70 5d c9 e0 08 4c 18 0d 2b Data Ascii: L kLvhzY@@5K G8{H]\Y_BX=f+8KWhbV\|m"8pc6P&`7(4 I(d"L[[6JcKh94baY\_x9J GY;T(T;44p]L+
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 30 92 78 61 7b 74 32 14 59 d3 a9 8e 46 09 35 80 07 b0 20 0c 16 20 04 4b 10 00 b3 20 0a b7 90 74 0f 20 07 76 34 54 3b 50 9c 6c c0 05 c9 c0 01 7d 50 06 28 f0 16 73 50 73 10 b0 02 44 10 03 16 80 06 af 03 0d ce e0 0d 32 87 05 41 39 3d 54 e0 0c 4d 80 06 c7 80 02 8e 70 04 54 b0 b7 0e 20 0a 00 50 9c 88 21 98 6c e4 3f fe 08 15 91 e1 8a 51 97 19 18 70 08 56 c7 19 2b 70 07 d9 90 09 3e 90 02 14 40 01 2f 10 bb b3 2b bb b5 ab 99 9b f9 01 31 90 0b 17 60 3e c2 43 3c 72 80 08 b2 19 9b c3 3b 9b b3 f9 4d b5 49 4e 1c 00 03 69 20 02 01 30 02 41 50 0d 46 b0 44 1c d0 53 64 a0 26 27 70 06 ee 40 03 0b 80 1e bb 88 7c 98 e7 4f e1 bb 4f 0c d0 07 16 00 42 6b cb 02 f1 79 03 fc 51 51 19 a5 01 3d 30 7b b4 17 00 b2 17 0c 01 40 7b f5 8b bf 01 e0 20 01 90 0a ff fd 8b 04 18 75 9f a7 27 51 Data Ascii: 0xa{t2YF5 K t v4T;Pl}P(sPsD2A9=TMpT P!l?QpV+p>@/+1`>C<r;MINi 0APFDSd&'p@\|OOBkyQQ=0{@{ u'Q
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 19 f7 18 a4 20 2f 06 d7 89 ba f0 2d 54 37 2f aa 04 13 ac 48 4d 76 80 0d 4a a2 36 46 00 c2 c8 a0 10 a0 20 0e e2 40 45 07 b1 77 57 94 0c 36 20 0b e2 a0 0a 1a e1 00 78 b7 77 e3 70 12 94 d7 77 57 b4 0f 8a 2a 04 62 81 18 0c 60 03 1e 31 91 16 a9 91 1a 00 48 13 c4 3b 9c 74 12 33 d1 48 e5 a3 91 88 34 42 92 40 3f 58 a7 42 b0 37 d7 e0 c3 00 ba b7 40 5c 29 02 76 71 43 ac 00 95 64 31 4d b1 f7 44 a6 8d 91 f0 77 4c 67 a9 01 ac 80 43 36 a9 01 f6 57 d9 1a e9 7f c7 14 7b 7b 09 7b e3 97 02 fa b7 81 b1 d7 0e 38 21 db cc b0 4a 38 21 82 ad c9 82 d1 a0 07 1c 01 1d 39 d8 1c 3d b8 83 41 f8 83 45 38 84 49 78 84 4d 98 1b d5 11 1f 55 78 85 59 b8 85 5d f8 85 61 18 1e 4b 80 16 6e 60 a4 6c f8 86 71 18 87 51 6a 1a 5c aa 87 d1 40 1b d2 41 a9 d2 c5 a6 6c 0a ff a7 d2 65 88 81 ca 22 8f 38 Data Ascii: /-T7/HMvJ6F @EwW6 xwpwW*b`1H;t3H4B@?XB7@\)vqCd1MDwLgC6W{{{8!J8!9=AE8IxMUxY]aKn`lqQj\@Ale"8
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 9a 18 00 a1 98 01 9b c8 c9 2f 0e 92 fa ae 89 01 e8 a9 39 2c 1c 31 34 41 35 8d d9 88 ad c0 1f 30 23 a9 24 29 95 1e 4b f1 d1 12 d8 58 06 48 74 00 5d f0 ca 30 78 98 ad 48 00 b0 9c 4c 04 43 f0 03 4f b0 05 97 80 4d b1 4a 18 c4 01 07 0b 0c 14 d0 63 0b a1 43 1e 6a 08 37 20 41 25 2a 80 1b 7c 40 17 2c 94 16 30 17 65 92 1e 43 69 82 1b 6c 2c 25 08 6a bf b8 c1 e8 05 5c 19 f4 cb 0d 13 c3 a4 12 c3 36 2c 03 00 c0 54 1a 11 71 c8 54 cb 4c 19 44 09 88 6a 53 91 2a 47 64 41 3a 9a 2a 35 92 86 ac 26 95 cd 60 5c c8 c9 59 0b ec 4c 3e 18 02 23 bc 81 21 80 31 d2 cc 40 43 a0 90 3d 16 5d 3c 11 9d 41 80 15 5d 0d 64 0b 3c 40 f6 fd e3 d3 bc 0d 69 4c 66 af 64 1f da 3c 9d 9c 61 40 04 6c ab 1f c3 dd d3 40 16 e0 24 56 45 06 b2 b6 12 72 e3 9c 5d 0b 6c e4 41 28 ff 16 da 95 e4 d3 d8 81 2e 70 Data Ascii: /9,14A50#$)KXHt]0xHLCOMJcCj7 A%\|@,0eCil,%j\6,TqTLDjSGdA:*5&`\YL>#!1@C=]<A]d<@iLfd<a@l@$VEr]lA(.p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49822	183.204.210.219	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	610	OUT	GET /jiamigif/168sc/168-1300x240.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	570	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 223344 Connection: close Accept-Ranges: bytes Age: 118 Cache-Control: max-age=2592000 Etag: "67555982-36870" Expires: Sat, 01 Feb 2025 05:10:38 GMT Last-Modified: Sun, 08 Dec 2024 08:32:02 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 2266e7185edfea412806bfbd7d941370 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT via: cache02.zzcm05 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:36 UTC	15814	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 ff 00 ad 9d 98 a9 91 65 fa db d8 fb d4 b2 01 d4 34 69 4b 15 97 d3 f9 e0 b3 ec 01 d4 fe 5a b1 f6 93 5e 9a ff f7 6d ff fb b1 0a 64 9e 8e 01 62 fb b4 90 bb 01 b6 48 f3 00 56 02 66 66 10 9c 29 28 28 58 62 ad e1 11 4e fb 6e 02 ff fb 90 00 f9 43 00 68 fc fb d5 4c 01 00 01 f5 b3 29 ff f4 4e b6 4d ef 9a b6 e7 11 62 04 fc d4 92 fd b1 af fe 96 94 d4 90 2d fb d4 6e fc d3 2d f8 b1 09 ff 69 69 b1 8d 21 d3 ab 93 b6 48 02 aa 03 fb f5 b3 4c ff cf 03 f7 90 70 f6 2a 2d d6 6d 06 6e 01 02 f9 00 b4 d5 00 00 1a 4c 6c 90 02 02 63 e4 f4 65 96 ab b3 02 01 d1 ef f9 d7 8f 6d d3 90 0b c9 00 88 d0 4f 02 d4 d5 d8 47 45 42 f8 b3 6f fe 29 00 b4 6c 09 25 99 f3 fc 4c 4c d3 26 31 93 4a 05 d3 70 29 d1 ba ad 11 25 61 50 75 c8 b3 6d 4e b3 6e 2a 00 73 c9 f0 d6 Data Ascii: GIF89ae4iKZ^mdbHVff)((XbNnChL)NMb-n-ii!HLp-mnLlcemOGEBo)l%LL&1Jp)%aPumNns
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 8c c2 11 90 c3 13 35 6b 72 a0 22 2c 23 87 3e 3c e2 22 de b2 23 2e e2 2c 27 07 2b ba 07 2c 9a 11 14 bd 40 75 f8 07 b2 2a c7 a1 b1 ae 81 04 47 3a a4 46 2f f2 2b 3b 5e d2 33 5f 2b 3b 6e eb 84 b8 42 44 d4 58 b9 66 73 b2 38 ee 5f fd 95 00 3c c0 b8 42 23 1d a0 1a 76 1d c4 8c 18 84 ee f0 c8 37 46 c2 34 b7 a3 bf d2 c0 26 01 5b 48 ce ff 33 3d 8a d2 28 79 c9 29 ed 80 27 88 89 c2 2a ec 3e 03 41 0b 3a c2 1f c4 c1 21 c8 09 2b 00 c0 0e ac c0 c6 36 4f 43 fa c5 12 d0 41 36 ac cb 1e fc 40 22 b0 40 12 64 01 46 9e 1b 28 a4 c2 bc 01 e2 77 79 a4 9e 3c 13 bb 31 ca 48 92 64 4b 8e e5 4b 9e b4 4a bb a4 37 59 43 10 c0 c2 bf a5 0a c0 21 64 21 2c 01 24 6c 46 21 48 c0 0a 8c 00 23 c0 42 24 04 c0 01 50 80 04 34 9c 16 88 43 24 28 00 23 28 01 54 b2 13 d0 4a 40 8f fd 13 d4 ad 80 a7 49 c0 Data Ascii: 5kr",#><"#.,'+,@uG:F/+;^3_+;nBDXfs8_<B#v7F4&[H3=(y)'>A:!+6OCA6@"@dF(wy<1HdKKJ7YC!d!,$lF!H#B$P4C$(#(TJ@I
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 59 8d d5 18 8b 04 39 28 84 03 50 85 03 00 00 73 56 80 57 00 1e 60 d5 a7 65 28 32 eb 71 02 3a c3 0d ef e1 1e 6d 66 56 d0 79 56 2a 83 58 a4 78 d8 86 e5 09 74 a8 57 32 70 45 32 70 01 19 90 81 24 30 03 1d f8 56 fb f9 c4 1f f8 81 28 48 82 33 f3 08 fd e9 80 67 f0 06 19 f8 81 8e 96 81 41 70 57 79 ad 57 4a 5c 32 0e a0 02 90 90 02 15 ff 90 88 05 d8 85 47 08 00 81 cd 15 2d 20 86 0d f0 80 ec d9 04 17 30 9f 89 8e 68 19 40 c6 c4 c3 0a 66 8c ea 4a 98 c8 19 ca 15 64 4b 2a 64 f3 58 3a e0 84 da f1 0a 26 23 0b 3a f0 cc 92 aa 1d b5 60 0c bc 88 2d 4b c0 21 ba f0 21 0c 08 02 57 d3 d8 2d 30 34 c6 b8 59 9c d5 03 36 c0 57 b9 60 89 78 ac 03 43 d8 69 22 28 01 36 60 83 2e 50 01 2a a0 82 2b 28 81 d7 65 00 62 e3 19 90 05 0b be d8 12 93 b5 34 6c 7b 46 ab a5 5a a9 45 8b ad d5 0d bb b0 Data Ascii: Y9(PsVW`e(2q:mfVyVXxtW2pE2p$0V(H3gApWyWJ\2G- 0h@fJdKdX:&#:`-K!!W-04Y6W`xCi"(6`.P*+(eb4l{FZE
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7c 9b d1 99 9d 19 b8 d1 67 9a a9 c1 06 4d 6c 7d e9 99 9e b1 b1 01 26 fb 07 82 a0 08 35 40 1a 5d 80 7d da e7 01 75 50 07 07 b5 01 08 e5 02 66 30 9b 6c b0 0f b5 51 09 b7 81 7e cf 80 62 35 6d ba 90 81 ba 32 53 4a ab 6b 1f ff c7 bd f5 e1 68 4e 32 45 ff 47 07 af fb 21 41 90 8c 2a 80 04 c9 f1 2d 1d d0 0a 64 50 09 25 60 02 1d 80 04 ff 73 a0 22 76 80 20 7c 44 d7 e3 15 64 4c 52 49 05 50 09 ad 80 22 44 f0 83 3d 22 a0 01 fa 82 1c 40 4a fb 61 4a 89 84 48 89 e6 1f 48 32 be 41 52 62 34 68 02 eb 00 65 f2 c1 06 73 00 84 a5 34 26 43 28 69 a7 44 4a 53 72 4a fd 71 49 4c 42 84 45 f0 a9 98 86 8d d8 88 0b ac 80 26 77 50 c0 c1 7d 26 ba 7d 86 b9 86 4d a6 c0 31 59 50 07 7f 50 00 75 4c 29 44 4a 29 73 88 4c 39 ba 4c 9f 92 28 e3 94 2a bd d6 29 de c4 87 83 d8 28 9e 32 03 51 9a 28 9a Data Ascii: \|gMl}&5@]}uPf0lQ~b5m2SJkhN2EG!A-dP%`s"v \|DdLRIP"D="@JaJHH2ARb4hes4&C(iDJSrJqILBE&wP}&}M1YPPuL)DJ)sL9L()(2Q(
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 60 11 f4 f0 a4 b2 40 5e 48 ce 7f 93 81 29 f2 97 b1 9d c2 4f ff f3 81 05 35 35 5a 03 f5 0e 0f b3 a5 15 b3 2f bb ec 66 e7 81 bb e2 51 e1 f1 35 58 f5 82 ff 2a e6 36 98 03 8a a7 33 3e 18 84 3d 63 84 8b a3 84 35 e3 b5 8b 43 2c dc 27 7a 54 78 85 15 d2 54 8b 40 54 57 95 19 a0 41 01 2e c1 7b 72 83 1c 54 95 51 76 b8 e9 2c d5 2f e0 07 ff 88 6b f5 56 0f e3 82 08 a8 88 5d a3 bc 80 d8 01 54 72 35 9e 18 5e 5d 03 0a 94 e0 3b e0 63 24 5d b2 39 3e cf bd a6 d2 8a 1d a4 8b 73 32 01 34 61 89 f8 75 5b ad 78 8c 7f 2f f7 9e 75 19 c4 41 be 79 af 85 5e e8 bc af d8 f8 90 8f 2c 89 4c fa 96 e1 00 e2 27 7e e0 a3 c0 1d e0 c0 e3 67 90 f9 84 8d 73 61 14 be 60 4c 14 60 02 60 e1 0c 7a e1 0c 14 60 86 7f ec ca 20 1c 12 14 40 02 c6 12 5d 07 e9 0c 20 81 c4 4b bc c4 07 79 19 c6 c4 c4 57 7c c3 Data Ascii: `@^H)O55Z/fQ5X*63>=c5C,'zTxT@TWA.{rTQv,/kV]Tr5^];c$]9>s24au[x/uAy^,L'~gsa`L``z` @] KyW\|
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 38 c4 39 d4 65 c8 a0 cc e6 b5 6d ac bd 6b ad 75 ac 18 c7 ab 25 5b e6 51 70 83 66 b2 0c c5 92 43 38 10 99 aa 5c c7 25 5c 0d 39 10 b2 75 bb e0 1d 4c 44 63 3a a6 d5 2c 84 af 41 8d b0 35 4d 4b d0 31 d2 40 54 50 f0 71 48 3c 6c 66 88 94 06 89 60 67 66 86 21 a7 84 22 63 04 13 30 41 05 20 b8 82 57 c0 25 1c 01 62 8a 04 0c 40 6c 11 82 ff e6 25 c7 c1 75 30 f8 82 33 81 1a 23 f3 2c fc e6 28 9b 32 ce d6 ac 71 86 78 bd 7d f2 87 9b f2 89 53 c5 04 8c 26 27 d2 32 77 ce 72 d1 ca ce 2d cb 38 2e d7 38 2f e3 f8 2e eb 78 2e ef b8 d2 12 84 c6 15 73 90 0b f9 90 a3 e7 d5 22 22 13 3c b3 34 67 73 82 32 b3 92 53 f3 34 3f f9 da 5e f3 2b 2a e8 d8 52 5d 75 71 78 cb 3c a3 31 fa d7 77 35 16 07 b8 41 00 50 03 49 03 00 5d 53 80 12 50 83 21 14 42 21 9c 01 32 9e 01 00 44 02 35 28 81 8b c6 b3 Data Ascii: 89emku%[QpfC8\%\9uLDc:,A5MK1@TPqH<lf`gf!"c0A W%b@l%u03#,(2qx}S&'2wr-8.8/.x.s""<4gs2S4?^+*R]uqx<1w5API]SP!B!2D5(
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: bc 5d 87 a5 22 4e 29 70 02 15 c8 02 36 08 03 75 f8 e6 14 90 9f 31 28 03 1e 48 81 38 68 36 5b 20 84 b0 4d 12 67 4e 14 2b 51 9e 00 e0 80 ff 09 20 eb a9 9f 22 b9 92 6e 86 01 47 70 84 b9 7a 00 5f a0 00 3a 10 9f b5 ca c3 3e 11 00 3e 14 13 1e 88 5d 56 c0 01 26 47 16 25 f8 cf 7a 8e f2 32 f0 ab 4d e8 00 36 60 03 7e 9e 83 3b 41 92 43 ff a9 1f 81 a6 82 81 8e d0 48 90 04 40 70 17 25 90 83 2b f8 03 42 39 b7 b8 da c4 01 9a 2c 87 8e 28 11 20 51 0f 30 d1 2e f8 c6 0c fa 94 d9 45 89 c0 0b 69 87 a1 d4 ff 05 09 6c f8 02 82 28 87 50 cd c8 f2 3a 08 7b 2c 74 a0 26 eb 97 26 6b 7b 31 08 21 aa 15 6a 5c a4 67 ec 08 dc 6a f4 8d 29 60 b3 c3 2d 25 25 60 05 13 54 a7 0e 3c 6e 60 85 ad 96 6a 30 50 03 7f 8c d1 a2 23 75 53 3f f5 f9 4d f5 55 6f 6a ac ce a9 57 87 f5 f0 95 f5 aa 16 f4 fc 85 Data Ascii: ]"N)p6u1(H8h6[ MgN+Q "nGpz_:>>]V&G%z2M6`~;ACH@p%+B9,( Q0.Eil(P:{,t&&k{1!j\gj)`-%%`T<n`j0P#uS?MUojW
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: d4 55 4e d5 1b fa 08 54 0e d5 5a 70 c5 63 8c 0a 75 6d d6 3d 4c b4 1b 7a e6 d4 70 e5 15 da e6 51 fd e6 72 4d e7 22 6a 08 62 5e e5 52 bd ae dc 21 7e c9 80 0b 94 70 02 95 60 0e 28 80 0e e8 e0 0d de a0 0e 1c 40 04 e8 90 05 2e c0 03 eb e0 6b 03 c0 d8 eb e7 6b 53 ba 92 71 4b a5 70 5b 08 52 40 07 fc c7 97 36 88 1e 9b 2d 08 82 90 09 ff 82 c0 39 22 30 a6 52 22 25 7f 20 49 6c 54 ca 11 d8 59 a0 2c 81 75 4a ca e5 26 03 e5 76 5c 51 19 95 2d 02 38 2b d2 22 2d 32 37 6c 40 06 c6 a5 02 86 ad 04 d4 30 a8 45 68 0a b9 83 ba ba 9c 71 6f 99 4d 6d d9 ba 47 30 08 15 77 a9 d2 84 cc a7 63 3a 3e f8 96 73 49 08 a2 7a 5f 72 60 09 1c 60 09 7e e9 97 27 37 85 d4 6c 09 72 40 07 86 40 07 e2 54 06 53 98 5f 80 20 04 e8 9c 2f c0 59 df 0e e5 41 d6 bb 0c 6b f8 12 c4 69 18 30 01 f0 2d 0e 13 34 Data Ascii: UNTZpcum=LzpQrM"jb^R!~p`(@.kkSqKp[R@6-9"0R"% IlTY,uJ&v\Q-8+"-27l@0EhqoMmG0wc:>sIz_r``~'7lr@@TS_ /YAki0-4
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: a3 b9 04 02 74 55 a2 0f 78 e0 4a 33 12 b2 0c e1 8c 6d 20 8c 0c a1 8e 6a 46 11 50 92 24 c1 b4 2e ec 82 c1 8b ba a8 e7 c8 16 82 a0 26 f9 28 07 b6 6d b6 ba cd 0c 12 c1 71 95 20 84 2d 99 ab 01 ae 92 bb 92 0e 9c 23 12 24 e6 10 1e 00 10 d8 4a 5a 12 e0 1c ce 01 00 34 5c d0 1d 24 40 b8 b7 1b 20 5d 34 4f cc 60 71 4a 7d 6d bc 24 fa e9 ff cf 7f f8 41 18 fb b9 dd 6a c7 e7 dd dd cb fd de f1 1d 40 08 47 1c 0a 5b bb 09 c9 de e9 07 e0 6b 48 e0 f3 bd e0 0d be c7 86 bb b8 15 5e e1 2f 21 bb c3 84 81 7f a7 02 0a f2 e0 29 be e2 09 ae 08 76 aa 12 64 a0 a7 4a 00 09 30 60 05 42 9a 49 1d 3e d5 05 80 07 f6 d6 09 f4 20 48 b9 f8 fb 08 a3 00 c6 40 b0 d2 74 0c 64 9e 30 ca 60 0b ea 80 75 71 21 0d 44 c1 08 04 81 8b b8 c8 16 4e 21 04 1a e0 8c b9 80 13 70 ba 2e 1c a6 6f 51 d2 66 08 e1 2e Data Ascii: tUxJ3m jFP$.&(mq -#$JZ4\$@ ]4O`qJ}m$Aj@G[kH^/!)vdJ0`BI> H@td0`uq!DN!p.oQf.
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 21 ca d9 21 8a 93 7d 23 84 7b 9d f3 29 c1 37 0e dd d5 c5 96 5f 3d 73 ab 84 d1 19 85 b8 88 9b 11 77 31 2e 96 88 03 b0 a4 11 b1 60 f3 ac 6c 9e a9 1c 9c 84 09 80 91 7a f8 8e 0e 69 37 c7 51 3a a3 b3 76 a8 38 7e 95 6e af a0 ae 41 07 f9 e8 f1 81 1a 2c 0c ed d5 ff 0e 42 c4 5c 16 3c 40 42 78 f2 45 8c 00 fb 88 e9 85 d8 1e 60 a0 41 ea 5e f9 46 b4 81 2b 30 6f 43 b7 6f 97 0b cd 1c 0e 44 81 3b 59 93 41 04 08 2c 36 87 68 6f 35 0d c2 0f 88 89 f7 72 34 41 bc 4c 53 0c 2b a7 59 c4 2c 90 53 4a 30 f4 fb 2e f4 10 1c c1 c4 ae a5 fb d5 ef 05 b3 e5 a0 57 b0 4b 1b eb 04 4c 40 d5 e9 f4 00 16 82 16 d0 41 14 03 46 ab 22 1a 4d 58 83 60 28 c0 5d 40 35 44 34 81 50 4f c0 5a 1a 7a 4c bb 5f dd c8 25 b0 b5 c6 5d 2b 07 a3 86 9a 09 84 a0 09 87 60 4a d5 86 d6 42 84 16 07 48 17 94 ab 06 34 c0 Data Ascii: !!}#{)7_=sw1.`lzi7Q:v8~nA,B\<@BxE`A^F+0oCoD;YA,6ho5r4ALS+Y,SJ0.WKL@AF"MX`(]@5D4POZzL_%]+`JBH4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49825	99.86.4.105	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	397	OUT	GET /media/dd9a87_67f016f8ae5948e4a82fbfedd1ad400a~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	764	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 267600 Connection: close Server: openresty/1.27.1.1 Date: Wed, 01 Jan 2025 14:29:08 GMT Expires: Wed, 01 Jan 2025 15:29:08 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Thu, 28 Nov 2024 18:00:55 GMT ETag: "255d2547f187ffe25a9feef511734f25" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-7bh25 Via: 1.1 google, 1.1 163be08bc1bc44818353c4fd88655bee.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Jja1qgDm9Mm0uDgZwIJowPb6wFRc72kYYcuutLRw53axEsY9s9HMow== Age: 53007
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 10 10 08 ff ff ff a8 83 77 52 48 48 96 79 88 05 04 03 4e 33 46 a7 78 69 0d 68 69 d6 00 29 8b 28 12 06 9e 9f db fa fb 00 ff ff dc b9 a9 a5 87 8a ff 66 27 9a 87 97 a5 6d 52 8b 52 4a 60 43 37 8f 64 55 ef 00 4a f7 ac e3 fd d5 dc e9 cc bb f6 6b 8c 97 75 79 a5 94 a6 ef 17 bd b6 ac b0 69 fe fd 6b 36 32 cf ce d0 6a 08 12 46 01 31 4e 09 0e 99 86 8a a5 8b 99 87 66 69 f7 b1 be 8b 6a 75 93 4f 35 c8 9a 8b 88 76 79 f0 52 76 c9 a7 99 75 56 66 00 cf d4 b9 97 89 25 15 15 25 13 24 f4 19 ca 45 26 35 46 37 36 78 21 0e 76 68 67 97 76 69 9c 98 9a 2d 21 17 63 57 56 68 46 46 27 02 21 17 09 22 34 27 26 22 02 18 74 70 8b 8e 97 a5 92 03 2b 78 56 56 a8 97 98 8a 78 85 55 34 36 3c 2d 48 33 16 25 f5 6c d2 37 34 34 67 45 55 27 24 24 75 48 55 78 46 Data Ascii: GIF89awRHHyN3Fxihi)(f'mRRJ`C7dUJkuyik62jF1NfijuO5vyRvuVf%%$E&5F76x!vhgvi-!cWVhFF'!"4'&"tp+xVVxU46<-H3%l744gEU'$$uHUxF
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: af 46 10 c5 d6 8c 57 4e 9c bc 9a 61 6b d5 aa 31 ab 7e 90 4a 62 3f c9 30 fc e1 0c 0c eb df 3f 89 29 1c 08 c8 81 09 04 12 68 c2 03 09 0a b0 a0 00 fc 08 70 00 3f 11 f2 23 81 04 65 f0 67 4d 7e af bc 62 df 7f 7e f8 d1 de 0c 33 f8 90 1e 09 35 80 70 c5 13 4f 10 b2 62 1d e6 d4 f1 62 1d 12 1c f0 22 85 12 d4 b1 01 1d 1b 08 60 8e 00 74 4c a8 c2 2d 41 4a 70 cb 90 b7 a8 a0 c7 14 ae f8 f0 43 29 a5 68 a1 04 18 35 50 a2 47 16 5a 64 a1 47 19 ac a4 b0 65 0a 47 10 40 80 97 61 7e f9 ff a5 98 64 8e e9 e5 98 69 82 09 e6 06 5e 9a b2 66 98 6d 12 60 ca 06 60 1e b1 41 0a 70 bc b0 e7 0b 84 e8 89 c3 09 2f 04 aa e7 09 70 9c 50 68 0a a6 28 1a 66 09 90 44 f0 28 a4 11 18 c8 41 04 05 4a 6a 82 09 11 24 58 69 a5 99 7a ea 29 a7 99 86 1a 6a a6 0f 70 fa a8 a8 a6 6e 9a 60 09 25 3c 00 c9 03 ae Data Ascii: FWNak1~Jb?0?)hp?#egM~b~35pObb"`tL-AJpC)h5PGZdGeG@a~di^fm``Ap/pPh(fD(AJj$Xiz)jpn`%<
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 83 1a 03 10 26 48 21 87 24 b2 48 23 7f fc 20 c6 05 42 0c f0 3c 12 5a 7c 64 46 35 18 fc b1 4a 2b 97 eb 22 46 18 74 c4 0f c2 2e 2f 3b 91 13 33 b0 68 01 85 2b 69 bc b1 81 4e 30 74 10 3f 30 bf f4 32 ce 2d 88 68 d1 47 ff 18 88 d1 17 39 f7 84 b3 4f 08 5b b4 60 c6 18 1b c0 ec 3b 4e d8 0c d1 9f 16 31 90 a6 bf 24 1b a0 63 d1 fe f0 6c c0 17 3a 2d b0 13 be 47 17 c0 a2 45 e5 fa 1b d4 4d 51 4b 24 15 99 28 a0 19 d4 97 41 1b 98 24 8a 49 54 cd 13 81 28 a2 40 94 99 28 d2 e8 24 cf ff 4e 10 c8 64 d5 4a 57 85 75 d6 f3 a6 89 02 01 63 8f 45 40 b8 54 7d 65 16 58 67 61 cd 33 cf 59 75 64 06 19 62 67 4d d6 d9 65 17 88 42 9c 28 60 85 d6 d7 70 9b f5 05 06 6c 17 80 c1 97 71 97 25 37 c6 49 d2 b8 75 01 75 9b 25 97 db 01 20 09 84 2f c9 f6 15 0b ad af 04 f8 2a 60 81 4d 08 f8 8e 07 ee f0 Data Ascii: &H!$H# B<Z\|dF5J+"Ft./;3h+iN0t?02-hG9O[`;N1$cl:-GEMQK$(A$IT(@($NdJWucE@T}eXga3YudbgMeB(`plq%7Iuu% /*`M
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 27 50 6a 4a 0a 97 9a a2 e9 a6 9b b2 60 ca 11 9f 62 6a ca 06 9a b2 92 c2 0b 2f 34 91 84 14 ac fa 21 85 12 b0 ce 30 83 2d 3f 38 71 05 a5 29 a4 70 42 6a 87 6d 21 4d 38 05 14 f0 cd 18 8a 8c 61 6c b1 c5 32 32 06 23 cc 36 cb 48 10 d0 06 e1 c3 b4 d4 fa 00 c6 b5 d8 82 f1 cb b5 3e 04 b1 cc 32 3e 60 62 8d 39 f7 7c f2 49 3f a6 58 53 83 0f df 0c fb 2c b4 dd 42 fb ac b3 cc 2a c2 08 b2 c4 1a 3b 45 01 5b 08 a4 d9 16 2e c1 44 16 47 2f 5d 04 03 5f 00 30 03 91 25 0a 2b bc 30 c3 96 ff 58 74 51 03 e8 94 c6 cc 02 05 33 55 14 62 a5 3d 86 97 c4 30 35 14 99 5e 08 44 d5 00 3e 79 81 3c b1 2f 23 7f 6c 32 3e ab c5 dc 2b 59 7f a5 a5 9a 5f b0 01 e6 da c0 54 a9 44 1a ce 35 ef 3c 90 61 32 ff 7b 55 69 2c 7d d6 d7 65 a4 25 5d 10 af 45 43 0d f4 d1 4a 77 bc d2 4c 48 2d 46 f3 62 6b e5 8c 56 Data Ascii: 'PjJ`bj/4!0-?8q)pBjm!M8al22#6H>2>`b9\|I?XS,B*;E[.DG/]_0%+0XtQ3Ub=05^D>y</#l2>+Y_TD5<a2{Ui,}e%]ECJwLH-FbkV
2025-01-02 05:12:36 UTC	7292	IN	Data Raw: ac 8e 19 8b dc bd 08 3b 8a de ad 88 08 7f aa f5 b6 bb 82 ca c5 d6 21 8c 64 88 82 84 84 b8 38 88 60 22 b8 b0 b7 da 88 ae a0 20 a4 85 4d 42 49 33 91 6e 42 02 b6 99 62 9a 61 a6 9a 6a 6b 62 11 9e 50 f9 c9 14 21 82 82 64 a8 12 8c 2a ca 64 a5 50 7e c0 a9 a5 58 7e c0 04 98 ad 9a f9 2a a9 ae d0 22 8b 52 f4 08 ab ac 9e 0f 80 02 84 b5 d8 3a 40 82 1a a6 58 85 b0 bc ee ca ab 2e 57 c6 58 c5 16 ba 14 23 4c 91 ba 06 43 ec 30 c2 0e 63 6c 31 d4 a6 9e 8b b3 cd 38 1b db b2 ca f4 40 ff 82 12 3d 42 d3 42 06 57 4e 7b 2c 35 d3 5e 69 6d a6 1a 92 b0 5b b6 bc 6b bb e2 b6 2b 72 6a 42 b7 dd 92 53 ee 05 c2 79 52 0e 39 e2 12 ff 8d b9 27 ae 70 bc 09 92 48 82 0e 33 71 2d 77 f6 ba ff f2 bb 9c f3 ee 3c ef 1c 74 67 3f df 9c bd 74 d7 db ae 3e f7 18 e5 7c dd cd 4d 67 ef 74 01 1f 84 3d 40 d5 Data Ascii: ;!d8`" MBI3nBbajkbP!ddP~X~"R:@X.WX#LC0cl18@=BBWN{,5^im[k+rjBSyR9'pH3q-w<tg?t>\|Mgt=@
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 38 64 62 25 93 64 17 8e 63 49 59 62 03 48 c0 49 97 63 0b c1 84 16 a2 c4 25 6e 72 5e a8 d4 04 a7 ff f3 02 a9 f3 72 ac 33 73 10 51 4b b7 44 28 ba 54 11 08 c1 5f fd 65 00 ba 13 12 ec c3 11 a7 32 62 bd e3 74 39 11 13 c3 a3 3c 03 c6 12 70 77 29 eb 73 3c ea 43 12 b1 22 06 97 e3 61 57 67 75 85 28 2b 32 f0 3c 9f 44 16 63 42 76 65 c7 62 60 a2 5d 73 31 64 6f a1 76 3c 56 26 52 10 63 ee 54 14 17 26 3d b3 32 77 ca c2 2c 96 c8 2c e2 a3 62 a5 68 00 94 60 8a 64 b7 64 a9 65 5b 4b e6 8a 65 d6 64 60 f4 77 4e 86 7e b1 a8 82 b8 d1 5a f1 52 79 a7 f5 65 5b a6 41 b7 11 47 a1 f6 41 21 e8 64 b0 08 19 b2 85 57 5b 43 0c 96 d0 06 ae 47 1c 6d f6 66 b2 37 67 75 56 7b 78 76 67 7c c6 7b ba e7 67 87 26 7c dd 58 7c c3 a7 68 e1 b8 68 c8 f7 68 ed f0 06 94 76 8e 96 96 69 56 d5 69 ce 67 43 c5 Data Ascii: 8db%dcIYbHIc%nr^r3sQKD(T_e2bt9<pw)s<C"aWgu(+2<DcBveb`]s1dov<V&RcT&=2w,,bh`dde[Ked`wN~ZRye[AGA!dW[CGmf7guV{xvg\|{g&\|X\|hhhviVigC
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: f6 62 6f 8c 42 ad e2 44 4d f6 c7 a8 eb 97 b8 0e 21 4d 74 41 2e ba 5b 49 70 61 f0 99 b9 e0 9b 26 28 bf a3 fb 0f 88 b0 e2 49 b9 e1 99 60 b0 98 fe 11 60 5e ef f2 86 05 8d 60 10 f2 a1 0a 8b d8 f8 8f 77 df 00 a7 7a 85 cf 05 90 0f 70 5c f0 e5 27 4c 04 5d 4e b6 c3 ec 0f c1 66 c2 9e 5f f9 5c fd f9 bb 6b b5 c1 46 04 f9 6d 2d 00 f3 63 1d ab c2 24 d0 08 51 91 61 a4 30 03 5e 48 10 b5 df 33 93 71 f0 02 e1 d7 02 71 07 0d ff fb fe b1 e7 10 9f 11 35 07 1a 2b 08 91 5e 70 ea 5a ac 84 e4 bc b1 5e ca 1a 53 ae f8 cb 12 6f a9 c8 10 2a bf a3 99 d0 1a c5 c0 05 c9 ff 90 01 59 cc b2 02 7d 1a d0 76 de 83 7c 14 4f c1 05 bc 60 6b 6a f0 0c 93 c0 0b f2 c6 b3 08 21 bf fa 4a 78 a8 c9 8a ff 70 05 83 87 9f 0c c1 d0 cf 02 10 16 fe 0d 24 58 d0 e0 41 84 09 15 2e 64 b8 50 da c0 06 96 06 02 b0 Data Ascii: boBDM!MtA.[Ipa&(I``^`wzp\'L]Nf_\kFm-c$Qa0^H3qq5+^pZ^So*Y}v\|O`kj!Jxp$XA.dP
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 3b 13 99 b2 88 24 75 ed 16 55 f2 fa ac d9 31 d5 2c 73 16 aa a1 81 30 57 8a 8e 32 68 12 4a de 78 bf d7 55 1f 22 0d e8 c8 f8 8f 1f f9 8d 5f 94 b9 37 f9 9b bf f9 67 fa 1a a3 df 1a a7 5f fa ab 9f fa af bf fa 95 57 7b 3f 55 fa ff e1 16 05 a2 55 b1 d7 2d a2 a0 79 1b 60 12 52 75 01 3e 3d d2 39 f5 1f 1a a1 24 ca 90 6b 63 a2 37 ab 10 80 66 14 7f f4 17 d6 c3 f6 1d 43 62 59 01 e2 c1 bf 81 04 0b 1a 3c 88 30 a1 c2 85 0c 1b 3a 7c 08 31 a2 c4 89 14 2b 5a bc 88 31 a3 46 83 96 b6 5c b2 00 32 64 98 2d 05 2d fd a3 13 32 64 38 72 1c 09 32 fb 67 09 40 47 4b e1 ff 1e f9 0b f9 48 d2 16 93 03 2d a5 b4 f0 e8 92 49 4e da 7e 5e fa 47 92 e2 a3 9f 8f 60 92 04 40 70 27 d2 a9 43 39 c1 8c 5a 72 69 ca a6 1d 0d 4a 25 49 72 28 cb 81 60 79 66 34 39 73 a7 d4 ae 49 7b 92 7d 89 36 a9 49 00 5b Data Ascii: ;$uU1,s0W2hJxU"_7g_W{?UU-y`Ru>=9$kc7fCbY<0:\|1+Z1F\2d--2d8r2g@GKH-IN~^G`@p'C9ZriJ%Ir(`yf49sI{}6I[
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ce 1a 16 7f d9 ac f9 a3 37 ee dc 3e 47 d8 1c 61 c1 f8 88 63 c7 2c 8e ac f9 2b f9 08 99 7f d3 dc b9 d3 02 44 8c 18 41 a0 41 67 d1 f2 6f 87 18 0a 3d 28 08 12 a3 c5 d0 8e 1d 40 04 b1 05 02 c4 46 e7 1d 82 28 50 40 c2 c2 48 09 32 3c e0 44 66 13 41 99 09 38 73 71 50 56 cc 46 47 89 38 7c 59 10 d7 61 42 87 8e 23 03 80 0c 38 a2 8c 45 9c 35 8e d9 28 ff 8e 5c a2 04 9b 3e 3c 70 48 37 cf a2 08 0f 32 81 13 2b 53 c6 e6 c5 7b 1c 38 fe 95 a8 6e c4 48 f7 7f 7b 3c a0 8c 11 18 00 c2 87 1b fd 19 c1 01 82 be ed 01 20 1b c6 19 57 02 0b 7b 94 90 a0 1b 18 ba 71 ce 39 68 c4 70 c7 1d 1e a2 61 04 1a 68 dc b1 87 00 77 90 e8 06 89 31 08 90 43 0e 87 9c 70 48 79 c6 39 b8 d2 8d 38 e6 a8 e3 8e 3c f6 e8 e3 8f 40 06 29 e4 90 44 16 69 e4 91 0f 6d 91 d3 3f 4f 35 15 d5 52 2e fd 34 d0 4b 2f 05 Data Ascii: 7>Gac,+DAAgo=(@F(P@H2<DfA8sqPVFG8\|YaB#8E5(\><pH72+S{8nH{< W{q9hpahw1CpHy98<@)Dim?O5R.4K/
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: b6 24 fc b6 16 e4 c6 4e 0b 53 f3 af 01 be ec ff 2c 91 23 62 41 83 69 de c2 7c 37 98 c4 5e 74 f7 ee 00 be df 26 77 dc 82 e8 84 f9 e0 b7 05 84 eb 6c 0b 2c 3a f3 e2 b4 f3 1a 08 86 9d 16 4c 8b e5 1f 5f 10 79 84 bc d2 e8 43 6f 12 72 da a3 0d c4 d9 a4 69 00 c1 ee 3a 73 af b3 f8 42 5c b1 b3 11 3b d3 4e 38 4e 00 c4 80 37 d7 08 bc 66 01 f1 90 fb a2 ff c6 ce ea e3 c0 8b 1e 43 fb 31 c8 1e 07 6c c0 97 49 6c db 22 bb db f8 db 82 99 15 a3 80 01 c9 df ac 44 00 19 68 7c f1 05 81 d1 c4 81 c6 ca 49 32 41 c0 4a 5f ac 0c 4e 38 ed 4c 9c e6 1f 74 ac fc 2d b8 05 cc 7c b3 cb 7f 90 59 a0 ca 37 1b e8 44 ce 32 fd 44 b2 4e cf b6 88 22 0a 30 7f 43 67 01 3c f5 44 54 d1 3c f9 ec d3 3a e0 12 9d f3 cc 44 13 0d 94 4a 3d 35 7d 93 d2 4d 3d fd f4 cc 7f 3c a1 66 07 27 76 00 e2 54 20 12 49 c4 Data Ascii: $NS,#bAi\|7^t&wl,:L_yCori:sB\;N8N7fC1lIl"Dh\|I2AJ_N8Lt-\|Y7D2DN"0Cg<DT<:DJ=5}M=<f'vT I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49828	154.91.91.54	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	608	OUT	GET /6d1a62e98f7abc0ea4a7ac9760cb2e97.gif HTTP/1.1 Host: img.qxwoiv.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	301	IN	HTTP/1.1 302 Found Server: NgxFence Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Location: https://ylg1.duyunfk.com/6d1a62e98f7abc0ea4a7ac9760cb2e97.gif Strict-Transport-Security: max-age=31536000; includeSubdomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49827	216.180.236.138	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	354	OUT	GET /img/1kkky_1300x240.gif HTTP/1.1 Host: ig23.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:35 UTC	1094	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 5894 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83ef19c1d0918-LAX Content-Length: 377690 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:11:00 GMT Etag: "676a9c4a-5c35a" Expires: Sat, 01 Feb 2025 03:32:46 GMT Last-Modified: Thu, 02 Jan 2025 13:08:55 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=z44gACYLlwI2M0vKxAwPjsd2%2F1KYBhu%2F%2BYtyuwaKYnQsz7CrnfsG4w%2Fzv8IdT51c9Cacw%2BJdISgwi44EUhIss5IubmN5P1Y%2BhtJfQ3Ol4cAQYRodzFKWC6xfSGhI7GL96A%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=11304&min_rtt=674&rtt_var=17342&sent=134&recv=27&lost=0&retrans=3&sent_bytes=174674&recv_bytes=2016&delivery_rate=24572121&cwnd=132&unsent_bytes=0&cid=7d7c7031643770e8&ts=4424&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:35 UTC	92	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 00 00 6a bb bb 9e 1d 0f 4d 33 fb ff fc b2 ff fc 92 ff 76 11 a6 ab e3 fc b0 93 32 33 fd fc b8 ae 75 bb cc ff da 50 ae 48 10 f8 94 8d f3 71 6e 77 cc d6 24 a2 da cc d5 d5 2a 19 10 64 56 54 9d cc bb fe d9 8e f7 6d 50 9d 5c aa f7 8f 72 f8 22 11 ba Data Ascii: GIF89ajM3v23uPHqnw$*dVTmP\r"
2025-01-02 05:12:35 UTC	2372	IN	Data Raw: fe ff 0c 70 b0 d4 d8 f2 96 62 e1 b5 cf d1 dc 10 07 db ab ea 6d cc bc 53 23 b3 68 56 df b0 96 66 f7 92 28 f4 50 49 fe d5 6e 60 52 ac 91 ee d9 f7 93 0c 4d 2c d5 db 31 29 17 8e b8 1e e1 e9 af b8 b9 4a 2d 25 8e b7 b9 6e 22 d6 ff ee 32 d6 b6 b3 da 74 74 6e 45 36 fe b8 4d f7 4b 2e db 45 2e d4 94 8e f4 71 8e 29 24 ac 8f 4f 44 b0 72 6f f2 4d 10 d7 4c 0e fc b1 71 db 6b 0c f1 32 2d d7 b0 95 d8 4f 46 d5 70 26 fa 90 4c d5 cd b4 fa 71 29 6e 31 29 d4 8e 71 d3 89 0f 3d 98 4a 29 31 d4 f2 50 70 0c 21 53 ff ef 11 b7 8b 87 73 d9 f3 f8 da f2 4b f8 f4 db b0 4a 89 dd f0 30 5c df 14 4e 77 b1 ee de d5 6c 52 8e 6e 6d 43 c7 f7 7a 29 0a 52 b9 be 91 69 4f b1 6b 50 46 d0 d7 4a 22 10 6e fa fa ed 32 4a 91 fc fd b3 b1 8a 4e 34 61 da 8c 28 d6 8e 4d bc c6 f3 b3 4f 45 d3 ee db 8e 89 90 8f Data Ascii: pbmS#hVf(PIn`RM,1)J-%n"2ttnE6MK.E.q)$ODroMLqk2-OFp&Lq)n1)q=J)1Pp!SsKJ0\NwlRnmCz)RiOkPFJ"n2JN4a(MOE
2025-01-02 05:12:35 UTC	538	IN	Data Raw: 31 0a 94 a2 47 11 e5 68 a3 46 8d 73 c6 09 37 9c 50 41 29 fe 2c a0 42 34 54 59 15 4d 34 15 94 4a 4a 3a 64 79 01 84 58 f7 30 a0 c7 aa 40 30 ff f0 83 5a 3f 78 72 41 5d 6e e5 4a 17 a5 93 ca 05 97 ae 71 c1 d5 81 01 1c 50 e5 cc 0b 74 f4 55 d8 b2 cc 16 b6 d8 b3 8f 41 26 2d b4 d1 4a 3b 6d b5 8e 5d 8b d9 65 dc 62 36 82 64 7e 1d 16 ae 28 e3 96 0b 59 b8 e8 32 96 ee 29 eb 7e eb 99 bb ec 7e 06 ef bc f2 d6 fb ae bd f1 de 9b af bb fc ea db ef be fe 06 0c 30 bb b1 f1 5b f0 c1 04 27 3c 02 c2 0b 2b cc f0 c3 0e 47 dc f0 c4 02 2c 6c 71 c5 18 5f ac 71 c6 1c 6f ec 71 c7 20 7f 2c 72 c8 24 8f 6c 72 c9 20 63 dc dc c2 2b 77 e7 f2 cb d8 61 e1 9c cc cd d1 6c 73 cd 38 0b 70 b3 ce 3c cb ec 73 cf 33 07 9d f3 ce 44 eb fc 86 01 20 b8 e7 43 7c 36 24 42 21 0d b4 60 c3 c5 7e fd 6d 48 a0 12 Data Ascii: 1GhFs7PA),B4TYM4JJ:dyX0@0Z?xrA]nJqPtUA&-J;m]eb6d~(Y2)~~0['<+G,lq_qoq ,r$lr c+wals8p<s3D C\|6$B!`~mH
2025-01-02 05:12:35 UTC	4744	IN	Data Raw: 2e cf d0 50 5c 35 9c 8c 30 c4 c5 98 1d 5a d0 32 e0 ca 0c bd ff f4 95 af 22 0e d1 88 f8 7a 8d 12 41 a3 1b dc a8 c6 36 be 89 62 70 a6 28 c5 e1 dc 86 65 c2 b1 22 15 a7 88 9c e6 30 07 66 60 0c 23 cc 58 56 b1 f0 9c 6c 64 58 b8 58 1a 31 b6 c6 11 c8 6c 61 6b 7c 63 e8 80 36 c7 39 0a 8d 67 31 83 0e cd ae b3 c7 3e 0a ad 68 78 14 c0 7a 40 b0 86 39 24 22 40 89 e8 81 0e b0 91 80 6b d0 c2 71 fb 01 83 d5 04 a4 b6 01 59 12 40 00 02 c3 2e 68 a0 84 03 85 81 06 3a 80 41 18 e2 f6 0d f9 84 21 0c 63 c0 9a 17 3a 19 37 23 d5 ad 1a 1f 72 e4 19 7c a0 a4 14 7d e3 46 21 92 91 0f 44 94 80 c1 09 a9 07 13 38 90 7e 7a 40 04 12 f0 28 0c 6c b8 11 8c 7c 34 20 2e c4 a2 1a df 50 12 11 be 01 a4 cc 09 89 4a 52 f2 1c 0a be 23 ba f3 6c c9 9b e8 c1 12 38 c5 44 ce 72 76 29 78 b9 a3 88 3a 7b 07 11 Data Ascii: .P\50Z2"zA6bp(e"0f`#XVldXX1lak\|c69g1>hxz@9$"@kqY@.h:A!c:7#r\|}F!D8~z@(l\|4 .PJR#l8Drv)x:{
2025-01-02 05:12:36 UTC	5930	IN	Data Raw: 43 8a 00 61 b0 61 43 1d c2 50 82 8d 30 c0 c8 4f 0a 1f ce b8 e6 1a 1a 6c b8 cf 45 18 d8 38 66 0b 25 7c 60 43 87 33 a4 90 42 07 1d 88 58 c2 06 2f 94 b8 2f 0c ff 10 0c 23 14 6c 7c 20 32 0c 36 c0 00 a3 07 1f 7a 90 60 3f 0f 27 50 10 0d 34 50 70 e2 b9 ed ac f3 12 8b 2f 77 fb 72 4c 30 b9 2c 93 4c 34 cf 54 13 cd 4c da 74 13 94 4c e0 84 b3 cd 39 df a4 f3 ce 38 ef bc 60 1a 4e fa f4 b3 cf 4f fe 04 54 d0 3f 03 2d 54 50 43 fd 4c ff 74 50 4e 16 25 f4 51 41 5f f1 53 d2 49 ff a4 94 d2 3e 3d e9 53 d2 5a 24 e5 f4 95 4e 39 d1 54 53 49 47 15 15 d4 57 46 45 f5 54 4f 6a f1 24 55 4f 5e 6d 35 56 57 63 b5 f5 56 5c 73 d5 75 94 64 3c 19 05 d7 5f 7d 4d e6 d7 4e 84 1d a5 58 5e 47 49 b6 93 65 8f 75 96 d9 4e a2 7d 56 da 68 ab b5 d6 da 12 8e 2d 01 db 6b 3b d9 36 da 6f bd ad 61 1c 61 ca Data Ascii: CaaCP0OlE8f%\|`C3BX//#l\| 26z`?'P4Pp/wrL0,L4TLtL98`NOT?-TPCLtPN%QA_SI>=SZ$N9TSIGWFETOj$UO^m5VWcV\sud<_}MNX^GIeuN}Vh-k;6oaa
2025-01-02 05:12:36 UTC	7116	IN	Data Raw: ad a7 a2 c0 03 a9 3c 10 7b ec 37 1f 7d fb 11 bd 61 d5 15 63 aa f9 fe bb 3f c7 20 d6 80 0e c4 63 50 43 70 39 b0 90 03 73 09 00 ff 3c f4 82 95 12 cb 00 d1 54 10 04 3c 47 94 10 07 05 2f f8 5c b3 35 a9 84 ff 42 6f cf 6d 92 43 11 c7 08 46 cb 35 87 35 40 84 f1 c8 0b 97 03 fa ca 67 c5 95 2f bd e9 5f ff 1d 2c a1 74 13 8a 3f a4 51 0d 67 54 a3 80 11 30 60 04 12 88 8d 08 60 a3 81 0e c4 c6 37 20 18 41 08 52 b0 82 d8 28 cc 35 20 78 0c 0c 7e a3 30 85 f9 06 2c 38 78 8d cf 90 10 1b 19 7c 20 fb b0 51 0d 13 d2 82 0a a0 01 cd 31 aa 91 42 6c fc af 19 fe 08 c7 ec 72 a8 c3 1d ce 4e 7c d6 40 86 35 b8 81 0c 6e 5c 81 1b c0 b8 02 30 90 81 8c 2b 58 83 89 43 04 22 12 ad f1 43 64 24 f1 87 55 04 22 16 7f a8 c5 2c 2e 71 0a c8 98 c2 15 bc 18 46 6b 4c a1 8c 53 20 e3 15 d2 98 46 33 f2 b0 Data Ascii: <{7}ac? cPCp9s<T<G/\5BomCF55@g/_,t?QgT0``7 AR(5 x~0,8x\| Q1BlrN\|@5n\0+XC"Cd$U",.qFkLS F3
2025-01-02 05:12:36 UTC	8302	IN	Data Raw: 74 81 00 9e a1 32 3a 28 ca c6 80 01 b6 c0 08 80 40 1c f0 a2 db fa 50 0c 19 60 db 98 6c c9 88 c2 31 16 63 2c a6 81 11 13 a3 1d b2 68 28 0a a0 1d fa 2c 8a dc 81 09 76 a8 c9 88 02 08 36 41 8c 7c cd 04 86 20 34 30 c0 96 5a 64 26 e0 08 8e 72 43 8e ca 85 c8 62 20 3a 1a 6e e1 6e 24 09 8c a0 46 3e 6d 09 96 20 0e 48 20 0e 48 ed 05 2a 88 02 7a f1 59 9c 05 18 74 a4 d0 aa a3 06 9e e4 1a 8e a1 97 4e e9 00 74 c0 01 1c 20 46 04 2e e0 34 23 33 50 e1 d9 3e c0 d7 ff 7e 8d 3a bc e1 18 fa 82 da b8 a2 14 96 60 44 7c 41 1c 81 a0 d6 02 d1 08 8e 20 0d d0 31 47 de e1 08 d0 6d dc d0 cd 1d 73 44 0d 8e 00 9d e8 cd 1e b1 01 09 f0 11 1b be 41 4e e4 44 4b 30 20 44 94 89 3a 58 c0 15 fc a1 df 08 e0 88 12 d2 16 12 00 1a 41 89 46 5e d1 15 15 0e e1 18 ce 15 0d 2e 22 bf 29 22 2b 52 48 82 04 Data Ascii: t2:(@P`l1c,h(,v6A\| 40Zd&rCb :nn$F>m H H*zYtNt F.4#3P>~:`D\|A 1GmsDANDK0 D:XAF^.")"+RH
2025-01-02 05:12:36 UTC	3674	IN	Data Raw: d8 a8 87 da c6 ed af 8a be 86 6b 4b 22 a9 f3 9f 09 ef 10 ca 9c c0 0a 15 00 6d 5d c0 0d 00 e1 4f e0 40 82 02 fb 6c 80 d0 ff 25 e1 42 08 f2 04 3a 6b b1 50 21 04 08 5f 28 26 ec c2 05 87 89 1c de f4 68 2b 18 d2 1f 91 7e 39 72 14 c9 e1 eb 5b a9 6b d7 12 2c d9 82 d2 17 2a 72 de 4a e6 d8 92 e3 c4 2c 4e 3d 7d 2a f3 e7 60 48 86 a1 45 89 1e 3d fa 23 e9 d1 a1 4a 9b 32 cd e0 94 28 2c 7f 0b 3c 71 f2 f4 aa d6 2b 81 45 87 0c 8d 0a d5 a8 54 a9 50 a5 0e a1 ba 60 94 a7 b5 9e d8 ba a5 2a d4 57 06 5f 43 7d 11 9c 9b 77 48 5d bd 74 e9 b2 f0 35 97 c5 a6 21 9b f8 66 60 21 b0 82 bf 04 80 03 f7 f3 c5 e2 d8 b5 c1 80 01 f7 bb e6 af 86 af 7e 97 59 88 83 0c 19 b4 2f d0 a8 3e cf 44 5d c3 9f b2 4e 9d 4a b8 86 dd e9 0e 00 da 21 52 dd c6 9d 2a 04 6d 00 5f 7a db ce ad 9b f7 f0 e0 a9 14 0c Data Ascii: kK"m]O@l%B:kP!_(&h+~9r[k,rJ,N=}`HE=#J2(,<q+ETP`W_C}wH]t5!f`!~Y/>D]NJ!Rm_z
2025-01-02 05:12:36 UTC	10674	IN	Data Raw: 9d dd aa cc d9 0b ae d8 33 1c 58 20 82 22 10 07 3d d0 81 cd fb cc 2c 90 9b b8 21 4d d2 23 4d c3 f4 9c 30 a8 22 d7 7b 3e ee 4a 9d c4 92 4d cb b1 81 da c1 4d f1 ba 9d f3 ba 9d 09 b0 1d 18 98 80 34 54 dc 12 00 ce e2 f1 3e e6 b1 9e f1 43 4e f2 8b dc e5 b1 1e e6 5c 4e ee 19 30 f1 e1 04 56 80 03 eb c4 08 85 50 80 96 23 08 05 20 cf fe 13 08 06 9b 08 fd 09 40 08 d0 b0 2e 98 80 1f 48 a0 93 f0 86 76 2d 88 2d 20 07 99 02 82 f6 6c cf 5f f9 00 33 14 88 6b 60 83 0a f4 06 6f f8 8c 70 21 82 62 d8 5c 4e d0 b9 82 e0 a0 24 6b 95 04 08 a1 0c a0 8a 90 50 06 ac c0 8a 57 70 8b fe 74 57 58 21 05 b7 78 8b 05 38 c3 1f 9a b2 c3 e0 8b af ff 40 d1 c0 f0 8b 25 c4 b2 2f 9b d8 c8 00 2a c8 30 8c 19 a5 42 c8 a8 86 6b a0 95 2f 72 12 13 da 8c 2f d4 c8 05 e2 42 5f 68 57 d0 10 87 31 4c 52 df Data Ascii: 3X "=,!M#M0"{>JMM4T>CN\N0VP# @.Hv-- l_3k`op!b\N$kPWptWX!x8@%/*0Bk/r/B_hW1LR
2025-01-02 05:12:36 UTC	11860	IN	Data Raw: a4 40 2b 57 aa 69 b8 40 07 7e 66 02 02 6b 22 29 61 0c 4c 60 07 12 a1 07 1a 20 23 b1 ff 89 16 cc a1 38 be 21 08 8f c1 15 06 76 60 87 43 1b 80 ee a9 28 26 61 a9 aa e8 5c b2 63 30 f4 c9 40 c6 1f a4 a1 10 a6 c0 14 6c f2 26 57 41 61 ba ea 0a b4 ce eb b2 ca 07 f4 20 01 08 e1 a5 74 c6 11 6a 40 09 78 e6 e4 a0 b2 07 7c 26 01 1a a0 01 12 c0 32 94 46 2b e9 6e 0c a4 06 06 0a 21 2e f8 40 02 f4 ce 0e 92 85 8d e8 c2 0a 10 08 81 be 46 2d d5 32 b3 0e 2f f1 96 16 b3 e4 c6 f1 1e 0f f2 44 cb 2e 39 61 01 90 00 02 ba 80 72 08 27 72 d6 2a 4d 0e c1 71 20 67 03 38 4f 4f ac 81 30 23 87 f4 6c 0b 02 94 80 b7 c0 02 80 18 81 53 d2 84 b8 ee 01 80 7a ab 3a db 96 32 5d 74 0b 16 c0 33 f5 e6 15 78 2f f8 0e e2 34 4b 53 20 04 17 79 0e 82 20 88 0f bc 60 41 34 95 8f bd 20 22 f9 a8 47 22 24 37 Data Ascii: @+Wi@~fk")aL` #8!v`C(&a\c0@l&WAa tj@x\|&2F+n!.@F-2/D.9ar'r*Mq g8OO0#lSz:2]t3x/4KS y `A4 "G"$7

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49829	154.91.91.54	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	608	OUT	GET /b38048b5589bcfb538c627481211202f.gif HTTP/1.1 Host: img.qxwoiv.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	301	IN	HTTP/1.1 302 Found Server: NgxFence Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: text/html; charset=utf-8 Content-Length: 0 Connection: close Location: https://ylg1.duyunfk.com/b38048b5589bcfb538c627481211202f.gif Strict-Transport-Security: max-age=31536000; includeSubdomains; preload

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49821	183.204.210.219	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	611	OUT	GET /jiamigif/168sc/168-200x200-2.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	570	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 308156 Connection: close Accept-Ranges: bytes Age: 140 Cache-Control: max-age=2592000 Etag: "67555191-4b3bc" Expires: Sat, 01 Feb 2025 05:10:16 GMT Last-Modified: Sun, 08 Dec 2024 07:58:09 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 86e6a5d2d8260345c170c153bc6ed3ea X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT via: cache10.zzcm05 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:36 UTC	15814	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 53 2a 07 95 12 12 99 00 ff fe f4 b7 f6 d9 6e dc a1 fd 56 b2 f4 f8 b4 90 a3 da f6 fc b2 b1 68 66 54 54 53 46 fb d3 aa f8 d4 4e fd fb d1 f8 b2 06 fd 93 92 ef 8b 77 d4 b5 4c fe d5 01 16 5f a0 61 9b a0 dd 01 5a 8c 8a 70 f6 d6 91 f9 8e 06 14 55 db fa 29 2a fe ef 70 76 76 65 64 8f 71 d2 d6 d5 5c 67 a8 21 54 5c 6e 4c 04 67 d3 ef b3 b3 b2 fb b3 2d b8 4d f7 d5 91 6f d5 b2 2d f2 d5 ff b3 b0 90 90 6d 04 b2 91 6d a5 dc ae 8d 70 4b b1 92 4c d6 d1 91 46 44 38 b4 8e 05 d3 b5 6d b4 ae 70 90 6e 2c f3 67 50 b9 01 b1 d5 d3 b2 d3 b4 8f dc 44 45 b3 91 2c 95 95 8c f7 d0 2d f9 6f 06 05 21 63 fb b6 4a da cf 6e d6 ad 07 da 11 24 f5 b3 6e 8c 53 9c b2 70 4d ff f7 4a ca 76 f7 ad 2a fb 6d 4e 28 93 8c 4e 03 aa ff d3 69 a7 29 ac fb 29 22 0b cf ee Data Ascii: GIF89aSnVhfTTSFNwL_aZpU)pvvedq\g!T\nLg-Mo-mmpKLFD8mpn,gPDE,-o!cJn$nSpMJv*mN(Ni))"
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ca ea fe d8 9d 35 78 32 43 64 6f 00 a7 f0 00 53 71 14 5b 32 2e 57 b2 2e e7 72 f8 62 32 e3 16 ae 3c 3c f2 ef 3e ae 19 c8 ca ff aa 71 b6 76 ae 08 8b 5a 21 07 86 22 8b 32 fa 0a a0 2c b8 6c 00 ff 2e b5 06 f3 1b db 32 2f ef f2 25 6f b3 37 eb b2 2f 2b f0 1d 07 33 b5 fe 6e 2a 08 83 30 a4 c2 15 bb 2c 3a d7 c6 2e 08 49 34 5b 6e e8 fe ff ed 2e d4 b3 2c cf 32 0a ab b3 35 3f 32 24 73 af 2d df 32 37 7f 33 14 07 34 41 0b b4 01 63 f2 06 1c ee 02 df 31 f9 ce 2c 39 f3 33 44 47 34 44 33 34 43 f7 72 38 17 34 46 1b 74 46 6f b4 41 0f f4 0a 5f 34 48 87 b4 2f 2b 6e 47 73 b4 49 97 34 4a 9f b4 4a a7 34 4b af f4 1c bb 74 4b c7 34 4c cf b4 4c f3 72 4d d3 34 4e df b4 4e e3 74 4e f7 f4 4e ff b4 4f 07 34 50 0f 75 50 13 b5 51 77 73 51 27 f5 51 2f 75 4e 33 b5 53 2b 35 54 cb 74 41 b3 02 Data Ascii: 5x2CdoSq[2.W.rb2<<>qvZ!"2,l.2/%o7/+3n*0,:.I4[n.,25?2$s-2734Ac1,93DG4D34Cr84FtFoA_4H/+nGsI4JJ4KtK4LLrM4NNtNNO4PuPQwsQ'Q/uN3S+5TtA
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ff 4f eb 84 de 01 d2 45 80 99 9d 86 c4 60 f5 bd cd 1e 31 60 05 8e d4 9b 61 a0 fd 74 61 9b bd 19 10 c2 9f 10 5e 05 7f 08 43 7f b8 14 ce ac e1 09 ea 86 08 0a 9b d3 b8 4c 16 fa 20 1c b6 a0 0d 2e 8e 15 d2 c5 7b 3d e1 db 65 88 16 d2 a1 17 ae 10 18 0a a2 9f 00 e1 f5 e1 4c 0c d9 d9 fc a1 43 11 16 a1 26 b1 d3 9b 6c e1 e1 6c 08 cb 9c 9d f7 f9 a1 9d 05 c7 db 58 cf 3e a5 1d 0d be 1d 89 35 21 26 be 0c 75 79 21 87 00 a2 04 fa 60 06 5e 94 4b 81 dc f6 64 17 1a 36 22 ce 2c 58 80 ad 60 f5 61 62 15 5a 22 0f f2 a0 9d a1 9d 4f 68 8b 0b e6 21 28 32 60 b5 10 63 29 fe 60 9e 1c 23 32 1e 23 05 b2 62 2b de d9 6d 68 52 7a 38 e2 12 c2 0c ae fd a0 25 56 53 33 06 e3 31 36 1f 4f d8 d8 17 8e a1 f4 8d 14 2f 8a c8 41 f1 09 6c 5c 23 75 8d 61 2a 32 e3 0e c2 d1 1a 7a e0 73 6c cf 5a ed 9e 11 Data Ascii: OE`1`ata^CL .{=eLC&llX>5!&uy!`^Kd6",X`abZ"Oh!(2`c)`#2#b+mhRz8%VS316O/Al\#ua*2zslZ
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7e 3a 30 11 00 73 3d 30 bc 30 6e 44 1f 65 24 eb fa 68 19 c1 4e 3b 47 cc 9b 34 98 4b 8b 2d 07 7d f4 29 4f 6f bd f5 d8 f3 32 ff fc bf d8 5f c7 1e dd 2b 61 ff 6d 84 df 91 bf e1 ed da 27 c0 98 bc 2f 7e d7 a3 5f fd ec a7 c0 5f f4 a2 17 a1 c8 5f 1f f6 a7 39 59 18 82 76 37 79 05 b8 c4 56 9e 01 1e 8e 77 d5 c3 5e f6 10 b8 40 fb 35 b0 84 0d d4 01 0a 75 10 85 28 fc 03 00 c2 38 cd 29 50 b3 21 9a a4 8f 83 b9 9b 1e 08 11 c8 8b 11 92 d0 84 bd 48 21 10 8f 81 42 71 c8 23 0a f2 90 c3 3f 84 61 06 0b 59 a3 89 1a ec 90 0d 49 47 3d 03 86 90 7e 3c 64 a0 0f 81 a8 45 14 de a2 8b 5e ec 22 11 57 92 8a e4 50 70 7d 51 94 22 f5 e4 a7 43 1e fa f0 87 5b 4c e1 2d 74 f0 c5 39 7a 71 03 5d 5c 89 34 ce 68 c3 de 51 71 8d 6c cc e2 1b e1 48 c7 41 de e2 1f c8 d0 a3 1e 15 97 43 3f 2e b0 8d 6e 7c Data Ascii: ~:0s=00nDe$hN;G4K-})Oo2_+am'/~___9Yv7yVw^@5u(8)P!H!Bq#?aYIG=~<dE^"WPp}Q"C[L-t9zq]\4hQqlHAC?.n\|
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 40 3c c1 d5 cc 2d 48 f6 e1 55 a9 5c 40 4e 68 48 cf 45 03 24 d9 84 52 74 03 0c 70 81 cd 60 de da f1 c0 5d c5 94 2d f0 47 37 4c 03 f3 e0 06 f2 bd 82 2e a4 c8 2e bc c3 2e 80 62 34 dd 02 36 8a 83 3c 00 00 00 c4 97 21 54 57 9a e5 61 7a 7d 46 41 c4 0d b9 40 05 b9 70 c1 6f 90 90 02 a8 23 0f 78 17 b9 7c 81 7f 98 de c1 a1 20 99 b1 ff 97 68 c4 1e 51 c8 84 aa 40 21 ae cc 44 74 0d ce 7e 90 e3 71 b0 09 42 b8 59 4d 58 e3 e2 60 23 43 66 a3 3c 44 01 00 e8 82 75 55 99 b0 11 64 88 f0 98 82 95 d4 b9 81 8d aa 7d c9 ba 91 19 a2 5d c6 d6 25 07 86 1d c4 cd 68 d0 71 78 22 c7 d9 9b 42 32 4e 43 be e4 2d e8 80 0e 88 83 1f c8 81 12 bc da 38 72 4c 7a 95 5b 8e 49 58 69 fd 9b b3 f1 1d a2 a1 12 fd 95 99 fc 09 4b 4a 4a 11 4b da c5 52 b6 24 76 c0 64 4c ca a4 54 ea c0 31 c8 e4 1e ec 41 1f Data Ascii: @<-HU\@NhHE$Rtp`]-G7L...b46<!TWaz}FA@po#x\| hQ@!Dt~qBYMX`#Cf<DuUd}]%hqx"B2NC-8rLz[IXiKJJKR$vdLT1A
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 42 07 bd 08 c5 1e 60 bc 07 23 d8 ab 0c 21 9a 4d 1d 8b 4a ce 55 c2 04 9d 1d 85 f0 73 6a 89 cb ce c8 82 a0 04 65 e2 3f 8c 86 56 63 82 58 7c 22 0e 6e 7d 81 78 e2 29 ab b8 ca bd b8 32 96 db f2 8b 5f f0 82 17 6b f8 32 98 59 e0 06 17 7c a1 cc 66 fe 02 1b bf d0 81 fb 18 98 a3 10 66 9e 9c 6c 61 c5 39 0b 23 06 68 6d 26 00 e0 22 8f 7f 88 03 b3 1f 5e c9 2d d4 f2 e1 27 13 7a be 86 2e b4 3e a3 4c 5c 13 23 77 ca 97 ad b2 8a b1 2c 69 2d 77 b9 d2 c0 b8 74 04 32 ad e9 4d 6f 1a cc 9e 5e 83 1b d6 60 84 51 8f 7a 0f a6 3e 35 aa fd b0 07 3f f4 97 bf e2 d8 af a3 fd 6c 5c e3 fe 63 d0 b5 86 69 ad 73 dd 64 24 21 7a d1 52 8e 75 72 21 9d 62 49 5f 19 2e 5c b6 f4 a5 81 c1 e9 65 33 3b 02 c9 ae 74 97 b7 2c ed 5f 10 bb 17 c7 38 c6 8a 53 fc 68 60 07 3a d0 b6 b6 f5 4a 06 ff 7d e8 71 f7 ba Data Ascii: B`#!MJUsje?VcX\|"n}x)2_k2Y\|ffla9#hm&"^-'z.>L\#w,i-wt2Mo^`Qz>5?l\cisd$!zRur!bI_.\e3;t,_8Sh`:J}q
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: c0 b6 cf 99 f1 03 1c 50 20 68 1c 93 e9 83 2d 59 83 04 c0 70 82 fd b2 c4 83 1f 14 c9 15 24 20 81 2b ec 21 93 bd 08 85 45 fc ff 20 20 38 94 40 67 88 d0 01 53 34 0d b6 aa fc c3 0f 88 d0 59 ad 11 91 dc b8 71 e5 1a d7 38 cb bd cd a2 87 b2 74 c5 de d4 11 c7 35 c4 e5 5d 8f d4 2b 3b b3 46 c8 a9 4e cc 47 85 24 3c 81 a7 22 f6 d0 8c 1d a0 28 44 c1 c6 78 05 89 5e 79 31 49 97 a0 46 d1 ba 95 4d 1d 74 22 72 6f 07 c5 22 72 a0 b8 65 28 fe 0f 79 24 18 7d 03 7f 39 cc 61 4d 29 97 26 fc 54 73 5e 38 94 6a ee 10 3e 4b bc e4 8d bb 38 c6 73 eb ec 97 74 7c 4d 3e 6e 26 6d 42 be 87 50 68 51 37 98 f1 83 45 e4 21 07 fa 89 a3 e5 17 2d 9d 0d 9f f3 ea 98 73 3d 2d b1 a6 f3 61 0e b3 eb 27 81 ad ea 55 c7 8f b1 33 23 94 50 28 0b e8 06 d3 78 f5 d2 54 c5 8f 53 e8 17 75 18 a1 d3 81 63 76 c4 5d Data Ascii: P h-Yp$ +!E 8@gS4Yq8t5]+;FNG$<"(Dx^y1IFMt"ro"re(y$}9aM)&Ts^8j>K8st\|M>n&mBPhQ7E!-s=-a'U3#P(xTSucv]
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 14 fc 88 c2 8f 1a 6d 68 80 5a 6a 1b e0 85 97 35 c0 38 c2 b3 20 bf 0d 8a be 08 fa 20 17 3f 3a a4 c8 40 8a 78 df 85 23 83 0c e0 30 90 52 a7 64 18 55 41 7a 7b 4e 08 ba 30 5a cd f7 22 0e ed d0 d9 8e 09 31 da 30 4d 5b e1 80 43 0a 38 10 39 38 80 60 13 56 ff 38 4d 79 fc 78 ba 04 ae a5 40 c4 e2 8b 05 85 29 a9 d2 8c a8 e3 e3 8f d7 b8 e2 47 a3 d6 70 fb ed 35 46 53 79 65 ba c9 4d ab 6e a6 1a 1c cb 4b 8b dc 75 70 68 bb fe 65 5a 4c ea 90 11 7c f0 c1 a5 b1 7a 31 71 e4 59 58 1c c8 c5 89 62 72 3f a0 ad 31 b3 9a f6 d0 bc 8e 35 78 f9 6c 0d 23 e2 8e 00 6e d2 dd 26 12 6f d4 53 af 1b 55 d6 eb 4a ab 5f 57 0d 4f fc 22 bb 64 47 9c 6a c5 17 d7 d3 a4 c6 a3 90 e7 62 3f 82 77 69 d0 a4 42 a9 e3 f8 e3 dd f6 1c 18 b7 89 2a 9d f4 08 8a 54 7d 7a ea f3 0e ee 4a 9f af 37 5c 1a c0 2b 94 86 Data Ascii: mhZj58 ?:@x#0RdUAz{N0Z"10M[C898`V8Myx@)Gp5FSyeMnKupheZL\|z1qYXbr?15xl#n&oSUJ_WO"dGjb?wiB*T}zJ7\+
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 39 20 b9 0a 28 c0 01 2c 00 0d b8 80 0a e4 c0 1a f4 42 14 98 dc 2d c8 83 1c 18 01 0f 68 cd d6 1c 85 d7 d4 76 33 b9 81 eb 82 39 7e 3f b6 4a 8f f9 4a 9f c1 3a e7 40 02 24 80 18 70 64 1f 5c 51 9b ef 41 1d 7c 81 12 ab 84 3a 2c 40 21 dc d7 ae 88 42 19 2c 8e 2d 48 85 50 4b ff 85 34 fa 39 bd bb 89 3c 30 80 48 18 81 7b c9 03 00 cc 01 0d 1c 00 06 7c d1 35 33 c0 5b 32 c0 0b 84 6f e5 7c 43 0e 44 46 10 f4 33 ac 2b 81 a7 b8 c1 1c 30 62 ae 88 80 1e 58 fc a5 4b 65 55 56 41 10 a0 00 10 ec 80 1c 34 40 09 54 03 07 58 82 08 9c bc 08 b8 c0 6d 0f 80 92 2f 3c 03 2c c1 01 c0 00 d2 c1 4a 0e 5c 00 00 dc 02 ce 1b 03 06 c8 01 37 86 c3 14 90 0e 53 84 8f 13 38 41 22 58 b4 1b b8 81 0b 74 b9 97 4f bb 2c 7b 9c 46 bf 72 87 25 40 32 94 c3 8b 18 41 b8 5b fd 15 69 b5 d8 86 67 f9 46 78 0c 28 Data Ascii: 9 (,B-hv39~?JJ:@$pd\QA\|:,@!B,-HPK49<0H{\|53[2o\|CDF3+0bXKeUVA4@TXm/<,J\7S8A"XtO,{Fr%@2A[igFx(
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 00 00 43 24 42 10 1a fd 44 ca d0 61 36 42 6c 34 2a 9b 98 d2 15 58 a3 1a 29 9e a0 0e 57 c8 01 19 72 09 0b 5c f4 22 01 c8 09 89 18 48 01 53 0c c2 23 1a bc 05 44 2e 5a 19 92 9d 4e a1 00 36 9d 60 34 7e e9 cb 86 e5 62 24 fc b1 69 39 02 05 da 70 84 40 03 4f d5 0a 24 78 90 11 5b 7c 00 52 20 1b 19 39 45 76 a0 71 9c cc 16 e1 60 44 54 bc b0 51 45 10 02 00 00 a8 c1 15 22 30 af 63 f4 e6 04 2c f0 40 38 32 73 81 bb aa 41 02 34 c0 c3 25 2a 20 e0 0a cc 2d 11 64 1c 01 24 54 e0 d0 19 d0 b1 1a 03 a8 06 06 68 55 8c c6 e2 61 8c 81 98 2c 66 1c 11 82 1d c8 2f 06 e1 58 80 0b 08 41 08 17 74 20 1c c2 70 81 ff 11 8a b0 d1 15 0b e0 13 23 b6 1f 45 fa 67 04 37 48 e2 b6 b0 48 d7 32 6c cc 83 33 68 c3 1d a8 44 e5 62 78 bb 0c 2e 1c 87 19 f3 30 b2 e7 7c 9a 94 a5 24 20 01 4c d1 46 52 48 02 Data Ascii: C$BDa6Bl4X)Wr\"HS#D.ZN6`4~b$i9p@O$x[\|R 9Evq`DTQE"0c,@82sA4% -d$ThUa,f/XAt p#Eg7HH2l3hDbx.0\|$ LFRH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49819	183.204.210.219	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	615	OUT	GET /jiamigif/tyxsc/xmspggTT2-200X200.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	570	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 124953 Connection: close Accept-Ranges: bytes Age: 599 Cache-Control: max-age=2592000 Etag: "67711026-1e819" Expires: Sat, 01 Feb 2025 05:02:37 GMT Last-Modified: Sun, 29 Dec 2024 09:02:30 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 59d66d34d8adc5dfac328a7eda29a787 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT via: cache06.zzcm05 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:36 UTC	15814	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 ff e5 71 f1 d7 8a e8 9e 01 01 ff 00 ff d5 00 99 ff 99 e8 69 69 57 01 01 9f ac fd 00 6b ff ff e7 8c ff fa 01 f3 d3 d3 6e 00 d4 8f 00 ce b0 00 c8 fd fc a6 fc 00 01 5b fe 5b b3 00 00 b5 8d 6f db 9e e3 ce ad 72 cc b1 8a cb 00 c3 fb ff 30 fd cf 72 e8 d7 a9 ef d2 f1 ff ee a3 98 67 50 88 00 00 f0 99 99 66 ff 16 fe ee b5 fb 00 ba b3 a1 91 a6 72 50 62 00 00 f5 b4 b5 8a 4c 36 d4 da fe 00 58 ff 97 00 00 6a 90 ff cd 00 00 a1 fe 25 ff eb 9c fd ff 55 fe fa 98 ff f5 c4 d9 00 00 ff fb ee e9 00 01 ff e9 00 ff f3 bb 00 35 ff 71 6f 54 e1 69 d3 00 47 ff 71 32 24 b2 87 58 00 27 ff ca ff ca 65 77 ff ff c5 49 ff ec 92 ff f6 cd ab 69 dd ff ef ab de c7 93 78 00 00 70 25 1a cb 9d 95 b1 71 67 e9 00 bd 76 47 32 aa 97 13 d3 ff 30 ff f4 b3 01 d5 Data Ascii: GIF89aqiiWkn[[or0rgPfrPbL6Xj%U5qoTiGq2$X'ewIixp%qgvG20
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: c0 b9 57 e4 a4 8f 47 e0 68 e4 03 a9 2c ee 5f 40 35 e6 13 6b 2c e2 fa 27 e7 92 87 cb 5f 5a 83 51 0e 5b 95 11 6d 8e ba 40 f9 4e 2a 19 60 74 15 e6 ee d6 b2 cf fe 0f bd 79 46 39 ba 8b 89 52 34 ab ef 88 f7 4d 65 70 c4 6b 65 3c 85 c8 93 d5 a2 ee ce cb 0a 7d f4 d2 53 3a b6 43 bf 22 9f 3c d3 4a b5 7d 6a c4 be 87 f4 9b c7 13 f1 eb 7d e7 e6 8b b7 2f f9 d8 87 a4 c8 f6 f0 c2 1f 3f 48 de a4 6f ff fd 78 ed cf bf 57 fe fb 5f 50 60 b6 3e 83 e0 25 02 04 2c a0 e4 d4 92 40 05 7e 0f 26 5d 73 60 42 bc 12 41 09 22 e4 29 15 b4 e0 41 82 12 35 0d 4e f0 25 7b f3 e0 06 43 12 42 11 1a 10 6e 26 cc 08 0a 53 88 11 8a 94 90 85 0b 8c 1d 0c 35 72 ba 19 aa 10 22 bd b3 e1 08 1d 92 43 1d 9e b0 21 a8 f2 e1 05 17 81 78 3d 21 2e f0 78 46 6c 61 f7 92 88 90 25 32 f1 20 01 34 62 40 00 00 21 f9 04 Data Ascii: WGh,_@5k,'_ZQ[m@N*`tyF9R4Mepke<}S:C"<J}j}/?HoxW_P`>%,@~&]s`BA")A5N%{CBn&S5r"C!x=!.xFla%2 4b@!
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 33 3b af 75 83 a8 32 19 b5 86 d0 b7 88 ff 2b 46 7e 3b be 8e 4a ba 33 60 bc 6c 84 bc 53 1a b6 00 1b 92 23 5b 3a 71 5a 39 d1 2a ad 42 6b 6f ba 3b b5 16 66 a1 c5 db 48 ea bb 9a 82 3b 8a ef 6b 39 f1 0b 39 2c 59 bb 84 5b 37 14 90 9d 96 8b bf e4 65 be e8 fb 32 0c 60 9a e5 e8 33 28 2b a5 69 c9 a6 62 6b 8a 01 5c 39 03 7c 38 d1 6a 99 da 6b 38 b2 8a 97 0c 6c 5c fa eb 8d 0f ec 32 8b 40 be 8f 4a c1 80 fb bf a0 b8 c1 90 d3 c1 86 b3 b1 07 5b bf a4 da bd 07 59 c2 2a e5 c0 fc fb c2 ec eb 98 a1 28 c3 ef 8a c3 3c 53 97 06 ab 8b 07 6c 6f 36 4b c2 e7 e6 0f 27 5c 03 29 fc 3e fd 9b 98 30 fc 01 1e 00 07 5a bc c5 9d 9b b6 5c 0c 07 34 ec 32 d4 4b ad fe 40 0d 83 5a 9b 2d 19 c2 3c d3 b2 70 30 90 bb f9 bd 8f ba c4 30 f3 05 2c cc c2 3e 7c ba 40 1c c4 06 7a 8f 3d 63 a5 44 db b6 5d 7c Data Ascii: 3;u2+F~;J3`lS#[:qZ9Bko;fH;k99,Y[7e2`3(+ibk\9\|8jk8l\2@J[Y(<Slo6K'\)>0Z\42K@Z-<p00,>\|@z=cD]\|
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 8e 16 7c 94 2a 9b c1 6e b9 c9 74 d3 c9 37 03 c8 37 23 c8 83 9c c6 6e 93 c0 4d db 33 5f 50 b9 7b a9 c6 5f 74 02 a3 09 9e 2a 75 02 2f ac bc a4 c8 cb 73 e3 cb 30 d3 b6 a0 6c c3 94 f9 bc 3d 43 b7 bb e8 bb 3c 93 c0 45 5a 90 35 29 ce 6c 24 ba c4 3b 03 b1 24 cd 79 bc b2 bb 5c 3a d8 fc 32 c0 0c 33 c2 4c 9d b2 48 c6 2f c3 bd 13 f0 ba c2 ea c6 bb 7b 90 b7 4b 47 0c 10 cb d0 6c 48 0c 70 96 6b 8a c9 f6 68 cd 6f 33 cf 2e a3 cd 37 13 ca 68 2c b4 8a bc 8b 03 dd bc 3a 1c 8c 3c 4c 3d 0f 3b 9a dd 68 48 a0 70 ac b7 6c c5 18 9c a3 67 2b cf 8b 1b c8 7f 0a 9f ac 2c c6 be e8 cd 3c 33 c2 06 ff f9 a5 13 f0 d2 c8 53 d0 cf 7c d0 5f 34 d2 80 3b 84 57 cc c7 3c 13 9b 8b bb cd d8 9b 8b cc 0c 33 37 2b 90 49 ed 32 d4 40 b9 d9 d9 02 4d ed d1 2e 2a c5 a0 bb b5 fa fc 32 3e 0d a5 25 cd 91 27 Data Ascii: \|nt77#nM3_P{_tu/s0l=C<EZ5)l$;$y\:23LH/{KGlHpkho3.7h,:<L=;hHplg+,<3S\|_4;W<37+I2@M.*2>%'
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: d3 9e 19 8d 38 fd d1 82 79 be 57 8d d5 6e f3 b9 5c 9b ba f0 3c 8a 88 a0 d4 3d d3 b9 66 bb d2 c1 7c d6 b9 68 d1 43 ba 8b 59 ed 0f a8 4c d9 13 90 07 0e 8d ab 0b d9 c8 ce cc 93 35 80 d3 04 3d b1 19 5c 8f bf ac d8 4a 5d d8 13 7d d8 88 1d be ff 4c 90 8d 5d ce 8f 5d 93 94 ec 0f 70 20 d9 d0 98 07 19 7d 33 ea cc 9f bc cd 46 09 0d b6 7a 3c b6 c1 ff bd c6 c3 8d da f6 ac da 42 6b ad b7 b9 8b 53 ed c8 28 ba c0 af 5d c6 8f dc bb b7 2a 9a d9 fd 45 db fd b3 14 4b 8a 32 9c 08 3c f3 05 02 3b 06 65 ed c9 86 4d 8b 9f f0 da 8e 1d 93 e8 6c cf 06 d9 dc 9d 69 00 a4 0c 33 b8 da d1 8b 40 ae 55 3d df 3f 54 df fe fb d5 ed 2b b0 4f cd 33 70 b0 c1 70 a0 c9 9e 6c d6 2c 59 de 97 c9 8b 44 fc 32 b9 4b d9 bb 99 07 d9 7d 02 d4 4d c1 81 d9 8d 14 fe 3e 16 6e c5 d4 3c 8a 69 dd e1 1c be c1 5f Data Ascii: 8yWn\<=f\|hCYL5=\J]}L]]p }3Fz<BkS(]*EK2<;eMli3@U=?T+O3ppl,YD2K}M>n<i_
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: c9 80 fc c7 a4 ac c9 45 ac c8 9c fc c9 ac ac ca 8b dc ca 90 3c c9 a9 3c c8 b1 ec ca 7c 2c cb 40 6c ca b8 0c cb 96 6c cb bb 2c cb bc 4c bf 41 9c bb c4 7c c7 c1 cc b8 a2 fc c4 c1 ec bb c5 2c cc bf bc cc c3 6c cc c9 0c cd cf 5c cd ac 4c cd d2 4c cd da 6c cd dc bc cd c8 0c cd c4 fc cd 84 cc b8 e4 2c ce e1 dc cc e7 0c ca e6 6c ce ea 3c ce ee bc ce e4 cc cc e7 5c ce 88 1c ce a2 4c cf d1 1c cf c2 ac cf ef fc c8 f5 dc ce df ac cf 01 ed cc 01 2d cf c6 5c ce cc ac ce 04 6d b5 3d 00 c1 5e c0 c0 10 dd c1 12 9d d0 05 4d b1 25 00 c1 12 3c c1 fb 8c d0 f0 2c ce fc 90 08 16 cc 2f cf 57 5c ad 42 cf f7 2c cf f8 6c d2 29 8d ce ff dc d1 e3 bc ce 0a 1d d3 f9 dc cc 0a ff 6d d1 1d 50 04 ce 20 03 fa 73 05 6f 01 1d 72 a1 04 00 7d ce e2 d0 01 2f 60 40 42 a6 36 81 40 d1 14 4d d3 01 Data Ascii: E<<\|,@ll,LA\|,l\LLl,l<\L-\m=^M%<,/W\B,l)mP sor}/`@B6@M
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 15 5f 78 c6 01 36 89 17 dc 15 5a 40 f9 13 c1 cd 85 23 83 5b 99 54 e9 4a 49 36 d5 55 40 35 6d 6c e1 7c f0 c0 55 9d 60 72 06 ca 2b 12 56 48 99 12 2d 26 94 95 99 dc 84 41 99 42 ca 20 16 c9 88 99 9c 0f 57 a5 f4 23 14 28 f0 15 3e 92 e0 03 22 10 ff ba 45 86 5e 3a 91 66 5d 7e 24 63 cb 2b 06 43 98 3d b2 06 4a 48 99 15 59 4e a1 1e 5e cc 64 56 b4 d6 14 84 b6 71 27 78 e9 8e 28 4b 79 c6 76 1e b3 8d f3 b1 61 e1 96 84 0e 3c 9e 10 a0 d8 1c e4 cc 91 d3 c1 6e 83 db 91 45 47 67 25 9b 20 19 60 48 b5 aa 57 bd 6a 56 98 a2 09 ac 8e 75 aa 01 6d 12 53 c8 5a d6 9d 30 45 94 6f bd ea 4e ec e9 00 94 e0 f5 aa f3 d1 84 26 a0 43 d8 a9 46 87 1e e6 77 92 3e c5 d5 33 64 d8 00 a7 15 1c c7 1a 86 1a c2 73 2e 82 75 55 b6 06 56 20 fb db ab 46 46 a0 89 6a 8a 63 83 1b dc be 3e 49 32 3a 71 6e 70 Data Ascii: _x6Z@#[TJI6U@5ml\|U`r+VH-&AB W#(>"E^:f]~$c+C=JHYN^dVq'x(Kyva<nEGg% `HWjVumSZ0EoN&CFw>3ds.uUV FFjc>I2:qnp
2025-01-02 05:12:36 UTC	10835	IN	Data Raw: e0 bc eb b9 42 f7 19 35 40 db 42 0d 5b 35 6c 53 35 50 2b 35 41 14 b5 55 fb bf 03 3b 35 3d 73 b4 3f 6c 1e 49 b3 33 f9 e3 c3 eb f1 43 3d 03 44 90 4a c4 43 3b 44 4b ac b3 e2 ab c3 40 ab 34 be 4b 34 27 23 35 e7 91 43 3a 1b 41 4a 3c b0 2c c4 44 6a 5a b5 06 8c c4 44 0b aa 66 7b c4 f7 91 45 42 8b ac 22 2b 33 26 b3 b3 9a 03 34 c5 6b 44 fc 59 45 f9 7a 31 4c 6b b0 69 18 44 c3 32 c6 e8 4a b0 64 7c 9f 13 60 46 37 fb 82 15 13 23 f0 ea ad 0f 1b c6 17 5c be 0d 03 2f f9 f3 33 0f 2b 2f 89 eb b1 70 04 af 50 32 80 72 9c af e5 c3 ad 04 53 c4 62 04 2f b6 bb c6 03 cb 46 0c dc c6 37 eb c6 ef fa c6 ee 89 c6 04 e3 ad 4a 6c b0 c8 e2 c7 f7 f2 47 6c ec c7 4a 63 00 f5 8a 29 10 92 c7 d8 a2 c7 f7 a1 c4 70 32 ae df 72 2d 77 bc 1e 32 d2 ad ff d3 82 c2 c8 93 48 8c e4 30 ae ea 48 8d d2 48 Data Ascii: B5@B[5lS5P+5AU;5=s?lI3C=DJC;DK@4K4'#5C:AJ<,DjZDf{EB"+3&4kDYEz1LkiD2Jd\|`F7#\/3+/pP2rSb/F7JlGlJc)p2r-w2H0HH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49836	23.224.82.187	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	353	OUT	GET /img/GYyh_1300x240.gif HTTP/1.1 Host: ig32.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	1082	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 5236 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83e838bd5f7cf-LAX Content-Length: 510915 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:10:42 GMT Etag: "67700bb2-7cbc3" Expires: Sat, 01 Feb 2025 03:43:26 GMT Last-Modified: Thu, 02 Jan 2025 05:10:42 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R32eRPa7TgouhQukKuPZH7BB45gKyDCimQsJuytTiMMwqRcbkWoO7kwkm4vDU5VVA5zfkKgu%2BzQj7DQStCuF%2FqRsCflvoO2a58WGmWc6r3iLgrOrSlrqjrZd6WXm7unwsw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=883&min_rtt=739&rtt_var=45&sent=347&recv=38&lost=0&retrans=0&sent_bytes=487017&recv_bytes=3529&delivery_rate=320863636&cwnd=412&unsent_bytes=0&cid=3e24dfef123ab61c&ts=8613&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:36 UTC	104	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 e6 00 00 59 10 01 66 76 b5 9f 1b 02 f1 25 15 fd c3 22 fd e8 80 f5 62 14 db b4 97 b6 6e 6c f2 dd cf 90 70 6e 2a 06 69 8f 88 94 dd ff fc 8b 75 8d dd cf c0 d7 72 47 cf 72 68 ba 44 44 4c 20 70 b9 4c 2d 74 5e 58 f9 6f 40 20 04 05 f8 71 64 b6 72 4f 88 88 cc d4 f0 d4 c3 aa 87 b8 b0 d0 bb Data Ascii: GIF89aYfv%"bnlpn*iurGrhDDL pL-t^Xo@ qdrO
2025-01-02 05:12:36 UTC	2372	IN	Data Raw: 42 04 77 88 b9 d9 db ee ac 77 84 aa 91 af 83 76 ad 6d 3a 1f 93 67 53 8f 40 2f 90 aa d2 c4 6a 28 ba ae b1 b9 33 39 cf bb c6 bf 82 04 97 52 42 8c 41 05 be cc e9 ff 30 35 55 81 d6 94 6d 01 8e aa b3 b4 99 c9 97 b6 e7 97 6a 2f ab bb e2 9a ab 8a cc 55 66 f5 8b 7a ff 55 66 ee dd ee cb cc ad 76 4d 6f cc 44 44 66 88 dd ff 44 3a ff 44 55 ff 55 55 dd 55 55 88 88 aa a8 9a 82 ee 55 55 ee ff ff 77 86 cc 77 99 ca ff ff ee ff ee dd 88 88 bb 78 99 dd cc 55 55 66 80 cc ff ff b8 99 88 aa a6 88 72 ff ff dd bd 88 74 88 99 c3 88 99 a6 aa 88 99 99 88 bb ff ee ee c5 99 75 ff 55 3c bf 99 9a ec ee ee 99 99 bd bb 55 5e eb ee ff dd 55 43 ee ee dd dd 43 44 ff ee c3 ca 55 3d 77 88 dd bb 88 99 aa 99 99 ff ee ff 66 99 dd ee ff ee 99 99 a7 77 aa cc ee ee c8 e0 ff dd eb ff c2 ee 44 33 66 Data Ascii: Bwwvm:gS@/j(39RBA05Umj/UfzUfvMoDDfD:DUUUUUUUwwxUUfrtuU<U^UCCDU=wfwD3f
2025-01-02 05:12:36 UTC	538	IN	Data Raw: 74 0b 4d 74 d3 e8 b4 57 c0 c6 08 44 2e f9 e4 46 da c0 b8 36 02 17 20 8e 17 1c 48 4d 24 00 d7 c8 3a 2b d2 5a 2f 9c c0 12 63 7c 0d 76 d8 63 4f ec e5 42 44 b6 20 7b 40 09 70 a0 76 db b8 e7 3e f7 ee bc 27 3e ad db be db ad 32 ca 5f 74 70 c3 0b 20 24 ef c5 f2 3c 24 ff c2 f1 56 64 97 77 53 c5 1f af 3c f3 cc 3f 6f 7c f4 d3 93 55 83 f5 d7 67 ef fc ff 09 4e 00 6e 7e df e7 ff 9d be e0 ec 13 8e ed e1 f0 23 1e 3c 9e 43 33 7d b9 36 48 ff 3e f9 fe 83 8d c6 78 05 ab d2 1c 91 e6 e1 39 d0 61 83 04 28 b0 c0 e8 08 50 ba 05 65 ad 07 55 88 a0 04 27 a8 ba d5 b5 6e 4b 12 31 1b ec 64 07 86 0e 56 21 6d b7 d3 9d 08 47 d8 ac de 99 70 7e 24 44 a1 f0 f4 74 03 ec 95 ee 85 30 8c 21 0f 6e 20 bd ee 69 a0 03 2e 94 a1 0e 4b d7 01 f7 a9 a8 85 3b 0c 22 0f db b7 3e f5 a1 cf 88 48 2c 22 11 97 Data Ascii: tMtWD.F6 HM$:+Z/c\|vcOBD {@pv>'>2_tp $<$VdwS<?o\|UgNn~#<C3}6H>x9a(PeU'nK1dV!mGp~$Dt0!n i.K;">H,"
2025-01-02 05:12:36 UTC	4744	IN	Data Raw: c5 28 2f 51 c0 d1 7d 84 a1 04 d9 b0 9a 32 99 c9 82 50 a1 ee 33 a0 99 23 45 57 ca 52 8d 58 13 83 d0 cc 26 37 67 ea 4d 71 8e f3 a6 86 cc e9 39 77 6a 4e 74 12 6f 9d bf 99 e7 0e 63 9a 4c 8e 9a e1 a8 c9 04 a4 1c 87 4a 4a 13 15 0f 92 44 2d 2a 52 93 4a bb 37 ee b0 87 7d ff b2 c2 0b a0 7a 00 82 48 75 aa 54 75 66 10 e3 59 50 82 ba 08 04 4d 35 ab 5a d7 5a 56 83 aa f2 ad 70 4d a8 5c 17 4a d7 86 da 55 85 01 89 68 2d 51 50 48 2c 4e e9 af 53 82 00 05 fc 02 ba 33 56 d5 34 d4 30 c7 32 97 d9 d5 37 1a 36 8e 15 74 29 1e 5f 5a 20 6c ca 94 a6 10 09 a4 4d 71 8a 36 07 7a a9 6c a0 5d c1 37 fb ca d3 d2 f6 54 2f 1a 4c ad f1 b6 f7 b3 d5 ba f6 b5 51 ac de 6b 61 0b 54 9c 08 55 86 5b 10 ac 07 76 cb db de fa 76 b7 09 34 e9 55 49 74 5b 18 06 f2 a8 bf 4d 2e 6f 51 a0 d4 e1 8e 28 9f 41 ac Data Ascii: (/Q}2P3#EWRX&7gMq9wjNtocLJJD-*RJ7}zHuTufYPM5ZZVpM\JUh-QPH,NS3V40276t)_Z lMq6zl]7T/LQkaTU[vv4UIt[M.oQ(A
2025-01-02 05:12:36 UTC	5930	IN	Data Raw: 5f 79 85 6a 18 68 a7 d5 1a dc 6d b8 e6 2a 1b ab 1d f4 ea ab af 9b 41 82 9b 6d c4 e6 66 ec b1 ba f9 38 13 71 66 42 a2 dc b3 d0 46 7b dd b4 d5 55 4b ed b5 dc 69 97 06 86 2d 74 bb 42 06 d6 90 d7 c8 21 e4 55 d1 5f 81 24 00 00 c0 16 1f 1e 80 88 01 2e dc 87 02 7d 16 a0 70 1f 09 28 ec 77 ae 2b 39 cd cb df 2b fb c6 72 d1 2b 0a 32 68 70 23 9a 94 f1 e0 84 0c 37 6c e1 c3 a3 b8 98 01 04 a9 50 1c f0 c5 21 8a 48 a2 c6 26 fa a2 62 01 54 78 27 f1 24 5a 50 d4 cd 8a fe 88 53 54 c9 2c b7 dc 32 05 32 3a a9 a7 cb 34 3f 02 24 94 48 12 f9 25 ce 56 0a 78 33 cf ec 3c 09 34 38 2a db f1 00 95 42 26 14 0b b8 fc 24 6d 50 81 e7 74 e8 8e 38 1b ad ff 0c 09 4e 2e 68 09 e8 a0 52 95 e4 35 d7 28 4d f5 65 59 cd e2 c8 54 4f 60 87 5d df d7 69 9b 34 95 4c 64 c3 98 b5 33 68 b7 cd f6 dd 60 bf 5d Data Ascii: _yjhmAmf8qfBF{UKi-tB!U_$.}p(w+9+r+2hp#7lP!H&bTx'$ZPST,22:4?$H%Vx3<48B&$mPt8N.hR5(MeYTO`]i4Ld3h`]
2025-01-02 05:12:36 UTC	7116	IN	Data Raw: 65 ee be fb 80 2e d4 49 3c 45 05 e0 36 f5 fd 64 fa b2 bb 76 f7 3a 8c 46 c0 16 09 93 10 9a 68 f0 6e f1 3e 67 a4 a1 16 f0 fe 04 f7 7f b0 91 36 08 59 b8 e8 22 20 26 58 64 65 08 4c a0 71 2e 86 31 0a 38 70 2f d0 e3 18 b1 10 d0 1d 94 55 50 3b 23 2b 99 c9 c8 f5 31 ee 89 8f 65 8b c8 12 27 96 76 34 af 11 49 67 0c 32 e1 e1 b4 87 42 10 0d 89 10 3e 03 d0 d9 22 94 c2 17 02 a0 66 4a 0b 86 7c 92 86 b5 1e 1a 4d 10 88 c8 61 d3 ec 80 a5 18 e2 a7 6a e9 f1 21 69 0c 47 b3 44 30 4d 85 f2 99 53 36 08 31 9a c1 11 ee ff 7d 19 c0 92 95 16 96 24 c5 b9 4c 44 d9 f0 c4 d9 ec 67 0c 2b 62 a2 37 b6 d9 e2 65 d4 66 c6 c5 bd 6d 77 51 13 53 19 07 77 c6 2d a4 d1 4a 2b 4a 1c db 30 91 a2 13 6e 0e 72 80 8c 1c e5 4e 67 ba d7 55 2e 0c 88 bc 5d 3b 16 82 a7 43 66 aa 74 89 12 d4 07 42 b7 28 87 50 12 Data Ascii: e.I<E6dv:Fhn>g6Y" &XdeLq.18p/UP;#+1e'v4Ig2B>"fJ\|Maj!iGD0MS61}$LDg+b7efmwQSw-J+J0nrNgU.];CftB(P
2025-01-02 05:12:36 UTC	8302	IN	Data Raw: 96 37 3b 42 58 19 9a d7 0d fa f6 1f fc b6 43 15 17 67 e6 c4 65 a4 e7 65 4f 08 85 46 40 51 e7 b2 70 ae a7 71 c7 22 7b 4b c8 08 e0 20 70 e3 14 44 90 85 85 8e d7 72 18 f7 00 be a7 5c e0 27 08 a3 71 40 fb 53 86 25 27 7d e4 95 4f c9 57 73 e9 45 00 dd e4 86 6f 78 18 5a e4 0f c6 c7 51 33 67 47 de 87 7d 2a d3 87 a4 c1 78 3b 57 88 9d a6 6a e4 f7 88 8d 84 7f 51 05 02 34 b0 7f fc 77 89 98 f8 7e 59 30 7f 49 67 7f 49 21 89 07 48 07 99 38 8a 98 48 07 f2 d7 5f 1b 88 49 56 b1 80 5e 50 89 97 18 7f ae c6 80 a9 f8 80 66 c1 8a 94 28 8a 9a 48 03 50 e5 5e b4 18 81 be e8 49 b7 81 2b 15 38 8c c4 28 4b 36 38 1d 52 f3 34 fe 53 01 6d d7 8c 2e 54 6d 0b 60 40 27 88 82 2a c8 ff 6d 80 86 1c 16 e0 01 f6 02 6e 80 d7 63 31 28 83 c7 18 8e 37 18 29 88 51 42 89 b7 83 ef d6 7a 90 13 5c 47 c5 Data Ascii: 7;BXCgeeOF@Qpq"{K pDr\'q@S%'}OWsEoxZQ3gG}x;WjQ4w~Y0IgI!H8H_IV^Pf(HP^I+8(K68R4Sm.Tm`@'mnc1(7)QBz\G
2025-01-02 05:12:36 UTC	3662	IN	Data Raw: f5 57 7b f5 5f bc ed dd 9e d0 a1 e1 db f3 1a ef 07 5f ee 1d 5d 2f cd 6d dc c7 dd d1 5b a0 dc 57 8e 08 df e1 e4 00 2f ef 86 30 c2 68 3e 29 1b 6c f0 80 cf 5a 83 cf e3 27 0d d3 50 7e 08 a2 69 dd ee 98 62 8d 0f f0 33 ad 8f 23 b0 7d 94 bb f4 9a bf f9 9c ff 04 28 3c ba af 3b f1 b1 3c b4 16 3f d4 8d ad d6 1b ef e9 ae 83 9d f5 50 ff df 21 ff e8 3d 74 92 89 ca 88 41 91 01 fb e0 ed cc cc f2 20 e1 f2 30 0f f3 31 bf d6 33 4f f3 36 3f fc 38 8f ea 3d 7f fc 3e 1f f4 ca bf fc 48 df fc 4e 9f 4e 49 ff fc d2 3f fd d4 6f fb d6 7f fd d8 9f fd 51 5f eb c3 62 ce e7 ec 82 59 af f5 2a 32 f5 d7 4c d7 d1 2e f6 01 4c ec d6 5c f1 61 bf f6 b8 af d0 90 df b7 1c 14 f0 94 ff e5 f6 5e d2 8a bf 83 79 6f f8 93 0f 08 05 13 0b 84 0b 23 83 85 09 65 51 05 8d 05 04 90 91 92 93 8e 8d 04 06 14 85 Data Ascii: W{__]/m[W/0h>)lZ'P~ib3#}(<;<?P!=tA 013O6?8=>HNNI?oQ_bY*2L.L\a^yo#eQ
2025-01-02 05:12:36 UTC	10674	IN	Data Raw: 8f 0e 48 97 46 1a a8 81 da 42 1a c8 9f fb f9 9f 88 4a a0 42 96 7a 01 3a 12 04 49 06 69 80 ff a0 92 9a a0 4a 42 75 2b 78 a9 3b d9 a0 58 f2 a3 ca b2 40 9e 9a a9 5a 91 28 98 5a 10 e0 57 9e d4 76 a2 0b 99 aa aa fa a1 ac 0a 1b ad 8a a1 25 1a 0d 3a c0 18 a5 83 19 ac 58 45 30 9a 12 3a c1 1d c1 d0 36 ba fa 69 50 8a 9a e8 26 71 a2 a3 9b bd ca 1d a5 c4 62 14 00 9b ca 12 a4 c3 7a a3 54 95 8e c7 5a 1c 02 91 a7 2a c1 ac 51 e8 a4 d5 17 ac c2 1a 7e bc 38 9c fc 61 6f cb 69 94 58 ea ad e0 9a 2b 4c a9 0a 96 e4 9d ce 49 2a aa c2 49 64 ea 08 c4 42 02 f3 87 48 5c e1 8a 14 86 8d 9a 45 78 6c 2a 50 86 f7 8d 61 d9 91 64 99 4a e5 b8 2f 26 73 04 08 9b b0 0a bb b0 0c 0b 45 ca c0 02 d5 ca 96 0a b8 a7 7c da a7 f4 59 9f 74 f9 19 82 ba 62 29 51 5c bb e6 b1 86 da 97 c4 45 12 89 aa 5c 8a Data Ascii: HFBJBz:IiJBu+x;X@Z(ZWv%:XE0:6iP&qbzTZQ~8aoiX+LIIdBH\Exl*PadJ/&sE\|Ytb)Q\E\
2025-01-02 05:12:36 UTC	11860	IN	Data Raw: 0d b3 48 8b a6 20 1f b7 18 96 a6 50 1f 57 54 96 02 80 09 69 89 2d 74 23 92 bf 28 6a c1 c8 80 cb 18 0e 70 87 8d ad 80 8c 48 25 8d 73 d9 8c 09 56 8c d1 28 8c 6a 37 57 08 c1 04 db 38 78 e2 30 76 da 78 60 e3 b8 77 7a 19 0d cd b8 98 93 24 98 1f f2 60 e8 98 6d ea e8 8f 45 d2 7a d8 d3 8e 25 50 8f f9 38 31 aa 35 8f 89 b0 02 2e 86 ff 99 4a 01 90 d5 e8 87 e4 a3 8f f1 88 2e 4f f2 84 43 68 9a 32 71 6d e2 88 84 2e e3 53 5a c8 77 30 a2 9a 5e 02 56 09 a9 90 0b c9 90 bb e7 05 77 e1 00 10 19 91 90 c6 86 ed 45 89 c5 47 88 b6 25 7e d1 35 71 34 84 36 4f 50 9d d6 b9 75 79 28 87 a7 85 7c a1 c9 4e 88 08 2a 26 d9 72 de 37 93 b9 91 43 db a7 50 5d e3 27 2d d0 93 a5 38 83 16 f9 35 7b f3 3c 9c 28 95 54 59 18 a8 78 95 1a 94 94 43 57 18 ec 69 19 c7 30 66 7d 76 0d 89 f5 9f 38 69 38 89 Data Ascii: H PWTi-t#(jpH%sV(j7W8x0vx`wz$`mEz%P815.J.OCh2qm.SZw0^VwEG%~5q46OPuy(\|N*&r7CP]'-85{<(TYxCWi0f}v8i8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49837	216.180.236.138	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:35 UTC	354	OUT	GET /img/fftyc_1300x240.gif HTTP/1.1 Host: ig38.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	1093	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 1932 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb819ffdfedf7a7-LAX Content-Length: 497098 Content-Type: image/gif Date: Thu, 02 Jan 2025 04:45:46 GMT Etag: "6773daf0-795ca" Expires: Sat, 01 Feb 2025 04:13:34 GMT Last-Modified: Thu, 02 Jan 2025 12:43:42 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Mr828jtUE5ChoDkqNpYk%2FhQGewgbdBn1kGL3Dsn2TwmOkk%2BY0miBu5pTmj2wc1o2Rsy9fKwdUQ0i%2BKcB7epBU6FLpe3k3ZhgALdAOpZx4mAeRLXCASN3F10CM8M%2B0yvMTw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=748&min_rtt=620&rtt_var=59&sent=3851&recv=443&lost=0&retrans=60&sent_bytes=5225390&recv_bytes=37108&delivery_rate=462506142&cwnd=796&unsent_bytes=0&cid=22bfbaf7fd054ba2&ts=145354&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:36 UTC	93	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 00 00 ff dd 2b 17 04 03 fe f1 a0 32 5f ae da b4 54 ef a8 94 a1 ac 53 24 8c 55 d5 cc 51 fc ae 05 ab d5 a0 b3 89 2c d2 ad 35 d5 cc 6f 71 48 12 4f 97 55 68 28 01 24 90 cc e8 72 64 f8 93 07 9d d7 e0 b8 69 04 5f d8 a9 d0 27 2b 47 0d 00 5c a3 ce 32 cc Data Ascii: GIF89a+2_TS$UQ,5oqHOUh($rdi_'+G\2
2025-01-02 05:12:36 UTC	2372	IN	Data Raw: b9 93 67 29 4f 23 01 6b 95 52 90 4c 09 d4 71 0b f5 97 2f ba 23 27 25 b3 be 05 5e 1c 8b 4f 25 b6 b3 b0 92 92 8c f5 da c6 92 6a 46 8d b4 d8 6f 6f 71 d4 73 29 d6 89 0f 73 99 68 b9 bd 59 af 4f 0a 75 aa 6c 4d 4b 4f d6 4c 2c bd b2 86 91 6a 0f 6c ce ce cb 24 e8 52 94 67 fc 2f 24 fe f0 0c db cf 2f b2 2a 0c 91 2a 09 cf ee f4 f8 4a 2f ab 7c 4f 90 b8 86 76 33 21 70 b6 86 33 44 55 33 48 76 47 48 6b 8c 09 0a b5 8c 0e 90 77 65 53 91 05 6f 04 02 b9 b0 3f 4d 84 ba b4 4a 27 db af 0f 4b b8 bb b6 11 22 f9 70 34 f3 73 06 73 4f 3f b7 95 7a 27 7f bd 96 8a 36 d6 28 0d d7 ee ce 70 8b 8c d1 4c 0a 90 b7 b1 41 b1 6c 6e 8d b9 71 6b 46 0d 88 3d 0d b3 b9 f0 24 17 6f b4 bf af 0b 05 e6 28 54 32 32 4a be 51 47 51 69 7b f8 b2 cc 4a 71 3c 0e 89 bf d4 0e 09 cf db f2 f7 4b 07 bc 82 68 30 88 Data Ascii: g)O#kRLq/#'%^O%jFooqs)shYOulMKOL,jl$Rg/$/**J/\|Ov3!p3DU3HvGHkweSo?MJ'K"p4ssO?z'6(pLAlnqkF=$o(T22JQGQi{Jq<Kh0
2025-01-02 05:12:36 UTC	538	IN	Data Raw: a8 b8 ac 45 c0 06 20 7a 28 22 aa 75 a5 4a 8c 31 b1 18 ff 53 e2 60 3c 9a b0 a2 62 2f e6 2a 23 64 9c 55 86 a3 66 36 c2 60 42 61 40 78 66 ec 67 40 ba 80 1a 31 c4 c4 32 8a 2c 0d 6c 66 80 8e 8f 4d db 19 10 26 dc d6 6b 6e 9a e4 06 a5 8b bd c1 f0 9b 95 e3 96 9b c5 70 5c 7e 19 9d 97 0f 44 87 9c 97 07 dc 40 e6 75 f2 3e 00 a6 74 cc 4d e7 c5 be 21 5a 41 e7 bf 00 07 2c 70 42 76 ea 99 e7 45 08 cf e0 28 a4 0c 37 bc f0 c3 0e 47 2c 31 c4 14 4f 6c f1 c5 15 67 fc d4 0d 02 a4 73 e0 56 9c 64 74 e9 a5 5f c1 e2 00 5f c1 88 6a c5 a7 6c 91 da d6 12 74 55 f8 29 0a 56 d0 d5 6f 87 ae b4 e2 ca 59 b1 6c b2 8d 2d 84 69 92 8f ad 53 ea ea 62 8c 2d 60 bb eb 61 52 de 26 a5 09 fb 74 3b ec b4 c4 1a 3b 43 b2 42 2e a1 43 6b 84 55 0d 03 15 51 7f cb 19 93 4b 0a 7b d9 0c 54 32 16 ae 95 c4 9d db Data Ascii: E z("uJ1S`<b/*#dUf6`Ba@xfg@12,lfM&knp\~D@u>tM!ZA,pBvE(7G,1OlgsVdt__jltU)VoYl-iSb-`aR&t;;CB.CkUQK{T2
2025-01-02 05:12:36 UTC	4744	IN	Data Raw: dd 22 df b7 8a d5 99 1a 15 a6 04 bf 18 22 fa 04 80 00 40 2c 61 87 b2 61 de 12 87 85 c4 2e e6 26 1c 52 3c 9e fa 80 50 02 6e 94 40 7d 56 da 42 fb b8 11 c6 54 c4 ed 38 be 91 df dd 54 80 9c fb ed cf 39 78 c4 17 74 b4 e3 85 4d 91 c0 66 15 48 59 02 11 48 c8 41 1a b2 90 87 4c 24 22 17 39 1e 46 3a 52 91 90 7c a4 24 bf 73 15 06 5a 12 61 2d e0 a0 26 31 c8 c9 4d 7a b2 93 a0 fc a4 28 47 09 9f cf 51 4a 00 9c 28 cf 08 4f 65 97 14 96 6a 85 ab 8b 8b 0a 61 91 c2 b1 84 a5 66 9b 12 4b 87 f8 b2 3d 57 f8 32 42 ad d0 1d 8f 54 d4 02 62 e2 0a 88 42 2c 1e 16 7a 81 3e 6e a0 11 89 4d eb 96 f8 7a c5 45 2a 30 af 8d 53 14 52 8a 64 c3 a4 2c 6e cb 6c 52 9a 81 f1 ac 17 45 65 12 af 99 d3 c3 e6 32 c7 a9 3e 38 ba f3 6e 5c 62 d7 bd f6 a8 c7 e9 a0 ee 8f 1b c0 45 20 83 e1 ff 8e 49 46 d2 9f 8d Data Ascii: ""@,aa.&R<Pn@}VBT8T9xtMfHYHAL$"9F:R\|$sZa-&1Mz(GQJ(OejafK=W2BTbB,z>nMzE*0SRd,nlREe2>8n\bE IF
2025-01-02 05:12:36 UTC	5930	IN	Data Raw: 60 8c 91 8a 5e 7a 29 61 84 77 be 38 60 47 1d 7b 7c 67 04 20 1f c1 27 8d 34 72 f4 11 48 24 df 51 24 95 13 c2 89 31 46 13 34 d1 a4 05 07 1c 20 24 9c 59 7e 39 01 08 18 b6 e0 46 cb 54 d2 51 60 8b d6 78 dc 91 0b 2e 0a 51 e0 04 2d 67 f0 c2 8b 0e 64 9c d2 00 2d b9 29 61 4d 30 d9 0c 4a c7 03 14 a1 86 49 26 61 80 e4 9d 4f f2 cc 53 01 21 fa c4 ff 93 c9 29 3a 68 e1 51 47 21 95 34 52 4a b9 ea 80 2b 4b 2d 4d e3 52 47 37 d5 b4 03 38 3b f0 14 4e 2f ac 30 15 16 fc 70 09 c6 c0 64 68 70 60 83 87 76 8a d5 26 5a 53 91 4b 90 2e 6c c8 b5 8b 90 54 f0 55 8f 12 4a f0 55 05 2f b2 28 27 8b 61 55 50 29 d9 60 93 35 a1 9c 61 8b 55 49 8f 61 83 3d e3 5a 3d b2 c8 e4 a0 59 65 cd 29 21 83 ca d1 63 dc 18 54 30 69 dc 33 f4 08 84 9a 61 f5 78 16 d9 61 97 ad 56 d8 61 9f f5 82 5c 65 55 88 81 dc Data Ascii: `^z)aw8`G{\|g '4rH$Q$1F4 $Y~9FTQ`x.Q-gd-)aM0JI&aOS!):hQG!4RJ+K-MRG78;N/0pdhp`v&ZSK.lTUJU/('aUP)`5aUIa=Z=Ye)!cT0i3axaVa\eU
2025-01-02 05:12:36 UTC	7116	IN	Data Raw: 15 0c fb a5 98 22 89 54 9c 2d 96 50 24 24 49 05 15 c1 3a a7 40 cb 96 ff 26 44 87 c7 7b 12 8e f2 28 0c 36 c7 0f d1 57 a3 bd 3f e9 a4 de 19 0c ca 8d 5e ba da 82 1d 85 62 0f 37 61 a1 9c 1b 81 b5 2f d8 06 68 39 54 ff bd f0 2d 4a 65 1d ae 04 90 af 45 88 e2 19 39 c2 43 93 74 31 8c 21 2d 70 18 54 c2 92 90 9a f4 24 7a 40 89 18 ca e0 11 2c ac 40 03 3c 6c c0 0a b0 08 92 94 94 11 a6 31 dd 82 17 4d da c4 26 b6 81 80 34 a9 c9 00 0e 20 cb 2f 9a b2 28 3c 8d 60 86 1d b8 01 b0 62 85 ac 18 ee b0 87 b3 80 14 35 0e 95 86 65 11 6a 52 30 02 c2 0d 6e 75 02 20 bc 03 87 74 ca 0b a9 68 f5 00 52 31 31 26 40 88 a1 09 a6 a0 89 7c c0 ea 58 dc 78 40 af d2 80 aa 4c e1 8a 87 25 98 21 24 80 25 2c 64 f1 6a 26 3e 9c 19 0f 51 90 8f 2d d2 d1 5a d0 9a 23 1e ef d8 82 7c f0 91 5b 7e ec a3 b6 02 Data Ascii: "T-P$$I:@&D{(6W?^b7a/h9T-JeE9Ct1!-pT$z@,@<l1M&4 /(<`b5ejR0nu thR11&@\|Xx@L%!$%,dj&>Q-Z#\|[~
2025-01-02 05:12:36 UTC	8302	IN	Data Raw: c2 29 ce 4e ed b8 c2 e8 66 26 0d 20 ac c1 b8 01 ef 2a 22 60 c2 e1 21 2e a9 05 16 8c 95 90 20 42 28 66 06 90 00 09 3a 00 09 4c 60 c4 32 b1 10 09 21 2a 5a a3 22 f6 4e 2d 42 6c ec c8 2e 11 21 f1 e9 00 2f 2d 68 4c 16 5d 2c 91 8a a6 01 a2 a3 01 a0 66 f8 7a f1 f8 f0 a2 6e a8 81 6a 14 83 31 b2 06 51 ee 8f d3 22 c3 6e e0 26 0b 8a b1 6d 02 60 f4 36 6a 6d da e6 6d 18 23 6e ff 94 c3 17 3f ca 36 36 4f 37 9c 31 34 82 c3 1a 7d cf 6d 4e a5 cf b2 d1 1c 8d ef 1c f7 82 71 7e eb 09 a3 d0 34 16 8d 4b 18 8d d2 50 c0 34 e6 4d 00 ec 51 9b 9e af 05 31 c0 46 34 04 fb ee e9 1e f7 42 fb 4e 03 1f 4f e3 05 01 d2 3d c8 ea 49 28 24 08 80 ea d6 e8 d1 3d 3e 8a da ca cf 1e ed 71 06 94 00 b2 6a 47 9b b4 a9 22 09 d2 2f 42 a4 20 03 12 ad 08 60 06 78 4d d7 90 d0 fa 02 50 24 57 32 22 5b b2 1e Data Ascii: )Nf& "`!. B(f:L`2!Z"N-Bl.!/-hL],fznj1Q"n&m`6jmm#n?66O714}mNq~4KP4MQ1F4BNO=I($=>qjG"/B `xMP$W2"[
2025-01-02 05:12:36 UTC	3673	IN	Data Raw: ff 00 81 29 d3 2f 81 02 07 16 34 28 ff 2f 5b aa 85 0a 05 8c 1a d5 49 e2 44 8a 15 4f 55 dc 44 4a c0 ac 4b 99 b8 61 29 a8 8e c2 c8 14 14 d8 94 30 b1 25 90 09 6a 98 4c 04 42 59 02 53 89 40 5b 4c c8 a4 79 93 25 b7 97 40 58 ea 8b 79 73 a6 89 94 26 f4 29 cc 26 48 50 36 7f 9c 1e 6e b2 18 55 ea 54 8a 0f 65 09 f0 73 40 eb 56 ae 5d bd 7e ed 3a e3 d5 b4 39 1c cc 42 d8 40 b5 d3 06 b3 18 da 22 83 2a 55 59 5b b7 c5 4e 90 3a 41 a0 2d 07 0f 6a 3b 79 70 ab 36 88 d9 8b 51 19 b8 45 0c e1 6c 10 12 c1 16 08 63 40 40 b2 32 64 c2 36 0c 76 ab 38 b1 db 5d 53 51 ed 55 16 b7 f0 44 12 66 51 61 5c cb c1 6f 27 cc 1c 30 cc 98 55 1a 31 81 d5 a8 6d df c6 2d 91 81 6b 0c 53 4b 9f 16 5d 5b ae 5b da a8 35 bb 9e 36 4b c0 8d ae 94 c0 3e d7 aa 71 5a 66 b3 2d 0f 12 bc 9e 5d 3b f6 ed dd bd 73 6f Data Ascii: )/4(/[IDOUDJKa)0%jLBYS@[Ly%@Xys&)&HP6nUTes@V]~:9B@"*UY[N:A-j;yp6QElc@@2d6v8]SQUDfQa\o'0U1m-kSK][[56K>qZf-];so
2025-01-02 05:12:36 UTC	10674	IN	Data Raw: 2e ad d5 08 55 ec 0c 9c 8d c6 60 e4 85 5d 70 24 6e d0 4f b8 2d c5 4b 2c bb 1f c8 44 31 d1 db b6 35 3d b2 9b 86 b8 95 50 16 a5 5b d3 4b 17 17 82 51 4c d9 48 9c e1 c9 c9 2b 1d 7a 89 81 32 88 81 21 20 84 12 a0 80 3e 00 dd 3e a0 00 6b 88 b1 df 9a dc d3 4d d3 35 cd 49 7b 7c c4 7f 69 91 d7 d5 03 74 cc dc 9b 90 5d 87 14 99 21 c8 dc 18 28 01 15 c0 5d 74 24 0a cd 1d 02 87 0c 87 28 90 80 28 30 de 13 90 10 80 79 0a d5 ad dc e6 9d 5c 2d 8b d9 03 30 be 65 98 bf 6b 38 55 40 55 85 47 05 d5 b2 54 4a 3a c5 de ed 55 85 4b 23 9c 62 38 c1 20 f8 5e 3b ff c5 de 3b 13 d6 93 c4 be eb c5 06 71 b8 d4 f5 01 df eb 3d 49 40 35 33 58 98 df 44 c5 06 58 7d df 53 bd b3 61 a8 df 00 a6 d4 fc 3d c9 23 30 d7 03 d6 d5 04 be d5 a1 9c 5f 04 76 e0 04 0e e0 50 8d e0 f3 a5 df 5c 98 60 46 f5 00 b0 Data Ascii: .U`]p$nO-K,D15=P[KQLH+z2! >>kM5I{\|it]!(]t$((0y\-0ek8U@UGTJ:UK#b8 ^;;q=I@53XDX}Sa=#0_vP\`F
2025-01-02 05:12:36 UTC	11860	IN	Data Raw: a0 ff a2 9e d8 90 14 f6 a9 14 3b 54 3e 0e ee ad 56 33 10 fd 60 16 38 61 e7 5c 55 3d 95 30 39 71 44 a0 60 80 05 d1 a2 bd 74 13 d4 80 ea 05 d7 73 63 39 36 d4 80 aa 2d 1a 76 0a d9 42 3b d1 70 2d 52 d2 61 db 93 8c 60 ad 4d d7 93 73 a6 80 0a 08 60 06 62 36 66 8b 61 06 64 76 06 e8 86 04 36 b6 3a 39 16 3b f1 02 3d 7f 53 3f 99 90 63 f1 03 db 3a f6 68 91 d6 06 97 ca 68 b1 67 3e eb d3 40 97 f4 01 a4 96 ab 6c ae 2d 02 01 43 b1 b6 3f 73 71 7c ba cb 05 78 e7 e0 5c a0 bb 1c 2e 3f b2 b6 6c d5 e1 3f 71 f4 2d 6a a5 69 67 8e 49 05 f1 15 ec c2 6c c7 29 17 49 a0 56 bc f6 60 ef 33 8a 2e 14 6b 8b b4 56 aa 96 6c e5 76 45 f5 c1 e9 1a 2b 12 3f ae b5 2e b1 46 55 d4 41 bd 6e a8 08 20 15 6d d1 46 17 77 6b c1 0e 43 71 14 05 ce 16 43 19 d6 e7 ee d3 60 a1 b6 73 f9 49 6a d9 51 77 14 6e Data Ascii: ;T>V3`8a\U=09qD`tsc96-vB;p-Ra`Ms`b6fadv6:9;=S?c:hhg>@l-C?sq\|x\.?l?q-jigIl)IV`3.kVlvE+?.FUAn mFwkCqC`sIjQwn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49835	36.42.77.151	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	592	OUT	GET /jsgif/ny.js HTTP/1.1 Host: 2024hwus1.heibanwa.mobi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:37 UTC	571	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: application/javascript Content-Length: 1186304 Connection: close Server: openresty Last-Modified: Fri, 08 Nov 2024 08:31:26 GMT ETag: "121a00-6266293ae6576" via: CHN-SNxian-AREACT2-CACHE77[5],CHN-SNxian-AREACT2-CACHE67[0,TCP_HIT,2],CHN-HElangfang-GLOBAL6-CACHE102[3],CHN-HElangfang-GLOBAL6-CACHE43[0,TCP_HIT,2] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: f83f1f5473b3c950b69a0cac22833260 nginx-hit: 1 Age: 2147825 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:37 UTC	15813	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 b8 97 8f d2 aa 97 fe 49 06 ff fd b2 d3 44 d6 fe d0 8d 9d 2d 22 ff f9 94 dd 22 fe ff b2 ff b5 33 da 94 22 ce 53 6b 96 ff ff 11 ac 89 79 ff 6e ff f7 bb b1 d7 44 ee ff 92 ff 22 a5 d8 ff 8b 68 55 2b 1e 92 30 93 12 29 55 dd cc b8 b4 b8 d2 70 10 b7 ba db f3 d7 dd ef ad 62 e3 ff 77 67 91 73 6d f7 b8 90 b7 cc d8 ff ff 28 cf 97 93 a7 2d 50 90 8d 91 f7 54 b3 72 0d da 2a 0c 2a ff ff 4d 71 22 6f ff fe 6e cd bb d1 db 27 64 90 11 fd fd b1 78 b1 95 d4 74 24 b7 4b 11 4b d3 92 6d b2 24 ff 55 00 aa ac 33 ac 2b 25 2a 6f 6d 71 32 11 10 ab 76 6d fc d8 00 8c 95 aa b4 93 af ff 2b 01 10 01 09 70 53 4c ae 11 ff 4d 48 4d 95 66 57 b7 aa 97 68 43 30 88 22 bb 52 25 51 ff 88 00 fa d8 6e db 2f 9c bb 44 bb ff 66 5a fe 09 01 fb b6 4a 2e 43 6c 8f 48 Data Ascii: GIF89aID-""3"SkynD"hU+0)Upbwgsm(-PTr*Mq"on'dxt$KKm$U3+%omq2vm+pSLMHMfWhC0"R%Qn/DfZJ.ClH
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: be 48 91 d0 88 8e 9c a6 2c 70 80 10 14 43 3f c4 43 8e 60 10 05 69 dc 67 8a e1 05 55 90 04 79 89 30 b0 d0 91 f8 8a 0d fc 9c 9c 14 91 9d d8 c9 d0 15 84 2d ec 01 9f 0c 22 14 bd d7 12 4c d1 34 d4 e2 0f 12 c4 2c 30 4a 2d 62 a7 0e 06 80 b2 78 27 41 88 e7 78 d2 5d 8d 8d a7 73 16 04 19 30 1e e3 6d 22 79 fe e0 08 fc 51 32 06 12 7d ce a7 7d d6 a7 2f 04 80 19 04 c0 7b ca 42 7a 44 92 78 fa e7 2e 8a 62 76 a2 27 41 78 98 90 c9 51 77 a6 67 3f 1c 0a 1c 90 8a 2f 30 68 81 f6 03 31 fe ca 83 86 92 27 1a 68 3f a0 a2 28 71 d8 7b 26 e8 2e aa 07 2d 4a a8 2d fc a2 af 4c dd 7b a6 28 89 ae a8 86 aa a8 86 56 a8 af 30 de 84 62 27 a9 b0 92 8b ce 28 8b e2 68 8b e6 28 76 ba 09 0b ec a8 81 a6 07 1c b4 81 0a c0 41 91 aa 00 91 c2 01 90 9e ff c3 91 1a 69 92 aa 00 15 88 a2 0e 92 67 00 84 41 Data Ascii: H,pC?C`igUy0-"L4,0J-bx'Ax]s0m"yQ2}}/{BzDx.bv'AxQwg?/0h1'h?(q{&.-J-L{(V0b'(h(vAigA
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 26 8c 42 59 f2 02 2f 20 96 2f 3c 08 6b b0 42 82 38 36 86 7a 19 82 00 19 9a 59 88 30 4c 88 2f 54 19 9b 49 88 88 b2 99 2a 4c a8 5b 13 19 8f 19 08 8a aa c3 8a 28 0c 39 94 c3 0c 95 36 18 e8 87 2b 50 05 92 fa 02 3e dc 04 2d 28 c2 72 d8 06 44 58 83 64 19 8a 99 a2 a9 29 c8 9a 92 c8 84 4c b0 00 af b1 03 3b 38 03 3b b8 50 a8 a0 02 0e 8d 43 0e cd 50 7e b3 c6 50 1c ab c5 30 9c 34 90 1d 24 2d c5 e5 40 45 b8 81 8c 51 70 8b d0 21 0d b6 88 45 b5 90 06 5a 2c 45 c3 21 d2 5b ec 38 5d b4 c6 eb f9 38 be d9 2a c7 c9 ab 80 13 8b be 62 b8 10 58 0d d9 11 0b 6e 68 06 63 c4 ab d2 b9 b9 27 78 9e b7 a8 2a 1e a8 b9 d7 79 88 b0 d0 0d 3d 29 0e e2 f0 d3 5c 50 1d 6d f8 d3 42 f5 d3 d9 08 01 d5 89 87 bb 51 9d 12 18 84 be ea 07 61 28 0e 48 ff a5 8c 41 10 1e d3 b8 00 3d ad 11 c2 6b 4a 82 4c Data Ascii: &BY/ /<kB86zY0L/TIL[(96+P>-(rDXd)L;8;PCP~P04$-@EQp!EZ,E![8]8bXnhc'x*y=)\PmBQa(HA=kJL
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 8f f3 f8 8d 33 a6 30 87 57 30 7a 70 7b b7 c7 7b ff 28 90 4e f7 2d f3 19 8a 24 21 8a 6a 86 4e e8 94 90 22 71 93 61 c1 17 d6 57 93 9f 66 01 e2 57 7d 7a 53 7f 28 65 00 2e 89 1b 3c 29 92 27 55 95 1e b9 6a 5a aa a5 50 e3 50 6b fa a6 70 1a a7 5a 6a 01 24 20 7e a9 e3 a6 72 9a a7 3d 69 67 34 49 69 ea 07 51 24 45 02 21 a1 16 60 7a 17 7d d6 06 90 d1 50 78 a1 14 31 30 38 23 06 07 6d f0 95 04 e3 80 5c b9 95 63 10 96 98 3a 06 9a fa 05 5f d0 08 97 80 09 65 f9 18 c4 13 1e 57 80 81 51 45 0a 54 25 1f 6f 19 97 54 82 26 d3 73 20 37 d0 9b 31 f4 9b 42 f0 01 25 f0 23 db 93 05 53 90 05 23 10 3f 17 52 21 ee 13 ac df 80 21 77 d5 03 c5 60 ac 0e c0 98 ab 35 08 42 20 1f 6f f0 22 ef 76 07 8f 89 99 9a e9 08 09 84 0b 18 b2 23 3c b2 3e ff 9c 65 59 44 a0 57 41 62 6f 18 94 44 49 84 0c 4f Data Ascii: 30W0zp{{(N-$!jN"qaWfW}zS(e.<)'UjZPPkpZj$ ~r=ig4IiQ$E!`z}Px108#m\c:_eWQET%oT&s 71B%#S#?R!!w`5B o"v#<>eYDWAboDIO
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 80 54 ee 64 10 b2 8b 19 5f e1 1a 86 81 91 f6 a5 84 6e 6f c4 94 81 08 7a c0 51 10 e9 52 d6 eb 19 9e 68 20 e1 0e be 2a 80 ba e8 04 55 82 91 55 e0 92 55 80 91 01 00 72 03 42 40 1a 84 81 16 72 25 1d 98 65 03 84 41 8f a4 a1 55 f7 b1 19 9e 41 c2 56 f5 1d bf 31 04 78 20 54 72 60 1c 7f 80 07 36 60 21 01 a0 1e c8 2e f5 12 29 51 62 41 19 00 65 94 46 6f 5e 72 ec 5d 70 6c 59 31 09 1c 70 cc f4 de 25 f4 06 45 f6 4a f2 c7 4e a9 5a 00 26 f7 58 12 96 80 8f 61 82 6f c9 68 f2 c9 0c c0 50 73 12 98 86 00 0b f4 e0 27 47 c6 64 a0 0f 65 08 e0 05 9a d3 29 8f 32 29 3e ed 29 fb 21 60 9f 12 16 94 b2 60 fb 95 d6 12 56 60 93 72 60 fb d5 16 be 12 2e 3f 60 61 27 b6 61 0f d6 62 fd 15 63 01 96 61 37 f6 62 11 b6 1f b4 cf 2b 73 80 60 0d 36 ff 63 ff 95 62 39 96 64 3d b6 64 1b 16 fc 5a d6 65 Data Ascii: Td_nozQRh *UUUrB@r%eAUAV1x Tr`6`!.)QbAeFo^r]plY1p%EJNZ&XaohPs'Gde)2)>)!``V`r`.?`a'abca7b+s`6cb9d=dZe
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 71 55 26 ee c9 21 a0 01 12 d0 23 66 ed 43 15 94 d5 a3 84 41 0b b8 81 1b 70 eb b7 7a 6b b7 82 eb 59 3d 93 98 18 81 32 cd 8c cd 38 53 5c 79 e4 d3 45 5d 0c 14 6b bf 10 15 48 16 4d 49 1a cd 60 a9 64 bd 7a 5d d9 69 00 d8 99 9d 4c 0a c0 26 cc 9d c3 20 41 13 84 cc cf 9d 02 09 f0 24 bd 08 40 20 58 c0 c2 de ea 25 b4 1d 66 6d 82 21 dc dd 2a c0 40 23 90 c2 14 f4 c0 15 94 c0 14 a8 16 37 14 1e 0f 70 c3 46 c0 96 e1 c4 d6 e2 40 40 32 b8 42 56 e2 16 e4 bd c2 01 66 01 00 8c c0 c9 82 43 2c 64 8e e6 e4 c4 e7 65 c0 2c 38 c0 57 16 81 5c b6 5e 33 c0 42 33 ac cf d1 02 d8 7f 09 83 39 7c 0e 4a 08 c5 d3 16 45 3a 60 00 3d 2c e6 78 ad 84 34 44 66 4d 8c d7 f1 dd 04 d3 86 4f f8 5c cf 7d 35 df 4e f8 c4 06 48 43 5e 52 cf 50 30 ed 66 02 ff 45 7f 61 1f d3 02 98 34 e4 42 34 d0 82 2e 8c 03 Data Ascii: qU&!#fCApzkY=28S\yE]kHMI`dz]iL& A$@ X%fm!*@#7pF@@2BVfC,de,8W\^3B39\|JE:`=,x4DfMO\}5NHC^RP0fEa4B4.
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: fb 12 3f 59 b2 0f fc b0 22 ca c4 a2 ff 68 31 02 31 90 04 91 bf 03 19 a3 19 b3 3f 94 25 4d 95 3d cd 0a 60 05 ff fb b1 00 34 00 21 13 c0 13 21 03 2f 58 91 d7 94 91 16 49 c0 d9 a4 81 28 f0 03 42 2a a4 30 c8 4d 68 58 ce df 34 83 41 43 5a df 54 5a 0f 50 5a a7 cd b3 a7 3d 5a a8 05 c2 a8 ad da a9 6d da ab b5 5a ac dd 5a e2 64 5a ae bd da 22 f4 5a b0 15 5b b0 fd 41 b2 65 ce b2 8d ce e1 b4 4e df 94 ce e7 cc 34 0a b0 82 75 58 86 2a 24 01 bb f5 03 6a 20 00 6a 40 00 49 c8 c2 37 d0 86 6c 5a cf f6 1c 5c 60 81 84 29 40 43 19 18 83 73 4a 27 fb 7c d2 51 54 03 34 70 03 37 68 01 37 40 83 4b 98 dc 4b 40 03 ca d5 dc cb 6d 81 cc f5 03 c9 a5 dc c9 95 5c 12 90 dc d0 ad 5c 37 50 83 a0 b2 18 01 f0 03 c4 02 c4 c8 59 44 78 99 97 be ff 6a 28 09 fd 46 26 08 07 8d ba 18 7e 1b 53 aa f2 Data Ascii: ?Y"h11?%M=`4!!/XI(B0MhX4ACZTZPZ=ZmZZdZ"Z[AeN4uX$j j@I7lZ\`)@CsJ'\|QT4p7h7@KK@m\\7PYDxj(F&~S
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 31 4c f9 8f 94 d6 14 2c a9 a4 0b 2d 3a 78 d3 58 9a 84 33 4d 29 46 09 8e 14 8b 9b 82 45 16 10 7d 88 10 48 ca d3 94 ee b2 20 b8 f0 63 4a 6d 21 ca bd 09 30 97 ff 90 c5 21 db 28 10 6f c5 04 4c 8b 09 dc 9a 00 50 ac 58 24 23 16 da f8 87 2d 6c d1 0c b3 34 a3 1e cd 34 10 75 72 d8 94 1e 69 67 0a 10 c2 c7 0f b3 52 a7 af 3c 83 3c ff a8 d3 68 08 f6 cd c2 a2 a7 21 63 60 54 0c d2 f9 0f 23 48 8d 2c 0c d3 94 86 96 b7 4e 05 d4 d3 6a 65 1b de 19 f5 d9 b0 7d 6e f5 23 35 f1 67 05 fe 11 07 3a d2 d1 04 71 3c 83 09 e6 40 da b3 a8 a0 2e 1b 74 9f 6c df 57 55 86 ff a0 f4 7d ee 03 a4 41 ea 31 db d9 f6 63 37 e1 c9 a5 6f 13 12 dc 9a 0a 70 a3 2b 79 a4 47 99 2a 0b bd e0 f2 a6 29 75 1f 06 4b 14 db b0 d8 f4 1f 4f 95 4b 00 db 27 16 58 a4 a1 20 42 c0 9b 78 a3 22 54 f2 8e b7 04 42 25 6a 2c Data Ascii: 1L,-:xX3M)FE}H cJm!0!(oLPX$#-l44urigR<<h!c`T#H,Nje}n#5g:q<@.tlWU}A1c7op+yG*)uKOK'X Bx"TB%j,
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: a3 9b a4 32 2d 80 bc f4 79 a6 9c b1 c3 c8 5f 93 49 0a f6 71 33 36 17 49 d5 ec 6a 73 95 6a 06 e7 33 65 30 40 65 63 79 1b c8 c0 46 9e c3 c4 48 fb e0 89 59 ca e8 83 b3 a1 ea 25 72 30 9b 21 be 98 40 30 a9 ed 2c 75 30 2b 1c 64 86 b3 b4 db d4 2d 63 b5 19 a0 d3 b5 cf 41 d7 e4 66 6f 73 fb 57 e3 2e 13 b3 d8 e1 2d 86 04 84 ce 6e 02 f0 42 57 c9 42 6d 39 54 d8 94 59 20 98 0f f0 8c 02 f3 10 9f 7a 36 64 92 cd a4 4c 11 f6 69 a2 12 09 e1 9f ff 14 a8 8b 4a 70 83 84 a2 25 07 46 ab d1 08 19 1a d1 85 70 01 07 0a 71 c9 07 70 30 04 8d 72 63 21 00 68 48 0f 92 ff a8 c3 27 19 84 05 e8 f8 07 06 5c 31 0c 96 36 04 a6 32 95 b0 d8 b6 34 11 a5 e2 29 22 30 80 c3 42 8a 6a 90 a1 76 b8 0d 31 08 f1 3f ca 20 15 b6 d9 c9 4e 12 91 6d df 1a 39 e1 85 d0 31 54 4f 99 6a 44 30 37 57 46 29 44 1b c2 Data Ascii: 2-y_Iq36Ijsj3e0@ecyFHY%r0!@0,u0+d-cAfosW.-nBWBm9TY z6dLiJp%Fpqp0rc!hH'\1624)"0Bjv1? Nm91TOjD07WF)D
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 41 b7 49 46 4a d2 91 54 41 8a 21 61 37 bb bc e1 84 26 71 83 04 12 54 0c 63 8a f4 4d 23 ba 0b c9 f3 3e f2 3c 08 2a 19 80 ba 80 ca 36 4a 0c be f6 e9 8e 00 90 60 df fb e2 f7 bd d3 39 4f 7d f1 eb df 7f f4 e1 1f bc 48 8f 7e be e3 b3 9f 15 78 95 b3 9c 25 2d 95 eb 5d a5 31 ed 69 13 02 66 7b 0a 64 4c 0c 21 f3 98 c7 64 5b 19 fc d0 61 3f 78 18 c4 22 1e 31 1f 42 07 4d 11 5f 02 c5 23 5e 31 8b 45 4c 02 10 bf d8 0f 2f 3e 45 db e0 c6 a2 e2 b4 08 c7 c5 d1 66 87 98 01 81 d6 95 12 ae 25 d2 67 46 14 86 b0 3e f1 29 61 0d fb c7 3a 4c 04 0c 01 2c 69 48 d2 75 ff e7 74 9d c4 89 2b 63 39 cb 5a de 32 27 2a 80 65 7d 3c 73 44 cc 60 c2 3f ae ec e5 2e 9b b9 cb ac 10 62 97 bd cc 66 37 93 69 73 15 f0 80 de 3a f4 0f c6 b0 c2 4a 61 ee 10 34 f4 21 44 56 4c b4 ce b2 f0 00 26 00 75 90 12 2c Data Ascii: AIFJTA!a7&qTcM#><6J`9O}H~x%-]1if{dL!d[a?x"1BM_#^1EL/>Ef%gF>)a:L,iHut+c9Z2'e}<sD`?.bf7is:Ja4!DVL&u,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49841	172.67.148.80	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	374	OUT	GET /318d22cf923239b38dec8c9337224fb4.gif HTTP/1.1 Host: go.imgmimi.xyz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	946	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 04 Mar 2024 13:40:35 GMT Vary: Accept-Encoding ETag: W/"65e5cf53-61f75" Expires: Tue, 28 Jan 2025 13:32:42 GMT Cache-Control: max-age=2592000 CF-Cache-Status: HIT Age: 315594 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0NFd3zzaCv69yDP3T7TrWYclgwDg33OOhnTMDQujVyJkgbEvpaojhzZ0iyz5vRblqvpgln2%2FCEsP5qUa8LXXUhB77UT6l2QTGlCMc8x1zEa7WUVHZIvcdFjfBB8tUJgeSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb8414d5fdf4302-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1556&min_rtt=1546&rtt_var=599&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2824&recv_bytes=952&delivery_rate=1795817&cwnd=252&unsent_bytes=0&cid=1c2cdeedb32d597b&ts=739&x=0"
2025-01-02 05:12:36 UTC	423	IN	Data Raw: 37 63 62 64 0d 0a 47 49 46 38 39 61 14 05 c8 00 e6 00 00 5f a7 f3 b2 a4 98 01 91 f0 f0 db d0 fc 59 16 fb db 64 dc cc b7 ea 20 e0 fc f1 d4 ed 60 5a f7 9c 0e 01 71 ef da d8 cf f5 d3 b7 e4 5d eb 8f b5 ed 67 59 54 e6 a3 f4 fe fe 04 b9 ef f8 00 51 dd 91 6d 57 fa 01 00 aa 8e 71 d3 b6 96 d4 b9 b0 1d 10 0b b2 d7 fa d9 00 00 d5 da f6 05 4b 9c 13 9f 03 1c 04 46 b4 04 04 fc d6 8c 93 d0 fb 01 66 dd aa 5a 1f fd f6 b4 72 fa 52 46 2a 20 63 d6 fd 62 45 32 ae dc a0 fb b7 6d f8 b5 b5 fb b9 43 f4 d7 f6 8d fb 6b 5d 69 8d 2a 90 f6 f9 26 03 f9 92 91 fc b4 91 ff fc 86 fa 29 28 06 af f8 00 88 da 77 92 ad 33 af fc fe 84 44 db f0 d8 45 25 55 01 51 f0 da 91 90 fd 93 6d 29 cb 0c bc c9 d4 d4 b1 70 d6 2b 28 c3 2a f3 27 73 ef 61 b4 55 1d d0 ff 8a 78 8b 27 6f d7 e9 72 84 52 7c db 50 e0 Data Ascii: 7cbdGIF89a_Yd `Zq]gYTQmWqKFfZrRF* cbE2mCk]i&)(w3DE%UQm)p+('saUx'orR\|P
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 39 63 63 63 34 64 65 39 33 2c 20 32 30 32 32 2f 30 33 2f 31 34 2d 31 34 3a 30 37 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 Data Ascii: XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.9ccc4de93, 2022/03/14-14:07:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Desc
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 09 73 6d 4c 79 72 e5 92 53 b6 6a b6 5c 53 32 e7 c8 97 9d 55 1d 4d 3a 5d bb cd 9f 53 ab 9e 17 c0 6d dc b6 6b 0b f2 6b ab 10 2d c3 da 59 d2 52 41 01 f7 f5 6e 14 01 f6 e6 b5 3b bc 38 63 e1 c6 93 43 f6 cc 7c b9 f3 e7 d0 43 4b 9f de 39 ba f5 eb ab a9 6b cf 0e 1a b5 77 ee df 9b 77 17 bf 12 6a e9 f3 e8 c3 ab 07 bf da a0 6f d7 70 17 e2 96 6f fb f6 42 de 72 df f7 f6 97 61 bd 45 e4 e4 29 27 60 75 d8 15 18 e0 76 04 22 58 60 66 fe 29 c8 5e 82 10 46 28 a1 83 13 1a a8 0b 83 0d 1e 67 e1 83 14 8e e7 21 87 03 02 63 47 88 1a b6 34 04 7a 28 8e 56 06 88 2c b6 a8 0a 6e fb c9 76 56 05 17 d4 68 23 8d 38 d6 27 a3 6b 3c ea 18 57 70 1b 92 28 64 85 00 fe 67 64 87 07 06 49 e4 ff 92 4a 22 f5 61 93 19 32 09 a5 94 53 22 69 e5 95 2e 66 19 65 92 b2 8c f8 24 95 08 9e a8 e2 54 65 90 19 55 Data Ascii: smLyrSj\S2UM:]Smkk-YRAn;8cC\|CK9kwwjopoBraE)'`uv"X`f)^F(g!cG4z(V,nvVh#8'k<Wp(dgdIJ"a2S"i.fe$TeU
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 8b 24 74 be 93 ad 29 05 87 f2 e0 2a aa 8f ce 35 2b 6e 8a 11 5e 27 48 5c bd d2 54 65 7d e5 17 11 6e 55 57 0c 22 c0 b5 85 85 dd 45 7b 3a 05 2e 2e 36 a1 8f cd 2e 64 1f 60 5d a1 92 81 01 94 05 ed 68 45 bb 59 02 98 97 b3 e5 45 6f 7a d5 4b de f1 8e 36 5e d0 5d 10 6d e3 cb d1 fa d2 d7 be b0 fd 6d 7e 59 6b 0b 3c 5e 0e b7 bb f5 61 80 01 1c d7 b3 de 37 1e b1 b2 67 ad f2 3a d8 bd 2e 31 91 75 b2 d9 ff ea 18 92 44 0c 04 d7 7c 80 3c 8c 6a cd 1a 24 a0 5e 77 a1 8d 05 f1 76 15 fb 58 85 de 0a a9 ec 5d ef 79 55 bc e2 16 b3 d8 b3 2f a6 ea 81 57 1b 5d fc d2 f8 c6 61 6d e3 7e 6d ac 5f 03 ef 38 c7 4d b2 2d 39 f4 c8 ce 22 23 e2 b6 10 85 9e 19 63 eb db 03 1a a0 02 76 2d 64 f6 18 6c 5c 08 d7 28 c1 39 c5 d9 95 bb 20 05 b1 f1 32 b5 f3 05 f2 2e b8 3b 01 0f 9b 59 c4 43 6d a8 64 6b 61 Data Ascii: $t)*5+n^'H\Te}nUW"E{:..6.d`]hEYEozK6^]mm~Yk<^a7g:.1uD\|<j$^wvX]yU/W]am~m_8M-9"#cv-dl\(9 2.;YCmdka
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: a2 e6 96 9a e6 6e 32 d5 84 6d d3 8e 03 81 6a 35 10 3a e3 c8 1b 40 e2 1d 1a d9 7d c3 56 91 7d b8 59 18 a9 8f 8a b9 72 88 55 ff 80 86 77 37 00 50 90 04 49 7d 43 d0 7c 70 98 70 0c d5 05 f7 58 02 ad 44 91 65 67 98 5a e9 31 9e 09 91 cb 72 92 5f 79 88 61 b9 28 a6 79 9a a8 49 13 ab c9 9a b0 09 93 85 a8 92 b1 59 9b b1 89 09 b6 99 9b b6 49 0c 23 a9 9b 31 59 75 a9 29 09 29 60 8a 92 18 9c cd d0 9b ac a9 93 8a b0 92 b0 a9 25 f5 88 95 d0 79 94 a1 a9 1e 56 b9 8c d1 09 95 49 49 9a a8 d1 7b d6 79 9d 4f e9 8b 30 81 9c b2 e9 9b e3 49 9e e6 29 8b de 60 84 2a 42 24 ea e9 00 8b a9 96 ea 71 69 3a 10 97 ea 48 9f f4 66 2b 58 f8 3d 38 f2 96 b4 77 8e f8 51 02 b1 92 10 25 30 7e 0d 40 04 37 a3 04 c5 82 8b 14 a7 00 0a 20 86 9e e9 99 d3 99 61 c3 37 6b 09 29 4d 11 12 99 70 b8 7e 7a 40 Data Ascii: n2mj5:@}V}YrUw7PI}C\|ppXDegZ1r_ya(yIYI#1Yu))`%yVII{yO0I)`*B$qi:Hf+X=8wQ%0~@7 a7k)Mp~z@
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 5a 5c 57 65 6a fc 50 c7 39 53 03 7f 45 b8 45 f1 9c 2f b6 99 23 3c 73 0f 48 c9 73 0b 0c 95 6a 81 b5 ba 92 3a a9 cd 9e ea cd 49 70 ba ab 4b ca 24 fc 7d a8 dc 3a 09 80 b2 b0 bb c2 78 18 8e 5a a5 c3 ba 2b 07 37 fc ca b1 68 ac ae 70 c3 93 d7 76 41 3c 07 2a 3d 9b 33 3d 6b c4 b9 b4 af 1a 9b be 7c d3 42 2b a4 5d ec cb 2d 2d 03 21 09 d4 2e 3d 9b 25 92 c2 d6 0c 95 0d ad 0d a0 dc d4 d7 f9 c4 af 10 06 52 1d 9d ce 18 d1 16 8c 0d 4a c6 32 63 9c c6 9f ec a6 e5 6c ce dd 72 2b 88 ea c6 6d 7c d6 11 0c c7 93 5a 12 7e 4b 11 fe 19 2c f8 0b c0 7b 6a c7 4e d8 ae 51 15 6f bd 04 05 73 22 b0 76 05 16 74 83 bd 0d ac c8 c9 08 04 a9 ab d5 94 8a ff c1 81 77 a1 8a 68 14 1d bc c9 38 d8 04 8f 1a bb a3 1a 91 c3 a8 ca 23 5d d2 a8 9c b2 d2 2c b7 8e c2 c5 cd 39 08 45 9d d4 35 ec 83 c5 ab c4 Data Ascii: Z\WejP9SEE/#<sHsj:IpK$}:xZ+7hpvA<*=3=k\|B+]--!.=%RJ2clr+m\|Z~K,{jNQos"vtwh8#],9E5
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 33 8c 01 9b 38 5b 0c 65 0a 93 c6 8b 9a 2a 13 50 ed 59 75 1d d6 82 5f c3 8a 05 09 76 65 d2 b3 68 9b 99 4d ab 2c 82 83 03 70 e3 1a 81 1b 01 ec db ba 8b dc ce 95 0b d7 01 de 45 6f f9 f2 fd 8b b4 c3 5a b2 67 31 74 51 e0 a2 80 e3 c7 8d 19 b3 80 6c 83 72 bb a7 03 32 f7 d8 ac b9 18 e2 b2 6a a1 1a 16 3d 6c 05 86 d3 17 52 07 c8 60 80 75 6b d4 98 3b 37 98 ad b9 45 ff 6d d9 b8 6f d3 7e bd 5a b5 0a 0d 1a 54 08 a7 02 1c 85 f1 e3 c1 89 1f 87 30 d6 ab f3 e7 9e a1 47 6f 4e 6c 8a 9d c2 a1 0f d3 e4 4c fd f3 f4 ef da 8d 09 22 c4 09 91 be 52 43 30 49 fc 05 40 bd a6 6f 84 e2 c0 71 05 2a 55 ec 4a a8 5e 4d a5 bf 3f 81 ac ee a0 05 08 e0 80 04 7a 27 dd 4a 1d 95 04 df 68 e1 1d b8 56 82 0a 2a c2 51 45 16 85 e4 91 84 00 51 f8 51 58 23 9c 54 9e 86 0a c6 33 51 88 fe 90 d6 08 89 de 10 Data Ascii: 38[ePYu_vehM,pEoZg1tQlr2j=lR`uk;7Emo~ZT0GoNlL"RC0I@oqUJ^M?z'JhV*QEQQX#T3Q
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: f8 aa 91 ac b3 9d 29 1a ea 2e 1c 4a a2 b6 92 b4 41 fb 54 1d 0e 75 06 b1 83 2e 89 a5 51 f9 ff a7 db ca a0 d0 ad 32 31 34 4b dc 0a f0 f8 25 59 c5 8a 85 b0 80 1d a7 68 47 bb 20 30 d1 71 7a cd bb 63 59 4f 2b d2 64 36 43 0a d9 23 00 cc fe 44 33 ef b9 56 b0 d8 91 a9 f9 6a 4a d3 f4 f5 76 a6 bc dd 64 14 50 03 bf 4f f6 d4 53 bf 51 c1 05 70 6b c9 03 19 15 66 cf 05 54 f8 6c e1 ca a5 ce b2 a9 b7 bd ee e4 1a f8 8d e6 62 f3 a9 98 18 1b 7b d8 e9 1e ad 7a 10 b2 8b 10 18 58 8b a9 1f 64 31 b7 ac 1c c2 6e 39 31 87 4e 53 81 ce b0 49 7c ab 81 8c 28 d7 3c ac 35 44 d7 9c 6f 5a 1f 14 da 87 ee 15 c0 66 01 e2 a1 1a 37 d1 af c4 f3 5d f8 3d ac e9 98 d0 59 99 64 f1 95 13 a0 f0 c5 be 93 59 d7 21 93 b1 1d 06 a8 c3 84 54 e1 1f 05 54 2c 21 6e 18 76 d1 4a da 02 83 b7 c5 03 b6 51 45 eb 98 Data Ascii: ).JATu.Q214K%YhG 0qzcYO+d6C#D3VjJvdPOSQpkfTlb{zXd1n91NSI\|(<5DoZf7]=YdY!TT,!nvJQE
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 42 b3 8a b1 48 53 50 50 8b b6 78 8b 05 29 76 97 74 15 35 33 33 9a f7 8b 90 51 7b 3a e8 79 c3 f8 86 c5 f8 92 e2 d3 85 e1 c5 87 44 78 0f d3 88 8c f0 f1 06 16 d7 6d cb b5 35 ea f5 36 c4 02 04 e7 08 8e 66 75 85 ea f8 2e 19 23 90 55 c9 21 bb c4 88 02 39 97 74 59 60 70 e5 86 65 91 8f c5 97 42 5e a2 60 9f d5 96 e2 f2 03 b7 54 8f 77 79 98 6f 30 95 87 f8 13 68 c9 6d b9 06 07 89 28 71 01 10 88 93 a5 77 ec 77 7f 39 f9 15 94 c9 4f e0 c6 77 e6 17 97 1e 79 98 a2 e9 6b 30 25 80 95 08 12 cc 23 32 34 01 27 2a 69 9a 29 09 93 b0 69 13 ae 41 0a f2 26 6d 17 08 5d 36 f8 77 d4 46 4c 09 49 35 3b c5 8a e4 36 ff 84 45 36 5c 25 a0 06 40 39 79 c0 d9 78 f7 46 94 f5 86 5c b6 a7 83 31 a8 48 9b e7 94 01 d7 05 51 00 9d 2e 59 85 c4 18 1e ef 40 1e e1 55 2b 43 48 0f 35 a7 84 5e 29 5a 31 f0 Data Ascii: BHSPPx)vt533Q{:yDxm56fu.#U!9tY`peB^`Twyo0hm(qww9Owyk0%#24'*i)iA&m]6wFLI5;6E6\%@9yxF\1HQ.Y@U+CH5^)Z1
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: ba b2 fc cb 4b 78 cc 73 29 b4 06 91 14 5b 3c c6 a5 3a bd 51 fb 25 12 39 15 d7 ac bd 16 3a b0 5b 52 cd 56 3c 3b d9 6c a3 60 f1 ba d9 20 c5 73 20 be bc fc a7 6d fc 4e 6f 4c 09 11 30 48 74 34 b6 a5 60 c7 f3 0b ac d9 a5 41 7e 37 8a 7a 82 ac c8 fa c7 d5 ba b7 82 1c 64 3d 2a d0 87 4c b7 bd 91 c0 fb 0a 04 65 e0 d0 0d ed c0 12 1d ff b8 14 fd 9b b3 21 c1 95 ac 5c 47 2b ae 79 b2 b6 7a 32 82 e6 26 95 a0 1c ca a3 1c 4b c7 58 c2 28 8d b9 2a 5d 84 2a e0 87 ab cc 5e 97 fc ca 65 9c 44 4b 3c bb 9b db b3 ec 1a 38 ce ac cb 26 fc c3 d0 ec 88 c1 cc cb 45 2c cc 84 59 2a 3c 4b 22 e0 49 95 ca d2 ba 08 c1 ba b6 e5 ca d9 d2 a9 dd ec cd 93 e5 89 cd 3b d5 54 cd 74 2e 1c 3d 96 85 d5 5e 0d aa a9 f8 71 35 7d cc ef c4 ce 42 3c cd b0 4c 4b 05 b8 ab 06 a8 65 25 a3 49 a9 e9 80 65 12 3d b4 Data Ascii: Kxs)[<:Q%9:[RV<;l` s mNoL0Ht4`A~7zd=Le!\G+yz2&KX(]^eDK<8&E,Y<K"I;Tt.=^q5}B<LKe%Ie=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49840	172.67.148.80	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	374	OUT	GET /00165139bb76d845bfa39bde42b929c5.gif HTTP/1.1 Host: go.imgmimi.xyz Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	946	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: image/gif Transfer-Encoding: chunked Connection: close Last-Modified: Mon, 29 May 2023 08:54:04 GMT Vary: Accept-Encoding ETag: W/"6474682c-4770" Expires: Sat, 04 Jan 2025 11:56:45 GMT Cache-Control: max-age=2592000 CF-Cache-Status: HIT Age: 2394951 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZR5vdKFnZiSVUwndoLAeYxJ48OAEZsTnbqiWlZsnliA8kre4IVhAqMjj1gaA%2BrLKphH0fUqCNGd4FAITbUlViZlR2uZ3u0QajFOpiwbHRFNgvvka8wE1XjDmGkobJK71LA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb8414d59207cac-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1798&min_rtt=1790&rtt_var=687&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=952&delivery_rate=1573275&cwnd=197&unsent_bytes=0&cid=eadd659bde7e49e9&ts=735&x=0"
2025-01-02 05:12:36 UTC	423	IN	Data Raw: 34 37 37 30 0d 0a 47 49 46 38 39 61 96 00 96 00 f7 ff 00 71 cf f4 ef ae 75 ef b4 87 d2 27 0b ff ff ff f3 6c 53 8d d9 f6 05 52 c9 d3 47 2e 2e 0f 08 04 03 05 db c6 8c a8 a1 8a ff ff d8 cd b1 73 fd e6 99 32 ae ea ff f6 aa 51 26 14 0c 6e cf 24 92 da 8c 75 4e 6e 4e 30 13 87 d7 ce 72 32 e3 8a 35 c5 00 00 13 55 a7 d7 8a 4c e5 cb 88 d6 01 00 fa de a4 ea 96 4a 6a 2b 12 aa 97 6b ff fe bc f6 dd 9c d1 35 21 ff fe c5 a7 00 00 ff ff e6 e9 4c 2e c7 b9 8d 91 4f 2a b3 8f 54 ff ff cd f0 04 04 eb d5 9a ce 00 00 d0 eb f4 58 c8 f2 a8 55 2b bc 00 00 fe ed ac 47 16 09 33 2d 27 b6 67 31 72 66 4e fe e7 ac fb e4 a4 d5 90 67 ec dc a5 55 46 31 4a 48 43 e1 c3 7c 26 6b ce 46 b9 ec fe ed b3 d8 d0 a9 ba a8 74 b1 4c 15 47 37 27 f5 b2 a5 ff fe b3 b5 f6 fe fe f5 bc ff f4 b3 e6 cf 96 99 8e Data Ascii: 4770GIF89aqu'lSRG..s2Q&n$uNnN0r25ULJj+k5!L.O*TXU+G3-'g1rfNgUF1JHC\|&kFtLG7'
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: b5 f5 d5 93 6d aa d7 85 7b 64 f0 5c 41 d1 65 17 da 75 6a dc 73 4b 76 71 60 8f 16 0d ec e5 ab 02 3e b4 8f c7 e0 74 42 1e 6c be e4 18 43 77 be 30 22 7a e8 ff 0a 73 e8 f5 ff ff fd e7 b2 ea 8a 75 f5 ec b3 e9 e4 d8 f5 ec e8 ca 1a 11 1a 0f 0a f7 d6 9d dc 6b 52 ee d2 8a fd ed c4 c6 65 44 fb de 9d 67 95 d0 21 78 e6 ed c4 ba f7 f5 bc 90 59 44 6d 34 79 7c 61 36 d4 a2 5d fe df 91 19 a2 e1 f7 ee bb bb 5f 1f fc ee df df 19 13 f6 eb ad eb 7a 16 f4 dc 93 ea e7 c4 b7 87 39 e4 de b6 c6 df ec f6 e6 b5 f8 db b2 86 3b 1c fe f4 ce 01 04 0d b4 11 0c ba 1b 13 f5 f5 c5 73 49 6f ef 4a 1e d2 0a 01 f4 f6 f4 b1 79 63 fd d4 9f 14 21 38 fc e5 bf fd bf b8 f6 cf a4 ec d0 a6 dc a1 90 00 37 c3 f7 f4 cc 19 1b 1e cb 61 56 c6 09 02 a5 25 3d 07 21 13 df eb f3 1f 5e cb 07 5d e4 07 10 08 fd f7 Data Ascii: m{d\AeujsKvq`>tBlCw0"zsukReDg!xYDm4y\|a6]_z9;sIoJyc!87aV%=!^]
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 46 45 44 43 42 41 40 3f 3e 3d 3c 3b 3a 39 38 37 36 35 34 33 32 31 30 2f 2e 2d 2c 2b 2a 29 28 27 26 25 24 23 22 21 20 1f 1e 1d 1c 1b 1a 19 18 17 16 15 14 13 12 11 10 0f 0e 0d 0c 0b 0a 09 08 07 06 05 04 03 02 01 00 00 21 f9 04 05 0f 00 ff 00 2c 00 00 00 00 96 00 96 00 00 08 ff 00 ff 09 1c 48 b0 a0 41 1a 34 34 24 5c 98 50 83 c3 86 0e 23 4a 9c e8 10 c1 aa 49 12 6e 3c 01 75 24 84 1a 0b 66 6c d8 80 d2 46 4f 06 0e 01 02 6c d1 03 a7 14 0e 59 8d 06 ad 48 70 e4 c8 a4 9b 1c 66 84 a0 a2 47 00 10 10 52 3e b8 5a 11 c2 d7 4c 70 e0 9e cc c0 f8 44 82 99 a7 66 14 78 eb 27 01 87 48 09 4e 7d 1c 31 c8 b5 ab 57 af 0c 15 32 44 a8 b0 2c c5 b3 12 db 34 9b 61 e6 89 17 b7 93 a8 68 f1 a5 46 cd aa 15 46 f4 80 70 e3 2c 19 88 0c 57 64 81 a8 62 04 c7 0c 1b 39 f6 98 91 30 69 c6 b7 15 ae Data Ascii: FEDCBA@?>=<;:9876543210/.-,+*)('&%$#"! !,HA44$\P#JIn<u$flFOlYHpfGR>ZLpDfx'HN}1W2D,4ahFFp,Wdb90i
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: a8 90 ff 08 77 a0 41 12 61 b8 c4 25 4e 69 80 4b b8 c3 16 01 98 91 a1 4e 22 0b d3 0d 2d 03 b7 78 c1 20 5a 61 a9 f6 65 8a 31 1c d0 c3 6c f8 b3 0e 95 d9 73 06 d0 aa 9f 0d 5c 05 0a 0d c2 0e 56 de a0 43 ac 46 e5 aa 8d d8 91 8e 62 da 9a 3f c0 02 bc 6d 1a af 84 08 e0 07 0d 02 d0 82 43 7c 60 04 23 d8 01 18 34 f0 05 37 10 a0 11 ef f4 c0 23 2c a0 19 ed ad e0 4b 6a b0 81 1a cc 20 07 11 b8 43 12 92 28 68 18 c2 70 ca 28 6c d5 ab 06 d0 0b 65 32 20 32 24 6c c2 0d 6e e0 81 1b 5c 31 8b 5e 38 8b 05 22 c8 85 2c 6e 51 84 f9 bc 24 01 5e e0 0f ed c2 13 c3 93 81 89 82 62 f2 07 56 b0 e6 16 50 a0 06 8f 30 45 6c c3 62 a5 00 ae f8 2a 6d 0a 49 64 03 ec 20 0a 84 0c 21 00 dc 08 45 21 db 10 27 0d 94 a0 0d 11 b9 9b 7f c6 23 81 a8 d2 86 49 7f f0 67 40 05 3a d0 53 72 95 a0 00 20 68 fc 58 Data Ascii: wAa%NiKN"-x Zae1ls\VCFb?mC\|`#47#,Kj C(hp(le2 2$ln\1^8",nQ$^bVP0Elb*mId !E!'#Ig@:Sr hX
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 84 c0 06 ca b8 0d 06 50 8c 23 08 0b 32 40 33 75 18 79 d4 18 70 f9 10 46 f6 57 84 29 30 0d cb f0 88 8f 98 06 69 50 05 c5 80 05 9e e0 88 de b8 0d f4 50 0a 29 d0 61 b0 17 8a e3 e5 24 50 38 76 99 54 52 16 74 41 ac e8 68 04 93 7b 28 f7 05 9f d0 00 b1 c0 4e 9b 30 1c a2 60 8b 29 d4 08 6c e0 4e 17 b8 5f 58 43 07 03 e3 0f e1 d0 7c 25 78 8c 31 80 82 e6 f8 22 31 50 06 b0 40 82 24 08 0b 94 f0 22 51 00 0b d3 28 04 65 00 01 fe f6 0e 09 00 05 f0 d7 06 ed c7 07 6d 40 0f de 98 09 62 50 02 08 c0 7e 08 98 06 99 10 2e 04 ff 40 0f a9 f0 0c eb 27 0a 05 70 1a 36 50 5d b2 a7 52 16 24 68 80 06 0e f1 a8 3b 03 b3 68 5a c8 85 0b 81 00 75 50 05 75 b0 0c d4 60 07 6c d0 02 8d c0 8f 76 40 0d 6d c0 06 02 b0 2c e6 90 90 74 e4 24 4e a2 20 78 30 87 b0 10 05 15 e9 8d 04 20 04 20 49 8c 10 00 Data Ascii: P#2@3uypFW)0iPP)a$P8vTRtAh{(N0`)lN_XC\|%x1"1P@$"Q(em@bP~.@'p6P]R$h;hZuPu`lv@m,t$N x0 I
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 0b 30 ac 01 b9 2a ab 8d 98 09 9b 10 6f 30 5c bf 09 72 b9 34 fc 04 3e e0 08 47 70 ba 38 bc 21 62 4b 41 08 63 4d 0f 23 80 0a 50 09 10 d0 07 71 db be 14 d0 38 8f a3 ab 8e c3 96 2f 22 09 13 70 07 43 1c b7 71 9b 05 85 e0 07 56 5c c2 84 6b 05 9f ff c0 98 be f9 22 9e 60 05 2f 4c b8 82 9b bc fd 0a 0e 33 bc 6d 00 52 13 80 50 13 aa 71 c9 03 08 41 c8 92 2c 22 cb 25 ae 72 03 80 10 1f 16 70 04 0a 42 72 03 73 03 85 d0 07 ed 1b b7 13 30 97 e6 e8 88 51 80 08 46 ac 8c 2b f8 9b 13 10 cb b1 6c b7 59 50 0f 03 30 05 9f 30 cc c9 bb b8 03 a0 01 9b c0 96 8c 10 c0 c6 2c 6f 93 0c a3 03 60 3b f3 e9 0f e0 70 04 37 70 03 74 20 0d 47 e0 03 37 f0 c3 3b 76 3b 38 16 ca 2e d0 0e d6 70 03 e0 f0 5d 9d d1 0a 58 81 ca ad f0 04 fe 20 c6 18 f4 0e e4 2b cb 11 ea 88 7b dc 07 07 10 08 be f9 ba d9 Data Ascii: 0*o0\r4>Gp8!bKAcM#Pq8/"pCqV\k"`/L3mRPqA,"%rpBrs0QF+lYP00,o`;p7pt G7;v;8.p]X +{
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: e9 8c e0 3b dd ec 24 7f 00 a6 1f 09 a7 c0 96 a7 00 0d 91 90 0d a5 8f 06 d7 99 82 d7 10 08 a7 10 04 dd de ed 41 70 07 50 0d 10 56 a8 89 63 c4 e8 59 26 02 09 15 a6 b1 a4 41 03 0c 63 11 23 5a 31 c7 47 dc 13 05 c0 fa f5 d3 08 4c 23 47 7f fd 6e 3c 01 47 47 9a b7 72 74 9e 48 f3 07 aa d5 1e 39 ad 2c 58 a0 03 ae 5f c6 8e 1c 69 78 70 a1 46 9b 02 8e e5 36 0e 25 3a 14 98 3f 2f 47 8e 9c 04 05 ee c9 cd a2 44 fd e1 41 15 64 c2 01 6c 58 15 2a 3c 76 ea d4 3b 68 88 08 b0 b9 16 e8 54 bd 03 07 22 1d b8 7a 35 08 26 3f 2e ac c0 68 43 60 db d6 ad db 32 a5 3a 83 40 a2 c4 8a b4 e8 7c cc 69 b4 9f 3f 7f 4f 6e d0 31 09 4e 5a c9 72 47 2a ec 59 97 c3 47 39 6d 37 8e dc 24 dc 8f a7 9a 7e e5 14 78 89 1a f5 23 48 2f 35 c1 81 f3 92 b1 e8 69 7f ca 50 a1 ca 3a 01 5a ff 10 36 78 15 a2 b9 8d Data Ascii: ;$ApPVcY&Ac#Z1GL#Gn<GGrtH9,X_ixpF6%:?/GDAdlX<v;hT"z5&?.hC`2:@\|i?On1NZrGYG9m7$~x#H/5iP:Z6x
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 8b 1e 84 34 a4 ba e8 68 49 3f da 83 7d 38 22 6a 87 71 04 0a de b0 84 25 bc c1 04 2d a0 69 0b 4c 00 53 98 be 41 a7 6f a0 69 03 50 f0 53 14 10 20 11 06 9c 11 03 08 c0 00 3a 18 82 08 8e 58 42 0b 7c 00 08 13 fc 53 05 0c c8 01 11 12 71 84 7d 90 c2 07 0c 40 81 0a 1c 41 8a 5f 14 a1 08 2d b8 81 34 54 90 03 27 10 a1 1f e1 f0 aa 2e 18 10 35 d7 e0 f0 9a 77 1c d0 01 8d 68 9a 8a ee 03 05 0d e0 ab 4d 6f ca 04 1d e8 40 13 4c a8 c1 0e 74 b0 83 1a 30 81 09 4b 60 c2 10 04 6b 02 39 a8 eb ff 30 39 48 02 09 04 61 d9 38 d4 a2 06 85 15 44 0f 48 f0 d9 cf 0a 42 10 9a 1d c2 12 66 6a 02 36 a8 54 48 0a 45 c1 11 6e e0 04 50 f8 43 0e 6c b0 8f 08 fc 41 84 24 20 a6 02 45 f0 c7 03 54 90 98 06 00 c2 1f 45 18 01 c8 80 70 04 27 34 00 31 b0 dd c7 6f 6f f0 56 bb be cf 88 0f 95 e8 b8 06 75 27 Data Ascii: 4hI?}8"jq%-iLSAoiPS :XB\|Sq}@A_-4T'.5whMo@Lt0K`k909Ha8DHBfj6THEnPClA$ ETEp'41ooVu'
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 00 39 8c 70 20 00 14 30 81 6e e0 3e 02 50 81 58 48 02 55 20 05 26 80 87 c6 9a c6 1e e0 b3 e3 11 84 11 60 80 29 74 32 57 34 81 9a 93 a9 37 28 02 15 f8 05 5a 04 19 33 cc 9f d0 f3 82 49 98 01 1c 98 01 5d f4 02 ff ec 73 34 01 24 80 f8 6b 00 52 10 30 9d 32 01 be 52 81 70 a8 00 78 20 ba 21 d0 41 4d d8 01 26 18 81 08 60 82 31 c0 33 c4 58 00 4a 5b b5 24 98 c6 40 34 c4 3a 18 83 43 18 85 05 e8 80 58 e8 ae 5f 50 05 98 1a 03 53 78 81 0c 63 80 75 f4 07 40 78 c7 37 18 02 99 6a 81 38 6c 01 52 68 81 05 68 05 ac 5c 00 26 88 03 12 68 85 b3 fb 00 13 70 02 a8 b2 b8 1f e0 ab 22 f0 01 9b 0a ae e4 42 ba 8c 84 1e ec 03 99 04 90 00 2f 90 80 15 c0 01 2a c0 81 49 c8 9c fc 61 b4 15 44 81 7d e0 ae 79 80 87 25 f8 85 5f 30 c2 4e a4 bf 16 f8 2e 2f 5b 06 4d a8 05 1d 08 b2 0f b8 05 12 58 Data Ascii: 9p 0n>PXHU &`)t2W47(Z3I]s4$kR02Rpx !AM&`13XJ[$@4:CX_PSxcu@x7j8lRhh\&hp"B/*IaD}y%_0N./[MX
2025-01-02 05:12:36 UTC	1369	IN	Data Raw: 68 5f 14 42 d6 1b 88 85 50 68 de 17 78 05 7e ba 31 6f 38 dc 0e f8 c9 31 50 29 92 3d 82 21 08 d5 5b 48 d5 3e 5b d6 0c 7b 01 9d 5c df 17 68 81 61 38 8c 1b 88 83 1d 58 80 39 7d 80 b7 72 82 4d 7e 00 1f b0 80 1a e8 80 1a 68 05 1b a8 62 09 50 03 38 20 e3 04 c8 45 30 56 e0 a9 1d 0d bc 1a 8d e9 9c 84 10 98 01 5b d0 82 85 9b ce e9 1c 05 c3 2d 64 41 90 03 0b a0 02 ef 4c 80 e5 1a 83 0d ee e0 12 1a 17 7f 48 04 13 08 e1 1d 70 80 75 e4 58 3a 58 80 43 c8 b0 23 f3 bb ce e3 d8 23 80 87 b9 bb 05 20 70 82 05 70 80 51 00 d7 05 00 02 f3 82 dc 26 08 85 8c 3b 8c 27 e0 85 25 70 82 23 d8 01 53 58 62 20 10 2b 57 b0 b3 46 be 05 62 d6 5d 2f 00 85 10 b0 05 0c 08 01 33 f0 05 49 05 43 23 19 0d cd 91 00 2d c8 00 1c 08 01 bb 03 10 ff 0b 80 e1 5a 5b 00 32 d8 83 55 d8 54 1e a0 82 15 78 02 Data Ascii: h_BPhx~1o81P)=![H>[{\ha8X9}rM~hbP8 E0V[-dALHpuX:XC## ppQ&;'%p#SXb +WFb]/3IC#-Z[2UTx

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49787	61.54.86.170	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	613	OUT	GET /yhgifjiami/xyh/1300x240.js HTTP/1.1 Host: yh88812345qwerasdf.lzaotw.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:37 UTC	687	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: application/javascript Content-Length: 481785 Connection: close Server: openresty Last-Modified: Sun, 10 Nov 2024 05:32:29 GMT Vary: Accept-Encoding ETag: "6730456d-759f9" Expires: Wed, 11 Dec 2024 00:18:49 GMT X-CCDN-Expires: 2584599 via: CHN-HAluoyang-AREACUCC1-CACHE16[10],CHN-HAluoyang-AREACUCC1-CACHE30[0,TCP_HIT,8],CHN-SH-GLOBAL4-CACHE29[17],CHN-SH-GLOBAL4-CACHE88[0,TCP_HIT,9] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: b3030898494873e81d14bbf65ea64fb9 nginx-hit: 1 Age: 7401 Cache-Control: max-age=43200 Accept-Ranges: bytes Strict-Transport-Security: max-age=63072000
2025-01-02 05:12:37 UTC	15697	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 ff 00 ff fc b9 6d 01 01 02 ff 59 fd 4e 04 ff ff da b9 03 01 a3 6e 1c c9 01 00 af 67 59 99 00 00 05 05 05 d8 01 00 ff ff eb ff ea 76 fd b0 4c ff fb aa f3 b5 67 f1 d2 d0 f6 d7 b1 fe 49 49 9f 98 5a ff ec 99 02 ff 23 fe 8e 04 29 29 29 fd cf 08 d5 26 10 fe 36 31 87 00 00 fe 4b 31 f8 ad 8e 8a 8a 89 ee 45 92 fe 92 2b ff fe 98 ff ec a8 fe da 88 75 75 74 fc 72 05 ff af 2e 5c 23 d7 ff b4 05 fa 6c 4e fb 91 4b 09 ff f2 fb 6f 2e ff cf 4a e8 01 00 ff fe 86 ff ea 88 f8 6f 70 2e 64 f7 ff d9 77 f2 89 87 f5 92 6d f3 b1 ac b2 af f4 9c 9b 1b d0 a7 a5 ff ec b9 ff ce 2f 07 ff b3 f9 26 00 fe dc 9a 08 ff d2 fb 16 59 02 ff 8b 4d 4e 4c ce aa 8e ff f1 51 d1 30 29 44 46 e8 cf aa 6d ff 1d 8f 5d da a3 cc 71 6e ff ec c9 d7 4f 48 d3 87 85 fd cd 75 d5 69 Data Ascii: GIF89amYNngYvLgIIZ#)))&61K1E+uutr.\#lNKo.Jop.dwm/&YMNLQ0)DFm]qnOHui
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 6d 2d d7 9a ae d7 3a e6 9f b0 43 7f cd e9 e8 ee 49 98 4d 2a 60 e6 60 28 40 ed 39 98 c3 1b 9f 83 24 9a 13 9b 88 ae 49 ad a9 4c b1 1c de ee 31 18 5c 65 4a 4d a6 39 24 1d 60 06 72 90 11 ee 96 18 ee 54 a8 83 22 2f 32 23 37 32 11 7b 04 02 34 b2 24 2f 72 3a 90 6e 47 44 f2 24 4b 72 25 8b 4e 26 4f f2 e5 76 b2 24 cf 24 48 80 b2 23 f7 04 29 33 f2 23 5f f2 29 2b f2 26 27 05 18 e3 13 14 db ee ea b2 6e 61 62 31 ec b6 d9 59 9c 2a 18 24 31 cf 12 01 5a 68 62 ad d6 b2 f0 0e 2f 31 bb c1 f1 46 b1 d0 4e 16 76 50 ef b0 0e 42 0c 5c 2f 2f f6 c3 11 49 cc a6 bd de 31 3a 91 a4 f1 15 a5 59 a7 f9 76 b3 12 6d 00 38 7f 33 68 ac af 77 82 da fa 9e 33 77 62 a3 fc da 80 fc 6e a3 79 5e c1 fd 8e 6b 8b 66 ff 9b 80 94 a4 44 da 07 8c 18 83 18 9c 83 3f c4 00 0d f8 c1 29 44 24 7a 9c c2 21 88 00 Data Ascii: m-:CIM``(@9$IL1\eJM9$`rT"/2#72{4$/r:nGD$Kr%N&Ov$$H#)3#_)+&'nab1Y$1Zhb/1FNvPB\//I1:Yvm83hw3wbny^kfD?)D$z!
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: c2 82 00 17 70 80 e5 35 87 e5 05 80 e7 85 00 75 50 50 05 ad 48 06 2d ab 07 48 07 02 88 01 17 f0 a0 0a 15 e2 71 1c 97 f3 25 c9 f1 f5 57 60 01 2d 10 15 d8 82 55 0c 07 74 5f 81 59 58 78 98 05 ab c0 25 a4 24 26 68 9e e6 35 3a 9b 0b cc 1a 06 4e 1b b0 78 d9 b4 39 4b 3c da 09 0a 16 e0 8c f0 09 ea da 58 ab 88 2f 68 ae d2 6f 63 e0 63 1a 52 08 ab d2 34 7c 8b b0 ec 09 5d aa a4 f8 92 09 b0 d0 51 29 0d ba 1f 0d b7 a1 d5 4a 3c 1a 4b ad 8c 08 78 30 e8 15 46 68 b7 a1 9e e2 71 11 d0 80 e1 da 09 bb 19 8e 5a 1b 8e c4 c4 94 53 0f 70 bf 50 f3 80 1a b0 2b bb aa 01 1b b0 2b 12 f8 01 08 10 5b 35 cb c4 3e e5 44 d8 00 45 db 49 db 1d 3b 63 fc b0 e2 31 ab e2 98 1e 33 da 59 4d 2d e6 bb 51 e4 62 bd ff 5d 5b be 15 e3 9f 3e c6 97 86 29 33 16 ea d2 a9 69 da e9 92 0f 0b b1 e1 20 4c 68 2c Data Ascii: p5uPPH-Hq%W`-Ut_YXx%$&h5:Nx9K<X/hoccR4\|]Q)J<Kx0FhqZSpP++[5>DEI;c13YM-Qb][>)3i Lh,
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 12 30 98 82 d8 75 4a 1f 23 11 78 70 08 89 01 00 0c 90 0a dc 8a 0e a9 8a 0e 46 f1 00 00 05 00 04 60 14 41 43 00 e3 40 10 26 93 05 13 5b 08 14 d0 d0 0e 4d 01 48 20 1c e8 0b 30 78 40 02 91 e0 07 48 80 04 0d 9d d1 19 fd 04 d3 43 bf 15 d3 82 dd 20 1c 14 e0 07 0c 2c 0f 0e ec 83 cf 40 01 0d 00 c9 90 2c b3 34 c0 0c 5f 39 a9 c9 90 05 87 f0 04 5a c0 c0 65 30 04 2d 4d 03 a1 62 c7 40 0d 2a 3d d4 43 a1 32 8f 78 f0 46 53 58 99 a6 49 73 dd e2 ae 23 5c c2 ad b9 0e 28 2c 60 55 52 0e 2c bc 07 2d 00 c3 31 8c 14 74 a8 74 35 ac c7 56 61 4c 7d d1 04 cc c9 07 3b 5c c8 91 67 b0 84 31 1b d1 49 66 8c d1 b2 47 6c 9d 49 ac 89 4b bc 9d 4b 03 9e 1c f2 89 16 1a 18 25 cb d7 bc d3 3a 58 bc 02 41 6d c4 ff a2 31 37 09 5a 15 a5 00 d3 34 4b 15 b5 47 1c 59 01 41 36 b0 d8 55 e1 b5 4f d0 50 fd Data Ascii: 0uJ#xpF`AC@&[MH 0x@HC ,@,4_9Ze0-Mb@*=C2xFSXIs#\(,`UR,-1tt5VaL};\g1IfGlIKK%:XAm17Z4KGYA6UOP
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 87 77 be 60 09 48 98 84 4d 98 5d 53 78 38 f8 8d 85 77 c3 85 3b a6 63 ba 20 64 29 84 39 b2 c7 86 f7 15 e1 06 91 87 67 53 05 56 e0 07 be 52 9a 2a c0 21 0c a2 1f 2a 20 3d fc 60 05 f2 70 62 e9 43 e5 fe c7 89 ff b0 3f 6a c0 06 02 04 63 3f cb 8a 5d 6e 80 a8 13 42 46 cb 11 4d 0b 12 91 83 3b 4f 56 8c 77 ae 43 90 c3 33 42 40 0b d2 58 84 d8 d3 84 de 38 e9 74 93 80 e7 f8 13 2f 60 0e f4 53 49 f4 78 8f af 8e 74 73 a0 8f b0 f1 16 01 32 94 00 34 20 a9 c4 6f c9 ce 14 30 a0 04 e6 16 16 d4 21 4d 60 40 22 fc a0 17 b2 00 be 9e 71 16 de 2b f4 30 a2 01 d8 63 4f 00 a0 0c 9e b4 4a 52 59 0b 4a 60 4b 10 2f ba ac 85 94 92 01 0f f4 a1 0c 0c 61 17 ff f6 52 86 48 c3 ac 15 0d 10 c0 16 8c c1 ef ac 04 ff 6e e3 a9 58 b4 a0 17 a4 a5 44 65 b9 b5 f5 61 8d 4c 01 6f af 55 1a 3e 57 5b cc 36 4b Data Ascii: w`HM]Sx8w;c d)9gSVR! =`pbC?jc?]nBFM;OVwC3B@X8t/`SIxts24 o0!M`@"q+0cOJRYJ`K/aRHnXDeaLoU>W[6K
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: bb c1 7e 34 a4 37 74 f0 0b 6b 44 7e 1c 54 4f 3a 0b 38 ac 6a 9e 64 f1 35 b8 ab 9d d8 8f 60 3f b6 a2 1c 15 09 53 31 af 9e 70 09 63 f6 0a 2b eb 9f 34 01 06 4d f6 35 94 04 19 14 00 ab 90 da 60 7b 76 ff dc 40 63 cb 6b a8 15 40 60 07 ab 12 07 05 56 00 43 0f 2f 46 13 14 40 c4 0c 43 a8 c2 84 54 a4 ab ba 3a 2b 3e 38 01 b7 c6 44 a9 fe 2a 56 1c ab 9e dc 6b be 12 4a 1f 78 b1 18 87 f1 17 93 b1 19 23 ac 17 ad 31 09 40 d6 cc d4 41 1c 73 77 77 47 c6 1c 47 46 65 e8 f1 b8 f1 71 ba f5 40 0f 4e c9 df 49 32 10 4c 72 7b ab f2 bc a5 0b 02 b4 77 0f d0 77 0f 98 2c 70 f6 9b 1f d6 77 0f 6c 82 21 e8 e6 0b 6c c2 7e d3 b7 7c 29 81 80 f7 80 71 35 b2 bf 51 80 81 33 38 7d 53 c0 0b 18 42 83 4b b8 84 17 ff 67 13 4c f8 85 33 38 2a 0b 78 30 55 27 db ec 37 02 40 82 80 af d7 7e 37 c1 13 06 f8 Data Ascii: ~47tkD~TO:8jd5`?S1pc+4M5`{v@ck@`VC/F@CT:+>8DVkJx#1@AswwGGFeq@NI2Lr{ww,pwl!l~\|)q5Q38}SBKgL38x0U'7@~7
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 96 76 e9 37 1a 43 32 6c 26 9a ae 69 ba 2c ac 52 b9 21 41 26 e4 bf f6 d2 be be 6e 84 29 ea 48 ae a4 a0 8e 64 a4 8e 02 02 43 e5 a6 76 6a 76 86 6a 0a 13 6b aa de ea 6d 1d e5 f4 be 5e ab 46 6f f8 8e ef f8 b6 89 16 56 66 69 42 8e f9 1d 0c 13 36 61 b5 ee 6f 29 4b 66 0c a5 6b 01 1f 70 02 2f 70 01 47 d2 bb c6 6b 71 a6 27 ec c6 ee ea ae e1 52 40 47 e2 b8 07 09 22 6c c2 36 41 fd 40 2a 7d d6 9e c5 0e e2 a7 aa aa 7f 7e 6c aa 74 40 39 8d 1f ca ae c0 a5 64 68 cc 36 db 16 98 03 cc bc ab 90 a6 2b 48 00 6e 00 e0 06 09 e8 02 9c db 44 1d df 71 1e ef 71 1f ff 71 20 0f 72 21 1f 72 22 2f f2 47 04 03 34 d0 03 1a 07 00 28 88 f1 cc 6c 63 4b 3d 6e 9b 10 93 98 96 ee 18 74 6e 18 44 36 38 e2 00 46 ff 78 70 d2 6d f0 06 57 98 84 e1 39 ee f6 8e f6 23 25 f0 de 12 fb 1c ef a7 36 ef aa 93 Data Ascii: v7C2l&i,R!A&n)HdCvjvjkm^FoVfiB6ao)Kfkp/pGkq'R@G"l6A@*}~lt@9dh6+HnDqqq r!r"/G4(lcK=ntnD68FxpmW9#%6
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 88 9e e8 91 c3 2e ec 5a 30 da 1c fc d5 a1 ea 69 19 2e 74 01 1f f6 64 ec 19 d0 0e 40 40 ec ad 16 20 f2 9e 39 98 43 3a fc 80 c3 0d 44 c4 49 dc f1 ad 99 ec 65 d3 04 74 c0 c3 a8 40 1c a8 00 cd 58 62 c5 6c c8 04 d4 81 0c 80 93 83 4c 08 26 7a 5f ca 95 e5 3b 81 e2 6e 99 62 89 c4 53 3c f9 81 0d 88 88 00 75 02 2b ca 9c 2b c6 a2 5d 0a 84 fc cd 5f 04 49 9a 5f e0 82 01 98 de d3 39 60 4b fa 5f 0c 90 82 b9 e0 c5 94 b9 23 31 d6 a4 40 cc 1b 41 90 82 d3 6d 45 02 20 c9 6e 50 e6 d4 58 0d 34 52 23 7e 4d 63 34 1a 80 14 21 cf 19 2a ff a6 d8 b1 4b a8 7d e6 2e 40 88 ad 69 84 64 bd 44 d7 dc 60 02 dc 01 33 e4 62 9c a4 44 2f bd c4 73 d9 4c de a5 02 18 30 d8 3f 36 18 b5 61 a4 9e 10 c4 45 92 c1 42 69 10 55 49 55 3b 24 10 41 20 a1 37 b4 c3 12 48 ce 13 52 64 8a 79 46 13 60 92 a6 74 44 Data Ascii: .Z0i.td@@ 9C:DIet@XblL&z_;nbS<u++]_I_9`K_#1@AmE nPX4R#~Mc4!*K}.@idD`3bD/sL0?6aEBiUIU;$A 7HRdyF`tD
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 4d 9c a6 6a e2 81 e6 52 b6 06 10 81 18 68 01 e2 81 36 dd 81 0b 1b 80 00 54 84 00 55 5c 45 67 d1 b6 57 74 4c 95 88 c5 79 92 8d 1a 18 05 09 b0 4c 09 e0 9e cc d4 cc cd e4 1e f0 73 8c 71 93 a3 27 f3 4c 5c 1c 8f 59 a4 03 5e 04 46 20 c9 11 62 2c c6 63 ac 99 2b 68 3c c2 e0 47 80 8b 83 10 8c 46 24 31 82 64 a4 c6 fd b1 c6 c7 18 20 02 c2 8d fe c3 32 1b e0 c6 78 03 47 88 a1 aa 95 b0 c1 06 50 89 00 e4 8c 32 7b 92 39 e0 0c 07 80 a0 80 8a a9 81 94 31 25 74 21 7d dc c1 0d cc be 8e e8 2a 5e 84 ca 62 84 a3 d9 30 97 f3 44 4f 0a ff 02 8c 25 53 0d 23 78 80 df 84 18 fd f1 b9 91 63 09 73 43 c7 7f 48 c8 a0 f1 c5 18 40 29 da 80 84 e5 a4 c8 8a 6c 40 d9 30 b6 0e 7c 8c 2b 50 a9 b3 da 1f 77 11 c9 dd 53 09 12 e0 92 1f 82 32 3a ab b3 1b 7a c9 72 0c 17 13 30 3b b4 bb 49 9c b4 c2 c7 4c Data Ascii: MjRh6TU\EgWtLyLsq'L\Y^F b,c+h<GF$1d 2xGP2{91%t!}*^b0DO%S#xcsCH@)l@0\|+PwS2:zr0;IL
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 08 39 f8 02 4a d0 9b bd b9 08 12 d3 12 c3 e9 9b ca 79 90 8b d1 18 5e b0 90 d0 c9 90 56 c1 4e 31 41 9c ca 09 04 dc 22 30 58 16 24 3b 18 05 92 41 41 d6 19 9e d7 39 9e e2 59 9e e4 c9 02 1e 75 0d 37 a1 01 4d d8 9e ee a9 17 5d 21 2c 1a 40 16 e6 29 9e 32 39 14 77 61 1a e5 19 79 70 28 19 1a b0 08 e6 79 9f 17 53 9f 25 24 60 c8 69 9e 06 d5 12 05 20 3f f5 99 87 06 5a 9d e7 79 90 f5 39 9e 3c 39 a1 16 aa 9c 2c f3 0f 14 d9 4e e2 59 2c ac 91 92 f9 24 9e e8 d2 a1 11 06 1d c0 b0 94 28 da 94 d3 d1 04 cf d1 7c 53 a4 46 9c 58 64 ff 09 f2 0f 71 59 96 e2 b1 95 e1 31 39 06 d7 63 33 b0 61 98 b0 06 55 14 a3 5c a5 96 65 69 96 d1 87 96 54 c4 34 34 c6 34 7d a3 a4 33 76 24 06 72 63 67 55 63 55 54 03 33 52 7c 19 b2 61 74 d9 22 bd 02 4b 5b f6 57 26 21 8c 7c 29 3e e9 07 8c c0 78 3d 3f Data Ascii: 9Jy^VN1A"0X$;AA9Yu7M]!,@)29wayp(yS%$`i ?Zy9<9,NY,$(\|SFXdqY19c3aU\eiT444}3v$rcgUcUT3R\|at"K[W&!\|)>x=?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49839	99.86.4.105	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	397	OUT	GET /media/dd9a87_34be67cd0dc34bedbba06a4a787cba19~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	765	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 148349 Connection: close Server: openresty/1.27.1.1 Date: Tue, 31 Dec 2024 15:24:45 GMT Expires: Tue, 31 Dec 2024 16:24:45 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Wed, 13 Nov 2024 08:10:42 GMT ETag: "6543c524ce4220d5af9217f0adb44911" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-2wl4v Via: 1.1 google, 1.1 1b412557b82dda96e078541f9ee8dfb2.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: ykixP2c0pQicT_MT0VtjoUyPW0fzYkJQsFJUBII4UUDnJeqMInZDpw== Age: 136071
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 b8 ab a4 ce ec ef f7 d2 d8 5d 25 d6 70 5b 61 b4 a6 9d 49 4a e6 d5 c8 bb 6f 63 5c 8c 83 79 f7 ba c8 97 78 74 9c 93 89 8e 59 66 57 52 59 aa c6 c7 30 35 4b 7b 72 6b df 18 29 14 12 20 a7 79 81 0d 09 18 d9 d7 f8 78 56 5c 2f 66 f6 b9 d7 d9 47 3a 44 ae a3 99 59 59 64 e9 54 6c 76 86 88 e8 10 4c 77 75 76 48 43 49 95 66 6b 6f 77 84 84 99 99 ca bc b4 95 a8 a8 85 7b 73 a2 ba ba 55 45 49 a7 8b 83 f5 ae ba c5 b5 ad 9a 68 73 a3 6e 7a b7 c5 fb b8 b6 f3 a4 9a 93 73 6a 63 94 8b 83 6b 63 62 fb f8 fb ed 70 87 68 75 78 53 4c 53 9c b5 b6 94 74 6d 87 85 87 ad 9c 92 30 41 62 b9 9a 94 4a 48 52 be b0 a8 a3 88 7a de d4 c6 63 5b 5c 74 6c 6a 28 26 34 c5 ad a4 8b 71 e2 83 75 6b 69 49 52 d9 cc c3 8c a4 a5 a4 95 8a 91 85 7c d0 c3 b6 83 89 ef 62 43 Data Ascii: GIF89a]%p[aIJoc\yxtYfWRY05K{rk) yxV\/fG:DYYdTlvLwuvHCIfkow{sUEIhsnzsjckcbphuxSLStm0AbJHRzc[\tlj(&4qukiIR\|bC
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 41 14 bc 5d dd 45 c1 ae 5e 9c 23 88 42 c5 8a 42 dc 0e a3 dd 36 eb 6f 7a 2c b1 ca 82 30 c8 82 df ce 40 32 dc 69 9c 6e 24 b1 3e 2b b1 e2 5c 30 04 2b ce 6d 64 28 cd 80 de 7d ec 46 26 9b 87 26 e7 af b9 43 29 b8 28 98 7a 40 3d ac 68 6c 59 cf 29 e9 ff 56 cf 0a 5b e8 ca 41 2b 04 ed d0 56 42 2b 0c ed e2 98 63 bd 5e 00 29 60 aa 1d 60 4a ec 5a 6d 93 e2 86 fe f0 2b 92 72 13 b4 a4 aa 3e 42 66 1f bc 47 8c ad a2 91 ec ca ac be 26 56 a1 12 c7 c5 d6 32 d6 61 1c d6 ad 23 b8 81 71 f6 e6 30 6e 41 c7 a6 e9 16 78 ac 2c 68 01 36 c8 02 36 30 80 df 7a 2f b3 0a ee 9a 8a 82 54 d9 42 f9 9a af f9 fe a6 b1 de a9 2c e8 5d 9a 7a 28 cb 72 68 b2 95 60 33 82 a9 e5 c2 96 f5 ed 00 f3 81 27 98 12 82 da fe af b7 f5 6c 00 87 2e 17 b4 81 4f 7e c1 20 bc 97 50 5e 40 3c 28 ad 1d d8 81 1a 30 c2 05 Data Ascii: A]E^#BB6oz,0@2in$>+\0+md(}F&&C)(z@=hlY)V[A+VB+c^)``JZm+r>BfG&V2a#q0nAx,h660z/TB,]z(rh`3'l.O~ P^@<(0
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 53 6e 35 67 ee cb 6a 1b 57 58 93 8a e7 95 13 12 d2 90 cb db 8e ad ab cd 72 65 7b 52 b3 fe cd b9 cd 09 d0 df 31 44 de bf 27 8b 2d 0d 92 71 05 68 64 5b dc a0 dc c3 9e a1 21 68 76 18 7d 16 d0 18 81 ba 57 93 33 c7 31 1a 0c 80 78 00 35 c6 51 f5 48 97 35 03 dd 08 07 ed f1 ad 1b 11 59 c0 ac 8a 3a ca 12 e4 ff 94 85 66 08 e3 1d ef 40 7b cb 84 81 57 61 cc f5 80 be 25 66 08 5c 04 97 ba db dd b3 3e e2 d7 8f 8e c1 77 86 8c 87 78 c7 3c e1 99 4a 3e 32 31 87 2a e5 e5 14 30 7f 17 df df 21 44 be cc 7f 90 bc fa db 3f 86 38 c0 3f 0e 2e 77 80 1e 22 e1 d4 3d c0 16 94 35 8c 43 d1 f9 ac 87 a5 63 38 37 b1 b0 51 3a 1f 33 40 bd 3c 91 19 15 a3 86 1c b0 8d aa 33 ab 49 93 bd 54 b0 3d 0f d1 0d e5 d2 8d 79 2b 1a 33 68 8a dd 9a 05 08 31 8d 62 50 04 45 30 01 45 00 29 45 63 99 94 18 8d 91 Data Ascii: Sn5gjWXre{R1D'-qhd[!hv}W31x5QH5Y:f@{Wa%f\>wx<J>21*0!D?8?.w"=5Cc87Q:3@<3IT=y+3h1bPE0E)Ec
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 20 4a db 1b 0e 89 12 48 1c 12 df 80 04 00 5a 8c ee 9f a6 1b d5 3e 80 ba c8 f5 de 77 ef 9e eb e4 82 ef be cb d5 db 9e 23 27 f4 bd 45 4e 84 e2 83 ed 82 67 9f a2 01 a7 38 85 b3 2d 2f 82 cc 73 41 da f8 d0 01 3e 3c ff 79 a5 a7 39 10 df 36 f7 8c a1 ae 6e 74 b6 7a 55 57 71 64 70 00 4e c0 13 f6 26 04 0a 10 ff 2b bc f5 75 b7 87 7b 7d 36 76 09 f8 13 04 87 80 0f 86 2b c2 77 09 c5 b7 76 c6 77 09 8e 96 7c 12 97 0d cb c7 69 46 70 58 ea 06 80 a6 66 6a 78 97 77 a8 76 0b 35 c6 63 2f 88 2e e7 82 2e 82 a7 5e 42 32 18 ea e5 6b 0d a0 78 32 e7 83 89 a0 3d e7 17 6c 46 b6 7e 22 d0 6c 40 d7 02 d5 56 6d 0b 50 6d f5 e7 84 fc c7 7f 6a e6 6d 6e 66 0a 94 20 72 51 67 60 ac 67 04 12 07 7b 0a 30 40 b3 07 4e 15 d2 67 71 e5 67 19 e6 13 76 55 6f 0b 43 31 18 88 2b 0a 50 7c 68 92 26 4e b0 70 Data Ascii: JHZ>w#'ENg8-/sA><y96ntzUWqdpN&+u{}6v+wvw\|iFpXfjxwv5c/..^B2kx2=lF~"l@VmPmjmnf rQg`g{0@NgqgvUoC1+P\|h&Np
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 0c b9 a4 d3 f7 66 6f 76 67 a7 36 68 9b 37 13 58 2e ff 42 e6 e8 9d 57 2c 8f ea cf d5 43 13 5c b9 3b 50 79 fe 39 42 02 e0 f6 e8 f1 36 2f e3 43 ed ea 80 0e a8 b5 5b 7b c3 5b 83 34 23 d8 81 9a 13 7b 9b ab 81 86 c6 c3 31 97 4b 65 14 5f 4a e3 aa 9d 7a 1d 9f 53 2b ab b1 c4 22 bf 9e cd b4 27 25 53 aa 16 60 83 29 c7 73 d1 46 aa 14 db b7 91 1b f9 78 8f 37 0f 4c 76 ba c7 c0 a6 6f 42 3e c0 83 90 6f ff 3a a5 fb b8 78 3b fa 7d 77 f6 69 d3 f8 69 1b c3 7a 0b 74 00 5f 2a a6 fa f7 a8 b6 b8 16 98 27 81 f3 b0 39 ef 32 21 88 f5 c2 2f 3c 6f 43 b0 0e b4 c1 17 b4 2d 9b 5f 80 1a 00 7b db 36 80 9a 5f b8 1a b0 41 72 b3 41 85 a6 6d 9d fb f5 5f 1b 72 4b 5b 45 02 de 94 c1 d9 30 8c 73 b7 3b d3 73 3c ef b4 cf 6e 01 cd 37 75 b9 9f 76 8e ab f7 3d f8 38 bb a7 43 0c f8 fc a6 17 40 90 5b 43 Data Ascii: fovg6h7X.BW,C\;Py9B6/C[{[4#{1Ke_JzS+"'%S`)sFx7LvoB>o:x;}wiizt_*'92!/<oC-_{6_ArAm_rK[E0s;s<n7uv=8C@[C
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 3c 49 ef 24 82 08 38 01 39 38 81 28 ec 3c fb a3 c8 8c cc 48 fd db cb 43 3b 3a 5c dc 03 10 00 01 69 00 81 1b b0 84 29 f8 83 3d d0 9f ca 79 3d 7f 13 32 c3 2a b2 1c d0 52 3f 30 50 3f 3c 4a 04 fd d2 70 c8 80 6e 10 1d 29 3b 26 a8 e4 0b 0b 6d 06 7b 10 16 bf d0 4d 2f 69 84 7a c0 ca d0 93 39 7b 10 bd 4e e8 04 5c 68 45 5c b8 d3 3c 95 8d 4c a4 97 0f 33 ae e7 cb 0a 41 ed b8 84 e4 2d 87 44 ae eb c4 3c 2a 8c bf 19 3d c9 f0 bc cb 2a b0 d4 ce eb cb 46 f5 d1 8e ec 42 54 05 01 22 20 d2 bd ac 45 30 dc d4 8c b4 3f a2 5b 05 46 8b 03 c9 8c cc 60 8c 4c 95 d9 4d 00 3a 93 d9 1b b2 d9 1b 87 71 c0 82 0c b0 00 ff a0 f4 c6 d6 fc d2 8c 6d cd 67 d8 c6 6e 70 86 c9 42 01 45 20 d6 2b c1 a2 2c f0 04 0b cd 22 dd 14 86 a7 14 06 c4 90 2f 76 30 b4 55 f8 c8 31 f8 48 ee ec 04 eb ec 84 51 3a 86 Data Ascii: <I$898(<HC;:\i)=y=2R?0P?<Jpn);&m{M/iz9{N\hE\<L3A-D<=*FBT" E0?[F`LM:qmgnpBE +,"/v0U1HQ:
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: f7 cb a0 53 75 31 9d b2 43 d7 8e df 0b 76 c2 5e 08 bb 75 f0 60 02 86 49 5d 18 78 70 20 45 85 0e 19 27 74 38 d9 71 43 82 04 d3 4c c4 98 66 e3 36 2b 1c 7b fc 00 bd ad 5d a8 91 37 43 58 e9 f8 03 66 1c 0e 20 92 2d c2 a1 72 f5 9a 35 1e 73 6b 08 a1 41 4a 08 7b 21 8e 1a c5 91 62 69 92 63 b0 92 a4 88 1a 35 45 12 28 6c d8 5c 90 5e 96 b0 d8 ad 64 cb 96 45 2b 77 6d 0b b5 22 e0 72 ff 1f c4 89 fc 29 bc 76 d1 a2 3f 95 e8 fc 97 f2 83 06 db 51 c3 a8 f0 60 5c 17 70 e1 8a 87 df 70 56 52 97 61 86 90 42 11 41 16 19 43 95 09 98 99 44 98 69 96 51 2c 45 c4 92 c6 47 1a fc 64 c5 49 30 39 c0 5b 4b db fc d0 0c 07 1c fc b1 c3 15 37 d4 b6 d3 36 10 ac c4 9b 06 25 69 a0 ce 51 47 fd 86 54 71 4a 21 37 d5 2b 54 25 a1 63 74 da 55 b7 0c 60 d5 6d 35 df 58 e2 a5 a5 56 1b 6a 7d 97 16 5c 72 c5 Data Ascii: Su1Cv^u`I]xp E't8qCLf6+{]7CXf -r5skAJ{!bic5E(l\^dE+wm"r)v?Q`\ppVRaBACDiQ,EGdI09[K76%iQGTqJ!7+T%ctU`m5XVj}\r
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 2f 35 fa 14 fb 54 aa 9c c0 71 6a a0 35 de a0 36 ad 46 25 fa 72 0a 53 7a 6f 68 d5 ea c0 87 2f 8a 23 77 b5 fa d4 b5 7b 3f 82 5e be 81 eb f5 af b7 4f 0b ff 0a 43 4c 90 94 38 7b ec a1 2e 98 c8 24 98 7d 50 ea ad a1 08 1d 7a cc b3 83 5a 33 cd 34 84 30 c4 f0 8a 8b 46 e3 07 34 d6 2e 8c a1 10 d7 58 7b ac b6 cc 70 13 85 c5 26 b4 b0 6c 06 59 1e 74 a9 a0 98 e8 90 49 b8 2d 0a a4 a3 ff b7 9a 90 c3 29 88 60 82 d0 29 10 a2 46 19 45 04 24 ab 73 0a aa a7 a8 12 81 93 16 b8 fb 4e 2b 35 c4 41 aa 8d 2f 06 31 eb 2c b4 fa e0 82 ad f7 a2 a8 04 af fa ea 02 41 2e b9 4a 71 c7 9d 7a 76 d8 c1 3f c2 9a 40 ac 1e 2d 12 8b d1 96 c6 28 d4 a5 8b 18 32 c1 8c b3 ce ac 29 40 44 04 55 83 c8 a2 0e af e8 e2 1e 88 ae 80 2d 86 d8 22 25 d1 9a 12 4d c4 a8 43 d0 1e 2b 29 b3 cc 4e 6a 02 54 2d 40 9d 13 Data Ascii: /5Tqj56F%rSzoh/#w{?^OCL8{.$}PzZ340F4.X{p&lYtI-)`)FE$sN+5A/1,A.Jqzv?@-(2)@DU-"%MC+)NjT-@
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 07 1a 98 c1 38 60 87 b8 d3 41 c8 89 03 3d 88 84 11 c8 b3 36 e9 9f 59 5a b1 1b b8 b6 8c e2 a8 1c 4b 3c f3 13 32 08 7a 23 f6 63 86 00 90 42 5f 68 97 a5 99 3f fc 33 a3 0f b1 2b 13 c0 3f 14 78 a9 3a 0a 40 a3 bb 81 66 f0 8c 9b ea 1d 81 29 18 9d 51 87 5d 39 15 ff 16 92 30 27 e1 8e 27 09 15 fe 38 1e 7b 73 89 50 4a 81 1f c8 ad 5b 33 35 5e 3b 8b 81 52 be 38 b8 c1 15 44 41 22 80 a8 43 24 02 14 64 41 34 71 3e 8b 8b 83 31 a0 81 12 64 87 ec 73 2d ec 63 07 4c 44 13 1e 84 86 df 38 2e fe b9 89 de b0 25 d6 f0 09 1b e3 2e 54 70 9a f0 4a 05 0b 08 07 56 64 26 56 8c c2 29 64 06 66 78 06 f8 c3 b9 c9 cb 01 54 b8 3f 33 98 0d 5e 8c 0d db c8 10 fc ab 86 fb 0b 3d d1 c3 19 c7 58 b2 03 23 1e 2f 50 07 2b 50 07 e4 f1 92 b5 49 9c b3 70 80 14 30 b5 b8 80 18 39 d4 18 20 92 02 3c 5c 16 1c Data Ascii: 8`A=6YZK<2z#cB_h?3+?x:@f)Q]90''8{sPJ[35^;R8DA"C$dA4q>1ds-cLD8.%.TpJVd&V)dfxT?3^=X#/P+PIp09 <\
2025-01-02 05:12:37 UTC	893	IN	Data Raw: 83 79 38 d2 80 96 c7 80 0f 48 88 58 46 81 20 d8 02 22 00 82 14 28 02 9c a0 88 8a d8 06 6d 80 81 91 08 7b 25 a8 03 0b 70 82 8e 70 7b 41 e0 06 a6 e0 82 31 18 04 14 f0 82 a6 40 8a c4 c7 03 8d e6 71 ea 67 86 90 10 13 e4 80 19 5e 42 30 c0 56 67 cd a7 7c cf 27 ff 48 56 45 7d 53 78 09 57 a8 7d 9c a1 19 5c 18 13 41 e8 8a 59 63 12 32 31 86 6f c0 07 2c 00 09 06 98 71 8c 36 0f 79 d0 77 f2 07 87 85 f7 09 88 60 83 76 d8 7b 8f 87 0e b7 f0 7f 90 47 38 35 27 0e 0c 28 88 98 47 88 9a b7 79 e0 b0 88 20 98 08 88 f8 88 2d 90 08 1b 28 02 91 18 8f 92 28 89 95 c8 05 95 d0 2d f8 a0 8f f8 f0 82 be a7 02 30 18 04 81 80 74 2a 70 87 a6 60 08 3c 40 78 8d a6 71 66 c8 02 3f 48 06 64 50 20 56 17 8b 52 95 75 0a a7 70 d1 67 8b 5c b7 25 ba 48 6d 57 38 43 2b f1 7c 41 18 13 09 22 13 25 49 26 Data Ascii: y8HXF "(m{%pp{A1@qg^B0Vg\|'HVE}SxW}\AYc21o,q6yw`v{G85'(Gy -((-0t*p`<@xqf?HdP VRupg\%HmW8C+\|A"%I&

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49842	99.86.4.105	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	397	OUT	GET /media/dd9a87_4314275b0467418ab4bd32c8da4d6358~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	766	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 1016730 Connection: close Server: openresty/1.27.1.1 Date: Tue, 31 Dec 2024 15:54:08 GMT Expires: Tue, 31 Dec 2024 16:54:08 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Wed, 27 Nov 2024 13:34:44 GMT ETag: "294291294d851fecadaf4c11864f83e4" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-fktdr Via: 1.1 google, 1.1 a350f357b825293e306b1b0a2cb490c0.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: Nqmx6fnpr7vBJyaTzsfJrm2GRuSbeZdsXwB13atbqxQi2yQEXaP2JQ== Age: 134308
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 aa 76 54 fe 33 90 50 89 f4 f5 f0 f9 a2 c5 fd 8d 67 cf 83 ac f7 9b 9b 99 cc cb ca d1 a5 77 a9 a7 9a ed ba b0 53 4c 45 aa 89 77 b4 55 b8 6b 77 e2 d6 45 a6 2a 1a 14 ce aa 98 ec c7 9a fb ca b0 c7 bd c7 52 37 32 bc 99 89 37 91 ff cc 4a ab a7 9d a7 f4 d7 ec f6 ae d3 8b 4e 34 4a 2a 16 e7 ae 7a eb 9d a1 7a 7a 85 c1 d1 fa 7a 62 48 98 6a 63 fc 6d ad d9 9b 78 f6 96 c5 cc 8f d0 66 66 58 ec 3c 9a b7 67 ba d6 6c ba 64 30 1a 64 5a 65 cb 9d 85 db 9b a5 d6 e5 fe a8 a7 8b db ad 97 fb c6 df b6 b5 9c a8 5b c0 c9 c7 bb cb 99 93 ab a9 a9 89 66 54 b9 b5 ab fd 51 9f b0 76 c2 d1 ac dd 93 5a 64 ab 5a 62 7a 64 54 c9 78 68 8f 7a 87 9b 85 60 81 38 42 95 8b 87 89 89 87 99 76 66 d7 a5 8f a7 9b 97 b7 ad ab d9 99 87 bd bd b3 76 78 74 cd 8b 92 e9 9b Data Ascii: GIF89avT3PgwSLEwUkwER727JN4JzzzzbHjcmxffX<gld0dZe[fTQvZdZbzdTxhz`8Bvfvxt
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: e7 1c d2 19 10 01 ab f6 27 ad d2 2a 1d 46 ec 1c ce 5e 5c e8 a1 1f 1e 48 ed 49 95 a2 91 93 a8 ec 1e af 86 83 52 85 c3 bf d1 23 cb 38 5f 0c 2a 0c 54 aa a1 9b 42 43 10 b8 40 25 48 62 b4 d2 58 40 d6 41 0b 2a d2 32 30 69 9c 95 86 23 bc 0d 1b e4 c3 3b 6c ff 16 00 8c 28 00 b0 ce 1c d4 46 91 61 5c c6 35 80 8a 1a 49 6e 74 5e eb 86 5f 2d 0c 69 91 36 40 18 a4 42 72 a6 68 1e d0 ae ed 7e c2 1c 20 e9 24 c1 01 1c 28 dc 3d 8c 80 32 d4 01 8d d5 41 cc 64 c2 2c 40 29 36 92 91 11 fc a7 de 04 22 4f e5 67 27 18 c1 11 8c 03 a2 f8 19 87 e0 c1 d8 f5 4d a0 ed 21 87 c8 45 dd 06 10 a7 0c e5 3a da 05 1d 30 90 01 ad e9 34 0a 88 e9 15 8a 9b ce 02 9c 56 81 17 40 c3 08 90 96 55 b6 20 a7 55 6b 25 44 97 8d dc 83 f5 e9 80 17 b1 e7 9f be 86 25 c5 46 7a 4a 5c a1 5a 41 72 46 44 2a 94 03 a5 96 Data Ascii: 'F^\HIR#8_TBC@%HbX@A20i#;l(Fa\5Int^_-i6@Brh~ $(=2Ad,@)6"Og'M!E:04V@U Uk%D%FzJ\ZArFD
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 70 36 63 78 86 7c ce 00 9d 30 15 04 7a b3 2d 0f 82 11 e8 32 10 aa 43 ae 03 41 aa 1b ff da 29 7b 60 b2 99 e7 c4 52 e7 05 c4 6c 27 4d 05 ad 8a 3a 10 05 9b a3 81 1a 15 94 fc 12 e6 db 14 94 70 9b 03 eb 97 80 9b c6 68 a0 83 32 58 7c f9 e7 86 70 ac 0f c3 27 68 b8 b5 32 62 03 07 29 b0 c7 ff b0 0f d8 12 0b 1f b8 b1 74 60 b2 ee 01 b6 d9 a8 c8 9d 99 8d 14 6c 27 0f b5 54 56 80 67 c2 f8 14 b2 49 bb 7c fa 12 a9 7b cd 48 ad c9 d7 5c cd b4 1b be f7 c9 b7 3b ea d4 eb 98 b4 09 0d 9b 47 0a 7b ec 96 5f d2 ca 73 c5 24 10 43 b0 22 fb 41 05 58 75 14 e7 50 b6 0e 9c 8d 51 b3 c8 30 c1 29 d6 c6 29 9c e2 02 bc 43 bd d8 60 6d 6b 00 23 0a e2 36 42 08 ad 2d b7 6e b2 4a 10 f3 e8 97 3d 69 d8 4d 21 cd 5c 5c 10 d0 5c 10 45 dd 05 94 30 be 7e 3d b4 7e 4d 9b 78 59 10 fa c8 c6 a3 8c c3 ba 07 Data Ascii: p6cx\|0z-2CA){`Rl'M:ph2X\|p'h2b)t`l'TVgI\|{H\;G{_s$C"AXuPQ0))C`mk#6B-nJ=iM!\\\E0~=~MxY
2025-01-02 05:12:36 UTC	15108	IN	Data Raw: a8 48 ac 52 85 0a 44 4e 55 32 f5 f9 b7 f1 1f b4 7f 23 04 8e 18 d1 87 e4 88 52 41 fe 05 59 19 04 4e 10 1d 5e f0 c1 11 38 53 a0 a3 82 05 e1 e0 d3 f1 6f a6 97 94 5e 4a a5 28 39 91 0a 30 60 d9 ce 58 38 83 b3 a9 d3 a7 50 a3 4a 9d 4a 55 60 26 81 c0 08 56 a4 52 09 9a 43 87 9c a0 55 f9 77 f1 5f 15 68 99 46 40 bb a7 12 e5 c0 94 74 58 aa 74 e9 a8 65 4f 81 3a 1c f1 fc b7 05 df c0 9a 36 ff 21 99 e9 08 0e e0 96 29 fb 78 a9 12 a4 4f 25 60 0b 67 59 00 e6 a2 aa e5 a7 31 04 1a 10 71 b9 73 d3 2d 63 a8 30 a8 c2 70 a0 c4 7f a1 67 49 84 38 f6 df 2c ab ff 32 8d ad d2 27 31 c9 81 25 05 a6 74 8b 2f a4 61 81 5e 74 a4 fc 47 e2 df 4d 9b 33 f1 dd ec eb 88 ce bf 1f 70 9c 97 f2 a2 bb 76 10 65 7d 2a 32 a0 92 74 1f 3b cf e0 0d 08 ff 10 21 fe 01 01 f0 9e ef 34 e4 d8 da ac 57 ae 12 e1 57 Data Ascii: HRDNU2#RAYN^8So^J(90`X8PJJU`&VRCUw_hF@tXteO:6!)xO%`gY1qs-c0pgI8,2'1%t/a^tGM3pve}*2t;!4WW
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 1f 6b 66 40 ce 3f d0 55 a8 dc ce 2a 28 01 d1 62 d8 11 68 81 03 ad c1 21 75 98 41 a4 a5 ea 90 e2 19 97 d3 a9 cc 8e 56 c9 4a e7 72 31 ad 14 67 2f 87 b1 74 86 8c ad d8 93 3d 65 86 11 1c c0 3f 04 83 11 dc 81 27 04 43 30 1c 01 36 68 4c bc f6 4e 90 8d d2 ed 98 df d2 e0 1b be 22 23 06 47 8d 0e e5 c4 78 6d 0a 09 fb 63 77 55 42 0e 8f 44 0b c8 f3 24 27 42 25 60 42 24 fc 40 07 d4 70 22 2c c3 0f a0 d1 f5 d8 81 b2 b1 81 dd 8a ac 96 30 46 66 9c a7 4b d4 10 53 29 87 17 04 c3 1d 10 c3 8d 38 84 cb 68 01 ba 49 e1 8a a9 ca 2a fe c3 22 4c de c6 74 02 ab 58 6b 6a bc 08 17 67 86 2c c6 62 8c c9 a2 cf f6 f5 9f d9 96 13 22 a1 5d ab 65 6e 69 03 31 b0 b4 36 1c 40 30 e4 c1 17 68 0c 3b cc 82 b4 88 52 74 60 89 eb 19 ff 55 26 b8 40 e0 02 96 d8 dd 84 97 b4 52 88 64 30 1c 18 19 75 2c 43 Data Ascii: kf@?U(bh!uAVJr1g/t=e?'C06hLN"#GxmcwUBD$'B%`B$@p",0FfKS)8hI"LtXkjg,b"]eni16@0h;Rt`U&@Rd0u,C
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 20 8a 3a 99 60 ae ce e8 aa 23 b2 08 98 9c 1e 52 82 88 85 fa 07 2e 6a 1e 94 68 b4 93 58 28 6c 60 80 a4 84 86 73 5c c9 75 1c 01 6f 28 05 1d 78 47 1d 88 47 00 40 b2 25 4b 03 7b 00 23 90 0a 0e e2 20 10 25 29 08 6c ab 8a 7f 08 05 be bc 32 ff df 99 33 09 68 ad a0 92 1a ea c8 0e a1 d2 0e 09 7b 29 9e ba c8 24 44 87 1a a8 0e e9 e0 48 cc 5b aa 9d e3 41 5b e0 c7 e0 00 19 2f 22 01 c1 22 81 06 a1 a4 7f 68 07 56 fa 2a 2e 6a cc 10 58 03 ea 5a 28 50 b8 c3 38 2c 18 b1 b2 40 ee 19 89 58 5a 11 2f 18 9f f7 fc 07 ea f2 02 7c 68 18 dc f3 82 85 b2 2e 12 3b 03 7c 61 00 60 68 07 4c 18 3e 35 38 44 81 0b 02 1d 90 4a 47 e0 1a b7 f3 ab 4f b8 9f 3c 70 8c c6 21 19 8b 83 0c 40 28 92 ed 5c 21 95 e1 cd aa 50 23 29 21 90 39 e1 3f 3d 49 c2 5b 40 27 09 20 c2 e2 dc 0a 18 68 ad 24 00 c5 1a d5 Data Ascii: :`#R.jhX(l`s\uo(xGG@%K{# %)l23h{)$DH[A[/""hV*.jXZ(P8,@XZ/\|h.;\|a`hL>58DJGO<p!@(\!P#)!9?=I[@' h$
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 14 1b b0 02 75 64 86 0f 50 00 31 08 66 6b f8 82 18 e0 86 4c 01 5e 08 f8 8a cd f2 06 4f 21 01 ae 50 10 33 70 93 b7 f0 0f 2d 0a 84 37 99 87 40 07 84 3a a8 7b 2f 40 0f b3 86 03 28 46 67 9f d5 0a 49 f7 84 25 c5 45 44 44 38 f7 82 20 0e d2 22 a2 81 81 2c 52 05 d4 80 8d 29 80 8d 12 fa 0f d5 39 15 28 30 5d 63 59 8e 2e 78 8e a5 a8 8a 4f 91 49 a0 d5 0a f3 96 29 85 b0 8f 4e 21 06 04 25 05 2d 2a 10 12 e0 7b 32 2a 10 7a b8 59 37 2a 6b b8 e7 97 38 96 59 77 f0 51 36 b6 80 4a 94 4d 92 07 07 36 01 25 6a a2 15 f8 04 71 d7 e7 02 e7 30 06 0f d2 8d e7 70 0e 9a ff 28 15 9f 23 96 22 89 a5 ff 60 00 69 99 72 04 70 72 20 ba 14 76 f3 72 2f 56 97 db 11 9b 4e f1 83 85 a0 a6 03 f1 9e b3 d9 a2 ad 99 04 70 66 87 28 66 87 7c 58 78 04 d1 8f 00 89 88 ba 86 78 51 d4 00 03 94 40 d0 43 24 05 Data Ascii: udP1fkL^O!P3p-7@:{/@(FgI%EDD8 ",R)9(0]cY.xOI)N!%-{2zY7*k8YwQ6JM6%jq0p(#"`irpr vr/VNpf(f\|XxxQ@C$
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 12 a7 a3 66 3d 56 82 56 89 4a a5 4c 0f 1f 92 55 b9 32 65 cf 11 74 fe 79 fb 07 e7 1f 4e 47 7c 83 a4 7b 1a 04 1f cd 20 3b f3 0a 0c d2 b3 8a c0 94 55 2e 56 64 00 cc 02 03 17 55 33 6b de cc f9 29 30 71 16 04 82 4e 98 f0 9f 44 cb a7 4b 03 5b cd b1 4a 95 4a a4 a1 85 fc 68 f7 1f 4a 9a ff 52 b2 d4 1d b3 54 10 df 70 e0 d0 f4 c2 57 47 70 81 5e 70 fe 4b 3e e2 f7 cc a1 d0 5c f4 f1 18 79 d6 18 60 75 2c 2c 15 d8 a8 b3 f7 ef e0 45 6f ff ac f4 10 da 3f f2 b2 dd 16 75 4b e5 9f 5b 85 54 c2 52 31 cf 36 e5 3d 4e ff 4e 8e 14 0a ed 20 71 9a 79 d1 04 98 40 74 cc f4 8f 62 ff 38 82 8f 5f 03 0a 84 0f 3e c4 19 87 db 62 76 79 21 5d 15 2e 8c f1 d0 2c 16 88 b3 cf 3e e1 85 28 a2 54 dd 24 64 1e 7c 0c a4 18 9f 8a a4 29 f4 cf 18 8e c5 e8 1a 51 ae 65 82 19 34 38 fe 93 02 4b 2c dd e3 db 4b Data Ascii: f=VVJLU2etyNG\|{ ;U.VdU3k)0qNDK[JJhJRTpWGp^pK>\y`u,,Eo?uK[TR16=NN qy@tb8_>bvy!].,>(T$d\|)Qe48K,K
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: ea ca ea 5f 30 62 da c0 0a 77 f9 af a4 c7 e8 0a 10 b2 52 72 fd 9f d8 7f c5 11 8e 54 69 10 6f 5f 81 5f 82 25 1c f8 0f cf f9 7f 74 24 ae 5f 1f 8e ce 1a 87 18 05 62 14 1f 99 d8 d7 cb 95 f7 63 96 61 04 a6 95 0e 60 e5 88 59 96 f1 82 04 5e 00 78 27 8d 54 04 b2 23 0d 3b 54 4b 23 b5 7f 78 f1 e3 12 5e d4 e8 60 99 7f 30 01 c6 82 33 3c b0 c0 83 7f 8c a8 21 2b 23 94 68 69 11 84 8e 38 80 98 f2 04 62 65 91 03 5a fa e8 80 3b f4 33 4b ff b2 e8 04 fa 8a ac 7f c6 39 c2 08 67 40 71 86 2f 22 d5 43 8f 49 82 fe 01 85 8e 3d c6 48 61 8f 58 62 f9 67 8d 14 ce f9 a7 0a 88 da fb e7 08 b1 2c 2b a8 a3 03 82 ec 2f 24 b4 d4 f2 48 06 e8 fe 19 a2 8f 2a 74 60 43 a0 3c 74 9a 03 8b 7f ec e0 a9 42 21 00 98 c3 8f 62 2c e1 a5 83 4c 6a e3 06 98 a8 2c 60 40 14 05 1c 45 8e 15 e7 d4 4a 69 25 62 cc Data Ascii: _0bwRrTio__%t$_bca`Y^x'T#;TK#x^`03<!+#hi8beZ;3K9g@q/"CI=HaXbg,+/$H*t`C<tB!b,Lj,`@EJi%b
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 5f fc 73 04 28 96 81 32 62 08 a0 7c c1 23 a8 ff bc 1a 2a aa 35 9e f3 63 aa 87 f5 38 06 35 af ed b1 c5 6c d8 e0 71 c6 6d 16 fc 93 db 42 0f 55 a2 4c 26 cd 42 43 5c 10 3a c0 e1 86 23 cb 21 e1 46 1a 69 7c 92 86 39 dd 7c 92 8a 1d 56 d8 62 87 5a 30 71 47 0f 20 34 e9 83 13 3d b9 8c 95 0b 81 44 11 15 8a 51 ff d0 3b a7 55 76 4a 81 4b 9e 61 e5 e4 1f 4d e4 85 f5 cf 2e d9 fd 73 a0 3d a9 fc d3 0d 11 6e 00 80 04 12 5b 38 e2 0d 3e 23 64 a2 cc 85 19 fe a3 21 3b 43 20 76 d8 61 96 c9 38 ab ab 87 55 66 10 42 99 81 88 47 a8 ff 14 e6 ff cc 11 85 39 e2 c4 1a 29 e0 b8 47 65 a9 e1 b1 c7 5e bc 42 83 8d 69 d8 fc c3 c0 3f 75 2c c4 40 1d 16 40 44 45 25 6a 54 74 97 84 f7 50 49 04 09 20 31 47 92 4a 0d 98 f4 89 15 63 aa f5 8f 4a b9 08 63 93 4d 62 d1 93 9f 3e 6c c2 23 85 14 92 84 c2 44 Data Ascii: _s(2b\|#*5c85lqmBUL&BC\:#!Fi\|9\|VbZ0qG 4=DQ;UvJKaM.s=n[8>#d!;C va8UfBG9)Ge^Bi?u,@@DE%jTtPI 1GJcJcMb>l#D

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49843	149.104.32.188	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	346	OUT	GET /11.gif HTTP/1.1 Host: 5967.5967007.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	472	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: image/gif Content-Length: 18662 Connection: close Set-Cookie: X-SUDUN-WAF-R-C=0001695112; path=/ Last-Modified: Fri, 20 Dec 2024 06:12:50 GMT Vary: Accept-Encoding ETag: "67650ae2-48e6" Expires: Thu, 02 Jan 2025 05:42:36 GMT Cache-Control: max-age=1800 Server: layun.com Access-Control-Allow-Origin: * X-Request-Id: 1a187df791478f8d9860cf10bc64c2b3 cache-status: HIT Accept-Ranges: bytes
2025-01-02 05:12:36 UTC	15912	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 fd da 2d ff f0 39 c6 0f 2e ff c6 0f fe e5 32 a8 90 15 bb 06 24 5e fb 54 f6 cc 36 f9 c7 2a ff d1 1a ce 15 35 df 22 45 f4 ba 28 dc 20 42 f5 b7 19 01 55 de e7 4e 6a ff e8 50 e9 a0 33 fa d7 36 ff c1 0a ff d6 22 db 1f 41 c5 0e 2d de 21 44 df 98 2d e6 93 2b ff c5 0e e9 97 33 d2 18 38 e3 89 24 1e 19 03 8d db 5b c5 27 29 d9 70 1e e6 84 34 c8 11 30 ff be 07 ff eb 8e de c5 25 d5 66 1e 02 f9 8f 02 b2 b8 ff f4 cd eb a3 29 ff bd 06 e8 96 1a dd b6 16 d5 30 36 d6 58 2b f3 bb 34 e4 7b 34 ff fe f7 db 74 27 f2 ac 17 ff d9 50 ce 51 1e ff fe 01 89 73 0e e3 6c 3e e4 8d 16 f2 9c ac dc 62 32 d8 1d 3e c9 38 27 d7 2a 38 ee a4 1b d3 19 3a d4 4a 2c ff e8 6f d8 53 31 66 56 09 d5 1a 3b e4 59 3e ff f4 b8 ff d2 1b dd 47 3b fc c3 17 e0 83 1d cf 16 Data Ascii: GIF89a-9.2$^T65"E( BUNjP36"A-!D-+38$[')p40%f)06X+4{4t'PQsl>b2>8'8:J,oS1fV;Y>G;
2025-01-02 05:12:36 UTC	2750	IN	Data Raw: 4a 57 18 12 80 d4 47 d4 14 10 46 a2 e2 8a 91 cc 87 c4 7e e8 85 c1 e2 79 7d d5 b2 e2 14 1a a2 05 02 8b 96 f5 b5 c3 8a 8d c0 b8 13 0a 2c 9a 18 c7 14 2b 32 88 56 01 2c 36 a9 62 2d 3b e9 21 a3 88 0d ca b8 a2 78 44 31 c9 a2 84 b5 ad 48 23 5a 48 38 89 e5 4e 5a 46 c2 e5 5b 48 b2 48 25 51 71 b0 08 ce 9b 70 be b9 83 25 70 ae 19 63 9c 1e fa 33 45 9c 6f 2e f6 96 27 70 0a 49 27 9f 5f 12 85 04 9c d9 a1 05 08 9f e0 9c 89 56 9c d7 44 5a 4b 55 94 22 81 82 9d e3 85 11 69 a4 1b 6e ea 29 a6 82 6c 3a a6 3f 9a 7a 7a 4d a2 1f 6e 8a 69 01 a6 72 5a 5b ab 98 92 ff c9 4a 18 b4 d2 5a e8 4e b5 e6 6a 6a a7 b0 4e 27 6a 5f a5 7a 8a 2a 51 aa 6e d6 ea 35 26 06 8b c9 b2 b1 fa 23 48 ae b6 02 0b 6d 18 28 2c bb 6c 61 ac 58 6b ad 90 48 58 3b aa 25 da 2e 0b 65 5f d6 62 0a 48 b8 98 b0 52 98 27 Data Ascii: JWGF~y},+2V,6b-;!xD1H#ZH8NZF[HH%Qqp%pc3Eo.'pI'_VDZKU"in)l:?zzMnirZ[JZNjjN'j_z*Qn5&#Hm(,laXkHX;%.e_bHR'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49833	36.42.77.151	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	600	OUT	GET /jsgif/yf1300-200.js HTTP/1.1 Host: 2024hwus1.heibanwa.mobi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:37 UTC	576	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: application/javascript Content-Length: 535999 Connection: close Server: openresty Last-Modified: Sat, 14 Dec 2024 17:08:23 GMT ETag: "82dbf-6293dfeb2c32a" via: CHN-SNxian-AREACT2-CACHE10[7],CHN-SNxian-AREACT2-CACHE36[0,TCP_HIT,2],CHN-HElangfang-GLOBAL6-CACHE31[602],CHN-HElangfang-GLOBAL6-CACHE130[395,TCP_MISS,599] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: cc1008580d1c0542d2ec6dfc19eab4f1 nginx-hit: 1 Age: 1598581 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:37 UTC	15808	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ca 00 9d 62 fa 96 70 5a 04 be ca ff 01 26 ff ee ac d8 d5 d3 af 8b 66 e7 64 a1 93 6e 9a d6 bb b2 6b 59 55 54 9c 49 da cc fc e3 dd 79 e8 99 1b f9 b2 b5 53 2c 1a dd ba 53 92 5a 29 cf 0c 54 d3 af 97 9e 05 06 fe 01 45 06 4b ae c8 36 85 01 66 01 fb af 95 63 46 2e 6d 8d de d9 cc b9 e7 dd fa 9e eb f8 e8 99 00 ea ff c3 af b2 97 ff aa 10 fd 96 a8 fe 68 70 b8 b2 b3 ee dd 4b ff dd 5e 68 50 91 f5 b5 6a b4 96 8a 01 00 01 d2 b5 fe 95 1e 8e b9 ae fb fb 4d 4c ee ee c7 f9 b6 cf b1 95 fe 65 1d ab fd 81 90 60 db f5 ee cc a6 9c 25 5c d3 02 09 ce 21 22 ff 4e 6e ff ef 98 f5 b3 51 fe 25 49 d0 ae 70 ee 88 1c ee ee dd ff ee ff d1 96 8d 8d 88 80 d0 93 70 ff ee 00 fa 8f 4c 5f 8b 9f 35 2b 2e 77 4b fd f6 4a 2f 17 6a 8d 56 2c 55 a1 95 2b 6c 69 f8 d2 f2 Data Ascii: GIF89abpZ&fdnkYUTIyS,SZ)TEK6fcF.mhpK^hPjMLe`%\!"NnQ%IppL_5+.wKJ/jV,U+li
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: de 75 44 c4 44 5e 1a 1c b2 df d1 b1 d6 60 79 62 6e 24 96 a6 6d 24 b2 b9 21 1f 12 08 ae d1 d0 77 dc 4e d7 09 22 43 b9 a2 69 a4 5c 43 3e da e0 18 e4 20 52 87 4b 7a 9f 6e c9 d1 4c a2 14 3d da a4 d6 f5 8d e8 5d a4 91 71 db 69 66 a6 d9 ad d1 76 52 a2 50 3e 5c 51 b6 0b 56 a6 07 71 3e 8c 8c 1c 4f 8d 80 81 53 66 08 86 bc a7 c3 a0 48 85 f0 cb 85 c4 67 22 f1 1d 28 62 09 11 1c 83 0a 8e 84 04 10 61 32 e8 c2 72 41 80 02 ee 1b 1f 18 80 13 bc 20 bd b1 80 08 34 23 00 29 40 07 7c 0c 84 4e d2 2e dc 00 47 64 c4 0a 98 52 bb d1 65 bb 3d 17 00 39 17 87 f2 60 0a fe 00 89 f2 41 20 28 dc 9a bd 12 77 c2 e4 50 9a e6 4a 46 59 1c 9e 9e 41 32 07 ee 29 e7 8a 26 5d 6a 3e 22 44 ed e6 a4 54 e4 6d 65 da 1c 42 e1 d9 6d 85 3b 60 24 4b 0a d1 aa f4 8d 40 b2 ff 4d 64 34 1f 1b b9 50 65 f5 9a 43 Data Ascii: uDD^`ybn$m$!wN"Ci\C> RKznL=]qifvRP>\QVq>OSfHg"(ba2rA 4#)@\|N.GdRe=9`A (wPJFYA2)&]j>"DTmeBm;`$K@Md4PeC
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 7b 83 8e cc 80 05 38 05 d0 00 04 7b 6b c8 96 ec a6 26 48 04 2a 50 49 93 3c 4e 97 aa 82 26 e8 47 ed a1 c9 24 a0 49 27 d2 c7 0d 90 80 88 bb a3 97 00 c3 49 98 84 a8 9a 82 49 f0 b3 39 1a cd 9d 14 ca 29 8c c0 df eb 31 10 dd 98 a4 7c b1 87 9a b1 94 83 cb 7e fa 45 5a 6b a9 a0 2b b6 b0 23 2d 3b bb ca ff 9a 3a ee eb 30 48 4c d1 8b 22 4b 43 02 ad 0e d4 be d3 2a b1 f4 53 bf e4 91 a5 b5 24 d1 fd cb a8 a8 54 c4 9e 63 52 26 8d 3c 3b 1b 88 0e eb b9 cb a2 4b 9f dc a4 cf e9 a6 2c 08 21 18 e2 d2 47 6b 81 47 f3 d2 3a f8 82 39 f8 82 ca 02 d3 2f 45 d3 33 45 d3 2f 15 a1 ba b4 52 c3 3c 84 38 cd cd bf 94 53 3a ad 53 db 64 b4 82 9a 81 2d 55 d3 34 85 a1 47 13 d3 2e e8 53 3f 55 53 30 25 a0 01 a5 c3 74 88 c5 43 18 cc d5 84 04 4e 89 a0 3d 25 54 33 ff 6d 81 3a 78 81 3a c0 54 4c 2d d3 Data Ascii: {8{k&HPI<N&G$I'II9)1\|~EZk+#-;:0HL"KCS$TcR&<;K,!GkG:9/E3E/R<8S:Sd-U4G.S?US0%tCN=%T3m:x:TL-
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 44 65 58 0e b8 5c 2c 9a 37 aa e9 9f 03 24 0c 84 40 39 1c 66 49 34 98 a2 d6 35 83 0d 46 60 4a 5a 09 89 46 3b 05 10 0f 88 53 a4 04 16 4c 78 b3 80 f8 17 36 70 10 00 33 27 0a 4b b0 04 35 b0 04 43 80 02 84 b9 75 3b 61 7c f7 c2 07 9a e6 07 38 36 2f 5e b0 00 67 e0 04 5e 40 33 9b 05 11 c7 a0 2c 79 9a 2c 70 53 17 30 74 87 d8 d4 68 56 f0 19 57 e4 1b 83 50 6b 24 60 01 36 04 03 84 fa 00 27 d7 1f 5d 66 0b 14 90 0b be 60 08 45 d0 7b ad c0 3e 1a 70 09 5d 89 03 26 20 07 a9 38 06 3f 80 3e 67 50 06 7c 60 00 3d c0 05 0e 50 aa 65 40 01 66 90 00 72 b0 15 29 14 01 86 21 06 ab d4 04 2c 79 1c 5d c0 9b 0e 26 31 29 a2 6c 31 09 72 85 78 11 c4 f8 14 d4 81 85 c6 e0 00 a5 00 22 fb 31 17 98 e1 19 3b 70 00 55 74 45 c8 a0 1d 44 a9 07 c9 00 6b 2c 21 02 ff 89 b0 8d 87 20 9b cf a1 05 57 30 Data Ascii: DeX\,7$@9fI45F`JZF;SLx6p3'K5Cu;a\|86/^g^@3,y,pS0thVWPk$`6']f`E{>p]& 8?>gP\|`=Pe@fr)!,y]&1)l1rx"1;pUtEDk,! W0
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 14 88 c0 82 ac 47 0a cf ac 7a 38 67 2a 98 84 3a ca 27 00 de 4b 01 ee e0 0f 48 d2 74 1c c4 41 58 c0 ce ec 2c 84 a6 82 d1 00 0d 48 74 a8 52 2d 35 54 35 a4 36 ea 0e c2 cc 20 0f 02 c0 0d ae 60 5b fe ef 3f 17 20 09 89 00 09 40 4d 08 c4 41 34 6e d1 16 6f 35 17 29 05 35 3c a3 2e cb a9 8c 70 e3 37 12 e0 db 90 31 df 6c 6d 19 29 c2 04 e2 43 02 12 29 94 58 12 00 88 60 36 12 21 00 3e ab 7a aa 07 1b 33 ee a3 92 a1 00 28 e4 90 44 60 0e 30 f2 26 16 09 3e d0 4d 3e 5c ac 00 70 86 92 8c 02 7a 44 a0 42 8e f1 06 aa 07 77 7a 4a 19 ef 90 2c ef 35 bd 5e 40 1b a1 27 f0 1c e2 1f 97 e5 dd 2c f5 95 de 43 5c d3 6b 0e 92 51 38 16 b2 03 10 f5 5f e0 88 2a 07 a9 75 e6 a0 22 11 c0 22 b3 ac 0f a6 b5 09 a6 40 63 8f b5 c5 36 0b 3a e4 43 28 b4 40 63 a7 a0 ff 0e 86 60 0a aa c4 20 53 56 8c b4 Data Ascii: Gz8g:'KHtAX,HtR-5T56 `[? @MA4no5)5<.p71lm)C)X`6!>z3(D`0&>M>\pzDBwzJ,5^@',C\kQ8_u""@c6:C(@c` SV
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: d3 11 66 7c 54 85 89 3e 58 8c a0 43 1d 29 31 4c 7a 14 44 2e 04 1a c2 48 a2 13 ad 7a 55 ac 1e 8d 0d 79 39 a5 4c b2 ca a2 61 80 91 68 53 eb a2 89 ae a6 a2 2b 36 b1 70 22 98 24 28 f7 f6 b8 c5 51 09 0b 87 34 49 98 18 e7 10 b7 3a 64 86 09 19 9b 4b 08 a2 46 24 b4 71 8d 82 a4 d3 db 04 3b d8 39 b2 f1 b0 8b cd 43 4b a8 14 d5 18 72 a4 ff 91 9f 14 a5 23 43 49 ca 2a 99 24 02 95 3b 6a 4f 6f 56 85 36 80 56 63 f5 ec 65 36 db b9 06 63 78 2a 3f a1 6d 83 cf da d0 b2 87 66 d4 b4 d9 c4 d0 0f b7 e2 3a 95 25 24 80 b3 55 01 53 b4 43 38 0f a5 65 b6 be 0b 5f 56 96 30 5c da b2 50 41 6d 70 94 a9 42 83 4d da 91 e7 a6 de 41 2e 36 a1 6b 5d 4f 95 af 29 77 d1 d8 60 ac 05 3c ae 54 6b 9a 4f 9d 26 54 dc 75 cf 5d 29 45 33 cd c4 4a 5b 88 c9 52 9c 62 4a 67 f3 a5 6f 7d 41 d3 b1 06 e5 97 2b c8 Data Ascii: f\|T>XC)1LzD.HzUy9LahS+6p"$(Q4I:dKF$q;9CKr#CI$;jOoV6Vce6cx?mf:%$USC8e_V0\PAmpBMA.6k]O)w`<TkO&Tu])E3J[RbJgo}A+
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 2e 36 3f 0a bd 28 a3 0e 43 13 b9 22 51 25 3b 04 d3 9a f6 d9 12 cb 6a ce 59 2d f1 4a 97 62 63 d0 4f b9 24 b5 c0 08 e2 a5 58 8b 92 da 89 14 2f 90 73 d7 52 d4 45 1c 80 d9 45 b4 bc c5 4a df b0 23 4f 88 30 56 24 bc 22 e8 00 c8 86 50 96 65 c4 a4 b0 6d df 52 1d 74 98 43 58 c7 92 d1 18 da 50 e5 4a c0 3d 3e a3 5f 9b 54 15 6b de 74 08 ff 83 cd d4 90 b8 db 12 0c 73 38 1f 6b ad e4 a1 4e 1d 8d 4d cb 9b 11 32 a1 d1 74 cc 5b aa 5c 36 08 0f 68 88 6c 20 66 ed af 7f 5d b4 32 44 96 ef bf 04 9e 91 72 2b b4 5f b7 2a 78 c1 6e 65 40 04 85 6a 5d 20 91 a6 23 71 8c a1 4d f2 3a d8 67 46 64 1a 87 c5 4d 5d a6 86 61 bc 8a b8 99 6d a4 4e bf e0 a1 11 7e b9 8d b0 7a 75 cd 48 f0 44 11 17 0c 6c 00 6e 0b b1 36 55 70 17 1b b3 f8 24 6e c8 0f f9 3e 12 d0 36 d9 a4 6d 0d 75 0a 51 44 a5 02 ae f4 Data Ascii: .6?(C"Q%;jY-JbcO$X/sREEJ#O0V$"PemRtCXPJ=>_Tkts8kNM2t[\6hl f]2Dr+_*xne@j] #qM:gFdM]amN~zuHDln6Up$n>6muQD
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: d1 5a 76 01 22 8c 49 1c 5d 2d 98 45 89 b5 12 27 01 09 88 0e 2b dc 33 5d da c6 96 01 d9 ed df fe 7a 79 3f f9 0d 2f 94 f5 80 68 3e 73 c7 bf c0 cc 20 56 f3 35 f0 81 6d c1 8a e1 24 20 40 19 1c a3 0b 15 32 3c e3 16 77 94 15 9e f0 70 71 07 89 e8 71 b7 9a e5 55 90 7f c8 40 84 3c e4 41 ba f2 9d ad 7f 88 b0 98 2d 41 57 82 18 b9 85 44 ff 8d 8b 61 75 4c 58 94 35 ae 71 70 2b 2c 60 8f f2 53 7a e0 d3 a9 0a 5e e1 ab 8b 4c 82 12 3f 28 42 00 8a b4 16 0a 98 40 01 01 d0 c2 0a f8 40 81 00 14 50 0c 55 c0 ab 99 2a 94 30 aa e2 28 05 1b c8 d9 70 12 e1 1f 50 28 c6 3f 01 90 c0 0a 1a 8a a5 a5 a8 42 01 6d 2e 6b 9a 1d 26 91 14 00 82 ce 80 98 73 0a 2e 61 e5 2b 0b 93 2c 0d 8b f3 d7 ba 6a d3 09 0e fa cf 6d 02 2b c8 c6 3a 37 40 6e f1 90 fe b4 d4 3b 5f d5 c5 f7 78 07 27 c4 79 d6 1b 83 d8 Data Ascii: Zv"I]-E'+3]zy?/h>s V5m$ @2<wpqqU@<A-AWDauLX5qp+,`Sz^L?(B@@PU*0(pP(?Bm.k&s.a+,jm+:7@n;_x'y
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 42 2c dd 92 10 45 4e 20 97 da b9 8e 2f 77 19 1a 61 22 6e 0a 54 51 c1 2b 90 b6 8c de 26 4d 03 5a 00 4a 1e c8 09 9b bc b1 a4 0f 7b eb 03 24 02 5a 16 25 2c e4 2b 2d a0 c7 e1 56 3b 99 02 44 b4 35 0b 38 05 50 76 d0 8a d0 7c 4b 22 6d 8b 07 42 6c d1 19 de b8 23 c7 2d 40 f3 ce ea 16 d1 25 b9 85 04 94 d0 43 42 5c a3 37 f0 90 06 28 7f ff 83 5b 1c c0 83 38 81 d8 e5 a1 5d 3e ca 44 e3 a9 b9 d0 00 80 6a 53 c9 09 dd 16 ad cd ce 5d 98 ad 65 52 c5 0f 44 b0 80 05 90 4b 02 ec 61 cf 7a 54 a7 03 3c a8 a8 0a 7f 90 c5 08 64 d1 d3 33 fc e1 0c 3f 0d d0 0f 12 c0 3b 02 19 80 0b c1 1b ac 8b be 10 55 ff 59 2f 11 69 a8 89 5c b7 0a 8a 2c 25 21 0f 6f d8 9e 8b 10 10 80 10 95 76 74 66 30 6f 5a a3 5d 15 40 d8 d6 d2 78 ba 76 0c 93 37 3d 3e bd cf 2d 7b b8 01 52 3a 0b 3e 89 34 e1 42 6f 48 c2 Data Ascii: B,EN /wa"nTQ+&MZJ{$Z%,+-V;D58Pv\|K"mBl#-@%CB\7([8]>DjS]eRDKazT<d3?;UY/i\,%!ovtf0oZ]@xv7=>-{R:>4BoH
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 3a 42 11 fd 14 f5 cc d8 8d cd 38 ac 56 92 9d b6 69 2e 6e 25 ac 81 29 81 4a 10 0c 7d b2 2f 35 94 6c 91 d9 0f 1d e4 c1 b6 29 34 6a 6c a0 7d e4 e0 9a c6 c8 76 ba c0 bc 6e 47 23 de db 2a 66 64 0d 7c 4c 85 d3 a0 cc 7b 19 44 a2 51 e3 95 ed b7 0c 07 d8 7c 24 d3 be 1a 8c c0 1b 38 07 f8 6b 15 24 63 e5 d1 6d 4b 3e 63 c1 ef bd 71 ba 14 c9 17 e3 d3 21 e7 c9 fc c7 59 fb 97 ca ef 77 e6 ed 93 8e ec f8 e7 7e 1e e8 80 3e e8 82 5e e8 84 7e e8 86 ff 9e e8 80 1e 71 94 0a 15 a0 c8 a2 a7 f4 6d db 1b 6e 73 0c 6e a6 48 76 5a 90 7c c7 27 6e d2 87 23 28 93 66 07 7e d2 bc c7 cb a2 fe 7b 02 4e 58 31 9c 47 24 63 de 43 8b 32 3b 6b 41 62 ad 64 c3 f4 4a 53 91 e7 72 6d 42 74 4d 42 8b 56 84 a5 eb ae 35 4c e2 36 fc 76 29 de 85 65 d1 d8 01 1b 3a 0b d2 d8 5b b0 05 1b 80 4f 89 d7 1f 4d 5c b0 Data Ascii: :B8Vi.n%)J}/5l)4jl}vnG#*fd\|L{DQ\|$8k$cmK>cq!Yw~>^~qmnsnHvZ\|'n#(f~{NX1G$cC2;kAbdJSrmBtMBV5L6v)e:[OM\

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49850	216.180.236.138	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	352	OUT	GET /img/GYyh_180x180.GIF HTTP/1.1 Host: ig55.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	1038	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 347 Cache-Control: max-age=14400 Cf-Cache-Status: HIT Cf-Ray: 8fb8242d0e4a0ffc-LAX Content-Length: 353124 Content-Type: image/gif Date: Thu, 02 Jan 2025 04:52:43 GMT Etag: "67700c5f-56364" Last-Modified: Thu, 02 Jan 2025 12:50:39 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rlshJ5uEJq%2B07fa2jNaPK8Vg91c%2Ff3hlytWf5QbHKBgf0xonymOaPNtSjWoXuX2UvFsJQMbplJUujHYHHgtjLMhHgp%2Bf8JCRcXS3YqAxBdcVYOAUD8dqcKd4uUO8rBJMlg%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=1415&min_rtt=1410&rtt_var=538&sent=6&recv=6&lost=0&retrans=0&sent_bytes=3095&recv_bytes=1017&delivery_rate=2995862&cwnd=252&unsent_bytes=0&cid=2c95e730e9151763&ts=11596&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:36 UTC	148	IN	Data Raw: 47 49 46 38 39 61 b4 00 b4 00 f7 ff 00 ff 26 26 ff ee ab ff db 00 ff 01 f3 da dc e6 a0 fe 90 ff fb e5 18 7e a4 88 89 8f fb d7 ce f5 f5 f5 91 76 41 ff 9c 5a ff 53 30 00 cf ff e2 e3 ee ff c7 00 ff 5d f6 35 b5 ba ff 00 b6 ff f2 01 02 02 02 24 ff 00 97 4d 84 d0 f5 fd 60 e0 fd ab 92 6a eb ed f5 92 88 52 ff f3 8d ed ed ed ff ce b8 ff 3b 3a d5 c7 b2 74 fe 59 6d 6d 71 fe f8 d9 ff 30 0b ff 94 10 01 ad d9 ff ac 0c ff f5 c5 ff 32 32 ff d1 48 95 71 3f Data Ascii: GIF89a&&~vAZS0]5$M`jR;:tYmmq022Hq?
2025-01-02 05:12:36 UTC	2372	IN	Data Raw: a3 8d 56 bb bc c6 e3 e3 e3 c7 b1 97 ff 02 02 ff 67 29 c5 c5 ce de de df ff d0 ff ff 6f 0d ff 4b 40 53 90 94 ff 4e 10 ff 1a 1a ea e4 da bc aa 8b 8d fb 71 ff ec 6c f5 ef e9 fd b7 a9 b6 a2 38 56 ff 39 ff 12 11 ff b3 fb ff d1 2e ff 0a 0a ff da 65 fe de 86 ff 8f fb fd a9 92 d2 fe cc ff fe f1 f5 f6 fc b3 f0 fe e9 f9 fd d5 d5 d5 3b d9 fe ff 2b f3 d7 d7 e1 cd ce d2 b8 b9 bc be c3 ca ce bc a5 b4 36 95 ff 76 68 ff 82 24 ff 90 83 a4 a5 ac 8a e8 fe c0 fe b3 2a c3 c8 fe e7 dc 3f 3f 3f db be 1c 59 a0 70 ff 68 59 ce b3 27 e0 d6 c3 ff f7 4d 96 97 9d 36 ff 15 ff ca 13 53 a3 c6 ff 38 1d ff ed ff 44 9d a9 fd f5 f3 79 77 69 74 75 7c 59 6c 65 ff 14 05 ec fd e9 aa ab b1 ff f3 26 fd ea c2 ab d3 e3 ff b1 3e 7b 5b 7d db 18 a6 91 c3 d6 58 50 80 f2 fd ff ef ea e1 62 78 81 e3 ff de Data Ascii: Vg)oK@SNql8V9.e;+6vh$*???YphY'M6S8Dywitu\|Yle&>{[}XPbx
2025-01-02 05:12:36 UTC	538	IN	Data Raw: 14 96 6e 2b ee b2 9a 7a 0b 16 a8 e3 a6 8b 20 b3 e6 62 a6 99 ba f0 4a 58 ad a7 10 86 17 ef bd 13 76 4b 15 13 f8 f6 eb 61 3c 73 f9 2b b0 bc 73 f9 3a f0 c1 c9 05 8c f0 c2 d6 15 cc f0 c3 be 29 0c f1 c4 9e 39 4c 31 c5 12 5f fc 30 c0 68 19 ac b1 c0 19 7f 8c 30 c7 67 79 2c 32 be 21 9f 2c 30 c9 5f 99 ac 32 bc 29 bf 8c 2f cb 5e b9 2c f3 b8 31 df 0c 2f cd 55 d9 ac b3 b6 39 ff 3c 2e cf 54 f9 2c b4 b2 41 1f ad 2d d1 4a 19 ad f4 af 49 3f ad 2c d3 49 39 2d f5 aa 51 5f fd 2b d5 3f 59 ad 75 a8 59 7f bd 2a d7 3e 79 2d b6 a3 61 9f 1d 2a d9 32 99 ad 36 a1 69 bf ed 28 db 31 b9 2d 77 9c 71 df 4d 28 dd 23 d9 ff ad ed 0f 3f 60 8c d6 c4 3b 98 11 cb 0e 10 f3 2d 92 df ca 9a 01 43 02 3b c0 60 06 c4 79 8b fb c6 15 04 34 42 cb 14 30 a4 c3 b0 e2 03 30 fe 6b 3a 57 fc 82 07 3a e8 9c 7e Data Ascii: n+z bJXvKa<s+s:)9L1_0h0gy,2!,0_2)/^,1/U9<.T,A-JI?,I9-Q_+?YuY>y-a26i(1-wqM(#?`;-C;`y4B00k:W:~
2025-01-02 05:12:36 UTC	4744	IN	Data Raw: 8f 7e bc a3 1f e7 a8 c4 41 ae ab 8f 86 1c 0f 20 f7 28 c8 44 1e 68 91 78 6c a4 23 f7 03 c9 3a 4a 72 92 ee a9 a4 1c 2f 89 49 f1 68 f2 8d 9c ec a4 72 3e c9 c6 50 8a 32 62 85 3c a5 8a be 93 2d 55 f6 e6 13 b2 f1 56 04 da e0 4a df 94 23 09 ed 9a 49 62 6a c9 98 ff e4 32 26 e0 72 65 b9 7e 09 cc 56 e2 11 96 c2 52 0a 10 ac 04 25 5a fa f1 96 88 fa 87 b1 a8 82 98 3a fa 52 46 1f 30 08 a5 e6 b3 cb 31 0e 73 3e 9c 32 c8 1b 90 c2 4a 7b 39 11 99 16 32 80 45 96 d9 1c 67 16 11 9a 38 d2 c8 34 95 52 4d 1e 5e 73 4b d9 44 c9 36 87 d5 ff 4d bd 7d 73 58 e1 44 c9 38 93 99 14 f0 bc 0d 9d 42 52 67 4e d8 79 18 77 4a 0d 9e 61 2a ca 07 98 89 a7 7e fe ec 9e 82 ca 27 54 ee b0 ab 0d 5d 94 a0 3f 21 d6 56 06 8a 2d 73 5e 0c a1 6a 7a c3 60 18 1a 19 87 3e 0c a2 ae 22 0e 45 8f 65 d1 81 61 14 55 Data Ascii: ~A (Dhxl#:Jr/Ihr>P2b<-UVJ#Ibj2&re~VR%Z:RF01s>2J{92Eg84RM^sKD6M}sXD8BRgNywJa*~'T]?!V-s^jz`>"EeaU
2025-01-02 05:12:36 UTC	5930	IN	Data Raw: d4 c3 25 44 d0 6b 04 78 43 b5 84 7b bd 91 57 84 6d 4f 23 a0 44 13 cd 03 b5 00 02 18 cc 10 8f 5f f8 ef 17 b4 d8 c0 02 16 d0 ba fb bd 6c 44 1b 62 48 fc 32 d2 96 e9 29 84 52 0e 94 d4 02 ff 50 a3 4f 1c 03 14 7d a8 43 2d ea d1 84 68 f4 a1 11 e0 b8 47 2d 98 00 b6 f5 65 b0 1e 0b 73 c8 04 31 32 3f 86 64 10 4b f9 d3 00 96 ee 71 8c 3e e8 a3 84 7a f8 c4 27 ff 8c f4 07 e5 0d ef 86 11 5c c8 0c 2f 52 41 fa 21 b1 46 da 83 86 3d ba 61 0b 5b 50 a3 16 9f 00 47 34 0c 58 a4 6e 98 c2 8a b5 a8 86 fa 9e 28 43 bf c9 4f 2c b8 1b c8 13 6b 41 37 7e f8 01 1d a1 18 c3 22 72 b1 88 50 d8 e3 1e fa f8 84 07 c6 40 c7 31 68 22 14 dd d8 81 f2 a0 75 bf 32 62 2e 7a 57 b1 60 42 d6 c8 81 05 10 90 79 f1 b0 85 26 72 31 8a 7b dc c3 14 b8 a8 a3 07 6a 64 8f 96 3d 62 8c 37 34 64 cd 10 69 95 34 0a e4 Data Ascii: %DkxC{WmO#D_lDbH2)RPO}C-hG-es12?dKq>z'\/RA!F=a[PG4Xn(CO,kA7~"rP@1h"u2b.zW`By&r1{jd=b74di4
2025-01-02 05:12:36 UTC	7116	IN	Data Raw: 61 5d 0a 66 06 66 10 0b 46 f7 29 88 c2 6c ab f3 6c c0 d2 5f 42 ff c8 25 1c 50 20 53 56 35 1a c0 6d 0a b0 4c 5b 16 7a 85 37 7a e5 d6 16 64 c7 1b d6 c5 57 a6 65 06 57 f0 82 57 40 79 60 90 0f da 97 22 6c f2 29 ba c0 03 f5 70 2d 7f 47 7f f2 96 39 b5 c0 56 dd 51 22 d0 80 58 88 65 08 82 d6 1b bb c5 01 80 28 19 3b b0 57 bc 98 39 8a f5 07 3c e0 8b 1a d0 8b 1a 10 7a 71 d8 89 79 91 62 66 c0 03 24 e3 8b b6 a7 01 30 10 63 3f 60 06 d8 40 63 29 b2 03 7f 30 8e 7f b0 5d e9 a0 62 3f a0 00 ea f8 06 9b 95 8e ea d8 46 3b e0 8e b4 57 20 98 76 8e a2 e5 8e 0a 60 86 3a c8 59 9b 05 20 e9 10 6e d1 08 85 b0 a4 3c 72 16 61 06 89 57 4e c8 89 02 39 4d 8c 75 90 0e 19 5e 09 59 7c d2 88 18 54 f5 90 16 39 5c 0c 18 70 0b 49 52 4e 72 91 1e 99 4a ff 40 78 11 d9 80 21 67 49 81 f2 91 28 19 43 Data Ascii: a]ffF)ll_B%P SV5mL[z7zdWeWW@y`"l)p-G9VQ"Xe(;W9<zqybf$0c?`@c)0]b?F;W v`:Y n<raWN9Mu^Y\|T9\pIRNrJ@x!gI(C
2025-01-02 05:12:36 UTC	8302	IN	Data Raw: e0 08 9e e0 0a be e0 0c de e0 0e fe e0 10 1e e1 12 3e e1 14 5e e1 16 ce 13 01 01 00 21 f9 04 09 03 00 ff 00 2c 00 00 00 00 b4 00 b4 00 00 08 ff 00 ff 09 1c 48 b0 a0 c1 83 08 13 2a 5c c8 b0 a1 c3 87 10 23 4a 9c 48 b1 a2 c5 8b 18 33 6a dc c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 b3 a6 cd 9b 38 73 ea dc c9 b3 a7 cf 9f 40 83 0a 1d 4a b4 a8 d1 a3 48 93 2a 5d ca b4 a9 d3 a7 50 a3 4a 9d 4a b5 aa d5 ab 58 b3 6a dd ba b2 96 57 ae 53 bd 8a fd 0a d6 e9 d8 b1 65 cd 9e 15 9b 76 e9 d8 37 b1 d0 b6 4d 3a f6 07 8f 74 72 e7 1a ad ab 41 41 5e bd 44 c7 fe 31 f4 e7 2f e0 a0 67 a1 2d 28 6c f8 f0 ce b5 5e cd 2c d8 01 b9 96 e3 c7 95 63 2d 80 56 d9 f2 65 9b 9d bd 5e d9 1c da f3 e7 98 90 7f 84 e0 c1 e3 8f e6 1d d0 58 87 f8 01 f9 34 cc b5 Data Ascii: >^!,H\#JH3j CI(S\0cI8s@JH]PJJXjWSev7M:trAA^D1/g-(l^,c-Ve^X4
2025-01-02 05:12:36 UTC	3618	IN	Data Raw: a4 c6 9b 22 49 37 b1 b0 3b 56 18 c0 25 8c 1b a4 e1 8a aa 4a 0b 19 4c fb 37 92 5b 0f 69 5a 0b de 3a b9 14 8b b9 99 ff 3b 16 52 8b 99 9c 89 b8 da 29 4b c2 4b 4e f5 70 a2 f6 09 b8 93 6a b6 c8 43 ba 92 2b 16 7e c0 25 b5 20 52 da 79 0f f2 5b bd 46 0b a9 c8 46 bb 7f 2a 9e 4a ab bb 91 a9 b0 03 74 63 37 a6 a1 e5 59 a3 80 5b a1 90 db b8 89 1b 49 ec fa 9d 76 0a 27 e3 ba a1 b5 40 ac de 19 1a 7f da b0 f3 fb 06 60 fb a5 04 bc 11 90 71 9b 3f 6b a4 e5 80 b8 5a 9a b3 90 d1 ae 48 fb bd d6 8b c1 b7 2b ba 95 01 bc 40 4a bb dc 3b 9e 95 ea 15 23 5c 99 65 2b c3 88 da 9d 39 aa bd f7 69 68 46 ea be 1a db bc 4b 0b b8 9f 60 bb a5 f1 9c 13 3a c1 51 7a 47 59 db b4 03 f0 ba 42 2c ab f7 fa a2 18 b1 16 1f aa b5 7f 3b 47 0c 7a ae 6f 7b b2 2d 0c bf 63 f1 a8 52 20 9d a8 ea b5 63 51 b9 69 Data Ascii: "I7;V%JL7[iZ:;R)KKNpjC+~% Ry[FF*Jtc7Y[Iv'@`q?kZH+@J;#\e+9ihFK`:QzGYB,;Gzo{-cR cQi
2025-01-02 05:12:36 UTC	10674	IN	Data Raw: 01 44 d0 98 5e 51 0e 97 19 1a 88 b9 99 84 59 03 95 41 99 95 f9 98 9d 81 98 a9 99 04 a1 f9 80 10 01 19 35 20 05 03 30 00 8a 19 01 b5 19 01 9e 79 16 6d 90 04 b5 39 98 49 40 9b 03 a0 9b 5e 51 9b c6 79 9c b5 79 99 44 80 9c c6 99 04 05 d4 9b c2 39 9c d1 19 01 e5 50 03 b5 79 9a b8 f9 9b d1 a9 98 6b b1 9c cc 69 9c 9d 11 9d cc ff e9 9c 71 47 11 59 42 04 d1 d9 98 f1 e0 9b b6 b9 9b 5e d1 06 c2 49 9e 9f 50 0f ec 39 00 86 19 0f de 79 9c 52 60 98 62 11 0f b3 d9 9c fc 59 1a f5 39 00 49 a0 53 c1 89 9c 90 51 9f fb 29 16 0a fa 9a 72 53 0e d9 89 9c 0e 2a 16 e5 f0 9d 0b ca 51 17 b1 16 15 da 9c 38 b5 a1 b6 79 16 d9 29 05 6b 91 9d 11 80 24 f9 f9 9b c2 26 16 de 59 03 29 da 19 11 3a 00 4d f6 9e e2 99 a2 6d 10 a1 11 b0 16 d6 d9 9c 1a fa 9d 37 ba 16 be 29 9e 03 40 04 2d 2a 63 16 Data Ascii: D^QYA5 0ym9I@^QyyD9PykiqGYB^IP9yR`bY9ISQ)rSQ8y)k$&Y):Mm7)@-c
2025-01-02 05:12:36 UTC	11860	IN	Data Raw: 7f fe fa fe 4c 8c 97 dd 59 3b 75 d7 9f 7f 42 1d 38 1b 44 72 71 a5 56 6e 0a 22 f8 9f 82 5e 35 58 d4 7b 83 45 08 db 53 1a be 74 9f 50 06 18 b0 5f 87 a5 71 48 e2 6c 01 18 30 a0 49 7c f1 77 a2 84 43 bd 58 cb 1b ed 6d a4 99 8c 25 3a 85 23 4c a9 59 e4 d0 1d 12 ed b8 a1 89 42 da 07 e4 8a 06 ed e4 92 8c ff 28 c5 95 90 3d b1 e6 db 76 5f 41 99 a3 56 56 c2 d4 9b 51 1e 41 98 e5 70 5b 7d 09 93 57 7d fd 53 8f 81 62 c2 48 a4 98 f5 64 d5 e4 8b 6f 12 46 57 9a b0 d1 09 26 5a 76 52 67 27 66 79 0a 94 a6 6a 7d c6 e9 9d a0 78 95 27 a6 9f 42 96 67 90 95 88 32 a9 28 42 89 12 1a 99 55 94 3d 1a 5b 7f 94 d6 39 29 a4 6d 59 7a 51 5e 61 6d 66 98 9e 85 52 e4 96 9a 9e 66 54 ea a8 8d 52 95 6a 68 49 99 ff 4a aa ab af f2 19 ea 77 a6 9d ea 64 ad b6 e1 da 59 ab 43 f2 ca 6b 61 bb 0a 6b 2c b1 Data Ascii: LY;uB8DrqVn"^5X{EStP_qHl0I\|wCXm%:#LYB(=v_AVVQAp[}W}SbHdoFW&ZvRg'fyj}x'Bg2(BU=[9)mYzQ^amfRfTRjhIJwdYCkak,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49834	36.42.77.151	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	599	OUT	GET /jsgif/yf150-150.js HTTP/1.1 Host: 2024hwus1.heibanwa.mobi Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:37 UTC	567	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: application/javascript Content-Length: 10355 Connection: close Server: openresty Last-Modified: Sat, 14 Dec 2024 17:08:22 GMT ETag: "2873-6293dfea22d2b" via: CHN-SNxian-AREACT2-CACHE21[7],CHN-SNxian-AREACT2-CACHE43[0,TCP_HIT,2],CHN-HElangfang-GLOBAL6-CACHE110[9],CHN-HElangfang-GLOBAL6-CACHE51[0,TCP_HIT,5] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 82ef907822f44041d6cdcbfc7087d4ec nginx-hit: 1 Age: 1598231 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:37 UTC	10355	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 03 00 00 00 0b df 81 d0 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 01 29 50 4c 54 45 47 70 4c f1 cf 9f 65 3d 1d 4a 2c 15 f7 e9 dd fc f6 ef f5 dd c4 01 01 01 fc f7 f6 05 05 04 f7 de c4 8b 5a 2d 37 23 12 12 0b 07 f7 df bf 2e 1e 10 d3 b8 9a 64 49 2b f6 de c2 c3 99 60 00 00 00 09 0a 09 02 02 02 05 06 05 ff ed bf 0f 0d 0a ff ff ff f2 d1 a4 11 11 13 0a 05 02 ff ff d9 19 13 0a f5 e1 cc f5 de c6 22 19 0d ff ff ce 2a 20 14 fa ee e1 f2 d7 b0 37 28 16 19 19 1a ff ff e2 fb f2 ea f8 e7 d4 43 34 1f ff ff eb ff f6 c9 02 04 14 ff ff f5 8d 60 2e 72 47 1e f6 de bb 75 57 31 51 30 11 60 38 16 52 3f 22 60 4b 2c 46 24 0b fd e5 ac 35 16 05 fb e0 99 d3 b6 7e a4 73 39 8a 7b 5e 16 Data Ascii: PNGIHDRpHYs.#.#x?v)PLTEGpLe=J,Z-7#.dI+`"* 7(C4`.rGuW1Q0`8R?"`K,F$5~s9{^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49831	221.194.141.150	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	621	OUT	GET /video/m3u8/202401/30/a2146fa33ff3/cy1300.js HTTP/1.1 Host: x-hweu2.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:37 UTC	589	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: application/javascript Content-Length: 117813 Connection: close Server: openresty Last-Modified: Mon, 08 Apr 2024 14:28:27 GMT ETag: "1cc35-615969e681fad" via: CHN-HElangfang-AREACUCC2-CACHE34[21],CHN-HElangfang-AREACUCC2-CACHE6[0,TCP_HIT,16],CHN-HEshijiazhuang-GLOBAL1-CACHE95[7],CHN-HEshijiazhuang-GLOBAL1-CACHE102[0,TCP_HIT,4] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 05fcf20fd4e44b7888c7de92805c668d nginx-hit: 1 Age: 354259 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:37 UTC	15795	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 d7 04 41 cd a7 96 d3 4e 4f c7 9b 87 6f 55 90 c9 95 75 d8 d8 d9 9c 88 ac b2 9a ca ec 48 30 fb bb 85 62 46 32 aa 79 67 ea 55 69 d8 ac 95 b4 2d 51 bb 96 86 a6 73 59 d8 a7 8c b9 8a 75 f4 7c 00 db 02 3a 16 11 0f 4e 34 28 5c 58 a8 e7 1b 00 ec 4f 08 ff ec e8 90 45 70 ef 67 54 b1 6d 3b f6 97 89 f7 ba 82 20 30 5b ef 79 00 31 24 25 98 73 68 ff c4 8a b9 84 69 87 75 9c 75 56 43 f3 88 77 c9 66 75 d2 57 60 e8 38 22 73 2a 2b 4b 27 19 2c 20 1a b7 ac ac be 79 95 fb c5 bb f3 77 65 e7 24 0a 20 18 14 fd de d8 f7 a3 96 cb c8 c8 e8 2a 12 eb 20 03 cc a2 8d b7 85 aa d4 b4 a7 f7 b4 aa e9 31 1a 51 4d 69 8b 54 3f dd b2 9a a3 8e c3 ac 86 75 e7 ad 7b 95 6a 55 df 3a 2d ad a3 d6 c4 70 87 f9 62 03 b0 2e 12 8e 25 2a ff e4 de b2 45 54 eb 24 08 c7 b9 Data Ascii: GIF89aANOoUuH0bF2ygUi-QsYu\|:N4(\XOEpgTm; 0[y1$%shiuuVCwfuW`8"s+K', ywe$ 1QMiT?u{jU:-pb.%*ET$
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 66 70 86 67 4c db 3a a5 20 5b cc 80 45 76 d1 59 d0 c6 3a ed 51 1f 49 6e 25 c7 45 d8 64 6e 0e 48 41 7a 01 26 5b 90 85 8d 44 9c bc bc db 43 c0 e1 72 38 2a e8 9a 53 6f 29 ea a3 c2 2e 78 84 cd e6 b4 c7 23 22 c8 ed 42 cd f8 e6 40 f9 76 04 cc ae 93 c5 25 d2 0c ac e9 11 52 d3 40 19 6f 5d 06 d4 88 41 dd 1e ba 6a 50 8a e9 70 e0 72 e6 00 91 0a 4c 9c e0 a8 26 25 fa 2a 5d aa d3 f1 bc 66 b1 be ff 1d 73 2a c2 30 98 27 fa 28 c1 12 58 70 2e fe 54 00 6b 94 08 68 80 19 fc 08 75 02 1e 9e c5 af 6f 2a 81 19 d8 f3 dc cd 09 de 09 5a bb 72 70 26 ae 14 7a 72 70 07 4f eb 73 16 03 e4 6d f4 46 cb eb 9c 19 55 bb 76 b0 27 2a 70 28 16 2c a6 e8 02 9d 5d 6b 16 e4 ab 28 1a 5a 0a d7 40 f9 cc 09 23 98 c1 c1 56 89 0b 9b 01 0c b3 d4 55 59 f4 ea d1 67 15 b7 8a 2a a8 c3 0d c7 9e a7 d9 ca 0b 04 Data Ascii: fpgL: [EvY:QIn%EdnHAz&[DCr8So).x#"B@v%R@o]AjPprL&%]fs0'(Xp.TkhuoZrp&zrpOsmFUv'p(,]k(Z@#VUYg
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: e7 73 46 e7 74 56 e7 75 66 e7 76 76 e7 77 86 e7 78 96 e7 79 a6 e7 7a b6 e7 7b c6 e7 7c d6 e7 7d e6 e7 7e f6 e7 7f 06 e8 80 16 e8 81 46 67 53 02 e6 61 46 e8 84 c6 d8 62 ee ba 28 d4 04 65 e6 c2 c4 08 63 5e 35 00 1c 88 06 f6 9d e6 80 c5 e0 08 c8 e6 09 80 80 e4 9d df 5b 3e 8d 2e b0 e4 d2 3d 05 04 40 80 53 80 87 6c 18 82 96 76 e9 97 86 e9 98 96 e9 99 a6 e9 9a b6 e9 9b c6 e9 9c d6 e9 9d ff e6 e9 9e f6 e9 9f 06 ea a0 16 ea a1 26 ea a2 36 ea a3 46 ea a4 56 ea a5 66 ea a6 76 6a 98 ce 86 7b 40 69 04 00 52 4f 56 e8 ab 86 b9 2f d5 4e ac 66 68 17 8d 06 28 d0 84 c1 6d 5c 89 ce 61 c4 20 85 68 88 66 a8 cb e8 a7 f4 66 38 20 de cb 4d 56 90 4e 54 b7 c6 3a 06 18 e9 92 16 5d 94 86 87 03 48 85 7e 08 86 60 38 87 c0 16 ec c1 26 ec c2 36 ec c3 46 ec c4 56 ec c5 66 ec c6 76 ec c7 Data Ascii: sFtVufvvwxyz{\|}~FgSaFb(ec^5[>.=@Slv&6FVfvj{@iROV/Nfh(m\a hff8 MVNT:]H~`8&6FVfv
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 2c 38 38 12 bb 0e 42 c7 67 8c 37 26 fa 65 7d bc af 5f 16 0f 01 8a 33 84 1c 13 87 9c c8 91 c4 28 b9 f0 05 78 30 78 9b 00 05 a0 d5 a3 8a 97 bd 98 9c c9 88 97 a4 97 d7 c9 e0 8b 12 a0 5c 4a a5 34 4a 30 f0 09 a8 0c 09 ed bb 4a 29 6b 04 f3 c0 b2 b1 5c d6 31 31 cb b8 74 bf 90 a1 15 67 0b ab 6e 8d b6 b6 72 8a 57 20 a9 09 55 01 db c3 9d be fc 2b 95 11 cc c8 93 1e 84 e1 62 16 58 cc 43 cb 9b ff 3f 21 9a ca 8c b4 08 18 c1 e0 fc 8a 2b f5 8f 94 fa 1b e8 a7 c1 c2 a3 52 fb eb b5 df 4c 6f 59 a1 c4 9a ad d9 8f 7d b4 fa 17 b8 b5 99 1f c6 99 4f f2 7c 4f b7 57 43 81 aa 7b a7 2d 1d d2 f9 cf d5 f9 99 e7 31 d0 f9 43 6e df e5 72 09 9d ce ad c1 d0 2f e1 d0 d4 4a 36 5d 50 47 18 e9 0f f5 ca 36 17 20 9f 4c 44 35 3a b7 ae 25 5d 46 f1 30 86 44 23 22 ab f0 c7 0d 12 0f fe 60 04 60 d4 b8 Data Ascii: ,88Bg7&e}_3(x0x\J4J0J)k\11tgnrW U+bXC?!+RLoY}O\|OWC{-1Cnr/J6]PG6 LD5:%]F0D#"``
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 48 31 06 29 08 95 b0 a4 06 77 64 c8 89 b0 44 53 9b 8c 29 78 4c c8 8c 4c c9 9c cc c7 5c 45 0a a0 4c cc cc 4c cc 6c 17 54 94 8b 78 99 97 31 12 23 d1 22 2d cd 6a 3d ca 22 45 56 2c ac 53 e4 35 9b 50 c5 d4 2c 2c 57 4c 23 58 94 46 eb 50 07 43 38 81 0b 60 0d 40 ba 45 43 22 3e df f4 99 5e 54 a4 ff 09 a0 be 01 28 2e 08 e0 ad 09 28 4e 6f 63 c6 1d 90 80 01 30 01 66 6c 46 06 f0 03 75 a0 4d 63 2b 20 1a ca 4e ed dc ce ec fc 3c 70 dc 42 f7 23 47 6a a8 0f 3c 44 2f 75 3c 3a 8f d0 c3 11 6c 8f 18 b8 10 10 d9 82 ac 0c 8f f0 d9 bf ab ec 0e 5b 28 b0 83 f0 81 12 0a 12 01 28 09 98 61 3b 82 13 31 14 f3 21 73 7a a6 01 63 13 02 f5 a1 b5 64 9c 32 b4 b2 0b 72 a6 93 3b c9 89 c4 38 b0 c1 bf 8b cc cf 58 5a 3f 6c 29 07 0e 2d 07 24 88 01 33 6c 93 91 ac 2f 4c 01 c2 16 54 b9 0e 4d 51 0e ad Data Ascii: H1)wdDS)xLL\ELLlTx1#"-j="EV,S5P,,WL#XFPC8`@EC">^T(.(Noc0flFuMc+ N<pB#Gj<D/u<:l[((a;1!szcd2r;8XZ?l)-$3l/LTMQ
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 64 38 b6 14 ad 93 03 52 e0 05 b5 28 7b 1d 92 03 3f 30 1a 16 75 51 e7 f3 04 3f 40 4b 83 f3 8b 4b 11 8c c1 e7 74 82 c9 3c 2b a0 03 69 a3 8c 34 c5 7a 89 73 67 77 96 67 38 45 8d e6 21 77 f6 41 1c e1 81 0e 7d 59 68 a4 a4 5f 9c c7 39 46 75 8e f9 d4 68 ed b3 8e 8d 80 2b bd 72 06 54 10 07 c4 d6 ff 2a 03 d9 92 78 42 01 64 c0 57 21 00 04 1e 90 2b f7 53 80 3c 94 90 b8 16 7d 98 32 2c d0 e0 08 7a d2 05 12 49 2b ab 32 8f d2 72 29 bd 12 0a 1e 70 56 69 25 90 e7 67 04 ea 37 91 28 c4 8e 0f c9 a1 bd e2 a1 60 d0 07 f7 97 7f fc 77 6c ca 47 05 d0 c0 a0 22 50 69 7d 10 07 3b 14 a3 2a 39 7d 49 4a 8f 53 a5 a4 4d 9a 29 2f 79 44 31 29 93 f3 30 81 c6 00 45 28 e0 02 17 d8 09 24 30 46 58 64 5a 5c 54 0d f9 90 0f 58 d4 6e 1c c8 05 04 61 94 fc e6 00 92 00 0c 26 20 10 b1 75 11 48 59 0b 70 Data Ascii: d8R({?0uQ?@KKt<+i4zsgwg8E!wA}Yh_9Fuh+rTxBdW!+S<}2,zI+2r)pVi%g7(`wlG"Pi};9}IJSM)/yD1)0E($0FXdZ\TXna& uHYp
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 28 8e 92 6c 17 d9 32 53 46 ab 18 6d 91 e4 de 27 01 9f 11 02 25 30 92 76 c0 1a 33 27 31 a3 05 e7 0a d3 44 7f 8b ce be 11 9a 2c c2 3c 92 e5 5b 26 c0 ce 2a 13 3f be 0c 28 32 d3 10 ac 8b 1d 8d a1 33 39 cd d1 88 13 f1 44 93 ed f0 d0 37 29 e1 f4 d4 e2 3a 83 f4 f0 64 73 d4 8a d4 0b 45 8f d4 f0 ff ca 02 f6 b0 39 bf a1 d4 c2 0d f4 96 94 1e 27 32 f0 98 13 d2 ae 30 4c a3 b0 f0 ae 80 10 de f1 49 8d 53 24 49 f3 d3 c4 10 37 7f 01 d8 cc 70 3f e5 eb 49 27 cf 48 5c e0 23 99 ad 4d 7f c1 0d e9 50 20 bb 13 10 bf b3 f9 fa 2d 11 47 4d 3c 69 8f 3c 09 35 78 de 13 3f d3 13 d9 3e c3 50 5b 8f b2 9a cf 05 47 ed 05 00 95 51 31 35 53 8b ef f8 66 d3 e0 fa 13 ae ae f2 78 02 54 40 51 84 2b 1b e4 9b 94 11 33 6e 31 51 d7 72 41 11 f4 35 70 51 88 c6 00 12 68 15 12 50 60 2e 13 6e 0c 50 a0 56 Data Ascii: (l2SFm'%0v3'1D,<[&*?(239D7):dsE9'20LIS$I7p?I'H\#MP -GM<i<5x?>P[GQ15SfxT@Q+3n1QrA5pQhP`.nPV
2025-01-02 05:12:37 UTC	3714	IN	Data Raw: 14 e6 61 38 22 f1 c1 e2 65 c9 e2 54 e4 c4 2a 10 d2 2d 5e 66 17 dc 82 10 bd da 73 a1 40 f2 fd c7 e2 74 81 ba c4 8c 05 e0 5e 24 79 12 24 5c 47 6a 0a 5a 7c 74 81 2b d4 62 30 0a 67 f3 d1 a6 35 2e db 6f 76 92 36 56 df 6e 72 5f 6f 2a d7 9b ba d6 38 ee 07 71 ae a7 8c 90 43 20 e0 02 33 85 9b 72 ff 3e 42 fa a1 4e 73 9e 9b 91 60 81 bb 8d 82 f4 68 42 2e 04 80 03 9c 57 36 ad aa bd ed 23 93 88 09 be 15 c0 04 e8 1b 40 f2 1f 3b 65 4d 26 7c 53 34 70 02 27 10 20 a5 ca 08 02 0c 0a 60 02 dd 43 ba 62 42 ad a8 81 95 d5 7e ae 28 b3 06 1d a5 54 a8 41 f5 27 41 39 24 0b 5d 1c 6b 38 c5 44 9c 0a 4c fa dc 51 b1 01 8e c6 96 83 16 1d 70 ad 84 4f 48 ab 55 1a d0 4d a8 e8 88 b2 a9 ba 22 dd 15 98 1e 04 e5 c4 0a 21 4a 0e 11 18 0b 22 dd 50 d1 45 4d 01 e8 b7 c6 d6 57 3a 26 a3 f8 65 22 c2 9d Data Ascii: a8"eT-^fs@t^$y$\GjZ\|t+b0g5.ov6Vnr_o8qC 3r>BNs`hB.W6#@;eM&\|S4p' `CbB~(TA'A9$]k8DLQpOHUM"!J"PEMW:&e"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49830	221.194.141.150	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	620	OUT	GET /video/m3u8/202401/30/a2146fa33ff3/cy150.js HTTP/1.1 Host: x-hweu2.hccoeutg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:37 UTC	578	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:36 GMT Content-Type: application/javascript Content-Length: 20305 Connection: close Server: openresty Last-Modified: Mon, 08 Apr 2024 14:28:22 GMT ETag: "4f51-615969e1d14f5" via: CHN-HElangfang-AREACUCC2-CACHE66[23],CHN-HElangfang-AREACUCC2-CACHE27[0,TCP_HIT,11],CHN-JSyangzhou-GLOBAL1-CACHE96[6],CHN-JSyangzhou-GLOBAL1-CACHE27[0,TCP_HIT,3] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 7cd4f8055b2a011721472b733cc1accf nginx-hit: 1 Age: 19442 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:37 UTC	15806	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 d8 b5 a8 fe 4d 19 b3 86 75 ff 0e 04 d9 a4 8a ff 2c 0d ce 8e 71 4f 2f 26 a7 af 18 27 13 0d ff bc bb 6f 72 21 d9 a8 00 d2 d7 08 ff 86 51 ff a2 a2 ff 45 41 9a 2b 21 d7 b9 b5 4d 49 2a 67 4e 00 ff ff ff c8 96 88 ea f3 02 ff 44 36 ff 36 26 aa 7a 6e 6a 34 2b ff 9a 64 51 35 09 8a 56 47 99 a8 d7 f2 bb 00 6c 45 34 d8 c3 a9 16 0a 07 ff 3a 33 db c6 ca ff 24 21 90 65 52 c8 a9 a6 ff 7c 46 72 59 47 d8 b8 9d 30 27 24 3b 27 10 97 70 64 e2 aa 8a ff ea ea ff 7a 10 b2 6d 55 8d 6a 00 98 a2 cc ba 8e 00 e8 d1 9c fd f9 c6 dc aa 93 fe 5a 1f ff a5 71 cb a3 8b ff 44 26 90 9c c8 ba 88 82 bd a3 94 6a 8a aa ff cb c9 ca 78 67 e3 b3 97 91 95 1b d3 9b 88 bb 97 83 8c 94 b9 ff 6a 33 d6 ad a4 47 14 13 ff 97 96 c7 99 93 e3 d5 dc ff f7 f6 ec d8 a2 ff d7 Data Ascii: GIF89aMu,qO/&'or!QEA+!MI*gND66&znj4+dQ5VGlE4:3$!eR\|FrYG0'$;'pdzmUjZqD&jxgj3G
2025-01-02 05:12:37 UTC	4499	IN	Data Raw: b4 5a 70 0b b5 5d db 8b 10 d5 88 5c c2 2c ec d6 ba 6d 04 92 bc 01 1d 50 dc 8c a0 02 21 80 0d 0d ab ca 8f 70 d2 d7 20 01 00 d0 07 7d 20 dd 75 5d 05 78 2d 01 be 0d 00 5a ad d7 7b 9d c4 e4 20 ae df fa ad 8c 70 00 21 90 09 27 e0 02 89 cd 04 7b 80 02 49 30 c2 61 9c b1 92 7d 0d 61 4b 0d 85 70 df 32 8b d3 a1 fd 01 72 70 e5 eb f0 c0 00 7e b3 21 e0 b3 5e 1e ce 7c 10 c5 c8 0a d6 2d 00 07 96 30 e4 3e 40 e1 5a 20 09 6b 6e db a2 b0 de 28 9d db 25 7c 0d 4d 2b 08 12 e0 02 f8 0c e2 c8 4b 01 ed ab 01 f2 0b b1 89 80 02 da 7a dd 58 b0 07 86 30 05 86 ff 50 d7 51 c0 e2 65 20 01 2b 1e bc 76 7e 02 3b 0e de b8 dc e3 fd 90 00 8c b0 cb 07 db b0 59 a0 05 db 20 0a 49 80 d2 61 0c d9 1f 4b 05 b7 c0 0f e4 3a 02 60 60 0d 28 bb 0e 33 0b d3 3d 70 04 30 7b e5 b1 c0 c6 34 10 0b 6f fc 01 36 Data Ascii: Zp]\,mP!p } u]x-Z{ p!'{I0a}aKp2rp~!^\|-0>@Z kn(%\|M+KzX0PQe +v~;Y IaK:``(3=p0{4o6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49847	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	362	OUT	GET /i/2828/qqww-200-1.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 189139 Connection: close Accept-Ranges: bytes Age: 84087 Cache-Control: max-age=2592000 Etag: "676f8cba-2e2d3" Expires: Fri, 31 Jan 2025 05:51:10 GMT Last-Modified: Sat, 28 Dec 2024 05:29:30 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: d934622d0128b4dc293a03ee59732c3d X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT via: cache01.oversea-GM-FRA2
2025-01-02 05:12:36 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f5 1f 00 ef bc 31 ff fb 9a ff fc c6 09 0a 0a fd d8 c4 ff ff ff fd d4 51 a2 a4 a3 90 8d 77 ff ec e8 74 70 70 cd e7 bb fe f1 7c fe de 67 f3 c7 3d db e4 7d ff fe e6 ea f9 ff 4f 4d 41 cc cb c8 04 53 ff 5c bc f8 c8 ed fe e1 ed ff 06 52 87 4e 71 ef 0f 9e fe 95 d8 fd 8a d3 b8 bd d4 ff e7 e7 e6 fd ac a0 ec e9 44 8e 7e 26 ff ff 56 55 09 a4 ea e7 23 ba 4c fa cc c0 75 ff fe 2c fe fa 0d 7d 00 e6 ca c9 13 c0 bc 31 cc 79 fc 9b 00 ff f7 e8 ff d6 d2 4f ed cb ff dc a1 fc a5 04 ff ae 2c fd fc 16 09 fd 8c 2b ff cf 13 0a 06 f8 d4 0b 5f 95 15 6a 48 02 f5 fd 5f 41 f3 0f f5 b0 01 cf af d4 5f 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 Data Ascii: GIF89a1Qwtpp\|g=}OMAS\RNqD~&VU#Lu,}1yO,+_jH_A_!NETSCAPE2.0!XMP DataXMP<?xpacket begin="
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: b3 e9 71 f7 db 3f 00 da a7 e4 eb bb 0f f4 2a b3 20 71 d8 07 7f 9f d4 7e ff fc e7 7f 8b 44 80 f6 97 80 0a f8 7e 73 e5 58 78 85 48 99 15 7e 0a 18 7b af 07 7d c7 16 71 89 b3 80 0c c8 7b a7 56 62 88 c7 7c e7 77 52 99 13 71 a8 04 82 0d 18 81 ee 07 7d 0f 86 80 1a d8 82 cc 47 81 cf 37 7b 71 24 42 12 78 7f e2 44 7c f8 77 40 34 c8 82 13 58 65 0b 56 68 12 98 7f 6b c6 7b a7 67 7e f6 54 70 d3 67 82 a2 f6 81 2e d8 84 de 67 58 35 28 7f ea 87 78 14 c8 83 3f d7 45 0c 18 76 19 c6 84 2d 28 80 b2 37 74 72 d7 45 cd 56 60 ed 03 76 07 16 46 46 48 69 ca 57 80 a5 33 85 3c e8 84 36 08 85 cb 67 00 46 e8 86 02 98 84 6c e8 43 6f 38 81 73 05 80 74 d8 85 fe 95 43 2c 18 82 4f d6 80 a2 37 87 7f d8 7f e0 97 83 c9 35 80 79 b8 3c 6e 08 87 2e 08 83 9a 27 87 f8 77 67 ec f7 87 06 70 89 a2 c3 Data Ascii: q?* q~D~sXxH~{}q{Vb\|wRq}G7{q$BxD\|w@4XeVhk{g~Tpg.gX5(x?Ev-(7trEV`vFFHiW3<6gFlCo8stC,O75y<n.'wgp
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: dc a4 78 c3 f4 35 51 77 52 8c 00 0c 88 28 82 2b 62 b1 79 51 fc 22 de 28 c8 c7 3e f2 71 7e e4 db e0 fe 70 57 46 fa c9 00 8d 47 80 e3 f2 86 57 b8 f3 e1 ad 8c 38 ac a1 17 5b 40 c7 42 52 6e 7b 79 14 dc 09 0c f8 43 32 16 31 84 85 b4 80 e7 aa 98 c4 21 18 70 91 a8 93 5e f6 da 66 bb 49 ba b0 7c 56 b4 dc fa 5e 97 c7 38 76 d2 93 23 b8 24 26 0b b9 4b 3d 8a 71 72 d4 ab 9b 2e 91 57 4b 0d bc d2 05 95 74 e4 20 0b b7 bf 1d 1e 73 8c b7 c4 25 2a 23 90 45 14 2e 90 98 aa eb 9e 11 2e 79 c2 61 1e 4f 91 92 fc 25 29 a5 b9 c3 1a 52 30 8c 8a 2b 67 1c ef c8 4e d8 99 a0 98 dd e4 25 36 55 70 4d 43 6e 93 91 d6 bc 9f 26 c1 69 cc 49 8e f3 83 60 64 de 08 94 29 ce 70 82 4f 82 6d 0b 1c e6 22 e7 c7 e7 85 f2 92 2c e4 21 f2 22 b9 cd b7 35 f1 84 b2 cc 9d 2b fd a9 47 80 2a ff 6e 7a 0c b5 a1 1b Data Ascii: x5QwR(+byQ"(>q~pWFGW8[@BRn{yC21!p^fI\|V^8v#$&K=qr.WKt s%#E..yaO%)R0+gN%6UpMCn&iI`d)pOm",!"5+Gnz
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 6e bb df f0 b8 7c 4e af db ef f8 bc 7e cf d7 6c 2c 80 81 82 83 84 85 86 85 1b 15 4c 18 45 8c 1a 18 8e 90 42 92 8f 8d 1a 19 98 53 15 9b 93 91 91 96 7d 47 15 11 05 a5 a6 a7 a8 a9 aa ab ac 05 8a 49 18 03 b2 b1 b3 b2 03 b4 b5 b9 b7 b6 18 35 3b 3b 35 51 15 0e c4 07 b6 bb ba b8 8e a1 44 a4 ac 1b d0 7f ad aa 80 d0 d3 ae b0 bc da ba c8 dd ca be 3b 21 c2 c4 0e c6 db de bc cc 44 a3 ad af 7e d7 a8 ee 16 d3 1b d9 c9 e7 e8 c9 e0 c1 50 c3 c5 c7 ca ce 2d 53 b7 c1 54 a2 4d 08 dd 09 49 88 f0 02 2a 67 11 3a 0c 61 07 b1 a2 05 58 90 32 6a dc c8 b1 23 24 04 20 11 48 39 40 b2 82 c7 93 ea 86 74 30 38 65 5e 3d 29 2b 4b 5d 24 92 41 87 8e 0c 01 67 d1 82 a4 b3 67 b2 ff 9d 4d 72 7a db 49 54 60 3a 3d 31 0b bc ac 10 ad a9 d3 97 1a e6 29 7c 52 50 66 11 1d 29 52 e8 10 2a 34 9f d7 01 41 Data Ascii: n\|N~l,LEBS}GI5;;5QD;!D~P-STMIg:aX2j#$ H9@t08e^=)+K]$AggMrzIT`:=1)\|RPf)R4A
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 3e 67 35 01 ea ed 67 50 81 b7 f6 c8 2c 00 b3 42 b4 a7 50 61 6a 98 b7 f0 89 c1 99 45 74 a4 48 a1 83 28 d1 7c 60 07 0c 3d f7 d5 2b 59 a5 2d 35 8c 3a 14 68 c8 4b 85 eb 1a 36 5c 4a 73 88 56 ae 66 b9 e5 ed 26 76 11 59 7c 7b 95 a1 2d 95 a8 5f c5 53 af ae c2 ab 2b c4 26 4e af 46 6f 41 3e ba 4c 49 e4 a2 94 27 27 d5 b3 94 30 45 b9 ee 0e c7 5b 09 0f 2b 91 8f 56 50 6a 2c a2 a0 84 eb 8d 8f 56 43 41 cd 79 f4 3b 55 4d 59 c5 05 fd f0 14 63 0d c7 04 53 c1 77 ac 08 8e e3 38 bc ce 3e 5b 1b f1 67 d0 0c 75 33 e9 6d ea 77 70 5b 56 c8 e2 32 8e 5c f9 13 ef 79 3a 63 6b 22 ba fa 73 b8 a4 7d 37 3a 97 3d 33 76 22 25 8e 97 00 3f 76 60 73 53 af 9c 46 7d 3a 0f b7 5b 54 13 09 61 51 01 bf d1 86 85 81 9d 60 90 93 6c 2a 55 21 5e 7e fb 41 d5 9f 6d e5 49 35 a0 75 cc 5d 71 9d 2c 45 6c d8 ff Data Ascii: >g5gP,BPajEtH(\|`=+Y-5:hK6\JsVf&vY\|{-_S+&NFoA>LI''0E[+VPj,VCAy;UMYcSw8>[gu3mwp[V2\y:ck"s}7:=3v"%?v`sSF}:[TaQ`l*U!^~AmI5u]q,El
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 8d af 8c 6b 39 d4 1f 1b f9 6e c6 95 6b 90 6d cc e4 26 0b e0 b4 45 4e 6c 80 9d 4c d6 60 2e b9 bd 7e f5 a3 57 e7 7b 65 27 87 58 c7 03 9d 26 90 e1 eb d7 1c 60 f4 38 f0 fc 32 4c 37 eb dc 36 b7 f9 8f 4a f6 b2 9c 7d 0c d9 5f da 97 c6 2d 7e a8 90 f1 ec de b7 12 34 b1 35 9d 33 93 99 8b 04 1e f3 19 cb 12 5d e4 6c 03 10 5f c4 f6 52 91 cf 8c b4 a4 23 3d 4b 9e 0a fa d2 50 1e c1 9d ff 1b e1 c4 0a b9 06 7b 0e a8 57 ff 0d da d2 14 93 59 cf 11 46 75 9f c1 7c 04 31 9f 98 cc 12 e5 e4 42 5f 1d 63 1d 1b fa c8 b8 be 9b 46 a1 da d3 4b cf f9 b4 ea fc 05 ad 3b 1d 52 46 47 b8 d1 e1 34 eb 34 41 fd de 60 f6 7a d5 3b 30 76 7b 19 2b ed 27 b3 5a a1 4b 6d 2f a3 b7 2d 80 a4 5a f3 ae 2a dd f6 b6 33 cb 4e 21 88 79 c3 e8 be e9 88 27 6a d0 76 cf 53 dc e3 76 77 bb 93 1d d5 6a c3 bb db ce 76 Data Ascii: k9nkm&ENlL`.~W{e'X&`82L76J}_-~453]l_R#=KP{WYFu\|1B_cFK;RFG44A`z;0v{+'ZKm/-Z*3N!y'jvSvwjv
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 0c 79 a8 aa 5b 35 5b f3 86 9e c1 16 a9 ee b6 a3 ff 44 a9 70 d0 c7 61 78 93 6b c3 d4 78 aa 15 81 89 66 57 1e e5 52 26 77 6b 12 88 9d 4f a0 48 a4 2a 81 96 42 0c c2 74 9d 7c 24 50 86 54 99 77 26 4c 99 b4 ad 97 6a 67 c2 7a 51 c4 ea 5b fa 78 a9 50 67 4f d7 ca 66 66 76 9a bd ca 66 4a 87 ae 8f 36 54 fb 85 4e a2 9a 7a 24 f6 4d d5 a8 03 19 75 9d e9 27 aa b6 64 49 66 66 4e b0 14 4b 8c 04 69 e7 4a 4a f4 2a 59 aa c4 4c b3 64 4b 6e 36 4e ab a8 7e a7 e4 b0 0d ab 70 c7 84 05 0e 4b b1 15 2b 4a 79 97 ae 1a db 4e 1d eb 66 8f 74 52 a0 c4 05 f5 7a 05 85 d8 05 20 9b b2 9b 34 b2 77 f4 b2 30 1b b3 32 3b b3 34 5b b3 36 7b b3 38 9b b3 3a bb b3 3c db 20 9e 14 b1 b7 a4 07 3f 4b b1 1f 4b 33 6c 71 b4 48 9b b4 85 d0 3a 5e 60 4c 43 30 ad d3 ba 7b 0f 0b 78 cd 25 b2 a3 95 48 50 9b b5 7e Data Ascii: y[5[DpaxkxfWR&wkOHBt\|$PTw&LjgzQ[xPgOffvfJ6TNz$Mu'dIffNKiJJYLdKn6N~pK+JyNftRz 4w02;4[6{8:< ?KK3lqH:^`LC0{x%HP~
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: fc be ef f3 5e ef 55 f2 ed c8 de ef 04 5f f0 06 af ef ba be ed 02 48 ca 28 97 78 76 b7 7f 0c 3f 75 cb 8e 83 14 5f f1 0e 5f 77 17 1f f1 18 9f f1 10 2f f1 1b c7 f1 1c af f1 0f cf f0 16 6f f1 0a 96 0a ed b5 7f 27 7f 63 25 bf 6f 6d e5 f2 be 16 70 2d 8f 83 2b 8f 0a 29 3f f3 30 3f ba 79 35 7e 14 5f f3 2c 4f f3 9f 85 f3 42 ff cf d1 a2 29 8b ed f2 ab 40 f2 0c 48 d1 49 9f 45 2c 3c f4 35 9f 2b a7 60 cd 16 af f3 12 21 f5 4f df f1 d3 a0 f4 48 df 0a 5c 3f f4 5a 4f 18 ff f5 be 09 8a a1 60 3f 94 10 06 41 f5 4b 8f 28 0a 81 43 11 f2 f6 d6 00 01 43 ef 53 39 14 1a 4e 31 21 5f 8f 75 07 31 f6 77 ff b9 02 b8 52 34 92 f6 6b 7f f6 73 61 c7 60 0f f4 88 c2 34 ff 1b 01 25 44 ba 15 1f 3f 12 e3 53 5b c4 04 ec 80 f3 4c 3f 41 e4 d2 1f 5f 2f f9 94 af f9 2a 0f 38 16 24 f7 7f 0f fa 23 64 Data Ascii: ^U_H(xv?u__w/o'c%omp-+)?0?y5~_,OB)@HIE,<5+`!OH\?ZO`?AK(CCS9N1!_u1wR4ksa`4%D?S[L?A_/*8$#d
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 40 27 e6 86 85 36 24 e0 38 f6 17 c2 11 be 90 8c 80 33 9f 10 35 c2 33 ef 21 90 68 4f 2b 1c ec 16 a7 46 ff 99 15 8b 66 f4 b3 a0 38 a6 e8 c0 e9 f9 0f 24 b4 73 e2 16 31 c8 c4 07 e6 2c 8f 55 ac 5f b1 68 18 c2 0c 4c f1 86 68 cc 21 e3 5c 48 c2 47 5e d2 7c 0a 84 e3 44 58 d8 c2 2e ce 71 7e 54 c4 5f e5 d2 18 bd f0 40 71 89 59 1c 24 21 2d b9 c9 40 da f1 62 05 34 24 fe d6 08 43 30 d2 2e 92 49 04 65 2c df 38 47 f9 bd 0c 95 6b 4c 00 59 f0 67 37 20 bd ac 02 a8 cc 9f ad 4a b9 48 1f 16 b3 34 aa 64 e5 0b fd f8 3a 46 6d 00 95 40 e2 99 2c f5 98 3e 2d 6e f1 99 40 64 24 37 77 09 bc 6a 16 13 9d 0f d9 26 b2 94 89 4e 0e 36 73 99 b7 2c a7 34 a7 99 41 c0 b8 b3 98 b5 24 27 34 83 d8 43 25 ea 73 9f 87 04 9e 06 4b 88 cf 25 12 f0 01 10 34 28 f3 88 45 50 48 12 74 94 ec 2a e1 5b 2e 58 cf Data Ascii: @'6$8353!hO+Ff8$s1,U_hLh!\HG^\|DX.q~T_@qY$!-@b4$C0.Ie,8GkLYg7 JH4d:Fm@,>-n@d$7wj&N6s,4A$'4C%sK%4(EPHt*[.X
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: d1 c7 64 fa 66 92 cd 68 3f 81 a5 6f 2f 28 65 1f 89 92 9c 48 8b dd 44 52 1e 59 65 29 25 63 10 a9 04 c2 87 54 cc 02 57 97 87 58 25 05 4b d0 f8 6c ec 15 4b 94 57 52 eb a5 52 bd d8 54 49 35 88 b1 16 53 26 95 71 ff 04 67 96 5a 30 64 f6 66 09 35 b5 6f 43 19 5c 72 96 71 26 85 79 1d 25 54 f3 23 13 71 19 56 de 07 61 7a a9 6a 6e 59 6f 41 e5 56 43 14 52 35 55 51 00 b3 97 71 10 98 86 d9 98 8e f9 98 90 d9 98 8a 19 99 8e 29 13 23 85 60 22 45 99 05 85 69 48 c9 95 18 b7 7d c3 a5 99 13 b5 66 4f 05 61 ed d8 51 3f 61 99 a2 b9 50 98 76 55 98 90 52 5d 09 94 71 26 8a 4f b9 9a 7b 90 97 cf 58 52 6c d5 95 69 39 99 99 39 07 90 11 9c 3a b0 14 bf f9 13 c2 79 1a c7 39 9c d8 94 52 7f 26 79 e7 65 5e 61 69 1a c7 49 9c 54 90 9c 8f 21 9c d4 89 4d 37 b0 9d 3a b0 9d 37 a0 2c ca 29 05 c7 e9 Data Ascii: dfh?o/(eHDRYe)%cTWX%KlKWRRTI5S&qgZ0df5oC\rq&y%T#qVazjnYoAVCR5UQq)#`"EiH}fOaQ?aPvUR]q&O{XRli99:y9R&ye^aiIT!M7:7,)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49846	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	365	OUT	GET /i/2828/qqww-1300-240.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 139280 Connection: close Accept-Ranges: bytes Age: 82328 Cache-Control: max-age=2592000 Etag: "676f8c9d-22010" Expires: Fri, 31 Jan 2025 06:20:30 GMT Last-Modified: Sat, 28 Dec 2024 05:29:01 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 85d22991807a6e7474dd56e32f69859e X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT via: cache02.oversea-GM-FRA2
2025-01-02 05:12:36 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 d5 3f 00 0a 0a 09 fe fa 55 ff fa 1a ff ff fd fe 12 02 99 01 ff 10 98 ff f6 ab 15 fe fc d6 2a 90 4d 02 01 fe 00 53 ff fb 63 0f 9c 9e 9a ff fe b3 ef b7 50 ff ff 89 a4 e4 ef fc a8 9f 9d de aa 48 02 e3 54 b2 9d f9 70 5b d9 a0 fd 9d a8 61 00 b4 ff 60 db a5 5c b5 ef f8 db d4 71 d6 e9 d5 d4 d6 a1 5b 0d fe d9 83 b9 40 f8 2a a3 8b 01 cc ff d6 23 45 50 44 e5 a0 55 a5 cc c7 b6 8b 8c e7 56 08 a1 f7 da b7 87 14 8c a8 91 2f e4 f0 f5 08 5c 6e 63 65 77 a3 d8 5c ee d2 fe 91 5c 5b a8 16 63 91 16 04 2e e1 84 c5 6a fe d1 f6 b5 cf f8 d4 d8 cf 7f 2c ab fb 03 82 d2 cd 66 92 db f0 87 30 8e d4 ff ff ff 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 Data Ascii: GIF89a?UMScPHTp[a`\q[@#EPDUV/\ncew\\[c.j,f0!NETSCAPE2.0!XMP DataXMP<?xpacket begin="
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 10 1a 32 b6 41 ec 4d e3 59 79 d5 76 72 e7 33 9a 1e 36 30 00 2e dc a3 30 e4 45 36 ce 1e 1b 48 80 80 a4 a0 5a 91 e7 fc 25 96 02 54 27 43 8e 98 88 d1 e7 7c 7e d8 39 1a d6 d4 24 96 8f 70 04 b7 8d 23 01 e4 98 7d 7a 18 7e a6 40 75 d6 27 7d 4a 52 7f 1c 28 88 e1 27 3d 8e 27 09 d0 00 09 cc 80 0c 54 67 35 00 24 00 94 96 91 e0 e2 20 91 d6 2c e8 63 da 04 c9 69 fd 91 8f 24 67 1b 1d cd 42 0a a8 80 e2 27 01 80 23 47 54 27 ff 40 a5 e8 80 9e 9e d4 38 44 99 54 49 94 bc e7 21 05 e8 82 f2 e8 87 8d 9a f5 89 d2 8d 0a e9 95 68 04 e3 65 8e 55 8c 05 a1 04 92 07 04 8a 91 28 45 2e d0 ce 8f 48 29 a2 84 8e 0b f8 12 4d 52 20 0a 72 0e a4 d0 60 24 84 e4 56 24 84 92 b6 d7 79 f1 a4 21 58 20 e7 d8 c1 4b fa 64 7d d1 17 23 bc e0 2d d8 e4 ed 88 e5 4f c2 42 0a a0 60 96 e6 e0 af fc 4b fa e4 00 Data Ascii: 2AMYyvr360.0E6HZ%T'C\|~9$p#}z~@u'}JR('='Tg5$ ,ci$gB'#GT'@8DTI!heU(E.H)MR r`$V$y!X Kd}#-OB`K
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 03 4a 88 00 01 28 4f 79 62 e7 ce 58 47 d6 64 ad ea 6a 91 a1 7a 60 ae 64 8f 17 7b d1 17 7f 11 18 83 51 18 a9 2f 03 55 03 fc 32 69 06 da cf 25 7c e0 18 55 a3 25 1c 2b 03 4d a0 df bc 42 06 f6 01 05 bd 65 00 15 83 af 9c e5 00 cb c3 1b 13 43 62 f6 80 60 5e 8b 33 66 60 05 ce 31 05 cc ed 1b c3 91 83 4e 90 3c 28 c0 dc ce f1 8e cc d1 3c 9c 05 de f6 ad 59 9a b1 18 f7 31 da f4 80 19 b1 62 83 14 0e 98 b4 51 18 b3 ab 1b ff ed 08 96 de 6f 06 cc f1 b6 b4 83 1d 79 d1 07 ba 31 31 ec 28 1b 0b f0 ae d2 66 c0 54 ae c2 b2 e0 9d 8e 50 99 8a ae 71 ea 66 20 5a c3 44 92 80 99 98 e0 9d fc 2b a7 b6 50 92 a2 d0 25 59 b2 6f ca c9 70 88 6e 66 f6 a3 bf 64 e0 04 8e ce 42 92 ce 1f cf 50 0f 3a 02 0c 3e 84 0d 45 20 02 54 a0 07 30 00 00 70 2c 47 2e 8f 75 d0 a4 13 5b c0 01 a0 67 02 1c 40 02 Data Ascii: J(OybXGdjz`d{Q/U2i%\|U%+MBeCb`^3f`1N<(<Y1bQoy11(fTPqf ZD+P%YopnfdBP:>E T0p,G.u[g@
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 48 90 81 a5 e9 a9 91 24 7c 60 26 e3 c4 49 7e 3c 15 aa d6 95 8a 54 4e 39 97 5f a6 32 4f f0 e5 00 03 3d 48 70 51 07 23 96 1c 38 c0 7d 13 9c 16 5c 44 30 97 ce cb 65 f1 f2 f4 f5 f7 4e d5 bd be 18 bb bd 02 6c cd e9 53 af 99 61 ef e5 d7 d3 1e 81 06 80 7d 2a fb fe 1a da d0 9e b6 7f 77 5f 98 61 35 40 db 2a d8 75 d7 e7 00 ee 3b bc 26 02 b0 41 7e 6e 92 df 9a 3c 90 1b 69 e5 ab 82 6e b2 a9 a8 ea 53 ff fa f5 b1 f0 13 2a ff b6 32 ee 7b 8c fb 1a d3 98 b8 59 14 7e ef 83 ff fc 3f c3 98 fa a9 21 33 63 bd cc 19 e8 8f 46 06 ca 5f fe f1 57 41 71 f4 8f 46 fc 49 ca 9d a8 a6 bb 0d 67 b4 05 0b 27 38 f2 67 7f 3b 12 47 23 d7 64 59 b7 80 0c 98 71 79 24 0e 22 47 72 1b 62 71 27 27 21 2a c7 72 d9 70 75 1c 07 73 84 34 4a 96 e0 03 39 97 70 c9 f0 73 7e 43 82 01 a8 05 3b 17 38 24 b0 47 8e Data Ascii: H$\|`&I~<TN9_2O=HpQ#8}\D0eNlSa}w_a5@u;&A~n<inS2{Y~?!3cF_WAqFIg'8g;G#dYqy$"Grbq''!rpus4J9ps~C;8$G
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 92 ad 1e 2f 2a 91 3d ae a1 b3 75 6e ed 05 12 49 a6 8e 84 29 cf 60 b1 8c b4 0e 24 1a 36 02 ab e4 81 b8 80 35 18 7a 08 40 7e d4 02 0e b4 e0 04 e2 c5 99 07 34 2b 10 19 48 ad 5b 3b d8 81 8a c0 f1 a2 10 8e 23 97 62 eb 06 3b c8 1c 0d f9 98 2d 9b ad 95 81 0c 2c c0 82 40 39 a5 54 63 4a 29 e9 e8 b2 35 71 5c e0 05 2b 18 68 11 e3 e2 01 99 a0 31 89 08 48 8c 60 aa 1b 52 8d 0e 2a a3 02 60 41 e4 0e 65 38 56 71 94 50 13 b8 ff c1 04 aa 22 5d 16 34 f7 b8 d8 65 81 76 55 60 b7 ba 78 57 44 2c c0 40 4e 6e cb 81 39 c9 64 1c 3a 19 53 ed 26 fa 2a f8 46 0e 04 2a 89 74 02 44 50 1e 41 20 28 05 4e 00 76 b0 81 5d 06 0b b7 18 c6 06 7a 30 19 84 bd 6c 27 f0 c2 0c 8f dc 81 b2 49 80 0b 2e 34 a1 17 bf 66 76 b3 97 d1 5f d4 fc 8b 3b f7 62 8d b4 f7 b0 05 6b 47 41 c4 cd 4b b6 7a ce c0 99 32 60 Data Ascii: /=unI)`$65z@~4+H[;#b;-,@9TcJ)5q\+h1H`R`Ae8VqP"]4evU`xWD,@Nn9d:S&FtDPA (Nv]z0l'I.4fv_;bkGAKz2`
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: c4 39 52 3d 26 2b 5e 81 c9 ef 8a 57 25 67 12 00 98 59 3a 0f 30 49 b7 4b e1 19 4a 54 f4 a3 e7 f5 18 e0 90 4c 38 8f 33 12 59 87 f7 d8 40 11 5e 96 86 a0 87 c9 d5 30 11 55 cd 89 80 61 a3 8d 6a 12 b0 14 4a 19 eb 11 8f 08 50 71 d4 35 ce 27 d0 5b f6 ef 73 cb 0a a0 10 40 88 1c 0e 0e 40 a0 e5 f2 d6 70 da 35 9d d7 38 01 5c c8 c1 4d 04 65 63 9c 9c 52 27 36 c1 d1 20 03 51 93 86 dd 04 55 35 cd a1 4e 17 a3 69 4b 8f 4e c4 ff 7f 0a 78 e1 e3 f8 59 28 50 99 65 89 57 d8 e2 14 8f 08 32 41 3c 31 3d 60 ed a9 1e 8c 18 56 2e 5e 4c 12 31 58 2b 12 3b d0 1e 1d 08 11 ae 47 8c 6a 21 2e 30 45 bc ce 21 ac 4a 9c c4 0b 40 f4 0a 3c b1 40 8f 2c 50 87 88 0e 00 22 50 00 e3 17 1b ba 90 46 34 74 58 22 88 c2 6c 3c 63 46 24 17 4b 84 a6 dd a2 92 16 12 8b 64 83 11 c8 17 10 92 90 10 78 40 36 52 a3 Data Ascii: 9R=&+^W%gY:0IKJTL83Y@^0UajJPq5'[s@@p58\MecR'6 QU5NiKNxY(PeW2A<1=`V.^L1X+;Gj!.0E!J@<@,P"PF4tX"l<cF$Kdx@6R
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: d7 72 4d 40 73 e3 19 9e e5 59 73 2f 40 9b 37 40 9d 3b 40 9b 4f 80 9e fd 19 05 e6 19 a0 35 77 2e 4c 40 9b 27 00 9d f7 99 9b bf f9 06 1c e0 04 d6 f9 a1 bd 79 9f a5 19 8c 4b 40 9b 01 18 9c 25 3a 9f 21 7a a3 d1 19 07 b4 99 88 71 f1 9c c3 39 02 a4 59 a3 39 fa a4 ad 59 a2 1b 9a 45 b4 f9 06 46 da a2 c3 99 a1 a5 59 a1 23 7a 03 3a c0 a6 c3 59 a5 c1 58 09 16 40 9b 3d 00 9d 65 7a 9c 1d 00 9d f1 19 a5 bb b9 9d 65 21 9a a5 b9 03 88 5a 9a 2f da a8 37 1a a9 57 a2 22 f0 63 3f 50 c4 aa 27 51 ec 06 c4 41 06 59 3f 00 a6 3f 54 ea 27 2c b0 76 ad 9a 15 7e 13 16 84 a2 22 ab da ab ab c1 62 80 c2 11 4f a4 ac 51 ff 44 45 fa 16 72 b5 99 a6 a1 3a af ab 99 a4 a5 79 95 25 6a 7b 05 21 5a 01 3b c4 58 b9 09 6e 13 18 a5 55 09 44 ac 5a 95 70 9b 14 1b 7c a9 15 19 f3 09 b0 e4 4a 16 1a 3b 21 Data Ascii: rM@sYs/@7@;@O5w.L@'yK@%:!zq9Y9YEFY#z:YX@=eze!Z/7W"c?P'QAY??T',v~"bOQDEr:y%j{!Z;XnUDZp\|J;!
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 8f 8b 8b bb c9 0b bc 93 6b bc 6f d7 b9 f6 52 bb c9 4b bb ca 4b bd cb 1b ba bb 4b bb 86 eb b8 2b b0 bb b1 8b bb 21 a9 bd 99 bb bb c4 3b ba 16 40 b8 cf b0 bb a8 cb bd a6 bb 02 98 0b be ee db bc df 90 35 3f 40 b8 94 7a bb 43 5a bd f9 6b bd 0b 40 b9 b3 a0 02 12 f0 00 01 0c c0 02 1c c0 0f 30 c0 06 2c 50 22 c1 5f 07 cc c0 05 cc c0 45 2b 12 94 88 c0 04 4c c1 13 9c c0 21 c1 5f 15 dc c0 15 9c a7 21 d1 02 2a e0 c0 21 ac c1 01 5c 1f d0 bb b9 b8 cb 88 fd bb 29 7f 42 bb ed ab bf a1 3b bb e4 63 70 2e f6 b5 5c 90 b6 3a 81 22 28 52 aa 2e c5 aa 19 d2 c3 37 c3 aa f8 96 34 ad 8a 04 49 23 44 b8 29 bf 8f f0 ff aa f6 ba 8d 78 fb 20 48 b0 02 80 2b b8 53 4c c5 2d 2c bb e7 4b 01 fb fb c2 5f aa c2 c7 7b ba 92 bb ba 56 1b 8e 26 bc ab 5a 3c 9e eb 6b b9 f7 7a b9 92 8b c6 c5 89 33 17 Data Ascii: koRKKK+!;@5?@zCZk@0,P"_E+L!_!*!\)B;cp.\:"(R.74I#D)x H+SL-,K_{V&Z<kz3
2025-01-02 05:12:37 UTC	8747	IN	Data Raw: 3f 45 01 3c bd 54 7c 11 c2 c3 c0 d3 0b aa 54 08 c4 00 39 14 80 23 f4 d4 3b 2d 36 48 75 55 2f 0c 54 ec 1c ce ac 1b 02 0c c0 53 47 55 d4 39 a5 40 56 e5 d5 44 05 d5 a8 8c d5 1d a0 35 3c 5d c2 3f a5 53 5f 4d 4e d6 8c 8f 4d a5 42 57 a5 53 1b 42 81 68 ad d6 64 b5 56 45 35 56 44 13 56 09 c2 56 62 05 56 6f 0d d7 6b b5 47 3c 15 00 3e 84 49 70 1d d7 74 05 d4 01 4d 57 6d 0d a8 6a 0d d4 cc 7b d6 6f a5 d3 ae 14 d7 75 ad d7 6a ad d4 b1 ac d0 b2 dc c4 ad e2 82 0e 25 86 2c e8 2a 3e 2a cb d6 a0 0d ff d0 37 b3 dc 9b ba b4 cb 3c b8 0d 08 28 cb c2 31 b2 e7 e8 4b 8c 4b 03 86 fd 57 7e e3 2b 79 3c 56 4a a5 1f ff 6a 55 57 1f 40 54 6c 65 d4 49 b5 9f 48 73 4d e0 d2 0e a5 db 25 f5 3b 06 21 45 ba 25 55 cf fb 9b 3f f9 6b 86 98 b5 02 d2 94 84 68 14 4d c5 aa 84 10 60 b3 03 24 47 a0 bd Data Ascii: ?E<T\|T9#;-6HuU/TSGU9@VD5<]?S_MNMBWSBhdVE5VDVVbVokG<>IptMWmj{ouj%,>7<(1KKW~+y<VJjUW@TleIHsM%;!E%U?khM`$G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49845	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	365	OUT	GET /i/1616/PPJJ-1300-240.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 200258 Connection: close Accept-Ranges: bytes Age: 65154 Cache-Control: max-age=2592000 Etag: "675feb4c-30e42" Expires: Fri, 31 Jan 2025 11:06:42 GMT Last-Modified: Mon, 16 Dec 2024 08:56:44 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 6832b34efc327aaa591dc7e2c2949d09 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT via: cache01.oversea-GM-FRA2
2025-01-02 05:12:36 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 e6 7f 00 f2 dd d3 a2 05 00 e7 6d 03 fd b2 03 f9 dd 6a ff cf 29 a0 98 06 d7 bb b2 fd d1 0d b6 9f 92 a8 8f 6c 5e 0e 01 a8 60 11 f6 ba 2b f7 8f 00 ff fd 45 f8 f0 d6 ff ef 6e 04 03 02 db 2f ff d5 05 01 9b 6d 59 ff f2 2f 66 50 0d da b5 48 d0 92 28 db ce b9 64 59 53 dc b1 2f cd ad 9d 9e c5 14 f8 05 00 fd f0 8b ee cd c3 a5 e0 a1 0b b2 ff f7 d9 8f e9 b5 ff a8 f1 f8 d2 b3 69 d0 b1 03 10 d0 fe 61 e2 31 b2 22 ff d3 90 07 f9 f4 b3 df 73 ff 1f b0 47 d8 d6 05 a1 d0 5f db cf cd e7 64 54 ef ba 48 07 a7 09 df ce 72 63 e5 f9 cb 96 8e d1 d3 93 48 cb 3d 6a a8 56 f5 dc fe f2 b7 b3 06 5f 29 09 d5 09 d9 f8 d8 65 9f 1e d7 fe fe 22 d5 4b 1b 57 57 ac b1 c9 ca 94 48 7a d8 8b d6 ce 4d ef 96 22 5b 9a 96 eb 8f 8f c6 f6 b9 b1 69 f8 c2 8b 75 23 71 83 0f 9a Data Ascii: GIF89amj)l^`+En/mY/fPH(dYS/ia1"sG_dTHrcH=jV_)e"KWWHzM"[iu#q
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 50 9c c6 79 9c 42 63 01 05 b0 9c 05 d0 00 0d f0 9b d0 19 9d 51 a1 15 5a 21 9d d6 79 9d d8 99 9d da b9 9d dc d9 9d de f9 9d 51 e1 9c e2 39 9e e4 59 9e e6 79 9e e8 99 9e ea 89 9e 71 d0 9e ee f9 9e f0 19 9f f2 39 9f 71 60 ff 19 96 d1 23 f8 99 9f fa b9 9f 94 d1 8a fe f9 9f 00 1a a0 02 ea 21 3f 55 a0 06 7a a0 3f 35 a0 0a ba a0 1d 12 8a 0e fa a0 a0 c8 a0 12 3a a1 14 5a a1 d1 86 a0 18 9a a1 1a ba a1 1c 9a a0 16 fa a1 0a ca 9f 22 3a a2 3c 62 9f 4a 45 9f 28 9a a2 f1 b9 9e 2c da a2 e7 79 07 f1 d8 90 32 0a 89 10 40 03 e0 79 a3 38 9a a3 d9 c9 9b 3c da a3 3e fa a3 40 aa 9b 52 50 2e 97 49 30 b4 34 4a a8 74 7e a2 e4 4a 2d 11 66 ad f9 54 1c d0 00 28 00 9a 54 5a 6e 61 85 88 e5 06 a5 28 b0 a5 2c c0 1a 54 0a 9a b4 99 17 1b 15 a6 64 5a a6 61 1a a4 68 9a a6 3f 3a 00 08 50 17 Data Ascii: PyBcQZ!yQ9Yyq9q`#!?Uz?5:Z":<bJE(,y2@y8<>@RP.I04Jt~J-fT(TZna(,TdZah?:P
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 54 00 f3 97 05 5c 30 03 f6 e7 6e 55 70 50 21 e0 06 52 30 03 49 70 55 32 d6 91 08 10 47 49 30 51 32 d0 6f 13 c5 07 11 d5 6f 0c b8 47 4e 00 52 ab c1 5b 2e f9 92 bc 65 81 88 43 15 a8 91 37 a4 61 04 f6 93 04 15 a7 0c 95 84 ff 28 28 b0 48 3f 09 94 ca f0 16 09 e2 48 28 90 04 23 27 83 33 88 4a f4 93 04 18 60 37 ce e1 1c 10 80 36 13 45 02 52 80 01 0c 65 83 aa 84 83 19 42 75 40 a6 63 66 85 85 3c 76 62 b9 e2 63 a2 d4 62 43 97 53 44 36 7a 69 c7 06 41 97 40 46 36 8b 83 98 53 72 d9 96 a9 67 87 4b 18 41 a2 54 97 61 96 25 7b 48 56 b2 b8 72 82 29 77 ca f7 96 4f 96 7c 39 86 00 70 98 69 62 f6 86 61 d7 56 28 f0 73 06 30 99 b3 f8 97 64 b5 07 48 e7 78 9a 28 01 5e 77 88 4a a7 72 76 38 99 19 42 07 e7 e4 8b 7c 29 86 8e 38 5a 74 a7 75 95 08 6c c0 76 67 c9 48 5a ae e9 66 aa 09 9a Data Ascii: T\0nUpP!R0IpU2GI0Q2ooGNR[.eC7a((H?H(#'3J`76EReBu@cf<vbcbCSD6ziA@F6SrgKATa%{HVr)wO\|9pibaV(s0dHx(^wJrv8B\|)8ZtulvgHZf
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: a2 0f 0e 24 06 41 e1 01 b6 32 06 ba 32 06 5c a8 2b 1c e7 0d 9f e5 71 31 60 45 46 10 03 62 20 01 6a b8 86 12 20 06 4c c4 00 57 34 46 68 c0 00 45 37 5c 76 48 45 45 e7 58 1c 80 30 e7 b2 01 99 a0 00 68 b0 00 2c 40 02 10 b0 ff 03 22 a0 05 54 e7 03 57 a0 00 df e5 26 5b 27 05 46 90 04 e0 f2 00 34 10 74 d0 b5 45 0d 70 07 34 90 01 e8 d4 00 4b 64 16 bc a5 2e 06 20 00 56 13 6f 27 a0 17 92 00 01 6e f0 59 08 82 88 7c 17 39 6e 90 75 27 00 30 df 76 2a 0d 40 02 4c f7 21 75 b4 7a 11 36 61 28 42 00 aa f8 21 76 60 7e 8f 87 47 94 37 79 8e 20 21 e6 47 79 fc a5 8c 97 17 01 c1 88 20 c3 d8 02 83 94 7d 8f 77 7d d6 47 7d da 78 69 9b 11 7d de f8 8d 35 86 78 e5 c4 8b 11 b6 1f ad 07 7c e8 88 8e d1 f8 21 e8 87 65 6f b6 24 f0 18 8f f2 18 8f 27 a0 7b eb 08 22 ed b8 7b fa 88 65 e9 48 65 Data Ascii: $A22\+q1`EFb j LW4FhE7\vHEEX0h,@"TW&['F4tEp4Kd. Vo'nY\|9nu'0v*@L!uz6a(B!v`~G7y !Gy }w}G}xi}5x\|!eo$'{"{eHe
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 9d bc 28 45 81 14 86 90 52 59 c1 57 67 9b f6 42 d8 39 cd 2c 4e 53 5d 0d ea 55 3e 4a 89 16 76 f1 c8 84 0b 42 1b 9a 4f 7b 30 28 dc 5f 21 4e b8 db 9e f5 a4 90 14 59 d9 57 8d 4a 5b 09 05 17 20 48 a6 fd 57 00 4e 17 42 11 04 ff 91 fd 9c 6f 21 a6 af 02 50 ac ce 30 84 ea 49 ad 0d e8 db da d1 10 8c 55 37 56 08 79 1a f2 e4 a4 8a 10 21 5f f5 d1 6c 39 c3 e4 d7 c1 7a c6 e3 21 9b 2a 6e 08 ab 1b 8d 6d c8 b3 11 2b 0b f0 23 7f 88 1c a8 53 39 a6 9d a7 6a 5f fb ff d9 a0 59 dc a6 28 d1 f0 2f f6 e2 6d 5f 04 5a 0a 41 7e 7b 90 13 60 04 03 5e 04 68 ba e0 45 fc c3 06 14 18 0c b9 32 5a 52 c1 00 1c d8 81 1e d8 81 df f2 81 22 78 5b f4 76 14 fc f6 2f 69 90 82 2a b8 82 2c d8 82 f9 46 28 bc 75 82 32 88 46 d4 c5 70 36 d8 00 dc 50 4a db c0 39 d9 e5 33 a4 c1 02 27 c0 71 af d1 1c 54 c3 1c Data Ascii: (ERYWgB9,NS]U>JvBO{0(_!NYWJ[ HWNBo!P0IU7Vy!_l9z!nm+#S9j_Y(/m_ZA~{`^hE2ZR"x[v/i,F(u2Fp6PJ93'qT
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: a0 41 83 38 d0 a0 76 0d 98 1c 5a e8 60 81 8c a2 61 d8 51 e0 00 b0 3d 40 dd 22 fd f2 97 5e 50 1c 93 b8 2b 09 e3 3a a3 49 9e 58 a1 78 fb cb 6e f3 a2 f7 9a a7 80 c1 05 c8 cb e4 dd f9 a3 bc b0 3b 45 ed f4 db 6e 7b 2a 18 84 ff ff a5 47 04 10 55 11 5d 6c 64 a4 e5 5c 5e 87 1b 82 82 e5 fd 28 a1 14 29 9e f2 d4 ab ac 6e fc bb 21 da c0 c3 c2 f7 49 aa 52 44 54 c3 18 28 c5 1e 36 7e f1 92 b3 2f 83 25 16 e9 89 4d da 2a 1b bf 94 57 b9 c2 f1 00 13 88 14 97 0e c5 81 39 a6 a9 cc 61 c2 03 1d e3 94 c7 51 29 c5 56 2e a2 e4 20 cb 02 0f 0c 50 b2 d2 d3 c0 02 a3 8b 82 05 4b 57 32 c2 a7 e1 e4 27 7f 33 ca df 42 82 5a 7c b0 03 00 58 19 cb 59 ce 72 bf 10 a3 67 c7 8c 56 6f a3 45 03 7d 0e 50 d8 b2 fe f9 d1 6c fe cc 8d e8 13 67 39 d7 b9 37 7f 59 8d c5 be 38 da c7 90 46 01 14 0b ec 61 f9 Data Ascii: A8vZ`aQ=@"^P+:IXxn;En{GU]ld\^()n!IRDT(6~/%MW9aQ)V. PKW2'3BZ\|XYrgVoE}Plg97Y8Fa
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 8d 6c d0 48 63 64 80 05 0d e0 40 12 1a 90 17 17 d1 40 0e 0c 10 83 34 17 90 80 21 4c 4c 95 00 5b 87 2e 55 95 b0 73 04 c3 62 d1 ad 80 04 b0 b1 03 65 e4 72 0a 52 50 80 18 cb d1 ca 06 14 80 03 62 70 42 c9 82 85 86 92 a1 e1 ff 04 d5 e0 82 11 98 69 04 39 4c 61 06 b9 b4 03 04 96 24 03 8a de c4 23 e5 9c 68 38 03 b4 92 23 77 24 9b 22 8d b2 42 53 e2 4e 94 dc 73 23 02 ed e7 59 e0 19 81 a0 dd 64 9e 56 5b 09 56 92 e2 65 aa e5 93 68 43 f9 f2 3c e5 76 a2 32 0b 14 cd 63 f3 8a 41 a1 b7 d0 aa 4c 19 6c 57 41 1e dd 1e 5a 37 e8 7d d4 ac 80 e6 ea 60 14 57 38 c5 11 2e d0 ab 81 e9 a1 57 63 38 b0 3a fa d1 a2 b3 08 56 71 b3 12 cb 9d 94 32 29 65 29 6a 34 3d 94 ad ae 20 42 16 71 29 82 b8 56 53 9b e6 0b a7 45 e5 69 00 68 37 54 e5 00 b5 a8 b0 8e b5 ac ab 43 9c bb de 55 6f 52 dd 9e a7 Data Ascii: lHcd@@4!LL[.UsberRPbpBi9La$#h8#w$"BSNs#YdV[VehC<v2cALlWAZ7}`W8.Wc8:Vq2)e)j4= Bq)VSEih7TCUoR
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 55 2b c6 16 80 b6 d4 a0 a2 98 a7 c6 c5 b0 81 62 1c c7 6c e0 c6 d3 90 07 76 7c c7 78 ec 0d 76 6c 4f 2a 68 0e 7b 3c 4f 2a 98 c0 dd 50 94 00 28 0d 73 90 52 0f 88 07 d7 a8 0e 0b dc c8 8e 7c 7f 45 f8 83 53 80 85 14 6c 84 91 08 01 df b9 83 37 07 6e 38 c7 01 93 0c 00 52 70 02 5d 33 0d a9 57 ca a6 6c ca 4d 48 92 75 40 02 2c 03 84 16 79 b7 fe 5a 0c 98 1c 84 77 9b 9c b3 ec 83 21 3b 0d 81 5b 07 c4 b0 10 5c 90 84 8d 38 0d c1 cc af 00 79 0c 27 70 02 52 a0 01 ca 0c 00 10 d0 cc ce dc cc db 80 c9 82 dc c5 d4 fc 0e d3 5b cd d8 9c cd da bc cd 31 41 a1 72 fc ff cd df 9c 95 dc 0c 1b 39 3b ce e6 7c ce 32 02 69 38 f2 0d 28 94 68 3a 04 16 90 56 23 32 71 7e 7f e0 19 f6 7c cf f6 fc 26 1f 72 1e 9a 81 02 36 81 cf 45 c1 25 24 32 15 e8 bc 15 e5 5c d0 08 9d d0 bc f1 a2 15 b1 ce de c0 Data Ascii: U+blv\|xvlOh{<OP(sR\|ESl7n8Rp]3WlMHu@,yZw!;[\8y'pR[1Ar9;\|2i8(h:V#2q~\|&r6E%$2\
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 83 59 05 83 f0 ad ae 3b bb b4 8b ad b0 3b b6 53 5b 44 ce 50 61 0a da a8 1a 16 af f2 0a 8a 5c 0b 7e 93 6a b6 8b 26 8a e6 c0 ba 5e bb 61 c0 6b a8 c2 8b b6 8b 60 a2 5e 9b 67 69 b0 94 70 21 00 74 3b a4 7d fb 75 79 69 b1 5e 87 8f 2c f6 75 da c9 b7 b3 ba ab 55 99 05 22 cb 09 c2 e8 0e 86 5b 00 b7 eb 0f 55 d0 be 0d 18 ae 42 0b 8f ef 4b 08 55 50 00 77 c9 a9 05 49 05 33 90 be 91 40 b2 8e c2 73 03 50 05 03 80 46 f9 62 2b 9b cb b2 36 cb 28 a7 2b a1 62 6a 34 0f 7c 08 80 13 ba b5 92 6c c7 8a ba 02 ca 06 a5 1b 97 8a 20 07 6b 5a bb 81 f9 be b2 2b c2 26 6c ff c2 fa 98 bb ba ab a7 c1 e7 bb 2d a9 c1 fe f0 bc e3 aa 08 f7 5b 05 19 06 9c c6 6b a1 ad 53 b6 42 08 c3 86 98 a3 fb 5a a2 27 9a 67 d8 eb 67 f3 76 bd db 9b c4 b3 f7 97 e4 7b 75 e0 6b 08 f2 9b 7b 25 a8 b8 b7 c7 ab c9 58 Data Ascii: Y;;S[DPa\~j&^ak`^gip!t;}uyi^,uU"[UBKUPwI3@sPFb+6(+bj4\|l kZ+&l-[kSBZ'ggv{uk{%X
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 3a ab 8c ed c9 24 8e 23 09 db 15 98 0c af b3 2c 7e e0 dc 05 bb 31 95 27 4d b4 ba f2 f2 cc 37 ef d5 96 ce 37 5f 33 d0 93 ea 3c a6 d1 95 5a da 35 d6 62 bf fa 1c d6 29 64 3f db 0d 5e c7 b9 3d d5 e8 a7 cf bd 7c 17 7b 92 27 d1 e8 2f 67 c7 9f b2 a0 89 fe d7 72 2b d3 74 fc 2d 9f 3f 69 dd c9 f8 52 fa 96 53 b3 ea 8c 67 3c d6 59 0d f9 24 d5 bd df d4 61 66 dc e0 4b 5f 6a 26 3c 04 e1 4a 79 ec 78 a0 88 f8 66 ab 54 f4 ff ad 83 9d 38 81 de 3c 11 38 04 75 23 78 bf c2 d1 2c 38 98 ad 5e d5 61 42 b4 20 c5 c0 48 11 8b a3 a4 a2 04 38 cc a1 0e 77 c8 c3 1e ea 10 78 87 f1 c4 1c 7a 24 1a 7b 25 43 47 15 2c d8 27 60 b4 0d 5b b9 40 85 bd 52 d6 1f 56 c0 89 27 76 42 8a c3 eb 84 09 a7 a8 0c 19 dd 68 43 33 da 4e f4 c6 48 c6 32 86 03 7a 66 34 19 81 ea e7 bf f0 dd 6d 36 f6 c3 94 a1 08 d0 Data Ascii: :$#,~1'M77_3<Z5b)d?^=\|{'/gr+t-?iRSg<Y$afK_j&<JyxfT8<8u#x,8^aB H8wxz${%CG,'`[@RV'vBhC3NH2zf4m6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49849	216.180.227.131	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	353	OUT	GET /img/FF98t_180x180.gif HTTP/1.1 Host: ig82.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	1089	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 754 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb837c68d2578d7-LAX Content-Length: 476245 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:06:06 GMT Etag: "6769630f-74455" Expires: Sat, 01 Feb 2025 04:53:31 GMT Last-Modified: Thu, 02 Jan 2025 05:06:25 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vrIr%2FtVFEiVF0xhRwJjFpceXLmmstx%2B8Xguibe6nZiRZ4R4kDlDlIB1U%2BmXHv4CZQklckFVt7v9uDS%2FaOsmQLumK0unZ8jUETrPmYgf3vIqviK%2FZDqwndF9f9MUItgJUtw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=6891&min_rtt=787&rtt_var=11629&sent=558&recv=45&lost=0&retrans=6&sent_bytes=781704&recv_bytes=2512&delivery_rate=1788130&cwnd=272&unsent_bytes=0&cid=06d2bfb77b177ca0&ts=2404&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:36 UTC	97	IN	Data Raw: 47 49 46 38 39 61 b4 00 b4 00 f7 ff 00 fd e7 ca 21 ff 00 ff f5 b7 f8 17 17 dd e7 f0 f9 b0 04 6d 90 a9 ca d4 dc ff f6 01 fe bc 74 a6 08 00 fd de b9 bd ce d8 ff de 00 8d a8 ba ec ef f8 01 01 01 d6 de fb 77 98 ef a9 bc cc ff ef 78 ff 98 fb fd d6 aa 8c a9 ef 4b 93 fe 59 5b 60 fd ce 97 a6 ff 97 Data Ascii: GIF89a!mtwxKY[`
2025-01-02 05:12:36 UTC	2372	IN	Data Raw: b9 ca f7 49 70 90 fe c6 00 fc c5 88 ff 01 f7 e7 ee ef a4 bb f6 ed db b9 f8 b6 6b 9b b4 c6 e1 bd 86 4a 73 e7 f9 90 0d 34 41 5b ff ea 30 6c fe 51 f5 de c6 0b 4d b2 ff 5a f5 ff f8 d9 ff fa 94 ef f7 f8 ff ef 4a 32 65 d4 da b5 71 6b 78 f8 52 fd 30 e9 cc 99 36 93 fa b8 b9 b8 79 86 fe ee b5 66 d7 a8 56 ce dd e7 ff fa c9 8e fd 70 ec d6 ac 46 6b d3 c9 d6 f8 cc 11 0a ee b6 4d 64 88 e7 fe cb 2a 8b 8c 8f fd da 69 d6 71 00 9a 94 47 33 44 fe fe d5 4a fd 78 0e 26 59 ce ff cb ff 0d 51 cd e9 bc 78 fb ef e7 7e 9c b2 54 7a e6 f7 4e 13 c8 32 05 ec c6 8b dd c5 91 b2 a0 2e d7 ff cf f0 59 a6 8c 9a f9 35 65 87 45 4e fe f4 2c 13 d6 4e 05 f7 bc 31 ef e7 cb d7 de e6 e9 ce a5 c5 ff ba fd 48 23 ff ca 11 db b3 12 ff 27 f7 06 c7 f7 fa 0c 24 e9 ad 60 72 ab fa 67 82 9d 1f 57 bc 8f 72 e8 Data Ascii: IpkJs4A[0lQMZJ2eqkxR06yfVpFkMd*iqG3DJx&YQx~TzN2.Y5eEN,N1H#'$`rgWr
2025-01-02 05:12:36 UTC	538	IN	Data Raw: 60 30 af ce 79 8b 3c ab 62 84 67 ae 27 ea d1 67 ad c4 a6 19 22 a1 b9 1e 8a 52 af 0b 2d 9a 6b 22 25 3c 5a ec b4 80 12 e0 40 a5 af 62 9a 1d b3 04 71 8a 6c a7 c1 94 20 25 b5 e4 a6 59 ce 04 b8 5a fa 6d 0b aa f6 da 6a 91 32 12 2a 6f 0b f3 ce ab 07 03 e5 e6 ab a6 38 b7 be 51 2f bd 00 23 3b ef 89 a4 3d a0 69 84 fe ca eb 2f bd 84 2e 12 30 c3 53 f4 f0 8d 3d fa 56 ac e6 b1 f3 3a ac b0 c2 0c d3 eb db b2 0f 12 b7 70 c2 24 97 5c 32 b4 d2 5a ac 32 95 df f4 d8 81 c9 30 97 9c 62 a6 db 05 16 f3 cd 09 07 33 c1 b8 2b f7 9c e6 37 e4 ec 12 0c ce 38 b7 db 18 98 a1 24 f2 86 d2 4c 13 ed af 1e c0 f8 2c 75 a4 c0 e8 a1 b4 d3 24 2b 1d ca 2d 75 fa a5 5a 22 4e 2c bd b4 27 4c 27 62 f6 d9 67 07 e1 40 04 b3 4e ed 36 cb 3d f8 88 f6 dc 74 8b 9d c8 c7 6b b9 45 36 d9 89 cc ff 70 b7 d9 7b ff Data Ascii: `0y<bg'g"R-k"%<Z@bql %YZmj2*o8Q/#;=i/.0S=V:p$\2Z20b3+78$L,u$+-uZ"N,'L'bg@N6=tkE6p{
2025-01-02 05:12:36 UTC	4744	IN	Data Raw: c8 06 32 0d 38 e0 f0 8a 51 0c 63 11 70 f8 c3 1a 8c b1 06 b6 88 5f 0a 97 c8 46 2a d9 e3 01 76 b0 85 19 c9 48 c6 39 f2 f0 8e 38 ac 41 0d 00 28 10 98 e8 f1 8f 80 2c a2 0f 03 a9 47 2e 00 03 54 6d 4c e4 a8 ec 41 0e 60 70 81 90 79 fc 63 24 b1 a8 c7 9c e4 51 8e 73 14 a4 1e 31 79 c6 1a 9c 50 91 a0 24 d6 37 5a 88 49 3d 0a 12 93 72 3c 25 20 75 b0 49 34 d6 80 95 72 44 25 1a d5 18 ca 5a d6 aa 89 22 40 85 2b 5d 19 cb 56 c6 12 0e 70 d0 81 1c 59 09 4b 61 be 52 8e 86 fc 83 2d 97 49 ac 37 72 00 15 c6 1c 26 1a 75 40 cc 57 be 92 98 d4 cc e6 35 75 c0 85 5a 90 63 7e cc 0c e7 a8 c8 21 04 2e 64 53 9b e7 d4 01 30 d3 99 4e 4b 44 40 9c f0 a4 56 04 2c c1 ce 7a d6 93 0b 29 8b a7 3e 6b 45 ff 00 73 d6 73 9d f7 dc a7 40 8b e5 4f 7b da 93 0b 03 4d e8 a8 0a 9a 4e 80 b2 13 a1 0a 8d a8 9f Data Ascii: 28Qcp_F*vH98A(,G.TmLA`pyc$Qs1yP$7ZI=r<% uI4rD%Z"@+]VpYKaR-I7r&u@W5uZc~!.dS0NKD@V,z)>kEss@O{MN
2025-01-02 05:12:36 UTC	5930	IN	Data Raw: 7a 34 f2 48 23 83 c8 e5 48 25 93 ec 31 88 02 85 94 32 c8 05 8b 64 12 c9 26 b3 ec f1 84 20 9c f1 70 4a 30 83 24 71 93 13 b8 34 33 88 32 cb 44 d3 cc 32 37 79 85 c5 30 e3 74 11 1a 32 d3 54 33 cd 35 9d d9 04 48 39 fb 14 72 3d 2a 4e 08 34 50 41 03 8d d2 4f 44 85 5c 15 70 93 41 a9 10 e4 96 0f 13 95 34 48 72 60 74 13 ce 49 bf 0a 08 00 21 f9 04 09 03 00 ff 00 2c 00 00 00 00 b4 00 b4 00 00 08 ff 00 ff 09 1c 48 b0 a0 c1 83 08 13 2a 5c c8 b0 a1 c3 87 10 23 4a 9c 48 b1 a2 c5 8b 18 33 6a dc c8 b1 a3 c7 8f 20 43 8a 1c 49 b2 a4 c9 93 28 53 aa 5c c9 b2 a5 cb 97 30 63 ca 9c 49 f1 41 2d 38 5e bc 58 aa f5 87 a6 cf 9f 0b 23 f8 ab e1 05 90 ae a3 5e e0 f8 7b 00 b4 29 d0 5a 96 04 79 39 aa cb 15 20 57 48 6b 58 62 ea b4 ab 4b 7f 5c 98 61 ad 6a d5 15 d6 b1 55 05 ed f4 ca f6 a4 3f Data Ascii: z4H#H%12d& pJ0$q432D27y0t2T35H9r=N4PAOD\pA4Hr`tI!,H\#JH3j CI(S\0cIA-8^X#^{)Zy9 WHkXbK\ajU?
2025-01-02 05:12:36 UTC	7116	IN	Data Raw: 1e f0 e9 c8 fb 04 a9 cf be 23 9b dc 8f c8 9d 6a ea 81 42 7a f4 59 b0 1e 7d e8 d1 d0 24 7d ac 74 30 43 e6 94 01 06 3a da ac 74 67 1e 07 d7 b8 ae 89 e3 b6 71 c7 c0 01 e8 f1 80 47 65 84 80 c1 a4 0e b3 9c e7 cd e5 b0 23 a6 25 05 14 00 54 50 b9 ac c4 c6 1d 05 64 d9 ff 51 05 1f 04 e8 71 26 28 a1 ea 49 10 fc 9a 24 6a c9 a3 28 d5 54 d3 27 23 d5 a9 07 1f ac 81 d1 4c 37 95 5b 88 cd 33 dd 71 67 41 42 0a 40 40 00 21 08 38 b1 80 78 06 20 95 1e 17 27 2a f5 4c 0d fd 42 a7 87 08 28 30 a9 9f 7a 56 5d 55 9f 01 5c 45 d1 0a 05 98 75 d6 0a 42 b0 71 73 c1 44 b1 d3 48 a3 06 64 80 e5 01 4f 77 32 72 d3 4d 31 4d 0a 5c 4a 3b ed f6 a6 07 ee 2c 60 41 55 f5 59 b5 cf ab 54 4d 75 8d 2f bc f2 81 80 08 ee 44 c1 56 37 6d dc a6 cf 43 6c 95 57 9f 35 aa c8 48 1e 02 62 a8 ea 2a 77 fd 1d 40 c4 Data Ascii: #jBzY}$}t0C:tgqGe#%TPdQq&(I$j(T'#L7[3qgAB@@!8x 'LB(0zV]U\EuBqsDHdOw2rM1M\J;,`AUYTMu/DV7mClW5Hbw@
2025-01-02 05:12:36 UTC	8302	IN	Data Raw: b8 84 bb 08 1d 20 b8 06 f0 9b f0 39 01 3c 86 b3 06 73 a5 5d db 03 e0 d6 03 07 d0 03 96 1b 98 69 1a 8e 9e cb b2 ee 49 07 5d d0 01 74 f0 9e 90 8b a9 eb b0 80 2d 98 51 34 9b 1c 81 1a 3b 69 35 5c 35 3a bb b4 5b bb b6 fb 1e 35 23 0e 21 c0 01 77 6b b0 76 4b b7 3f ab b7 81 39 b6 6e d0 01 1d 30 ba c6 4b 07 ca fb 98 cc eb 06 cd bb bc c6 7b bc c6 eb 9b 2d ca 63 21 10 03 f6 20 0e 89 0a 6e 54 39 05 ce ab bc bf ff e9 a2 76 60 07 7d eb bd 74 90 01 4d 3b ba be 09 9c 66 4b 00 21 30 b9 59 ea 53 9f f9 21 1b 74 57 54 00 72 78 b5 8b fa cb 8b b1 ea ab 4a 35 4b 2d 85 03 74 eb bb 1a 51 aa 02 2c c0 18 20 0a 0a 3b 9e dd eb bd 82 fb 98 8d db b8 53 30 c1 14 5c c1 bf d9 b8 ce cb b8 64 6b b6 98 7a 2d 17 d6 33 53 59 02 ee 29 b8 90 f9 b8 5d 4b be 7f 6b 00 cb 0b c1 ef 19 96 7f 79 bd 06 Data Ascii: 9<s]iI]t-Q4;i5\5:[5#!wkvK?9n0K{-c! nT9v`}tM;fK!0YS!tWTrxJ5K-tQ, ;S0\dkz-3SY)]Kky
2025-01-02 05:12:36 UTC	3669	IN	Data Raw: 40 7e 98 42 95 94 dd 4b 23 55 3f fa a7 d7 bd df 1c 01 b3 16 e4 e5 2f c7 5a 5a df 98 67 07 27 9d 1d 4e 44 11 40 1a 6c 23 ca e8 51 a9 ba ab 64 7d 70 b8 99 03 ad 61 dd 36 76 f9 03 f2 8a 3a aa b9 ed 09 50 dd 1b a2 8d 46 1f 40 6c 75 36 13 c5 b1 bc 6e cc a4 fb 21 b9 49 75 6a f2 49 28 58 45 1d 9f 2e a5 19 7b d2 de 8a a1 8d 76 d6 ad 0c 0d 16 dd 4e b5 86 1c dc 5d af 72 75 55 ce 3b 77 5d 3f 2d 43 26 57 f5 63 ed d6 f5 c2 5d db 96 e6 72 45 a5 e8 ff a1 f7 ed ec 3d df fa 56 7a ba 7d 18 83 38 7a 76 50 64 e6 29 02 fc a5 69 96 3f 0e 72 31 db 4f 6e 5a dc d0 dd 94 dc f0 e2 22 56 e5 de 9e 78 b8 39 6a da 2a 66 1a dc 91 9c 00 57 c9 e9 21 8d 43 09 85 b6 2c 9e c9 bb 5a 49 42 07 01 55 21 e7 0a 79 a8 40 64 bb 91 a5 83 86 8d 0c 52 51 09 f1 7a 1b 1b df b9 2b af 0c 33 7d dd 3e 4c 20 Data Ascii: @~BK#U?/ZZg'ND@l#Qd}pa6v:PF@lu6n!IujI(XE.{vN]ruU;w]?-C&Wc]rE=Vz}8zvPd)i?r1OnZ"Vx9j*fW!C,ZIBU!y@dRQz+3}>L
2025-01-02 05:12:36 UTC	10674	IN	Data Raw: 81 b1 c5 db 4a 96 6c 81 a4 80 f1 e2 8d 1a b1 8a 60 c5 17 09 19 36 1c ef 2f 64 c8 37 25 16 50 8c 19 ef 5f cd 12 9b e6 55 ac 96 6d 44 6b e1 de ae 84 65 6f 6e 03 6b 56 04 5a 91 05 06 a1 ff c2 90 49 71 cb 21 b4 b1 c1 99 dc bb 07 df 5e 18 9a 72 83 26 8b 83 0f 1f 3c 19 e7 f2 e0 49 4f 1f 6f 80 58 38 74 39 f4 7c 4b 44 c1 3c 29 d4 83 c3 2f 6b e7 8a e2 b6 ee a4 6a 15 78 f0 e8 f6 ad 4a 72 b0 5e 46 24 46 8c 3b ee bb 97 f3 e7 27 64 bf 3a c2 fd 00 bc 6b b0 c1 ee e8 88 ba 06 2a 49 8c 40 01 2f 1b 42 a2 05 2f fb 6b c0 c1 0a 43 90 33 02 bd cb 4f a1 c6 3c 4a 4e c0 c1 d4 1a c2 32 d2 a0 f2 2f 22 ce 48 a3 10 1b f5 88 39 b0 01 0a de 2a 67 b5 19 05 a0 ac 89 09 73 cc d0 41 ee f6 db 71 c7 de da f2 41 00 01 86 54 41 22 90 7c d4 71 38 b6 80 53 72 c0 bf 26 d4 8c 82 22 89 f4 61 3e e4 Data Ascii: Jl`6/d7%P_UmDkeonkVZIq!^r&<IOoX8t9\|KD<)/kjxJr^F$F;'d:kI@/B/kC3O<JN2/"H9gsAqATA"\|q8Sr&"a>
2025-01-02 05:12:36 UTC	11860	IN	Data Raw: fa 0a b0 4a 3b da 91 8d 74 74 87 7e 56 a2 87 20 54 8d 5e 0d 58 26 04 37 39 ce 37 1e 2e 5f d9 dc 26 3c b7 41 c6 72 10 00 68 25 cc 22 37 c1 a9 c9 c6 79 28 9a 11 a9 84 3b f8 06 50 78 4e 6b a0 11 41 c2 37 58 f2 0f 88 ea c5 2f a8 29 d9 2a b9 f9 ce 5f c2 ec 9d 16 c5 68 40 07 e2 83 75 e8 21 11 04 b0 87 d0 60 89 51 8b 82 13 46 ab ec e7 2f 01 1a b5 90 ed 85 a2 85 bb e8 2a 6d fa b5 21 54 cb 6d 0b 95 c8 46 5b aa 49 42 b8 d3 a5 37 3d c4 40 ac d1 12 88 46 54 92 eb 5c 26 4a 5d 0a d4 81 34 01 a0 37 9d aa 26 1f e4 d0 44 bc c1 1e 38 1c 08 e5 a8 ea d4 ce a5 f4 a9 9b 6c e1 5d 56 12 82 10 f8 85 a9 63 fd ea 10 0a 44 b2 26 16 60 00 54 a5 6b 55 ed ba ca 2a fc eb a1 49 a5 e4 5e 4a aa 3c 8e 3e 75 95 d1 db 28 42 53 9a 3d 7b 04 23 18 0e 1c 80 60 11 ca 4d f2 3d 96 ff a3 16 f5 e4 b5 Data Ascii: J;tt~V T^X&797._&<Arh%"7y(;PxNkA7X/)_h@u!`QF/m!TmF[IB7=@FT\&J]47&D8l]VcD&`TkU*I^J<>u(BS={#`M=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49848	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:36 UTC	364	OUT	GET /i/1616/PPJJ-200-200.gif HTTP/1.1 Host: amjs.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:36 UTC	539	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 301616 Connection: close Accept-Ranges: bytes Age: 70016 Cache-Control: max-age=2592000 Etag: "675feb46-49a30" Expires: Fri, 31 Jan 2025 09:45:42 GMT Last-Modified: Mon, 16 Dec 2024 08:56:38 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: ca0e06384f936294ac73fc99d121a72d X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:36 GMT via: cache01.oversea-GM-FRA2
2025-01-02 05:12:36 UTC	15845	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 d5 3f 00 ff fe 0e f9 d3 4e ff ff fe fe cf 30 97 09 06 e0 b6 49 f7 db 68 f8 b5 2e c7 2c ff f4 a3 a2 dc 67 10 9a 92 12 06 04 01 fe f2 2c ff f7 49 fb b3 0a 53 16 05 99 65 16 fe e9 73 fa ec a0 07 4a fe f6 8a 0e fc ca 15 62 4d 0d ff 00 00 d0 95 30 f4 6e 6e a4 9f 9e ce 05 06 da a9 34 d2 cd 0b f8 c9 c5 e3 96 ff f7 9f 1e cb 87 14 6b 6a 66 c4 36 08 aa 88 70 d2 d0 cf c5 b3 0c f9 ec e1 fd 37 34 ab 67 4c f5 33 06 f8 dd fe dd cb 2b db 3a 33 3c 67 d1 e6 c6 69 ed c6 4c e0 18 7a 15 c5 a0 9a b6 ff 31 2d 15 90 30 13 e8 be fd c2 18 06 ee e6 0f be ad 71 b4 cf ff f1 19 10 f4 e3 3a 67 1a a5 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 ff 0b 58 4d 50 20 44 61 74 61 58 4d 50 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 Data Ascii: GIF89a?N0Ih.,g,ISesJbM0nn4kjf6p74gL3+:3<giLz1-0q:g!NETSCAPE2.0!XMP DataXMP<?xpacket begin="
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: 7a 81 d9 84 d0 25 3e 66 90 d4 02 01 a0 ea 8f d0 4c 19 43 23 b5 b0 7a 62 76 ea 46 5c 6c 04 e2 dd ff 58 1d 31 1a 97 03 86 41 a0 35 93 03 74 be 37 1e e0 01 a7 43 ec fb c1 eb 5a 35 ec c6 3e 30 71 70 54 c8 2e 18 4c 83 0c c8 7e d9 76 8d 34 4a 83 36 52 f3 3a 51 53 35 93 ce 16 e5 82 31 72 24 e9 88 90 ac 01 21 e7 44 7c 5d fd 04 a3 fa 71 b8 58 1d 80 0a a8 1c 3f e1 7b 56 fb 26 0a 28 7e 27 6c 06 03 32 64 46 45 38 28 7b 0b 0b 60 38 eb 20 de ec 10 3b c6 c0 b3 60 83 b2 05 1f 0a ff 41 e7 0c 4f e7 d2 84 e7 0d 8f d5 86 21 68 62 d1 29 a0 7e 30 fe c8 7a 62 d1 18 62 91 1c 77 33 2b 98 56 2d 84 b0 33 ca ae ec 79 9e e7 25 0f 62 b9 12 34 42 66 d7 ed e5 f2 80 63 d7 dd a6 6d 50 ed f2 36 7f 91 39 a6 45 bf 98 93 fb a1 e7 e2 72 0c 4e 53 0b cd 54 1e 11 b3 37 c9 61 f4 55 bb 21 a1 70 ef Data Ascii: z%>fLC#zbvF\lX1A5t7CZ5>0qpT.L~v4J6R:QS51r$!D\|]qX?{V&(~'l2dFE8({`8 ;`AO!hb)~0zbbw3+V-3y%b4BfcmP69ErNST7aU!p
2025-01-02 05:12:36 UTC	16384	IN	Data Raw: ae 60 19 00 9c d6 b5 03 68 ac c0 1e 3d f7 ea d5 53 34 c1 1e 9e 16 a9 da 5d 70 57 43 20 42 83 20 bd 28 3b 51 a3 06 03 77 01 fb e0 19 10 88 4d 08 18 13 0c 18 48 00 83 8d 9d 3c 8a 5a 44 58 68 f2 82 07 ff 84 0d 42 0a bd 82 30 47 04 06 26 c7 b5 90 14 28 84 53 a7 1a 62 48 98 20 00 c5 04 18 4f 9d 1e 88 21 09 e3 42 a4 11 10 02 18 4a 36 0a 42 92 0c d2 fa e4 04 a0 87 a0 1f 07 34 40 0d 31 80 de 04 14 02 26 48 c0 2a 57 ae d6 3b 78 3c 6c 34 89 f4 e7 d8 b2 88 93 e4 40 b8 20 2d d2 05 88 2a 15 79 aa e1 40 0f 8a 31 27 68 76 10 e0 40 56 0d 43 06 b0 45 4b 78 01 42 82 89 53 0b 31 7c c1 f1 da b6 48 9c d6 55 64 00 6b 82 02 30 26 1a f0 9c c0 69 11 c0 39 5a 13 0e bb 4c 35 e2 a2 ad d3 2e 58 1c 34 49 08 03 7a 7a 14 c8 e6 57 2e 0c 7b 03 9e ce 62 ec 98 c1 85 b3 c6 c9 16 25 cc c0 34 Data Ascii: `h=S4]pWC B (;QwMH<ZDXhB0G&(SbH O!BJ6B4@1&HW;x<l4@ -y@1'hv@VCEKxBS1\|HUdk0&i9ZL5.X4IzzW.{b%4
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: b5 54 54 96 89 c0 d1 7d c4 d3 a3 a5 ec 44 9b f0 cf 6d 0b 13 d4 21 0e 0f ed 20 d6 3e a2 db 32 3b 48 22 55 26 87 5e 1e b1 c3 96 3e 36 9d 40 38 8e ff 28 da 0c c2 69 0d d2 ee 5a 74 bc f5 2a d5 47 bb 45 12 c9 57 d7 65 c3 49 5d 1e 95 f2 0f 44 19 99 37 16 46 0d 3e 38 da 60 0f 81 61 08 7b d3 88 ed d2 c9 ea 3b 93 53 7d 3d dd 18 e0 38 ad 1d 38 25 37 42 72 52 9f 7b be 45 52 a3 75 bf 8b 80 ae 9c 79 95 b8 43 75 03 2e a3 2a 2d 7d 62 33 31 84 12 fa b0 22 c9 24 5a e5 88 b3 00 70 20 2b 7d 89 9b d1 5f 06 9c 7b 33 e0 ac 5d 36 05 9c bf 9a 30 cd 35 24 6c 8d 30 c9 25 81 89 cd 91 f5 ca 2e cf c3 ec b0 06 a0 62 be 30 6e 13 10 44 74 18 16 b9 5a e7 60 b1 10 03 a8 16 2e e5 36 b1 10 c2 c0 96 bb e6 42 63 21 9c 84 f9 41 48 6c 36 60 dd 26 07 82 78 a9 82 71 2d e0 e3 a2 7b ad dc e8 47 20 Data Ascii: TT}Dm! >2;H"U&^>6@8(iZtGEWeI]D7F>8`a{;S}=88%7BrR{ERuyCu.-}b31"$Zp +}_{3]605$l0%.b0nDtZ`.6Bc!AHl6`&xq-{G
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: d0 48 67 b8 22 72 27 af 3e 8b 76 ac 1e 15 3f 36 f8 c3 7b 35 a3 54 43 8e 54 94 08 ce 64 14 6e 17 0f 1b 00 ea 0b 20 dd a6 45 40 48 41 0e 5e d1 2b 00 aa b6 d6 bd 10 80 ec 07 96 21 19 e7 26 b8 a5 73 a9 cb 42 2a 43 db 01 34 88 40 d4 d1 8c 4d 9d 71 5a fa d6 97 3c fe 45 03 25 51 d9 c7 3e f4 36 0c 16 c6 af 1c 0b 48 c4 ef f4 97 05 4a b0 c7 61 ae 13 a0 f2 0a 48 ad 8b 21 50 63 1b d4 5a b7 2c 54 81 8f 7d 04 82 0b a2 e0 d8 4e 46 a1 06 de 28 4c dc 7a 17 f4 28 85 26 58 bc ed 30 b0 69 80 0e 49 48 37 43 44 c7 1c 28 d4 49 3f e8 37 46 73 5c c0 0a 34 d4 df 89 dc 74 b8 2d aa 8f 87 d6 aa 54 bc 50 e5 ae 0c ad ff 0b 6c 95 09 5b e7 b2 47 b6 cf 85 ee 82 67 bb 54 10 23 37 3e 48 ad 89 75 d0 a0 9b 01 02 b0 c8 2d b2 28 76 20 8c 8a 39 26 59 bb 49 3e c4 8c ba 4a 23 0d a1 c1 b4 08 24 52 Data Ascii: Hg"r'>v?6{5TCTdn E@HA^+!&sB*C4@MqZ<E%Q>6HJaH!PcZ,T}NF(Lz(&X0iIH7CD(I?7Fs\4t-TPl[GgT#7>Hu-(v 9&YI>J#$R
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: dc 8b 4e fb 80 cd 3a 71 cd 0b 1d 14 a1 bc ca dc 1c cd 18 42 1a 07 13 03 21 a7 29 69 24 b9 12 8b a9 ef dc 02 23 90 1a 6b b1 95 50 ec 00 19 10 01 ab d1 1b 8c b8 c5 0d 60 29 44 45 cb 35 36 ab 48 e4 97 34 4b 3e 93 0a b2 00 65 59 e8 c2 27 38 dc cd 95 01 d1 88 1b 22 66 29 4b 3c 71 cd 11 1c c1 db 6c c4 43 51 1c 5e 9b 1c a0 01 4c 56 c1 4f d5 d8 c4 e8 8c 29 cb fb 7b 2b 6d 03 23 60 03 27 30 cf ef 7c 02 5b d1 ce 89 9c b0 f5 01 01 ff 0e 8b cf f0 a7 40 86 b2 94 4a 7b c9 f3 aa c9 8a 43 44 c5 b2 c7 03 6d 34 05 1d 14 e4 d0 09 d9 9c d7 3f e1 13 06 6d d0 44 c1 cd ea 4b 1c ba 5b 2a e9 12 90 4a e8 53 80 fc 5e 1c ed 1f 0d 90 01 5c 31 02 21 ad 31 45 e2 00 2d 60 03 28 a1 62 56 7c d5 68 e1 10 08 07 7d a0 2b 7f f0 3b 8d 1b dc 9a 4d 6a 53 f9 b4 38 af 63 23 3b 8d 27 4a 91 d4 aa fc Data Ascii: N:qB!)i$#kP`)DE56H4K>eY'8"f)K<qlCQ^LVO){+m#`'0\|[@J{CDm4?mDK[*JS^\1!1E-`(bV\|h}+;MjS8c#;'J
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: ea 32 87 e5 78 6e 35 89 55 30 64 91 e1 ea 26 6c 58 eb 6c 17 a6 5a 89 e3 91 9d 97 25 21 ec 1b fa 46 19 a5 23 ad ff ed 98 f4 ac a3 b3 82 2c 86 cb b3 88 ef 30 f9 56 e1 84 00 40 a4 38 89 c2 09 a7 fa cc 69 c4 5d 9c 74 ac 0d 75 33 8d fa 74 bd e4 4f 1b ff c9 a6 e0 dd b3 d3 6e 5e 30 41 79 45 d7 ed 16 19 f4 3d 6b b9 a3 a3 6c c2 0a 05 a2 d6 75 6a 23 18 41 c3 a7 29 6a e1 f6 db 6d af b8 80 c3 cd 32 4b 71 d3 ad 07 7e 23 91 d1 d5 24 ce 19 79 43 d9 f2 72 30 67 de 65 01 f9 c0 b6 02 e5 8b 5c 0c c2 da dc 4c 17 ae 14 b5 2f 1f 08 b3 02 87 02 c0 a1 16 74 29 70 18 31 df f9 30 28 35 6e a5 25 71 d6 93 db c7 1e 77 ae 74 e1 ef 47 f4 4a 19 d9 96 e7 bf e3 d1 e9 78 9f cb 43 05 af f0 38 da 34 68 34 3d 98 9b 04 46 93 8f 9d 35 4b 4a e9 31 4b 1a 9e a5 30 55 a4 26 07 3d 48 42 07 32 98 c4 Data Ascii: 2xn5U0d&lXlZ%!F#,0V@8i]tu3tOn^0AyE=kluj#A)jm2Kq~#$yCr0ge\L/t)p10(5n%qwtGJxC84h4=F5KJ1K0U&=HB2
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 23 53 5b 8c e2 f8 28 05 32 a8 93 33 77 a3 1e 0f 34 4d 55 72 0e 62 67 b6 9a d3 4d ad 73 b6 42 65 c7 dc b2 23 59 f1 63 8c 6a 48 49 81 14 e2 73 3e 45 94 b3 f0 68 bb 38 6b 44 d9 c4 99 de 08 c6 ba 66 75 9c a2 34 b2 22 a8 82 aa 5b c6 68 6a 48 92 12 a8 c5 3a 29 c1 25 6b 6a 10 57 32 09 0f d4 17 e9 c7 40 0c d4 4d 83 2c c8 66 eb 13 9a e0 69 ee ce 51 41 2e c7 dc 6b 63 74 e0 c1 de cd 2b 98 34 1c a9 a7 8c b4 28 98 3e 28 72 a8 00 48 ae a0 57 7d 95 d7 ae 45 0c ee 01 07 89 48 15 f3 d3 16 0d a6 33 e9 ff c0 00 9e 2d 61 32 d5 1e 9d 95 33 e3 d4 e0 ac b3 df 50 f5 3e f1 2c 6a ac c6 2d ed 6b 69 02 ca 6a c6 f3 14 6e 53 51 17 62 b6 42 a3 3e 60 40 56 64 63 2c d8 02 19 72 c4 4a 5c 46 f0 c4 c0 22 80 4c b6 3c c2 31 2a a1 40 0d 25 2c df 01 41 eb 45 53 a7 35 60 4b 75 5e 52 55 5e f8 6d Data Ascii: #S[(23w4MUrbgMsBe#YcjHIs>Eh8kDfu4"[hjH:)%kjW2@M,fiQA.kct+4(>(rHW}EH3-a23P>,j-kijnSQbB>`@Vdc,rJ\F"L<1*@%,AES5`Ku^RU^m
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: 1a a6 e6 35 97 bd 64 06 66 b6 d9 a1 76 b6 a2 a6 2d cb 15 8f a9 53 66 65 42 12 23 15 d1 02 2c 46 4f 11 34 a5 4b 90 4b 27 3b ff a9 db c8 8a a5 4c 21 e4 20 31 78 32 d2 12 d0 d1 04 d9 1d 8f 0e 86 eb 40 1d 18 f7 b8 c8 6d c7 08 34 7a b9 0f 7d 0c b4 5e 71 86 79 2c 99 82 d6 89 88 a4 23 8a e4 c7 f2 67 9d e5 99 4a ff 01 fd 18 6b c3 3e 5a 60 48 41 b6 1b 9c 81 81 0a 44 74 50 bf 59 49 4c f7 a0 86 37 05 d0 36 f9 72 16 26 37 20 ed 1b 3c 19 e0 11 35 25 72 92 13 02 a4 10 36 4a c0 64 60 01 15 1e 30 aa 28 18 47 ed a2 d5 54 24 4a f1 58 ae 41 ca e4 9d d8 9d e4 fd 07 29 29 8c 62 e7 72 c7 93 59 73 46 06 7a 85 b6 f8 82 f8 ad af b8 84 63 1d cb 3b 72 59 ac 75 55 76 ec 48 2a 54 3b f6 f0 cd 23 95 12 40 f3 66 2c e0 8f 91 54 04 78 aa 32 7a 7a b9 65 27 8c d4 9f ee b3 11 df 02 82 22 d3 Data Ascii: 5dfv-SfeB#,FO4KK';L! 1x2@m4z}^qy,#gJk>Z`HADtPYIL76r&7 <5%r6Jd`0(GT$JXA))brYsFzc;rYuUvH*T;#@f,Tx2zze'"
2025-01-02 05:12:37 UTC	16384	IN	Data Raw: bc 15 c6 cd 43 cc ed 6e 09 1b 39 82 2a f5 b0 c2 3d 03 81 97 c9 58 e3 6d e8 99 21 22 1c 26 26 0c 19 28 eb 56 8c 8f 68 b0 79 1f 81 e1 ab 51 7a 86 24 08 41 17 6d e0 81 8a a2 c4 44 28 46 71 7a ff 3f 90 c3 c2 94 3a 36 73 a3 2f ca f6 66 67 f7 7d e0 35 39 64 c1 20 01 da 63 53 f1 76 a0 c6 74 d7 04 03 fd 05 23 33 b3 43 8f 5d 5a ae f5 24 5e 94 6e 2e 67 fa 85 30 a0 3a 20 b6 b0 34 a0 c9 04 80 8c 04 c6 5a de b4 7d 99 00 24 10 8b 02 50 92 ed 2d c2 70 cc 39 66 ad 92 f6 53 47 9e 9e b6 af b9 31 b7 00 4a 80 03 71 9f 96 00 3b e6 5c 40 75 76 55 00 03 37 04 44 a6 c0 53 a3 6a 60 e4 26 ed 71 09 36 11 38 c3 73 b5 80 ea 16 84 57 c9 6a 86 1b 60 00 09 5c 56 01 d8 35 80 37 4f a0 00 91 82 8f c4 50 29 a3 02 3a 13 6a 51 e7 38 2e f0 4b 80 c8 47 4e f2 92 97 7c 90 2e 20 d9 7d e5 ec 3e 5f Data Ascii: Cn9*=Xm!"&&(VhyQz$AmD(Fqz?:6s/fg}59d cSvt#3C]Z$^n.g0: 4Z}$P-p9fSG1Jq;\@uvU7DSj`&q68sWj`\V57OP):jQ8.KGN\|. }>_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49855	142.132.201.10	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:37 UTC	374	OUT	GET /7bd578c706a9f8fb6f46da207b46e618.gif HTTP/1.1 Host: we.zz17377.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:37 UTC	940	IN	HTTP/1.1 200 OK Age: 2098380 Cf-Cache-Status: HIT Cf-Ray: 8fb296b99e79d29a-FRA Content-Type: image/gif Date: Wed, 01 Jan 2025 12:42:21 GMT Etag: W/"675530c7-4758" Expires: Fri, 31 Jan 2025 12:42:20 GMT Last-Modified: Wed, 01 Jan 2025 12:42:21 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vXLbWuQNk7UeA9lWu%2BCC2wzyNlaSiUuZakk%2F1YbO%2BS5xHP9DYvFuAuZkyhvadbRlvWGt4snmwSFoRc57%2BdqwndZC8Qkx6Pa%2F%2Bdx3zRl3%2B%2FsZoJsUQsuK5%2FpwyPIMBSS0yKkDY64DYSgzS1I1zLg3"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=5488&min_rtt=5472&rtt_var=1551&sent=5&recv=7&lost=0&retrans=0&sent_bytes=3098&recv_bytes=1153&delivery_rate=735005&cwnd=252&unsent_bytes=0&cid=2ce0f0170a064d35&ts=18&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close Transfer-Encoding: chunked
2025-01-02 05:12:37 UTC	246	IN	Data Raw: 34 30 30 30 0d 0a 47 49 46 38 39 61 96 00 96 00 f7 ff 00 c8 c7 c7 9f 91 6f 51 45 36 37 24 14 fd fd fb 08 07 06 e2 0e de fe e9 b0 bb b9 b8 b9 af 8f ff e6 ba fe 29 05 2c 2b 2b 86 85 84 f9 d4 ce 5f 13 d9 8d 79 61 44 2e 17 ea c6 94 47 45 42 e3 e2 df ff f3 ba fe 68 26 ff 89 60 a9 4c 24 ee ed ed ff ea c7 3a 3a 3a c6 bc b3 7c 79 79 e3 e2 e2 ff e5 d6 21 21 20 46 37 25 db d8 c5 58 57 56 27 18 17 1c 1c 1c 12 10 10 ff ff f4 c1 b3 82 d3 c5 98 a6 9c 93 68 67 66 a4 a4 a4 35 35 35 9c 9c 9b ff 63 18 ff aa 8c ff 5e 22 46 3d 33 ff fe dc ff fd c2 ad ac ac ff d3 a2 3a 31 28 d5 d4 d3 ff fd cb ff fe e4 07 23 33 35 2b 23 67 56 49 ff ff ec 78 64 52 ff 59 1e ff 56 1c de dd dd 46 25 25 f3 f3 f3 ff 43 07 ff ec e1 93 93 92 ff f7 db c5 c2 bf ff fe d3 ff 7e Data Ascii: 4000GIF89aoQE67$),++_yaD.GEBh&`L$:::\|yy!! F7%XWV'hgf555c^"F=3:1(#35+#gVIxdRYVF%%C~
2025-01-02 05:12:37 UTC	2372	IN	Data Raw: 10 ff 72 4c ff f2 d5 a1 30 1b 52 49 40 b6 aa a5 37 17 1b da cd a1 db d4 b5 ff dc ac 29 1a 0c 2f 2f 2f ad d1 cd 10 8f f5 13 06 04 c4 4a 18 e5 0c 6c 42 88 a0 0e 30 3f c2 b9 96 25 4e 74 98 87 83 5a 51 42 f9 c7 0f 0a d8 fe d9 d1 ab d0 e6 f1 77 69 61 08 fa 9e 48 17 12 c4 c1 a7 b7 b4 b2 18 12 12 5b 2a 7f 6c 45 39 ff e0 b3 45 1c 21 ff 46 18 e1 d7 bd 3d 38 33 96 95 8c ff 50 14 a4 81 1e ff f6 c1 a9 1d 74 4e 38 1f e4 d9 a6 3a 35 30 7d 73 66 51 3a 35 f3 f2 e3 2b a8 6e 0d 29 0b cd cb c9 fd de a3 df dd d3 ec ea db 6c 5c 60 25 33 3b fe f5 ee 33 1d 1c 2a 23 1e 18 10 0b f6 f4 e9 ff f1 cd e3 58 1c f3 ff fd fe f4 e4 df f1 ff 4f 26 27 fb f7 f4 64 3b 2d 99 97 96 af aa a1 e8 e1 c9 f4 fe f4 ed f1 ea ff ca 9e 2e 28 22 74 27 0f cd e1 cd 47 2c 2e 28 2d 30 fb 5a 02 26 35 23 ea fd Data Ascii: rL0RI@7)///JlB0?%NtZQBwiaH[lE9E!F=83PtN8:50}sfQ:5+n)l\`%3;3#XO&'d;-.("t'G,.(-0Z&5#
2025-01-02 05:12:37 UTC	538	IN	Data Raw: 98 70 ec 97 29 6c ee 7e b8 c0 2a da 15 61 e4 bb ab bc 80 c1 d4 fc ea b3 81 dd 78 f7 6b f7 c4 7b e7 ff 7d 37 c0 7e f3 ad f7 cd 7b ff ed af 3e 85 03 8e f8 e2 8c 2f 3e c1 2f e4 68 88 90 3f b0 a4 fc 9d 76 b0 c1 e0 63 77 b2 1e 3d a8 db 99 3a f4 63 10 72 d3 dd f7 e9 a8 e3 8d fa dd 79 f7 cd fa e2 83 23 ae b7 ea b1 0f 3e bb ec ab 33 6e 7b e3 bc 37 6e 02 3d fe ec 55 6d 11 e0 01 41 e4 02 9a 7f be 27 f2 1e a2 4c 24 13 1f a8 18 f7 dc 2e c3 6e bd e2 7e 17 ee fa eb bb 1b ee fd df db e3 7e bb ed 01 6b 8f 7b ef e8 eb b3 0f 34 13 10 90 31 41 94 5b de 76 ca 9a 1b 62 48 a0 53 85 b9 00 2c 0e 11 18 26 91 a4 f3 8d 38 e4 90 be 02 a2 ef 75 06 4c a0 f5 14 c8 c0 06 22 2e 1c 26 80 4e 41 b4 44 b2 a6 15 21 15 43 31 c2 05 61 41 24 66 85 69 5d 9b 6b 5a 00 a7 86 c0 05 96 b0 77 27 6c 5c Data Ascii: p)l~*axk{}7~{>/>/h?vcw=:cry#>3n{7n=UmA'L$.n~~k{41A[vbHS,&8uL".&NAD!C1aA$fi]kZw'l\
2025-01-02 05:12:37 UTC	4744	IN	Data Raw: 07 3b e8 44 38 b1 a9 ff 4e 66 98 d3 9b e0 2c e7 2b 36 70 4b f4 b1 f2 97 08 45 a8 3e 4c 90 a3 62 c2 80 78 46 b3 d5 d1 96 d9 a9 6a c5 60 4b 3a dc 0f 6f 8c 21 87 1d 28 c3 0a ae e8 80 0b 66 d1 80 15 1c 61 16 47 58 41 03 5c e0 02 79 74 60 12 b3 e8 86 3c 66 31 8b 49 c8 a3 01 34 95 87 3c 46 0a 8c 1e 60 e0 a7 02 28 c4 2b ae a1 d0 84 96 b2 13 fb 80 40 1d ea f0 83 9d 92 d4 a4 28 55 e9 2c 5c d0 81 0e d0 74 12 13 70 05 2a 7f c9 cb b5 78 95 2c e5 90 87 15 43 48 24 cd 5d cb 1f 0e 48 5a b5 2c 80 2b e2 7d ee 05 8c c0 97 3e ae 01 1a 1c 38 24 03 2e 78 88 0b de e1 90 76 b4 e3 ae 6a 78 48 0d f8 ea 0f 7a 00 cf 1f 96 80 80 27 96 b0 04 df f4 32 2c 46 f5 e5 06 90 b1 0c 31 58 b6 0e ea 70 c8 28 c6 f1 10 16 64 c8 1f 49 f8 ab 43 c8 71 0b 82 92 32 2c a9 84 ec 69 bf aa 96 12 3c 21 12 Data Ascii: ;D8Nf,+6pKE>LbxFj`K:o!(faGXA\yt`<f1I4<F`(+@(U,\tp*x,CH$]HZ,+}>8$.xvjxHz'2,F1Xp(dICq2,i<!
2025-01-02 05:12:37 UTC	5930	IN	Data Raw: fc e1 40 8d ab 40 c1 60 81 22 8a c0 a0 9c 50 42 99 92 04 68 0e 99 75 d6 28 66 95 b5 a5 1b 78 70 26 e1 97 54 e1 55 a7 38 a2 88 42 b5 09 08 24 2e 0a cb 56 e3 23 84 33 a3 40 44 0f dc 96 61 e9 86 68 fd 49 81 da 6a c3 10 a6 c1 a0 b8 75 99 1d 16 c5 95 39 3a 64 0a d0 67 2b 16 d6 d5 65 8e ab 08 e8 06 9e f1 e8 f5 c7 de 7c 3d 41 07 91 29 ff bd 65 08 59 93 6e da e0 10 6e 60 e7 56 5c 5f da ff 55 cc 19 7c b5 e6 44 a3 c0 8a e2 90 2d 4b 80 ec a8 28 5a 58 a6 c1 95 04 20 99 80 ab 72 41 79 8c 27 d0 e0 c3 41 97 5d e6 61 ba 99 67 ae 59 1f b6 fd a9 61 5d 0a e6 e9 db 1d 5d ae 42 80 83 7a 21 58 c0 13 4f 30 28 21 e9 08 0e 09 18 72 ca a7 0c 61 00 85 51 a2 b2 cb 4c 1e ce 3a 0a 53 ea 96 98 04 12 ca 59 23 8a ae 0f d9 e0 32 01 5e 7a a2 c1 15 e4 91 47 12 39 b0 99 c0 17 10 aa c8 64 00 Data Ascii: @@`"PBhu(fxp&TU8B$.V#3@DahIju9:dg+e\|=A)eYnn`V\_U\|D-K(ZX rAy'A]agYa]]Bz!XO0(!raQL:SY#2^zG9d
2025-01-02 05:12:37 UTC	2560	IN	Data Raw: 23 1e f3 68 bc 0e 59 6f 8e e3 69 45 0e 50 20 3d 3d 12 b2 90 6b 3c 52 0e aa e8 c7 34 b5 82 06 28 b0 a3 21 23 29 c9 e9 c1 a5 62 8a 5c 64 9a c2 95 02 44 e0 70 92 9e 9c 64 e6 50 40 83 4b 62 92 91 34 c8 c3 88 b4 f8 c9 55 e2 11 37 29 18 65 29 af 57 8d 68 54 40 ca 6e aa 64 25 2e b9 68 99 1e c8 0e 35 b1 3c 60 20 1c 29 03 37 e5 b2 98 39 b4 4c 26 ba c5 b9 5f f2 30 5c 15 08 00 27 3b 69 cc 69 7a b1 32 55 80 40 e0 48 c9 4c 1e 62 31 1a 01 b8 61 14 a9 59 4c 5a f1 20 00 b1 a0 81 01 b7 89 c9 60 3a ed 07 d1 1c 22 3c e3 29 cf 79 d2 b3 9e f6 a4 15 08 7a 50 8f 73 06 82 54 ea 8c 65 32 68 19 08 14 40 20 0c 88 48 44 22 b2 20 4e 49 66 21 0b 89 20 c1 0b 51 90 8c 0a 44 23 9d ff dc 66 2b 02 4a 83 8a 26 43 86 28 f8 28 48 43 2a d2 91 92 b4 a4 26 3d 29 4a 53 5a 52 19 4a 21 10 81 8b 46 Data Ascii: #hYoiEP ==k<R4(!#)b\dDpdP@Kb4U7)e)WhT@nd%.h5<` )79L&_0\';iiz2U@HLb1aYLZ `:"<)yzPsTe2h@ HD" NIf! QD#f+J&C((HC*&=)JSZRJ!F
2025-01-02 05:12:37 UTC	1894	IN	Data Raw: 0d 0a 37 35 38 0d 0a 66 48 d9 fa b1 86 7d b8 02 19 95 98 81 02 ac db da 44 ac b1 00 40 0e b2 44 74 16 3f 5b ac f6 1f 3a 48 c3 8a 17 02 e4 dd 21 2e a0 1f 0e ad 75 67 30 05 13 3f ee 71 41 06 f2 2a 37 2c 5f 97 28 4b 22 b7 90 41 30 1a e0 5d eb 96 f5 07 3f 06 f0 93 23 cc 66 ff ae 31 ff 0d 3a 50 00 41 96 dc 10 bc 05 d9 c3 fd 00 b1 75 15 40 e5 7f a4 39 a0 6f b5 f3 95 5b 4c 97 12 94 42 0f 8b 40 c2 8e dd 30 03 32 1c 4d a4 59 b6 48 3f b2 60 e4 1d 1b 91 6a 16 09 f2 87 ff b1 63 05 28 81 0c 2b c5 4a 5a 5f 22 35 2f f8 a0 d3 8b 98 c1 08 98 01 8d f8 35 d9 23 f1 4b 83 8e e7 9c 69 20 1b ad 1e 21 56 00 9f 41 3d d3 1d f5 83 10 33 d0 80 ae f9 4c 89 60 e8 63 02 20 e0 87 fc 08 0d 91 37 cf c0 0d 9c 16 08 9d 25 a2 e9 3c eb 58 03 6e f8 74 a8 99 14 bf 38 e4 c0 0d 0a 70 43 13 b4 c1 Data Ascii: 758fH}D@Dt?[:H!.ug0?qA*7,_(K"A0]?#f1:PAu@9o[LB@02MYH?`jc(+JZ_"5/5#Ki !VA=3L`c 7%<Xnt8pC

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49853	116.162.210.150	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:37 UTC	595	OUT	GET /img/uu-rt150x150.gif HTTP/1.1 Host: monkey.p2ld58.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:38 UTC	621	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 200936 Connection: close Accept-Ranges: bytes Age: 0 Cache-Control: max-age=7200 Etag: "67700a17-310e8" Expires: Sat, 01 Feb 2025 05:12:38 GMT Last-Modified: Sat, 28 Dec 2024 14:24:23 GMT Vary: Accept-Encoding Via: cache37.jnmp,cache09.hnchangsha-cu15 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 54a6fded13963988f2abd980869419aa X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:38 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:38 UTC	15763	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 e3 ae 95 d5 9d 83 fb 63 51 ba 7d 61 65 18 a9 db aa 95 8b 51 37 db a4 8a c8 8d 72 f9 d9 c6 fe 95 2f f5 21 72 f4 a8 cc ed ca b7 e3 48 bd e7 b2 9a fb 96 52 ff 19 46 47 93 bb fb e8 d8 fb 6b 90 db b6 a6 f3 ba a6 ce 96 79 ad 71 56 a7 6c 52 fd c4 2d 9b 62 49 94 5a 41 96 2a db ff ba 52 ff c7 4d 18 28 52 eb b6 9e e7 3b a6 f3 ce ba bd 82 65 5f 70 90 ff d5 dc fe 76 68 f5 77 a7 c6 d0 da 5c 2a 1a d3 9a 7d e7 c3 ad fe a8 58 b3 75 5a 9b 5c a2 c4 8a 6d ff 24 45 eb 35 99 f9 ac 6d a4 66 4c ae b7 c8 fb 18 57 fa d0 93 fb ec e6 ff 37 45 ff c9 17 c9 9c 87 fe 87 62 f8 d4 bf c3 86 69 fd fd fd fc d8 e6 fc f5 eb ff 56 4d f7 1c 66 f3 c3 ae b6 c6 d1 da b1 9d fc ce 6d fe ea b0 fe 6b 6b fd 98 60 ff 47 48 fc 5d 51 f0 2a 85 e6 b2 96 f1 56 8c e4 be Data Ascii: GIF89acQ}aeQ7r/!rHRFGkyqVlR-bIZARM(R;e_pvhw\}XuZ\m$E5mfLW7EbiVMfmkk`GH]Q*V
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: fc 0f 13 90 a7 33 80 08 ff 0c 01 b5 4b b5 7b aa b1 3f a0 b5 1d 3b 03 33 70 06 70 3c 01 37 e0 bb c9 80 cb 77 0c a8 f0 1a ad ff 70 04 7d ec c7 04 51 0b 81 ec c2 ce 8b c8 14 71 cd 31 9c b7 cf e4 c8 84 b0 d2 fe 00 07 36 7b ce 27 90 ce 48 7a 02 4a 4a 05 88 10 b1 88 90 05 54 10 04 74 f0 09 38 80 08 3c d0 03 88 10 d4 3f 30 02 97 8a 07 7d ad b9 fc 9c d1 e3 f5 ba 4a 80 09 38 30 01 98 8d d9 3b ad 08 13 c0 d0 6e 8c bb d9 80 d5 f0 f6 03 c4 7b c7 06 3c b2 09 ac d1 04 71 03 67 2d 10 1e ed c2 2a 91 b7 a9 c0 c8 d2 6b b0 71 1d c9 fe f0 03 04 02 a6 e8 4c d0 31 0d 04 32 0d d8 77 20 b1 9b 30 be 70 70 7b 94 90 00 9d 8d d0 3d 90 a7 4a 50 d4 47 dd 7e ff ec ba 56 6c ac ca da 02 33 d0 bb b7 ab bb 8a 70 03 1e ff 00 c7 83 20 d1 96 65 0d 1c dc c1 02 81 07 aa 3d 10 1c 4d 10 af 5d 11 Data Ascii: 3K{?;3pp<7wp}Qq16{'HzJJTt8<?0}J80;n{<qg-*kqL12w 0pp{=JPG~Vl3p e=M]
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 08 d6 30 af 04 f1 a4 67 f0 01 48 f0 83 fe 90 c2 17 4b b4 1f 5b 10 1b fb c2 1b 9b a7 ba 29 aa 0d 56 10 5d a0 06 49 70 aa db 6a 02 38 00 07 40 dc 0c 03 91 05 9e 9b a6 27 30 02 70 c0 03 d3 20 b4 13 b0 b4 ff 10 bb 09 d0 9d 70 40 ba 3c d0 b7 41 70 b4 3f b0 af 98 c0 ba 2d 10 ac 3d 50 b5 09 30 01 d6 f0 0f 85 d0 03 13 50 c1 5b 3b 08 d6 70 03 d9 10 04 3d 50 1c 37 e0 01 83 70 06 d6 70 04 20 fa b0 1f 90 0d 24 3c 10 1b e5 b4 17 9b 0d 1b 4b 97 73 0b 97 0e 80 bd 72 5b c3 7a 2a 10 d0 ff d5 10 9f 60 be 04 8a b7 09 e0 0a 77 70 07 05 11 0e 26 90 a0 54 01 07 44 70 02 9b 10 0a 44 f0 03 3d fb 03 23 00 c0 3c 3a 02 3d c0 3a 3f 30 a4 a5 8b 03 b7 0a 0d 54 40 9e 10 d0 03 09 70 bc b3 3c c6 44 3c cb 5e bb a6 85 70 69 1e 30 01 bf 4b c7 71 7c 04 41 e0 b6 98 ba c7 3f 88 07 76 7c b1 85 Data Ascii: 0gHK[)V]Ipj8@'0p p@<Ap?-=P0P[;p=P7pp $<Ksr[z*`wp&TDpD=#<:=:?0T@p<D<^pi0Kq\|A?v\|
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: a1 90 05 11 5b a7 33 a0 04 53 3b 03 77 2a aa 13 30 03 ff 80 57 0a 90 05 33 60 59 22 6b aa 85 90 0c a5 aa 08 d9 f0 ae 7f 9a 80 25 7b 06 b2 b5 98 a9 aa 01 57 e0 af ff 90 0a ba 49 b7 28 91 0a 0e e0 00 69 70 9c 7c 27 b0 06 9b 04 bf f0 0b 0d c3 04 df 7a ab 0b fb 0b 09 60 02 89 0b 07 54 40 05 09 f0 b8 8a 0b 07 12 db 07 ff 90 00 7d 30 02 94 30 01 38 b0 b9 59 30 01 3d 00 a7 ff 80 03 a8 10 ba 04 11 04 a8 10 04 d0 d0 b1 37 f0 0f 85 f0 0f 59 50 08 a6 f0 03 ad 9b 00 59 70 03 ee da 02 41 90 0d 83 50 08 8a 30 08 be 3b 10 67 eb 10 6b 78 04 37 50 08 47 e0 98 ad ba af 7a bb bc 69 a0 b7 29 d1 bc c5 29 12 01 1b 08 1d f2 03 84 10 04 71 21 00 d9 8a b3 27 10 0e 70 d0 0c e0 ff db 0c 38 30 0d e1 db 0c 70 40 04 95 8a 08 70 00 b5 e1 10 04 a1 80 08 84 10 0a 4a 30 0d a1 40 b1 9c aa Data Ascii: [3S;w*0W3`Y"k%{WI(ip\|'z`T@}008Y0=7YPYpAP0;gkx7PGzi))q!'p80p@pJ0@
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 29 57 99 ee 8c 3e ee 97 77 ae f7 9e ef 3d f7 ef c8 ff 3b 42 f0 8e 2f ec 3f f0 95 06 66 8f 56 74 47 c7 06 3e c0 12 22 53 60 8e 27 47 1c 40 67 c1 04 11 58 b1 43 56 85 55 6d 34 10 d8 07 42 dd 32 39 dc 57 39 a1 f1 14 d7 03 0a f8 d0 00 76 00 07 e7 a7 05 9f d0 05 73 e0 72 6f 06 03 b8 40 4c f2 a5 46 55 c6 68 c3 c6 62 71 f0 05 35 78 7f fe e7 7f fa b7 83 fa 17 0f 80 07 7c 5e 06 0e c7 95 70 be 15 53 d7 47 14 34 d0 2f 05 75 56 d4 e2 7c ba e2 03 08 c1 06 89 85 55 cc 54 7d 5e a0 44 dc 25 52 d2 d3 2c 4f 01 0a 3b 70 0e 70 60 07 a7 97 0e 38 80 0a 54 f0 03 97 80 0c 3e a1 6e f1 06 77 a7 c0 40 f6 86 06 05 30 83 71 50 87 ba b7 7f b8 d7 7f f1 c0 83 7c f8 05 3e c8 73 c6 e6 04 42 88 70 c4 77 74 d7 87 12 af f3 74 11 87 1a 07 42 03 96 ff 90 12 92 f7 86 28 15 00 c6 40 0a 2e d5 52 Data Ascii: )W>w=;B/?fVtG>"S`'G@gXCVUm4B29W9vsro@LFUhbq5x\|^pSG4/uV\|UT}^D%R,O;pp`8T>nw@0qP\|>sBpwttB(@.R
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: ab 00 6c e9 91 7e 19 96 96 6e 6a 2d cc 79 6f 50 b0 c8 90 10 b8 ce 5f 75 82 4c 50 ed fa 19 79 d8 c4 68 16 a8 6f 64 9e c9 d3 b7 f2 e1 94 02 1e 30 1c 93 05 55 05 2f 58 bc 89 a5 58 c5 c2 eb 38 04 93 f3 78 4b f9 65 7f fa d3 d2 df 00 d4 bd 86 ff db 60 66 37 5b 57 7f 8d f8 5f 95 a1 89 19 9e 2c 18 61 b9 98 a7 ee 01 4d a0 54 3b e0 e8 c4 11 0d 55 4d 2c 59 12 fb e3 1e 57 4c cd 6b 06 ce 6d f1 48 40 74 92 00 89 cb 18 80 3d fa b3 28 d7 80 0e 0d 19 5a db 70 95 89 e2 c8 60 13 bf fb 62 4f 4e b8 9c 62 2c cf 0f c6 5b fe 8c a0 be 70 51 30 27 6c 92 d8 4d d4 77 79 5c 5b 36 67 1a cd 10 ae f4 6d 75 58 00 50 9c 77 19 61 d0 46 3f 85 89 67 0a b5 b7 14 6a 4b 26 66 1f b0 1d 7a d4 77 b9 b3 8e 9f 3c fc e4 1e 5b 63 39 27 7c 7b c7 4d 72 a4 54 e0 bd f1 af c7 0a 0a 2b 11 6b e6 4c a7 79 cd Data Ascii: l~nj-yoP_uLPyhod0U/XX8xKe`f7[W_,aMT;UM,YWLkmH@t=(Zp`bONb,[pQ0'lMwy\[6gmuXPwaF?gjK&fzw<[c9'\|{MrT+kLy
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 79 c7 c8 29 5e ac 95 01 2d 7e 20 63 53 7a 1c 80 f8 da 5d 3a b9 d7 d7 4a ac e4 56 d3 4b da 2d 95 14 5a 30 42 f5 5b 7f 13 0e 57 dc 1e 8f ad a2 d0 62 8b 09 54 e0 44 5f 21 18 1d 8c 29 a9 74 d4 69 2e f8 e2 43 8f 02 21 c0 08 23 17 c0 e0 4b 78 3f 21 e3 07 06 37 81 a8 1e 89 36 b1 e6 1e 76 b3 e5 46 c3 4b 1c b4 88 81 25 bc e5 17 23 49 d1 d5 58 d6 1e d2 49 b7 0a 71 7b d4 39 15 85 04 52 f6 e3 9d 0c 75 66 5d 5f b7 91 c0 c6 0a 1c 01 38 10 0c 6c 30 b2 02 1b 24 28 35 5b 18 c8 b0 02 a2 96 64 72 69 13 5f 26 ce 16 58 4e b8 05 95 9f 9f 32 da 03 e7 2a ab ec 41 aa a9 73 32 a4 aa aa 92 51 e6 aa 8f 64 ed ff 37 12 7e 18 38 18 da 4b 3b 00 f0 80 20 8c 70 e4 43 a9 ff 61 74 ca 05 2b 30 e2 05 95 82 15 95 de b2 75 6d b9 13 a6 5f 0a 35 26 4c b8 15 85 66 62 51 a9 c9 e6 2a 13 92 6a 4f a9 Data Ascii: y)^-~ cSz]:JVK-Z0B[WbTD_!)ti.C!#Kx?!76vFK%#IXIq{9Ruf]_8l0$(5[dri_&XN2As2Qd7~8K; pCat+0um_5&LfbQjO
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 94 10 05 07 1b 9d 13 1a a9 85 1b b1 3f 6d de 79 dd da 3e fd e1 7f 1d d8 76 6c bc 03 3c d8 95 7a a9 03 48 dd e2 69 c4 60 86 4b 95 38 15 82 63 12 93 34 59 2a c5 93 1d 11 15 ad b5 c1 81 cc 61 82 77 78 0a 8e 8b c6 07 00 5b fc a9 cd 17 7b 97 30 bf ee e8 bb 16 0a bc 49 bb e1 1c 6e 01 ac 4d 0f e5 dd cd 23 0e c0 ca 9b d4 3c 3c ce dc e9 8b b1 da 5e 43 19 5e 4e e5 78 e5 68 14 a3 b2 6a b9 5c 61 03 61 83 42 37 55 ea 45 78 3f de 87 05 28 69 8c a7 4e a9 f3 76 13 60 04 22 89 ac d3 89 05 71 00 d1 74 0d 0f e5 0d d4 1d 6e de 66 c0 d3 38 7c bc 73 ff 6c c3 f4 50 a5 16 9d ad 29 1e 9e e6 b5 61 ff e8 ae 94 78 01 9f bd 12 65 9e 5d d0 84 3a 7a b7 02 84 95 b5 1c 2c dd b1 3c 84 0d 6e 5b 0a 38 15 f8 76 09 ef 58 00 2e 8c 05 f2 20 0f c4 3b de 80 be e1 75 0d e5 20 3e de 43 5d e5 76 2c Data Ascii: ?my>vl<zHi`K8c4Y*awx[{0InM#<<^C^Nxhj\aaB7UEx?(iNv`"qtnf8\|slP)axe]:z,<n[8vX. ;u >C]v,
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 10 b7 2b 93 a7 1d 11 78 9b 53 c3 b9 5a 5d c6 da 56 79 b8 52 40 03 a8 d4 33 21 52 b5 bd 38 85 6d 20 03 0e 60 05 64 a8 e2 49 08 86 28 28 5f 23 b8 04 d1 ad 59 4c ae 66 2f 66 db 7e 7d 5b 11 6d df 83 4d 00 63 90 87 2c 98 80 1e 50 07 75 b0 00 1b 6c 00 1c 60 c5 cb 05 9b ea 21 0c a7 4d 1c 94 18 62 1f 0d d9 62 a3 3d c8 b5 3d 45 21 81 02 12 a2 72 0a 19 62 b6 88 6d 60 08 56 c0 80 65 9e 83 28 08 86 60 f8 de 0a 20 df 7c ed 62 28 c0 e4 87 1e 61 30 16 03 ff d4 b5 c6 62 25 e3 37 dc 8a 2c 08 67 78 50 07 41 b0 03 16 0d 82 09 c0 4f cb dd b9 1e 34 a2 3c 3e 8c d4 52 5e d5 22 d7 58 ad bd 06 cd ae 65 b9 00 8f 51 86 65 c8 83 95 ba 39 3b 24 05 85 50 81 64 a6 05 58 80 85 83 4e e8 ef bd 04 2c c8 d7 f3 8d 68 6b be e6 9b 35 5d 9d 65 df d5 35 e3 37 0c e7 09 98 00 6d a4 84 fa 0c 02 23 Data Ascii: +xSZ]VyR@3!R8m `dI((_#YLf/f~}[mMc,Pul`!Mbb==E!rbm`Ve(` \|b(a0b%7,gxPAO4<>R^"XeQe9;$PdXN,hk5]e57m#
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 8c f1 b6 2c 34 c9 76 3f 40 09 e8 20 33 39 c9 17 8e 85 0b 87 21 87 17 f0 7d 01 b0 03 76 f8 77 43 49 94 7f 08 00 4e 70 94 4d 99 94 84 49 98 4c 49 8e e5 38 88 e8 68 95 41 41 53 5a 39 4c 26 49 13 75 53 11 46 d1 17 3d e1 02 a4 21 4f 64 60 89 96 10 93 de a2 89 00 29 7a 1c 15 0c d2 78 90 3f 28 15 c9 85 18 41 d7 70 77 08 94 7f f8 97 46 00 98 15 59 98 b4 a9 94 e2 f8 8a 19 79 8e a4 b0 69 52 28 96 cc e5 59 8e e8 6a 77 f6 08 18 20 2a 16 41 59 06 81 80 63 f9 9b 6a c6 33 67 09 93 32 09 9a 6b 89 03 15 30 09 a0 60 90 07 79 10 41 88 69 d8 b6 97 7c f9 87 46 e0 04 84 ff d9 94 80 29 9e 4e 10 07 e7 59 9b 87 49 8e 1c e8 70 f7 72 50 1e d1 55 6f c2 01 6e 80 82 1b 40 79 3d a2 12 a1 12 16 91 55 10 06 91 9c 1c 71 1d c3 44 4f 6f a1 0c 31 11 93 25 b7 96 1e 74 09 3b 90 5c d9 b7 5f ac Data Ascii: ,4v?@ 39!}vwCINpMILI8hAASZ9L&IuSF=!Od`)zx?(ApwFYyiR(Yjw *AYcj3g2k0`yAi\|F)NYIprPUon@y=UqDOo1%t;\_

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49854	142.132.201.10	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:37 UTC	374	OUT	GET /655358e6aaad94a5e9fe6a141b3bc5ef.gif HTTP/1.1 Host: we.zz17377.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:38 UTC	938	IN	HTTP/1.1 200 OK Age: 1125987 Cf-Cache-Status: HIT Cf-Ray: 8f6083f50e0635ed-FRA Content-Type: image/gif Date: Sun, 22 Dec 2024 13:39:00 GMT Etag: W/"6756e7f7-6b1bf" Expires: Tue, 21 Jan 2025 13:38:59 GMT Last-Modified: Sun, 22 Dec 2024 13:39:00 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7v2eUwLnCF97MNxFZg1iQqyFzCAnjmlarHqNszGqC5Yr3tGHP4QZ8OwxI%2FHVDpY4IqfvMFe7jwFHigqeWouSMazqXvnf5ffIwA4Dvm8ULFYqWd4FEVmfl2v7NPiWY2pAVAiAjQeIQCK9TyUV6BIE"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=8135&min_rtt=5291&rtt_var=5458&sent=2553&recv=391&lost=0&retrans=9&sent_bytes=3332139&recv_bytes=14635&delivery_rate=5795411&cwnd=262&unsent_bytes=0&cid=9760e7b03652621c&ts=62702&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close Transfer-Encoding: chunked
2025-01-02 05:12:38 UTC	248	IN	Data Raw: 38 30 30 30 0d 0a 47 49 46 38 39 61 14 05 c8 00 f7 00 00 43 33 26 cf ab 94 fc ae 25 fd d4 94 a4 0b 05 d6 bb ab 2d 22 10 fe b2 02 fe 00 00 fc d7 70 23 11 0b ff f3 90 94 93 91 fe d4 00 2f 22 22 6e 6b 6a f3 2a 74 f7 4e 24 f8 dc d6 d8 cd b7 18 01 fa f7 d7 b2 ff 50 6a ff ff 28 60 93 b0 fc d0 4e 00 91 da b3 ff 00 53 44 2f b4 ab 93 b5 8e 73 ff 2c 07 61 ae cf 9e d4 f7 f2 6d 98 f2 90 6e ff fa 71 69 44 32 8f 67 0e 9d b1 e2 f3 b7 46 b3 99 8f 02 62 ed f9 b2 b1 9d d3 a6 6a 55 42 95 70 23 f3 72 4c f8 8f 01 00 ae 22 f5 92 23 90 6c 4e d6 b3 73 f0 6c 28 50 4a 49 f6 93 91 f5 b5 6f 51 72 a7 f7 b3 d3 db ee f6 fe fc 4e fe 45 10 46 27 13 f3 b2 8f ce 97 8a f9 6d 01 cd 00 00 d5 ff 00 73 4e 0a 72 68 4e d3 90 08 8f 75 6f 92 8d 71 da dd f1 ee 21 88 d7 b0 4c d0 Data Ascii: 8000GIF89aC3&%-"p#/""nkj*tN$Pj(`NSD/s,amnqiD2gFbjUBp#rL"#lNsl(PJIoQrNEF'msNrhNuoq!L
2025-01-02 05:12:38 UTC	2372	IN	Data Raw: 94 6f 66 b1 71 af 71 05 d4 94 28 8b 52 08 70 61 e6 fd ce 2e f8 6c 69 db ac 2b b4 b0 02 95 91 03 00 99 22 b3 8c 28 b3 8f 4d da d2 02 fa 2d 2b b0 70 4f d4 92 4d d4 b4 05 d9 73 04 00 75 11 fd 4d 4d f2 8c 50 d6 d0 91 dc ef dc ae 73 26 00 70 c0 00 51 b2 6e 6a 03 94 6e 99 b4 ad 72 d6 4b 05 5f eb 69 dc 33 22 d8 8e ac af 76 68 0e 13 5f 63 c8 fb 02 b8 fc 06 0d b0 c6 27 09 71 2c 05 8d 4f 2d d8 6b 6d fc da f2 84 af b5 0a 89 b7 b5 8e 06 fb 92 b2 d5 6d 4c 4d 4a 04 e3 ce 68 a6 29 4c 93 8d 50 96 d6 77 fc 08 2e 74 a6 02 2f 70 b5 d8 4d 29 00 88 14 00 44 9b 92 91 b3 8b 55 46 d3 70 29 90 ae 94 71 6a 2c 2e 43 50 0b d0 ff 46 1f f5 10 ea 0e 73 31 27 52 1d a4 5a 25 5e a9 41 0b 79 05 02 02 8c fd dc d9 28 d5 4e 4e 48 09 01 46 51 6c b2 4f 4b 94 8e 2b 32 b0 fc b7 af 4d b0 4b 28 ed Data Ascii: ofqq(Rpa.li+"(M-+pOMsuMMPs&pQnjnrK_i3"vh_c'q,O-kmmLMJh)LPw.t/pM)DUFp)qj,.CPFs1'RZ%^Ay(NNHFQlOK+2MK(
2025-01-02 05:12:38 UTC	538	IN	Data Raw: c5 5b 70 8d 8c de 02 6c 48 cb b8 c9 01 9a 4c 56 04 67 0b 1c 5c bc 65 0b 30 bb e4 54 cb 22 67 99 16 63 0a f0 ac 11 99 0a dc d2 da b3 23 65 19 b4 4d 2f 77 26 f2 92 59 f2 cc 65 61 a5 29 aa a6 9c b5 75 3a 6a 8a f1 8e 3b 69 74 8b 76 7a e3 ce 70 e9 8c e3 4c 97 56 26 5c a9 2d a3 cd 2e 6d 64 07 d9 76 cb 74 cf bd 6b dd ca 7a c8 32 c6 56 2e ff 27 53 52 5e b5 97 6e dd 81 97 c8 53 af 74 03 9e 37 9f 2b e3 ed b6 b9 90 47 2e 39 ac 20 e3 0d ed 80 7c bf 33 f9 e6 d3 86 64 8f e7 af 72 3e 79 4c 1d 73 cb a6 22 76 cc 70 04 12 1e 04 d0 c1 11 0e b2 77 96 31 ce 88 6e 3b 82 46 bd e8 f6 ee 1d ca 1b e2 bf ac 7e 45 23 87 f1 ed 04 13 9e 83 87 a5 1b e1 a1 45 ea b8 44 21 06 bc f7 5c 8e df e2 56 d0 20 4f bf 12 af 29 7e 6d 76 df 8f 9b d6 36 92 12 53 c5 e4 67 52 45 f8 b8 df 76 a3 cc 25 f6 Data Ascii: [plHLVg\e0T"gc#eM/w&Yea)u:j;itvzpLV&\-.mdvtkz2V.'SR^nSt7+G.9 \|3dr>yLs"vpw1n;F~E#ED!\V O)~mv6SgREv%
2025-01-02 05:12:38 UTC	4744	IN	Data Raw: 32 6e a1 d9 1e 58 f8 07 c1 40 8a cc 96 50 81 53 09 7e a9 80 99 5d d0 32 74 b3 0b a1 5c 79 3c 4e 41 f1 53 b6 62 94 66 a6 d2 19 5f a6 89 67 be a4 9a 9c 3c 72 19 80 cd 4f 43 30 f9 c9 f8 ba 06 c1 ec 41 89 61 f8 cb 5a 34 cd c9 a3 0e 4e 84 53 79 62 d9 4e 0c 66 ff 22 54 a9 46 68 89 24 9c 13 65 f9 4a 52 62 87 72 d5 71 91 72 c6 c8 90 83 8e 64 60 dd d3 1f b0 16 b7 44 de 91 f2 8b f8 b9 68 41 29 fa c7 8e 0a 25 74 66 d4 68 b3 3a 2a 2d 86 3a 80 76 0c 35 57 82 9a f7 c0 da 11 8b 8c b5 04 cc d2 0c e0 46 45 70 60 99 25 a8 29 17 ca c0 04 1a 14 60 1a d1 48 47 33 8e 60 83 d8 95 48 73 24 2d e3 75 68 c4 44 fd e9 d0 78 f8 b4 91 bf 1c 69 2f 5c a1 cd 5e 48 f3 1f 53 30 b5 43 b5 85 68 5f 90 c2 89 68 9c 7a 42 bb 6c af 47 1f da e4 e1 62 c4 b0 40 3e 6e 2d 0b a4 08 5a 24 46 b3 55 a2 cf Data Ascii: 2nX@PS~]2t\y<NASbf_g<rOC0AaZ4NSybNf"TFh$eJRbrqrd`DhA)%tfh:*-:v5WFEp`%)`HG3`Hs$-uhDxi/\^HS0Ch_hzBlGb@>n-Z$FU
2025-01-02 05:12:38 UTC	5930	IN	Data Raw: 4f c4 52 45 cc 73 c7 11 63 12 09 55 35 71 4c 08 a2 eb de 04 76 4f 5b 6f da d1 46 1e 0b 62 32 59 1f 27 1a 32 23 96 36 aa e8 46 54 6f 1d 31 47 a6 fc 54 92 ac 6c 5f d4 55 2d 8f b2 35 11 c5 5e 6d 7a d2 57 6c d1 3d 17 d6 6f d5 fc 74 49 49 80 c2 54 28 4c eb 00 17 4d 0d cf da 30 5f 7e fb f5 f7 5f 80 ff e5 b6 db 80 dd 35 78 df 80 13 56 78 61 7f bb 93 cb 06 bb 72 18 60 0c 0f 6a 10 83 91 42 d4 40 41 8d c2 16 18 20 87 55 5c 31 6c 8c 6b a0 29 64 0e 60 5a 39 02 34 68 0a 00 6c 09 14 60 06 82 09 06 18 e8 00 83 3c 46 18 2d 8c 31 c2 98 02 35 c0 3c 08 e0 9c 3b 02 60 e2 0e 20 d2 99 22 8c 3b 5e 08 63 04 cb 7a c3 e1 8f 00 82 03 ff a2 80 e0 46 60 9a 89 e9 28 05 20 3a 49 f0 7c 69 29 87 2b 9d d1 98 16 6d 60 e0 88 16 b6 eb ae 3b e6 1c 60 ee 1d 1f 2a 48 c7 83 12 ea d8 c6 9f 25 06 Data Ascii: OREscU5qLvO[oFb2Y'2#6FTo1GTl_U-5^mzWl=otIIT(LM0_~_5xVxar`jB@A U\1lk)d`Z94hl`<F-15<;` ";^czF`( :I\|i)+m`;`*H%
2025-01-02 05:12:38 UTC	7116	IN	Data Raw: a1 8c 9e f4 b4 3f 48 dd 29 43 86 d8 16 12 09 a5 99 f4 d0 70 52 75 59 06 db 1a 95 28 bc 54 86 43 98 1a 5c 81 c6 55 b1 2d 52 8c 47 ce 9b a1 8d 52 e5 c3 2a a9 0a 44 ec c9 8f f3 98 91 02 77 d9 0a 2f ef c1 54 ac 3a 48 ac 2b 4d 0b 5c 13 31 16 ad 2e d6 10 2e f2 51 1a cf da e0 45 38 14 2c e7 55 6b 19 d6 a2 a3 21 93 a8 48 40 ad 61 79 e6 c1 63 1f b9 d8 01 e5 39 d2 01 ed 8a 64 b9 d2 51 1a 88 61 b2 93 9e ba c6 27 3d b5 c9 39 92 47 62 9e 3c e5 27 f5 e8 c8 55 52 e4 22 19 e1 d8 26 b4 d1 0d 46 60 83 ff 11 18 c0 46 37 12 21 32 92 d8 72 24 3c 59 45 16 64 f0 84 1c 8c e1 0f 39 48 c0 1f 76 b2 92 55 b8 22 07 8c 40 c1 12 5a 31 89 23 30 00 1b 34 a0 01 36 f2 a0 cd 3c 14 60 0a 58 b3 40 1f e2 b6 37 1a dc e1 0e 40 70 83 d2 b0 36 85 1f 90 a5 6b 1e d0 01 d8 e2 51 02 bb 94 60 9e 72 51 Data Ascii: ?H)CpRuY(TC\U-RGR*Dw/T:H+M\1..QE8,Uk!H@ayc9dQa'=9Gb<'UR"&F`F7!2r$<YEd9HvU"@Z1#046<`X@7@p6kQ`rQ
2025-01-02 05:12:38 UTC	8302	IN	Data Raw: a2 c8 18 8f 1e 81 af 1e 95 ac f0 50 25 44 d2 08 a7 5c e5 c0 d4 44 61 78 80 04 04 92 20 07 d2 20 0b 12 21 0f 52 21 13 92 21 17 72 20 3f e1 90 f8 87 c4 0e 89 36 10 a4 11 1a 92 20 cb 0f ba 8e 84 ce 30 f2 20 6f af 57 36 62 19 54 c1 21 0b 52 92 76 c9 f4 96 01 00 12 52 f6 4a 92 04 96 ef 40 48 41 26 67 92 14 3c 92 26 69 d2 23 79 80 07 c8 af 1d 81 8c 5f d4 0c 25 77 6b 19 2a e1 1e 8b d2 1e 13 af f8 34 a1 07 da c0 c9 c0 8f 98 2e 52 27 a3 52 2a a3 12 26 e7 6c 2a af 32 2a 49 e2 13 b0 12 2b fd c0 fc aa 6f 5f b8 52 2a d3 ac 22 6a 52 2c 75 b2 13 80 b2 21 3a e1 2c d1 f2 2b 4b a2 11 cc b2 2d a7 92 fc de 12 26 8a a0 07 6a 60 fd da 8f 2f 99 c0 10 fa c0 9e ff 4c c2 06 0a 2d 0f a0 80 9f 12 c0 ff ce a1 02 50 40 06 20 8d 68 22 ed 9f 08 4a 72 3a 00 69 8e 40 16 6c a1 18 8e c1 16 Data Ascii: P%D\Dax !R!!r ?6 0 oW6bT!RvRJ@HA&g<&i#y_%wk4.R'R&l2I+o_R*"jR,u!:,+K-&j`/L-P@ h"Jr:i@l
2025-01-02 05:12:38 UTC	3524	IN	Data Raw: 31 55 fb a0 85 83 ad 48 52 20 21 f8 a6 60 89 16 25 38 94 00 6d 14 00 36 7f a5 4d 9f 46 9d 5a f5 6a d6 a5 b1 71 48 b8 4c 01 87 16 2d 00 8c 5c 96 5b b6 c4 88 b7 ac 62 cd 3d bb 85 0d 00 0a 74 3f 55 40 9a f5 8c 88 4f 39 14 99 d1 99 a2 d5 e0 00 e0 5a 9c 78 db b8 53 03 dd fb da bd 2d b5 5f 9b 0f 1f 7a 7c d8 52 fe 3c 7a ff f3 e5 d3 a3 5f 9f fe 3c 1d 05 3e 38 b7 80 ed 83 fc 7a f8 ee db b3 ff af bd 36 a8 e3 ee a9 aa a8 32 8e 28 2b aa 61 b0 41 07 1f 84 30 42 06 1d 58 50 42 0b 2f 64 d0 8a ee ba fb 6b 99 df f2 39 ae a4 85 18 7a 8a c3 dc 0c 68 a0 1d 0c 2f ac 82 a9 a5 b0 2a c9 45 19 75 a3 2e 25 3f 30 34 a1 1f 2f 56 e4 b1 c7 0b ad f8 ed 37 0f a5 22 f2 31 f2 d4 eb 0f c0 2d e2 fb 2f bd 36 64 24 aa 1f 3a 9a a4 92 bf ff d6 c3 f2 c9 a5 54 42 a3 9a 06 1a fc 92 c1 30 bd 04 b3 Data Ascii: 1UHR !`%8m6MFZjqHL-\[b=t?U@O9ZxS-_z\|R<z_<>8z62(+aA0BXPB/dk9zh/*Eu.%?04/V7"1-/6d$:TB0
2025-01-02 05:12:38 UTC	4096	IN	Data Raw: 0d 0a 38 30 30 30 0d 0a 24 0a 91 3b c6 49 43 5b 7c f4 03 3f 70 02 21 bd 45 9f 73 06 30 dd a1 b9 ad db 56 ac 02 27 a8 2d dc c2 2d 7b d4 84 a7 2d 0f 4d 68 14 71 7c 5a 27 b5 d2 80 cc d2 6e 65 89 84 14 46 46 b9 33 ac c5 47 e8 bc 47 33 45 5d 32 f5 02 2f f5 5c 94 b8 52 67 6c d3 d6 b5 21 07 98 81 37 20 bd 50 91 30 8b fc 01 2a 30 02 01 f0 02 01 f8 83 7d f0 3c 1c 23 3d 7d aa 81 0b 14 01 95 4c 5e 81 40 c9 00 40 49 d5 7b d4 e8 15 85 e7 bd 83 00 c0 01 1a 90 31 4b 7a c9 0a 08 27 6b 90 00 77 f0 87 00 58 82 6c a0 82 e6 23 82 3a ff b0 97 28 48 b2 7c 91 be 39 a0 0c 60 80 03 4a c8 8f 93 41 ab d0 34 10 ef db a5 ac 04 02 40 00 04 3a 38 06 4d d0 84 63 90 04 40 00 85 0f 53 26 5f 0a 19 91 49 01 82 30 08 0e 20 4c 81 81 e0 9d 31 9d 92 a8 ca 77 50 00 45 08 00 69 18 80 19 60 8a 32 Data Ascii: 8000$;IC[\|?p!Es0V'--{-Mhq\|Z'neFF3GG3E]2/\Rgl!7 P0*0}<#=}L^@@I{1Kz'kwXl#:(H\|9`JA4@:8Mc@S&_I0 L1wPEi`2
2025-01-02 05:12:38 UTC	11860	IN	Data Raw: 91 5f 0a a4 40 11 44 d9 ce c4 45 33 09 9a 5f 44 cd a5 01 c6 f0 91 9a da 44 9a 3e dd 91 5d 0c 0d 07 18 86 db 94 cd f6 51 46 d6 ac 4d d5 70 1a d8 bc 1b a8 85 5a 46 f8 98 70 0c 4c c1 81 1b b0 45 86 e1 39 81 59 f9 db bd 19 81 43 f0 85 49 e1 95 c1 8d c7 ba c5 9f 12 25 8c ee 31 83 0f f8 54 c4 ad 60 15 2c 9b ba e1 98 8b 40 01 0c 76 d4 4d e1 cd 1e f8 c0 11 9a 9e 40 b8 d5 bf 35 80 13 04 4c b5 a1 46 fc 8c c6 0f 9a 40 10 f6 55 80 dd db 4d 01 58 be f5 95 17 88 db 6f 6c 47 2b dd 87 f2 fc 87 db 68 42 8c 04 1f ef 7d 86 bb 9d 4f ff 57 e1 0d 13 ca 55 c2 69 1c 8c 60 e1 01 e0 0d 5c fd e1 49 19 01 14 7c cf a2 99 80 59 dd db ac c1 d5 75 fc 87 e2 bd 0b fb 78 e1 1f fa a1 5c a5 94 b1 18 15 20 6e cf 1e f6 c3 25 ca 95 24 1e 80 0f 68 a2 c6 39 83 22 78 dc 93 44 09 64 d1 00 0a d0 00 Data Ascii: _@DE3_DD>]QFMpZFpLE9YCI%1T`,@vM@5LF@UMXolG+hB}OWUi`\I\|Yux\ n%$h9"xDd

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49861	216.180.236.138	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	353	OUT	GET /img/1KKky_150x150.gif HTTP/1.1 Host: ig23.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:38 UTC	1086	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 6046 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb84012b97708ce-LAX Content-Length: 507238 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:11:46 GMT Etag: "676a971d-7bd66" Expires: Sat, 01 Feb 2025 03:31:00 GMT Last-Modified: Thu, 02 Jan 2025 13:09:42 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sEqvdlc2w5%2ByW22sct0uezPpBeyVSo3Bm0rELvdcxA%2Fmur5iw4bmBJFQaFFp3FnklDYVaOOVZaW7UNxZgWsE5LIT%2F2UgkVYsd46vCDIeBRoVnU2A0kBU73vMUx4jx7APKw%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=1499&min_rtt=682&rtt_var=1477&sent=935&recv=73&lost=0&retrans=7&sent_bytes=1314930&recv_bytes=5254&delivery_rate=993993&cwnd=280&unsent_bytes=0&cid=b7c7d35b736d0de4&ts=50678&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:38 UTC	100	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 00 00 fe f8 aa fa b3 00 d8 4b 0b ff ef 00 da 49 27 ab 93 73 f2 d1 8f 01 cd ff 9d 6c 61 b7 4a 2a 9a e3 f7 d3 90 8c b5 a7 88 02 75 b8 d4 af 8f f3 8e 73 b3 0b 01 21 fe 00 d0 0f 04 d4 6b 4b ef 90 00 5b d2 fd 0f 0f 10 5b 50 17 93 04 00 fa 0f 08 ee 8a 33 b5 22 09 f4 99 8e Data Ascii: GIF89aKI'slaJ*us!kK[[P3"
2025-01-02 05:12:38 UTC	2372	IN	Data Raw: ff cc 52 69 5c 53 a0 8a 01 f2 67 4d 4c b7 ec f2 44 2b fe f4 97 d9 90 6f ee 71 2c 0c 8f d0 de 66 01 31 b6 f3 ef aa 73 cf b3 00 d9 6b 2b da 76 63 da 8b 52 47 2f 1a fe 99 3d d2 33 22 f4 77 61 db ce 96 d3 54 3f f5 33 23 10 87 b8 95 e5 66 da ae 6c d2 b2 ae cd f1 fa b2 31 22 52 f9 1a d4 d7 d4 d6 cc b2 e8 77 00 f3 cf 75 24 97 d3 a8 f8 95 f2 55 3c 2d 28 25 ff f1 4a ff f2 27 56 8d af 28 aa e0 2c 25 11 fe db 2f ff f1 6f bd 77 7e 18 52 10 f2 b6 d4 11 11 22 8b bc ce 12 50 65 78 f7 53 1d ae 02 0b b0 ee da ff d3 ee 4b 0f 64 db 9f 07 ad db d9 8d 00 a3 ee 03 26 10 10 95 22 10 c9 fb b4 ff dd f0 da 94 b0 d4 b3 4b dd cc 00 1e 35 42 97 2c 26 d6 da 29 c4 dd e8 f2 97 b4 c4 c5 76 57 a2 0d 49 3a 3f 0e 22 2a 0e 28 0f 23 11 22 d3 b3 2c 7f 82 66 d7 ee 00 d6 f7 90 c4 d9 48 ef bb 2b Data Ascii: Ri\SgMLD+oq,f1sk+vcRG/=3"waT?3#fl1"Rwu$U<-(%J'V(,%/ow~R"PexSKd&"K5B,&)vWI:?"*(#",fH+
2025-01-02 05:12:38 UTC	538	IN	Data Raw: 29 a0 0b 7a ff 6a 25 8f 97 2a a4 12 26 5e 06 1a 68 81 9b 30 e2 20 a1 30 06 cb a8 a9 a9 0a db 66 b1 b6 2d e1 88 ac bb ee 7a 65 96 b5 0a c4 67 97 9c 8a e9 ea b5 65 9e 69 ec b6 c7 a2 ea 6d aa 88 36 8a c6 12 0e 30 7b 6d b3 a7 3c 1b ed 1d 4d 6c c2 2b 95 8b 58 bb 2b 02 1e 34 0a 2e b7 f7 be 17 ee b7 f7 de ab e4 9b 8f c6 0b ab c0 05 56 59 c6 26 96 fa 58 4b bb d5 0e bc 88 83 2c 7e 4b ec a8 32 92 9a af b6 68 2a 9a aa c6 68 ae ea 41 ab e8 ee fa 4b 13 36 01 97 a9 9f 61 a6 6c 49 bc bf 76 3b 71 bf 17 e3 6b a8 bf f6 9e 39 6e ac 2a df 69 25 c9 1f a6 c5 d7 2f 5e e6 6c 09 af 8e 38 a7 2f cd fd 4a bc af 16 19 53 4c 73 c6 1b 5f 3c 2e c8 43 d7 19 e4 c1 1e aa 45 19 d0 55 de 78 8a d7 f1 d2 5b 6a c5 e1 22 a1 b4 d3 65 17 fb f4 a9 31 7b fb e8 b2 5e c7 7d 30 ad 21 36 c1 75 dc 41 c6 Data Ascii: )zj%&^h0 0f-zegeim60{m<Ml+X+4.VY&XK,~K2hhAK6alIv;qk9n*i%/^l8/JSLs_<.CEUx[j"e1{^}0!6uA
2025-01-02 05:12:38 UTC	4744	IN	Data Raw: 0c 9b 58 42 cb 2c cf 84 36 74 01 84 e2 33 2c c1 f9 d0 82 f8 bb e0 17 f7 37 ba 26 7d 70 88 df 0b 61 f8 94 05 3f 1a 5a 31 7e 2b e4 11 d0 16 60 c2 3a ae 06 8b 76 b4 0c bd 5c 70 01 17 68 71 08 9d 4b da f5 c8 98 43 2f 16 32 58 3d ec a0 06 35 06 c0 10 a6 31 59 55 cc 23 1e 25 f9 46 2b 56 f2 79 2d 41 83 1f 35 a9 c9 3f 02 d2 7e a9 ca 9f 28 43 c9 41 20 0a 12 7b 87 24 a4 f7 6a c6 ca 00 0a f0 6d 77 a4 a3 2c 2d a9 1c 3c 6a c6 96 7b 1c 02 1f d1 70 01 5e d2 c7 8f 9f 0c a2 f6 38 27 4c 52 1a 33 70 c7 5c e4 30 d7 86 a4 33 ba f2 51 58 bc 65 2d 35 43 cd 59 9a 70 36 45 dc 64 2f 7b e9 c7 6e 06 f2 90 a8 5c 26 06 8b 09 c6 70 8e f2 82 8d 2c 62 1a 0b 95 06 35 de a6 8e b7 ac 66 34 35 d3 12 e9 58 40 8d bb dc 26 1a 38 09 ff 48 2e 96 32 91 8a ec 5e fd 90 69 ce de a9 8d 88 8f d4 5e 11 Data Ascii: XB,6t3,7&}pa?Z1~+`:v\phqKC/2X=51YU#%F+Vy-A5?~(CA {$jmw,-<j{p^8'LR3p\03QXe-5CYp6Ed/{n\&p,b5f45X@&8H.2^i^
2025-01-02 05:12:38 UTC	5930	IN	Data Raw: 0f 71 14 31 38 18 61 94 d1 8b f3 52 5c f1 c8 e3 46 23 b1 00 08 83 2c f1 b9 1d 41 44 8b 31 1b a3 e4 e9 a6 9f 68 f2 e0 b2 25 1d ec b2 00 22 d1 43 72 4c a5 56 69 42 41 12 bf 24 71 a8 02 3c b0 aa 31 f9 a8 94 b3 4a 0f e7 4c ec bf 05 4d 54 b3 80 25 7a 69 82 4c 40 41 bb 23 17 05 1b 64 73 81 25 4c 84 ff 71 89 c1 5c 43 0c cb c3 a4 44 69 d2 9b 80 4a 03 0d a1 1e e4 f3 c1 44 11 85 70 89 25 9a c8 25 50 52 05 4d 30 d1 43 51 55 f4 41 04 a0 ac f3 d5 1c a5 ac 2d cb 47 4b fa d1 d0 3d 41 0d b3 54 5e 43 ab 25 17 4f 4d 54 b5 53 54 5d bd 90 4a 4b 39 a4 14 ab 95 b6 4c 95 c9 61 37 f5 22 97 02 7b b5 36 b4 26 bc 00 95 cf 4d b9 8d d6 cd 64 b7 db af 3a 58 f7 c3 33 51 6f bb 25 96 b3 51 af 75 b7 38 42 b7 4d 97 53 75 1b 3d f6 43 fb 5e ba ca 05 a1 a2 ed 94 db 4d 8f 7a 77 60 e3 ba 68 62 Data Ascii: q18aR\F#,AD1h%"CrLViBA$q<1JLMT%ziL@A#ds%Lq\CDiJDp%%PRM0CQUA-GK=AT^C%OMTST]JK9La7"{6&Md:X3Qo%Qu8BMSu=C^Mzw`hb
2025-01-02 05:12:38 UTC	7116	IN	Data Raw: 02 d7 a8 07 ed ff 85 fc 42 20 04 c0 df 92 89 a8 fb ba 0f e8 84 2f 0b 31 a4 f8 89 af f5 8c 9f b1 61 4f f5 64 66 96 c1 e6 32 16 6f 09 43 5a 0c 04 50 54 76 b3 ee 88 0e 10 90 1e b9 12 01 c1 85 0b 08 87 62 3c 82 24 28 d0 c3 87 86 30 2d 02 41 20 c1 85 04 55 40 2c c2 64 08 62 c4 44 9b 62 10 ca e3 c2 82 93 93 29 d7 a8 64 89 72 e5 c9 36 94 44 4d 0a 04 69 d1 4d 9c 02 33 e1 bc a9 ca d0 4c 51 69 5a 6a 51 33 d4 65 4a 84 1b fc 70 b8 f3 20 c6 d3 18 0f 6a 11 38 b4 48 10 aa 53 31 40 08 e1 2a 04 44 8c 53 57 39 28 92 f0 c0 e3 a6 07 5b 8d 75 8d c1 a1 e1 25 18 10 66 90 12 94 88 43 8c b5 6c 1f 74 84 14 a3 51 31 a3 2d 8b 1e 85 09 60 66 dd 48 3c 23 e9 54 dc 51 d6 24 19 5a 52 0e 0e 2c 59 a5 a2 bd 1e 63 64 e0 cc 19 8f 29 0e a4 20 81 c0 d3 d9 b4 e9 18 3a 05 3d 28 7d fa b4 90 8e 6e Data Ascii: B /1aOdf2oCZPTvb<$(0-A U@,dbDb)dr6DMiM3LQiZjQ3eJp j8HS1@*DSW9([u%fCltQ1-`fH<#TQ$ZR,Ycd) :=(}n
2025-01-02 05:12:38 UTC	8302	IN	Data Raw: 5d 1c 4d 9d 70 c6 6c ac 07 0f 00 a8 55 fa 45 10 e1 b1 06 f1 70 33 d1 85 ce 08 86 0c 41 c2 15 4a 61 e9 7b b8 c0 59 6b fa f2 c7 31 33 03 c6 b4 71 27 33 4d c9 ff a4 c5 2b c5 c6 df ab b5 33 d3 c6 af 74 09 0c 60 a2 46 7c 97 1c ec 85 29 a8 c9 b7 57 1a 25 ec 9c 63 65 b8 85 cc c6 8d 6b 6e a2 8c 33 9c 74 51 8a fb 4a 02 d0 33 13 2c 49 2f a5 07 a2 8c 7f 6c 55 cb 51 d4 4d 0b 7a a1 cc 18 7b 94 08 71 3f 69 9b bf f1 c9 5f d4 03 dc d4 20 86 60 5a 4e e2 ca 68 ab 4d 0c 72 b5 ad a5 49 05 f3 4a 9a b8 ca 34 cc 4c 69 0c 21 15 eb b0 f0 8a 09 2c 10 57 18 bc 9e 23 88 c9 07 b1 97 9a ec 5b 5f c8 a8 a3 80 bf e2 e9 01 3d 60 5a aa 7c 40 44 c5 6a 0b d2 cd 67 0b 2c 25 a5 cc 8c c7 5a 2d ec 20 1c b0 01 2e bc c2 0e d2 cd 04 f0 cd a1 f4 45 24 48 c7 7d f7 62 d0 fb 66 4f ca 08 ea 1c 4a ec 9c Data Ascii: ]MplUEp3AJa{Yk13q'3M+3t`F\|)W%cekn3tQJ3,I/lUQMz{q?i_ `ZNhMrIJ4Li!,W#[_=`Z\|@Djg,%Z- .E$H}bfOJ
2025-01-02 05:12:38 UTC	3666	IN	Data Raw: 06 64 91 86 51 db 88 3d d0 4d 9d 4e 01 33 30 ad da 2f bc ff ad 1a 58 13 20 b6 70 97 c5 0d bd c2 2d a6 a5 cb 38 d7 e3 da 5f ed 8a b7 45 23 2d 30 d7 6c 03 08 fe 1c d9 d9 03 d2 57 73 17 d7 1c 12 8c 40 4d 75 34 15 fb 4c 19 eb f4 4c 66 51 47 ea 96 16 e4 9d de 67 4b dc a3 0a bd 22 12 3f d4 dd 89 b1 ed 47 ec 4d 19 0b 14 e1 be 5c 47 38 88 10 fd 7d 49 39 e5 dc cd 44 e0 d9 23 01 90 1d d2 53 51 4e e5 24 01 9e 5d b6 e6 9d 11 a1 80 de 66 7b 07 02 26 46 11 31 1e 1a 35 15 10 50 df 26 41 4b 48 4d 27 70 42 d8 ab 2c e2 33 10 12 79 22 01 ce 23 37 17 0d e2 78 82 e4 4c 7e 09 48 2e 1a e6 85 5e a2 db ae 2d 8e 11 f8 db e0 cb 33 15 3d 6e 0a 2c 40 00 4b 46 00 d2 b7 54 1b 5e d6 75 74 d6 f3 9d 3d 1b d0 e3 78 b2 40 66 9e da 62 bc 41 70 c8 ae f5 6b ba 1d 3a bd a5 dd 61 9d 44 e4 5d 50 Data Ascii: dQ=MN30/X p-8_E#-0lWs@Mu4LLfQGgK"?GM\G8}I9D#SQN$]f{&F15P&AKHM'pB,3y"#7xL~H.^-3=n,@KFT^ut=x@fbApk:aD]P
2025-01-02 05:12:38 UTC	10674	IN	Data Raw: 47 51 54 c9 a2 50 c5 b5 3a 43 9e ec 41 4b ec c6 4b 04 bd 5d 2c 49 a5 04 be 20 8b 0b 88 18 13 bc 58 02 0c 60 49 51 70 c9 e0 d2 49 3d 43 ca a4 9c b1 ee fa be 45 3c bb 28 fc 38 08 30 3a f0 6b ca af 0c 36 7e d4 8d 24 54 09 ac 64 c9 3d 0c be 70 63 4a 20 db c5 57 74 2c 09 9b 01 18 b1 bb 8a 3c bb dd 92 30 d4 80 80 1b d3 cb b6 fc bc 89 83 80 14 c0 18 c7 58 80 bc 98 4b a3 bc cb 9b 6c 39 df 5a 4b 85 b4 2d f8 4a 00 70 64 81 b1 ac b4 c7 5a 4b 45 80 2f ea 1b 01 f7 40 3f dc b3 4b f3 eb ae 50 e9 47 ac 98 3a a2 e4 cc 49 d0 40 ae ac 4d db 5c 32 b1 00 af 0c 83 30 5b bb 40 ac 01 c7 d1 79 0b ff 09 90 32 bc a4 ad 0b dc 80 d6 04 47 21 ec 2e e4 a2 4d c1 34 ad d8 7a 40 5b 8c 99 2f 71 00 d9 90 4c 03 88 2f ed dc 4e 08 80 01 03 98 14 1b 49 af e1 1c 4f d9 ba c0 3b c4 8f b7 01 80 1b Data Ascii: GQTP:CAKK],I X`IQpI=CE<(80:k6~$Td=pcJ Wt,<0XKl9ZK-JpdZKE/@?KPG:I@M\20[@y2G!.M4z@[/qL/NIO;
2025-01-02 05:12:38 UTC	11860	IN	Data Raw: 1b 78 66 d6 02 30 4f 1d ba 71 7b 9d 10 c0 0a 08 c0 01 46 a4 00 43 19 4d 40 0a 5c b3 02 08 7a f4 68 d8 ec 09 23 48 b0 02 3e 4e e0 97 19 6c 01 23 66 da 02 7b ce 80 13 03 34 84 08 37 30 4d 49 2a 33 9a d6 54 68 d6 5a ba 87 64 6a f1 04 79 98 a1 0a 80 59 d4 13 58 ac 70 1b f0 a3 24 bc e9 ce 0c 26 60 05 27 e8 44 0b 33 e8 87 15 08 60 92 1a 3d 41 02 f8 78 55 b1 ce 13 98 b7 63 25 4a 09 70 82 0b 55 74 61 94 a8 e2 54 09 e0 4e 30 ea 40 8b 7e 08 24 fc 48 e5 ce 48 ba 8b a2 49 75 e8 fd 92 f9 cf 93 f1 41 13 93 4c 66 29 24 d1 11 4e b4 00 02 79 e0 ea 06 26 4b d9 ca 5a b6 13 94 c5 ac 66 2d 0b 59 cb 4e 36 af 93 35 e7 91 7e 29 54 e5 f1 d4 b0 ee 3a 6b 69 87 89 05 2d 46 0d 94 81 b5 d7 9d 06 17 32 0a ff 54 f4 a5 8c 25 20 27 36 57 55 7b 42 56 02 bf 0d ae 70 83 eb 59 60 ee 92 b3 93 Data Ascii: xf0Oq{FCM@\zh#H>Nl#f{470MI*3ThZdjyYXp$&`'D3`=AxUc%JpUtaTN0@~$HHIuALf)$Ny&KZf-YN65~)T:ki-F2T% '6WU{BVpY`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49860	216.180.236.138	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	352	OUT	GET /img/996a_180x180.gif HTTP/1.1 Host: ig79.vip Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:38 UTC	1083	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Credentials: true Access-Control-Allow-Methods: PUT, GET, POST, DELETE, HEAD, OPTIONS, PATCH Age: 1853 Cache-Control: max-age=2592000 Cf-Cache-Status: HIT Cf-Ray: 8fb83905cd2dcb9b-LAX Content-Length: 509971 Content-Type: image/gif Date: Thu, 02 Jan 2025 05:06:57 GMT Etag: "6769630e-7c813" Expires: Sat, 01 Feb 2025 04:36:04 GMT Last-Modified: Thu, 02 Jan 2025 13:04:53 GMT Nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MZR4L7NK3AdjLeHaQmA3nINSEDQJV5SnMDfw0W2IHFK4huWacR80LuvBItNWl65Sm6W12G74lVaYxMryJQWTz7fLdqA7cdn%2BCq9jGoqo5263OV8ia8GbOSQi6t8%2FzaJr6g%3D%3D"}],"group":"cf-nel","max_age":604800} Server: cloudflare Server-Timing: cfL4;desc="?proto=TCP&rtt=689&min_rtt=650&rtt_var=16&sent=665&recv=93&lost=0&retrans=1&sent_bytes=912755&recv_bytes=3426&delivery_rate=309146005&cwnd=544&unsent_bytes=0&cid=ec4f3a9dbd4fd270&ts=25955&x=0" Vary: Accept-Encoding X-Cache: HIT, server, disk Connection: close
2025-01-02 05:12:38 UTC	103	IN	Data Raw: 47 49 46 38 39 61 b4 00 b4 00 f7 00 00 d9 49 26 ff ff b1 0d 2c 49 f1 b0 93 a0 de f5 a3 b0 dc 4d 66 9b f9 ce b5 d6 6f 4a 0a 22 2f 22 fe 00 b1 0c 00 d8 4a 0c 5f af d8 00 cc ff f7 88 2b 28 4f 8c f4 b8 ae 5c d1 fe f9 44 30 f2 8a 71 fd f3 99 f2 67 4c 95 04 00 95 a4 aa b5 22 09 f9 b3 00 fe ec 67 f5 d5 8a fa 0e 08 Data Ascii: GIF89aI&,IMfoJ"/"J_+(O\D0qgL"g
2025-01-02 05:12:38 UTC	2372	IN	Data Raw: f0 70 29 24 44 71 b6 47 2d d5 8a 51 a0 95 19 f3 99 86 d3 0d 00 6f 8a ad 11 44 6e 0c 8c cc dc 8e 6f ee 90 00 b6 5d 53 37 b7 f4 25 30 4b 00 75 b9 d4 33 23 01 11 24 9a 9d 62 0c 88 b9 4a 4d 49 d8 6b 2c 61 63 1f d3 d9 f4 d7 76 69 da 95 8f cf f0 f8 28 67 96 25 32 6b ef b3 76 22 98 d4 b4 32 1d c8 d3 d9 dd 66 03 ff 99 3d f1 77 60 d7 55 3c f6 33 23 10 52 89 29 aa df f1 55 3b 0d 31 68 d0 b6 06 43 52 74 dc ab 6a 2d 45 4c 4d 69 72 5e 20 21 2d 68 b0 a1 e9 a3 d1 b6 af ff ee 2f 54 fa 1f 26 2c 2f 15 ae 15 ea 77 00 d4 d2 8e 2b 60 d0 93 e3 6d 26 53 af 1c 55 1e 09 b3 ee 67 7a cb 66 de 5f 6d 6f 77 d4 d4 b2 0e 66 91 78 8a 61 6b 6e 4c 10 46 52 dd cc 08 5a db a5 db 67 91 54 67 52 d4 ae 92 8e 2b 29 fe ee 0c 56 30 45 10 4f ac 07 aa da 75 4b 4e d1 f2 d0 97 22 10 98 2b 51 d2 d6 2d Data Ascii: p)$DqG-QoDno]S7%0Ku3#$bJMIk,acvi(g%2kv"2f=w`U<3#R)U;1hCRtj-ELMir^ !-h/T&,/w+`m&SUgzf_mowfxaknLFRZgTgR+)V0EOuKN"+Q-
2025-01-02 05:12:38 UTC	538	IN	Data Raw: a9 04 05 65 2b ae c0 ba 09 eb b0 c4 ce 6a ec 82 75 fe 0a ec aa 7b f2 ea a7 23 ca 2e 9b 2b 1c 6b 10 bb 04 0b d8 66 3b ac b1 c7 76 6a 88 72 d2 e6 fa a8 99 d6 45 0b ee b9 e8 f6 90 81 6b da 2e e1 ee bb ee 6a ab 6d ab dc 76 9b a9 67 9e 9a 9b 6e ba a4 ba c7 a4 be fb aa ab 2e ab d7 c2 6b f0 bb f3 c6 5a 2f 97 c4 36 ec b0 00 b5 02 1c 70 06 86 94 89 9a af 19 0c ac f1 c6 1a af eb d8 c1 06 cb 20 b2 c1 09 d3 7b ac c3 f2 a6 ac b2 b6 4d 18 92 71 c7 1c 77 dc 6c 61 cf 66 60 f3 cd 38 e7 8c 33 b5 d9 86 2c f2 cf 40 8f 1c 6f c9 28 17 6d f4 ca 48 93 c8 42 cb 3a 37 9d f3 b8 70 95 eb f4 d4 eb 56 0b 72 d0 58 03 8d 30 d1 47 a3 5c 30 c9 d7 66 2b f6 d8 64 7f b6 46 1a 54 3b dd 2f 56 ff a6 dd b4 63 3d bf 9b f5 19 74 9f 91 b5 d0 5c 77 4d 36 c8 7c 83 ff 5d 76 78 e5 b9 dd b4 c5 4b 61 2c Data Ascii: e+ju{#.+kf;vjrEk.jmvgn.kZ/6p {Mqwlaf`83,@o(mHB:7pVrX0G\0f+dFT;/Vc=t\wM6\|]vxKa,
2025-01-02 05:12:38 UTC	4744	IN	Data Raw: e1 87 60 0c 23 07 fb c7 3f db 89 ed 88 48 1c a0 0e 74 c0 82 4e 30 4d 8a 70 ac 58 92 06 52 be 38 4a 51 4a 21 ac 22 0d 23 98 bc 3e be 4f 8b f7 c3 43 0f 73 40 c8 41 1a 20 07 78 48 a4 22 09 c9 48 27 38 f2 91 8f 04 62 07 89 68 44 34 12 81 84 6b 5c 23 b6 dc 08 87 25 96 69 81 76 6c a1 03 c7 00 b8 07 ba 8b 8f ae 4b 25 20 83 b8 c8 46 ba f2 95 8d cc 02 24 67 19 49 03 28 52 88 94 c4 5c 00 bb 87 c4 4c fa 92 8d d9 32 61 28 5b 68 a1 25 ba 29 3c a4 d4 e3 1e 55 19 c4 66 b2 b2 95 b0 94 65 34 65 49 cd 2b 58 f3 9a b3 b4 65 22 ef 47 46 33 86 90 97 98 cc 84 38 7f 09 4c 25 2e f1 74 8f 40 1f 32 95 b9 cc 55 3a f3 9d d0 9c 26 35 e5 79 cd 7a 5a 53 9a 8c f4 a2 f4 ce d0 ff cd 22 6a 4f 00 68 4c e3 38 d5 48 4e 1d f0 ee 9c 69 73 4c 96 d6 59 a2 19 b6 b3 6e ef 8c e8 20 61 f9 4a 6a 5a 94 Data Ascii: `#?HtN0MpXR8JQJ!"#>OCs@A xH"H'8bhD4k\#%ivlK% F$gI(R\L2a([h%)<Ufe4eI+Xe"GF38L%.t@2U:&5yzZS"jOhL8HNisLYn aJjZ
2025-01-02 05:12:38 UTC	5930	IN	Data Raw: 9a a8 ba 0f 20 74 52 c2 ed 84 fa d0 3b 96 2e 54 6d c3 e9 3e d4 92 05 9d 42 8c 72 44 a0 2a 49 43 05 32 cb 2c 13 8e 47 c6 44 20 84 10 10 50 21 8d 47 2a 81 a8 89 47 40 58 93 4d 37 d3 68 02 a2 4a 9a 50 13 4f 15 40 78 64 8d 24 74 3a 52 a1 24 95 94 ff c8 c1 07 99 30 e0 d1 07 45 94 72 ca d4 aa 04 0f 43 0d 17 cc 52 4b 41 40 e4 a9 50 db c0 14 75 54 e9 4a 35 55 a2 26 9d 0c 15 d1 44 3d 5a 6b 89 46 1f 85 34 09 49 27 ad f0 3b bc ae d4 74 d3 2d 51 45 ef 50 52 83 15 56 d1 54 0d 88 74 8c db 04 01 73 51 07 1d 95 95 09 5a 81 55 d4 3c 2a ed ba 54 d7 5d 39 55 d6 d3 da a4 1d f6 5b 53 c3 75 95 4b 08 54 45 96 d4 25 61 75 56 d6 68 29 a4 d4 c2 6b ab 74 29 5b 6d b9 4d cf 5b 70 f3 5d 36 27 3c 20 ac 75 d9 25 63 9d 75 42 5b 43 aa d4 da 5c e5 85 6e 2f 4e 41 ec 72 55 56 f5 95 d8 5d 7e Data Ascii: tR;.Tm>BrDIC2,GD P!GG@XM7hJPO@xd$t:R$0ErCRKA@PuTJ5U&D=ZkF4I';t-QEPRVTtsQZU<*T]9U[SuKTE%auVh)kt)[mM[p]6'< u%cuB[C\n/NArUV]~
2025-01-02 05:12:38 UTC	7116	IN	Data Raw: a4 69 c7 7f 02 60 7d c4 48 b2 fd 69 b2 bb ca ad cc e3 21 d2 5a 49 ac 36 01 9a 85 62 66 7b b6 66 8b 18 68 bb b6 dc 95 16 6b 6b 61 a1 00 65 a8 85 5e 5d 36 b7 e8 e5 03 17 eb 9e 50 4b 82 b2 5a 59 55 eb 7c 3b 04 a5 87 ca 85 89 4a 4d 50 85 b1 b1 88 b2 e8 e3 96 61 ab 46 b6 d0 71 24 41 5f f2 25 b9 a7 40 5a 91 6b 27 95 3b 5e db 35 02 07 50 62 28 d6 71 9c cb 61 14 f0 5e 78 9b b7 50 78 53 49 a0 66 fb 37 b5 57 2b b8 e3 0a 93 e5 6a ae b6 a8 b8 ad 03 b6 8d cb 02 49 10 b7 2e 60 81 b3 76 62 52 b6 7e 4f d6 0a bd 76 78 14 a0 71 24 27 09 93 1b 6c 97 66 ba ce 07 73 f9 68 95 ab cb ba 58 ab 9c 5a bb b5 d3 07 6a 8b cb b8 c1 a5 46 5e d0 6a e1 f7 6d be ff d0 0a e6 a6 7e 42 b0 59 e3 4b 97 a5 70 0a 4f 76 6b 18 d6 71 ec 4b 97 95 3b 66 ab 75 b1 99 47 b5 56 b8 6f a0 e7 ba 68 19 93 9f Data Ascii: i`}Hi!ZI6bf{fhkkae^]6PKZYU\|;JMPaFq$A_%@Zk';^5Pb(qa^xPxSIf7W+jI.`vbR~Ovxq$'lfshXZjF^jm~BYKpOvkqK;fuGVoh
2025-01-02 05:12:38 UTC	8302	IN	Data Raw: 13 0a 50 c8 8d 84 b4 b9 75 7c 5f 56 d7 c4 0a 25 88 13 a7 e5 5b ae cc ae 46 e0 cb 2e 74 c0 04 3e dc 02 80 fb 41 71 66 60 79 03 60 ac e5 6e 2b 4e a5 02 8f b1 07 28 6e 7c 37 9c 04 0c c8 82 25 f7 cd ef c0 98 66 5a 58 a8 e0 02 0b 68 2b 85 db a9 de 06 4b 54 08 82 d5 e7 08 c5 19 de a8 5d 20 03 0a 75 aa 38 cd 4b e1 1e dc a2 04 1f 10 80 20 04 b1 61 01 e8 a0 04 9f ed 08 b6 06 16 91 26 37 99 c4 19 d1 45 60 2f 50 e3 54 3a 18 c5 28 2e ef bd 10 70 63 2c 5f 00 c5 42 08 01 67 7d f6 db 9f 56 b9 45 28 70 30 79 2f 00 02 58 30 41 ff 07 43 1e 72 91 75 f0 81 12 20 d7 be 4e ce 73 9e a1 dc 4a 0c c8 c0 0a fe bd 40 8b 9d 84 de 0b a0 80 03 03 e0 40 a1 b3 fb 89 13 1b 1a d1 3b d8 01 07 58 11 02 14 4f 96 14 82 bd 80 0a e8 26 04 4d ff 14 c3 fc 5a 80 a6 59 91 04 1d 74 22 ce 1b fe 80 aa Data Ascii: Pu\|_V%[F.t>Aqf`y`n+N(n\|7%fZXh+KT] u8K a&7E`/PT:(.pc,_Bg}VE(p0y/X0ACru NsJ@@;XO&MZYt"
2025-01-02 05:12:38 UTC	3663	IN	Data Raw: 0e ec 80 eb 53 17 f9 c7 0d ca f7 be fb bd ef b1 28 37 08 24 4b 78 b4 c3 61 7e 85 9f 81 de 11 9f f8 72 f3 31 f1 65 7f 76 18 04 90 00 01 24 01 03 b2 38 08 dc c3 23 f7 91 5c 02 68 a4 0d c1 05 2e 00 87 58 fc 3d 03 a3 4f 7d b9 57 cf fa d6 bb fe db a9 bf 80 e9 0f fa 4f 38 90 3e 16 b8 a7 7d e0 47 5f 7a dd 7f cc f6 bd d7 7d 06 6c 4f 7a a0 7b 81 f2 95 a7 bc e6 3f 1f ae ce 8b 84 f9 75 bf 7b ec a7 4f fd ea 5b ff fa d8 cf be f6 b7 cf fd d8 73 9b 03 68 48 02 ff f2 93 bf 7c c3 cd dd 05 13 48 ff 04 5c 90 6d 72 6f ff f5 f0 8f 3f fc bb 4f ff fa 7f df 0a 5e f8 80 0e c6 2f 80 f2 ab 9f 7c e7 a7 7e e9 d7 5f 3b 60 73 d7 f7 71 08 a0 04 21 50 78 0c d8 80 0e d8 80 21 70 2f fd 04 7f 16 e6 7a 3d 00 02 2a 50 76 ac 57 81 16 48 5a 56 50 02 10 a0 7f 3a c0 02 4b 50 82 26 61 0b e8 27 80 Data Ascii: S(7$Kxa~r1ev$8#\h.X=O}WO8>}G_z}lOz{?u{O[shH\|H\mro?O^/\|~_;`sq!Px!p/z=*PvWHZVP:KP&a'
2025-01-02 05:12:38 UTC	10674	IN	Data Raw: bc f1 c8 11 30 9b 2f 82 c1 84 88 60 b9 27 93 1a 52 ca 22 87 b0 2a 42 25 05 23 a8 c9 94 5c d9 0f c9 a1 b2 9b cf 46 30 77 d4 2f 08 2b e9 9b 60 88 38 f3 14 93 82 e0 42 a9 52 c9 11 8c c0 53 4f 29 87 98 20 88 50 00 a5 ff 31 d0 41 09 0d f3 d0 3a f7 03 c0 15 94 06 58 0a 81 f3 00 fd 32 4e 1e 3f 29 2f b0 3b 1d d5 d3 88 2d ff 7a 45 50 51 f3 9c 40 be e5 4e 6d 34 d5 47 59 dd 8f 02 94 28 28 28 d1 be 42 19 c0 82 57 39 05 6c 00 58 09 1d 62 84 e5 80 0d 56 4f 62 fb 8a a0 d7 63 89 1c d6 b4 50 1e 73 f1 18 1b 2a 33 6d d9 60 3b 5d 85 14 63 f3 54 e5 5b 70 c3 05 73 d5 ed 98 f5 56 dc 42 73 3b 60 d3 73 d1 1d 37 d9 11 0a a2 00 b6 6a 5d e0 eb 80 52 da cd 51 db 75 cf 25 c1 10 80 03 2e 25 5f 4e 23 60 57 ca 81 03 16 98 60 30 49 45 35 ce 84 15 26 e1 12 86 a5 34 c2 3f 52 ce a4 34 5e 50 Data Ascii: 0/`'R"B%#\F0w/+`8BRSO) P1A:X2N?)/;-zEPQ@Nm4GY(((BW9lXbVObcPs3m`;]cT[psVBs;`s7j]RQu%.%_N#`W`0IE5&4?R4^P
2025-01-02 05:12:38 UTC	11860	IN	Data Raw: 89 0d f7 da d2 ea c7 ab f6 8b 82 a8 b3 09 21 32 c9 03 99 04 ef a7 9f 52 28 b5 d4 13 2f 6a f5 d5 28 38 dc 90 12 33 5c ed 75 bc 99 1e aa 26 02 24 10 7b 74 ad c6 dd 60 66 ab a8 44 fa d0 d3 a8 c8 c9 b4 40 26 91 0d 36 d4 78 e7 3d f1 c4 a8 f0 ff 3c f6 dd 7b df 2d 36 c8 16 ab ea d0 d3 a0 34 eb 90 ad a4 1a de d0 7e 9f a2 d0 eb dc 25 87 92 f4 00 11 64 ae 79 e6 36 00 ae b7 b9 2a 91 c2 b6 de 79 7f ea 78 7a 50 bb cb 50 ac d3 8a 4a ec ae d0 3a d4 31 09 9b ce cd d0 01 2e 7c ea f7 db f1 5e 82 65 e9 83 6f c4 2a 2a a5 17 0f 7b 8d af 83 12 fb e3 f5 7e c6 bb ef f6 e6 5a 36 09 b4 52 ce d0 f0 17 53 5b ad 0d 28 20 60 c3 f7 46 6b 98 fb c5 e0 97 ff ba ef 1b af f8 7a fa 37 7c 9a fe a8 a0 4b 6f f6 56 94 e3 04 8b 10 58 0a 5b eb eb 53 53 6d ba 4a 70 93 57 ff 10 10 af 09 a9 cd 4c 00 Data Ascii: !2R(/j(83\u&${t`fD@&6x=<{-64~%dy6yxzPPJ:1.\|^eo*{~Z6RS[( `Fkz7\|KoVX[SSmJpWL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49862	99.86.4.105	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	397	OUT	GET /media/dd9a87_b1d6c5504d164c40835d918239dcd10e~mv2.gif HTTP/1.1 Host: static.wixstatic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:38 UTC	764	IN	HTTP/1.1 200 OK Content-Type: image/gif Content-Length: 975329 Connection: close Server: openresty/1.27.1.1 Date: Wed, 01 Jan 2025 06:59:53 GMT Expires: Wed, 01 Jan 2025 07:59:53 GMT Cache-Control: public, max-age=15552000, immutable Last-Modified: Wed, 13 Nov 2024 13:00:11 GMT ETag: "c935ad6dde4cf98f305eaf0d69f195cc" Accept-Ranges: bytes Access-Control-Allow-Origin: * Access-Control-Expose-Headers: Content-Length Timing-Allow-Origin: * X-Seen-By: gcp.us-central-1.media-router-9fdb4b487-hm64q Via: 1.1 google, 1.1 7fcb41b117930690c299be9cec4a977a.cloudfront.net (CloudFront) X-Cache: Hit from cloudfront X-Amz-Cf-Pop: FRA6-C1 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: FFJKbJyicXdVyI1O6z2A_ZKIjrsUELxMIEzJg-gFTTciN2XmwZMYew== Age: 79965
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 ce 99 8c 67 44 32 d4 95 73 ff 50 03 df 5f ab b5 aa 97 75 6f 68 1a ae 72 91 66 50 f1 b9 b0 2b 26 27 f6 ee db f8 dd f7 a3 0e ab 61 92 b1 b8 cc d4 aa 00 dd 72 54 46 23 bb 88 62 af d5 b4 bb ce 92 b6 ce 06 05 05 4c 32 2b d0 b7 da 4f 48 47 ae 77 6a b0 70 4c 9c 71 94 8c 50 2e ff 87 16 8f 88 75 93 1c 1a d5 11 f1 b3 ce ef ef 67 64 59 76 90 dc ee f1 26 0f 0b ff 1d 0b d8 b2 ef b2 62 e5 8b 54 49 f5 b2 d6 20 58 98 f7 b0 f7 98 99 ac ee 22 ff c5 18 9a fe 99 ff 90 d8 f9 25 2c 4f 8f aa b7 aa 99 ab 6d 11 11 71 11 cd 6b 66 5b 2b 48 68 f8 70 c9 22 96 c8 6d cc f2 2c 22 11 4e 2d 46 ef aa 75 45 23 16 a8 dd c6 dd aa 77 f3 72 fc fd 54 d9 cc 87 5d f5 cc 98 4f 09 0b 6d 31 29 25 0f 26 b7 b1 ea f6 8f d8 d4 94 d7 91 28 52 d4 93 ad 0d 23 27 10 11 Data Ascii: GIF89agD2sP_uohrfP+&'arTF#bL2+OHGwjpLqP.ugdYv&bTI X"%,Omqkf[+Hhp"m,"N-FuE#wrT]Om1)%&(R#'
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: a2 c5 54 0c cd 14 e3 c4 88 98 40 5c 86 df a5 85 00 fc 51 5b a8 40 07 f0 09 88 61 4c 07 e4 ac 09 e0 41 cb d6 c8 13 f0 81 ec b4 ac 1c 18 c0 35 32 e3 8f f9 0c 91 fd 8c d3 1e cd 33 96 8b b9 2c 0d d1 2c 4d 34 12 0d 01 50 81 01 b0 23 0e 7c 80 80 04 00 ef f8 41 29 48 17 98 d4 40 fa cc 82 ac d8 63 02 9d 19 59 79 5b db 98 cd 0c 90 1b 89 a8 8d b7 35 0c 55 6e 04 df 70 4e e1 fc e6 9c d9 08 b7 02 4f 00 34 41 37 c1 c5 84 ec d1 84 2c da 1e f1 02 2f c0 45 5b 44 86 a5 80 16 c9 7a ab 45 70 a5 b9 7d 8e 81 68 c4 41 2c 84 a9 8d 51 8c c8 99 9a 5d ff 0a 1f c4 4f 8b f0 c1 fd a4 5a ac 49 84 44 c4 4d 05 05 88 aa f9 40 1f f4 9a f8 d4 90 bd 7d 10 08 91 90 0e b9 e5 7c 84 d4 f7 7d c7 95 44 43 dc 46 1b 3d 52 c4 cc 25 90 fd 64 da 59 29 40 03 51 10 a6 85 d9 57 d9 4f ff dc 8f fc 10 d0 57 Data Ascii: T@\Q[@aLA523,,M4P#\|A)H@cYy[5UnpNO4A7,/E[DzEp}hA,Q]OZIDM@}\|}DCF=R%dY)@QWOW
2025-01-02 05:12:38 UTC	7216	IN	Data Raw: 91 31 72 79 c3 2f 30 05 7b 94 97 7c 4c 48 7b 31 05 5c 80 32 25 1b 98 81 51 98 c1 75 4a 82 12 18 26 43 18 6e aa 81 53 b8 84 49 2b 86 2a 7b 1b 78 a9 c7 c1 75 85 79 30 80 31 08 00 0c d9 99 61 f2 25 67 38 a4 99 b9 80 d0 d0 ab 4d f0 d6 52 68 d4 61 40 19 94 3c 99 ff 30 18 00 e3 00 be 42 1a 50 60 43 3e f3 33 67 c9 d3 c0 98 9a 3c 3d 34 af 21 8f 46 6b 34 13 28 3b 3e 60 07 b7 01 05 a4 e4 b1 7a f1 db c9 55 98 68 e0 00 bb 09 19 86 91 4a 22 18 35 c5 21 4b bb 48 1c c9 21 4b 58 93 9c ed 0d 3f ca 09 dc 5a 13 bf bb a8 1e eb 69 a6 16 6d a6 18 ff cc d2 08 c8 04 6e c0 05 8f 08 89 0c 00 80 5c 78 84 6f 50 84 04 d0 86 5e 00 80 55 48 a1 4c 58 85 55 18 90 b6 5a 1d 02 59 85 7d 93 99 7f 3d 3e c5 6b 99 67 32 9e 05 f6 36 2b 10 9e c8 0c 1b 05 78 1e 73 23 1f bc a8 9e 0b 0e 4d 7a fb 1e Data Ascii: 1ry/0{\|LH{1\2%QuJ&CnSI+*{xuy01a%g8MRha@<0BP`C>3g<=4!Fk4(;>`zUhJ"5!KH!KX?Zimn\xoP^UHLXUZY}=>kg26+xs#Mz
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 61 02 8a 85 35 b7 96 39 0a 17 ce 91 a8 70 2e 5f b2 84 29 4a 94 4a 97 34 5d 3a ba e5 f2 d6 4b 51 b7 74 b4 79 92 04 0f 1e 28 4f 14 cc 20 21 e5 c0 d2 27 52 26 ec 90 ca 82 84 9c 1c 39 f8 3c 81 b2 b5 47 8f 0b 7c ac 44 30 40 c2 55 b4 59 b8 d0 d6 28 70 ea d4 a5 53 c0 40 89 0b f5 81 16 10 13 3d b6 26 49 a2 a0 07 5f 13 40 ec f6 f8 0b e4 c2 85 00 38 9e 21 88 70 c1 84 02 28 7d b7 02 09 80 a0 52 ff 25 4a cd 2a 65 6a d6 0c c0 a3 47 94 28 55 6a 46 a9 15 02 15 71 86 21 88 13 e1 d9 33 15 5b 54 a8 40 10 d1 74 e1 24 5d f1 9a b8 6b 02 0f 10 05 5f 89 f6 d8 eb 35 02 5e 05 24 a1 28 08 a0 80 cf ef 00 17 14 28 78 d2 e3 09 1e e6 06 0c a0 82 36 26 c2 6f 3e 5e f5 a0 78 e0 4e 14 24 9a 90 cc 43 7a a0 de bc a8 f5 eb dd a7 7f 20 8a 82 5b 53 a7 6a e0 32 65 0a ed 2f 5c a8 5c 69 ce 31 e6 Data Ascii: a59p._)JJ4]:KQty(O !'R&9<G\|D0@UY(pS@=&I_@8!p(}R%J*ejG(UjFq!3[T@t$]k_5^$((x6&o>^xN$Cz [Sj2e/\\i1
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 70 9d aa 61 d8 b0 60 17 bf 70 45 43 35 cb 15 64 c8 bf 16 43 fb 15 ed 17 2a 57 1c 7e 0d 43 85 aa 72 8d 62 35 a6 15 a3 40 61 1a 85 62 c5 02 0f c6 f5 8b dd ac 61 ce 10 38 8b 10 00 08 92 00 b9 e3 a8 d8 c2 8b 17 80 52 97 0a 94 7a 04 e0 51 a9 e2 c9 37 2d 2f fe 68 13 f4 4d bd 36 3d 67 fe 3c 79 a9 df ad 32 c9 76 96 81 ab d4 a9 5b f9 28 48 32 f5 3c 14 28 0a d2 43 79 d2 3e c7 8c 1c 4f a4 e4 a0 ff 31 ed 3e a8 d3 c5 68 d4 70 81 4b 31 63 a8 44 73 99 2b a8 6c c6 c1 2c 1c 40 16 4d 64 3a b4 11 41 04 56 c8 01 21 85 11 ca 91 01 86 13 62 98 21 86 11 64 e0 e1 87 38 58 81 03 84 19 58 f1 a1 87 17 da 16 00 1f df f1 41 9e 54 5b 29 90 c9 73 df 3c 92 4b 33 5b 10 a0 41 16 00 38 01 40 2f bd 28 f2 c8 23 94 50 b2 9d 38 cd 18 99 4b 2e c5 51 92 0b 25 cd ac 92 49 28 55 92 85 00 89 10 06 Data Ascii: pa`pEC5dC*W~Crb5@aba8RzQ7-/hM6=g<y2v[(H2<(Cy>O1>hpK1cDs+l,@Md:AV!b!d8XXAT[)s<K3[A8@/(#P8K.Q%I(U
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 10 c7 01 04 1f 46 ec 4a 1a a7 29 0b d4 7d fa 96 a9 92 00 5b d4 75 4e 02 f0 0a 00 00 01 ca 94 15 d1 60 83 0e 06 1c 30 00 02 09 ac 46 94 05 26 c1 64 92 4f 26 b1 64 92 29 a6 90 c6 9f 16 a8 c0 30 05 0c 31 fc 62 c3 63 fc 99 64 01 4c 16 f0 67 17 06 4e 34 06 45 06 52 d4 a4 1c 10 a7 d0 a1 0f 3c 14 40 60 31 28 6e 84 62 16 fb 76 c2 05 2f 5a d6 a0 45 2e 04 32 40 20 97 6b 7c 89 04 1b 64 38 e1 04 ff 1e 5f 90 f1 a5 1a 32 02 80 22 89 0b ba da ca 2b 0b 04 03 0f 30 05 2e 00 02 a2 00 22 50 21 02 04 c8 0c a0 4c be cc 44 20 94 0d 34 68 86 17 00 28 01 20 17 3b 1f 69 a6 92 00 35 e0 b3 92 4a d6 ca a5 94 47 00 68 86 12 04 c6 2c 73 cc be 26 0a 00 08 32 24 ea 0b cc f1 80 b8 69 47 9e 40 d9 32 cb 1e be 64 b4 2f 04 34 a8 a6 9a 50 54 50 01 01 67 70 70 e6 03 02 50 b0 04 12 4b 34 49 c6 Data Ascii: FJ)}[uN`0F&dO&d)01bcdLgN4ER<@`1(nbv/ZE.2@ k\|d8_2"+0."P!LD 4h( ;i5JGh,s&2$iG@2d/4PTPgppPK4I
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: f4 a8 8c 00 45 08 20 e4 90 02 08 41 64 25 11 54 05 df 05 7c 5c a0 02 02 c0 b0 92 10 28 8c 80 e2 88 28 a2 30 e2 88 96 c2 65 c9 88 28 9f 30 f2 49 96 e1 08 27 9c 23 2b 7c e1 c2 2f 2e b4 d9 a6 29 b8 b8 60 ca 9c 73 b6 d2 0a 2a c3 0c 43 8b 2b a8 cc 82 cb 2f bf cc 32 0b 2a ae 04 ca 67 34 b8 c0 79 4a 31 8b 7a 32 4d 31 b3 48 61 45 06 56 54 9a c1 a5 7c e4 c0 c7 a5 17 5c ea e9 a7 97 4e 1a 81 15 ff 63 f8 e3 4f 21 2f a4 1a 02 aa 2f ac 1a 42 08 ad 9e 31 84 3f 96 7c 30 0b 9f ae b8 62 ab ae ae dc 7a 6b ae ae a8 11 ac 2b 06 00 6b 6c af c5 16 ea 27 2e a8 98 52 83 0b a7 d0 50 cc b4 9e 14 43 41 31 a0 50 e0 49 2c 8c 32 ea 42 9c c5 f8 c3 40 aa ad aa fa 02 ab ad c2 aa 6e 21 ae b6 ca 2e b9 21 9c a1 2a aa ae ca eb 2e ac ec ca fb 2a b9 ec b2 1a 2f ac 67 a8 0b 2b b9 f3 c6 1a 6f 3a Data Ascii: E Ad%T\|\((0e(0I'#+\|/.)`sC+/2g4yJ1z2M1HaEVT\|\NcO!//B1?\|0bzk+kl'.RPCA1PI,2B@n!.!./g+o:
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: e4 94 69 c0 b9 e4 92 02 2e 99 06 94 46 1c 71 a4 11 46 18 f9 f4 53 48 41 f9 46 a5 19 14 50 49 01 55 1d b3 02 d6 0c 7c 58 29 56 92 68 35 a0 80 52 45 65 e4 93 5d 1d 11 f5 d7 46 58 c9 04 01 1c 58 60 e1 09 16 02 61 81 0d 16 e6 e8 e4 96 4f 41 21 15 d4 51 7f 65 44 94 51 45 ed b5 d7 5d 47 6d 44 94 cd 34 49 c6 11 56 b4 51 84 15 61 1b 01 45 11 61 1d 99 16 5e 52 41 99 b6 11 45 36 f9 66 13 50 20 ff 81 44 94 7d c7 60 41 8c 31 7c 98 81 60 3a 92 98 e1 e0 84 9f a0 23 1e 7b 2a e1 85 ca 14 f1 95 04 dd b1 14 71 44 1b 4f 2f 06 d5 91 76 cb 2d 97 95 a5 00 88 c7 89 16 15 e9 82 88 21 08 50 a4 97 14 55 ec 25 2c 96 eb 4d 77 ac 5e 24 79 a4 99 11 cb 7c 25 c5 71 1e 91 a4 17 ab b4 6a 37 64 b1 60 59 02 69 14 94 78 40 09 63 d2 29 a7 9c 64 52 98 43 8c aa c5 48 41 0c 0e ae e6 20 85 ae cb Data Ascii: i.FqFSHAFPIU\|X)Vh5REe]FXX`aOA!QeDQE]GmD4IVQaEa^RAE6fP D}`A1\|`:#{*qDO/v-!PU%,Mw^$y\|%qj7d`Yix@c)dRCHA
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 26 98 4c b1 e9 14 53 70 12 af 68 ef ce 3b a6 1e d5 e2 9b 6f 03 c4 c0 41 0c 04 fe 12 a3 c9 98 28 c0 f1 2f be ff f6 eb 6c bf 08 2b cc 2f bf 06 17 ec ef c2 08 43 2c f1 c3 17 43 90 82 3f d2 9c d7 9b 30 46 d4 72 4d 2d f5 5c 03 0f 27 c8 20 d3 09 ca c8 9c 7c 32 36 d8 f8 72 0d 36 91 48 e3 cf 17 fd 16 0c 01 c4 06 1b 33 a6 31 00 e3 8c 70 bf 28 f8 b3 80 22 b6 f8 93 82 c3 05 27 0c 18 31 58 f8 73 ff 09 21 84 20 61 83 0d 48 b4 e2 4f 3a 0e 43 10 f4 d2 50 17 33 46 0e 73 48 c1 42 0e 39 90 c0 06 0b 3e cc e0 4c 26 1a 34 c3 0b 25 73 e7 92 0b 00 92 34 f4 8d 24 23 6d a2 88 24 92 44 f0 c4 0e 73 0c ce 82 e1 73 9c 22 89 22 8e f8 c3 80 c3 0a 4f cc 74 b5 38 3b ab 33 d0 5d 5b 2e 79 d0 39 2f 1d f1 bf 98 2f bc 74 d7 0d e3 bc 70 c4 63 5a 9d ba ea 20 58 5d f5 d5 56 b3 de ba 0d 20 f4 81 Data Ascii: &LSph;oA(/l+/C,C?0FrM-\' \|26r6H31p("'1Xs! aHO:CP3FsHB9>L&4%s4$#m$Dss""Ot8;3][.y9//tpcZ X]V
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 44 98 83 05 2b 66 b0 e2 81 90 8c d1 63 d6 7c 61 8d b5 67 8a 9f be b5 57 88 7b 4e a1 28 7f 26 75 c6 19 57 9e 99 e7 99 61 86 79 c6 6b 24 6c 30 9b 0c 3a c8 00 c2 ec b3 d9 76 db 06 42 40 b0 a1 6c 42 6c e8 63 09 4d cc b2 04 93 12 30 29 ab ac 12 cc 3a 4b 93 49 34 81 04 12 51 30 f0 64 f1 c5 81 b9 c4 93 69 80 69 f2 f1 4b 2e 99 e6 94 4b 4e 01 06 92 64 34 d1 84 82 52 0a 78 c4 38 4a 42 c9 20 d3 ff 4b 31 55 e0 89 d4 15 e0 43 81 31 7e 39 c5 13 48 46 59 08 3a 47 22 44 90 91 4f 78 d7 2d 19 dd 7a df 9d 93 4e e4 7c 6b b7 bd 24 a1 ec 11 58 36 49 8e b7 dc 7d 5f b0 c1 4f 0e ec a4 7a 46 b6 fb 84 13 86 40 d9 65 8a b3 fc 3e 0b 94 88 40 49 52 b7 85 1a d9 64 1e 36 d8 98 21 07 36 48 a8 dd 18 48 1e a0 e0 81 07 ca 88 47 83 93 29 19 bd 97 5e b0 a2 11 7c 91 8b 22 22 d1 88 48 38 c4 21 Data Ascii: D+fc\|agW{N(&uWayk$l0:vB@lBlcM0):KI4Q0diiK.KNd4Rx8JB K1UC1~9HFY:G"DOx-zN\|k$X6I}_OzF@e>@IRd6!6HHG)^\|""H8!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49867	149.104.32.188	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	388	OUT	GET /1300x200.gif HTTP/1.1 Host: 5967.5967007.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: X-SUDUN-WAF-R-C=0001695112
2025-01-02 05:12:38 UTC	476	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:38 GMT Content-Type: image/gif Content-Length: 1399506 Connection: close Set-Cookie: X-SUDUN-WAF-R-C=0001695112; path=/ Last-Modified: Fri, 20 Dec 2024 06:12:57 GMT Vary: Accept-Encoding ETag: "67650ae9-155ad2" Expires: Thu, 02 Jan 2025 05:42:38 GMT Cache-Control: max-age=1800 Server: layun.com Access-Control-Allow-Origin: * X-Request-Id: fb15dbc773c64cd39413118917ef1c93 cache-status: HIT Accept-Ranges: bytes
2025-01-02 05:12:38 UTC	15908	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 e6 7f 00 fe ec 6d ff da 03 ee 05 25 ef b0 61 e5 a9 9c fe a7 02 fd e5 a2 f7 f3 d4 22 a0 df f4 63 73 33 30 2f 78 74 71 b4 b2 b1 af 86 60 90 8f 8d da db fb 6c 6c f8 f5 dd ee 03 01 6f 05 03 8b f9 ba d3 45 47 f4 88 88 fa 0f 09 f7 47 b2 e6 a2 d9 f5 22 11 f8 0e 00 da 05 ff 3c 03 01 00 58 5d a7 02 74 b9 57 29 26 44 44 33 b4 b3 d9 29 22 dc 21 0b dc b3 b2 f3 72 53 4c 5a cc fe d4 ee f8 42 20 67 69 66 5d 33 44 f2 91 91 d5 bb 95 89 c0 82 30 68 84 b5 95 70 77 ba aa 8f 72 71 d1 47 46 db 9d 06 ff 45 33 ee 07 88 c8 9e fe b1 54 4e 69 8b b1 d5 8c 90 b9 25 0f 0f 89 77 e9 6e 50 6c d5 f6 d7 55 66 f6 32 3c 46 22 22 1f 35 31 8f aa 98 ab 57 fe 80 56 55 f4 94 ae b3 55 66 54 ab 99 d6 90 b0 f1 51 68 6e 9c 99 f6 ca 6d f9 31 44 33 5a 54 dc c0 c5 1c f8 3a Data Ascii: GIF89am%a"cs30/xtq`lloEGG"<X]tW)&DD3)"!rSLZB gif]3D0hpwrqGFE3TNi%wnPlUf2<F""51WVUUfTQhnm1D3ZT:
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 13 b5 35 6d af 95 0e 5d a1 2c 2b ba 05 98 e1 10 3c 79 79 73 75 57 04 23 59 e9 86 71 f1 08 1b 70 f0 06 4a 03 6f 3b 82 80 09 e8 27 14 98 27 fa 36 92 f7 96 7a 82 d0 27 8d 63 35 64 53 0d d7 f0 5c 25 89 4b 04 c7 3c bc d4 98 06 d1 1d f8 49 37 f6 b0 00 39 31 06 60 10 04 38 92 3d ec a5 37 2a c3 52 05 83 06 7b 30 31 be c6 3d 2f b8 23 c3 b3 36 35 c8 85 95 10 09 3e 97 4d 06 86 95 27 77 18 52 22 85 11 01 04 75 23 09 64 29 43 fd 92 39 c6 86 11 47 b0 96 58 19 2b 26 e4 a2 70 89 07 72 19 24 76 3a 06 77 79 9f 04 05 32 64 18 63 96 92 0a fa 92 ff 46 b2 c5 05 91 d1 02 b1 f3 97 c2 31 08 d3 36 6d 87 89 1f d9 65 64 59 ea 87 03 e7 0b a3 38 21 09 81 3c 93 f9 91 2a 69 99 83 e8 0f c5 33 ab 28 41 36 92 49 52 93 41 73 c6 58 ac c6 7a ac c8 0a 1d 6f b0 0f ad d9 65 ef f3 65 9e a1 78 b2 Data Ascii: 5m],+<yysuW#YqpJo;''6z'c5dS\%K<I791`8=7R{01=/#65>M'wR"u#d)C9GX+&pr$v:wy2dcF16medY8!<i3(A6IRAsXzoeex
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 25 9c 30 7b b0 d8 4b be 74 7b 8a 70 50 a9 a0 97 24 58 43 0d a2 74 52 12 6d 2e 98 7b cc 56 20 2d 23 3c 2a 17 5d 90 61 61 8e 32 91 bd d8 3c d9 65 4d c6 f7 6d d6 77 5a b3 e5 6e a8 25 99 8b b1 95 5b 99 7d 96 59 1f f6 c1 3d e0 17 7e e0 63 6f f2 b5 8c f0 a7 30 ec e7 6f c4 31 1c c6 51 8d b0 79 9a 6f 90 58 0d c7 70 ad 19 41 f6 c4 2e 09 d3 9a f0 d5 25 ac 90 28 4d d1 29 8b 69 5f 22 67 0c ed f8 59 3b 40 05 68 30 3a f6 c0 48 2a b0 03 c9 f9 41 dd b0 8f ef e6 8f 28 16 90 93 90 82 33 59 32 49 27 63 bb f3 31 db c9 9d 8b e0 90 31 b8 21 b4 70 ff 1e 17 89 91 b4 a5 33 e5 15 44 ee 69 71 45 d6 3d 48 25 92 4c 34 84 e1 69 09 f3 d6 10 24 21 8c 3a 52 05 fe 19 23 c2 18 0e 30 79 0c 52 78 9f 97 90 9f ef 61 65 70 17 66 40 88 46 3c 49 04 76 07 94 12 aa 36 b6 88 94 21 20 3a 78 f3 24 a5 Data Ascii: %0{Kt{pP$XCtRm.{V -#<]aa2<eMmwZn%[}Y=~co0o1QyoXpA.%(M)i_"gY;@h0:HA(3Y2I'c11!p3DiqE=H%L4i$!:R#0yRxaepf@F<Iv6! :x$
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 85 f3 83 7a a9 57 27 35 c7 7a 88 f6 73 b8 38 0c 54 78 62 94 31 1d e8 f4 37 eb 85 4b 51 b7 10 33 c1 06 89 f5 4b 06 71 04 5d c7 7c 09 e8 20 dc a3 8a 05 66 0d 99 55 47 e1 b0 73 da 20 5c 98 b0 7f da d0 7f 97 e0 82 e8 97 7e 1a 81 8e e8 a7 7d a2 24 31 c1 11 0e 7a 00 85 c0 50 7d ef 41 71 e9 f8 7d ea b6 0b fb 07 05 f2 f3 8e c0 00 81 96 40 7f fd 31 6e e5 c6 4a d3 75 20 fb 68 09 18 52 5f 41 b3 71 2a 10 03 12 c2 82 9d e4 69 c9 88 7b 00 37 2b 02 89 7c 9d 02 70 cc e1 53 ec d0 0b 0b e9 07 43 10 5e 89 57 22 52 f0 31 cc 67 09 fa 85 7b 01 28 ff 15 cd c1 23 b0 11 60 90 c0 25 15 d7 2d b7 b4 72 19 35 72 2c f9 1a a1 68 28 54 01 72 a8 13 6f 9f f1 00 65 70 8b 50 28 3c cb 43 4f 21 06 31 60 b2 3c 49 19 74 c5 28 64 6c a2 94 51 14 0d b5 70 26 8e a6 18 57 08 0c 50 69 0b 5e 58 85 84 Data Ascii: zW'5zs8Txb17KQ3Kq]\| fUGs \~}$1zP}Aq}@1nJu hR_Aq*i{7+\|pSC^W"R1g{(#`%-r5r,h(TroepP(<CO!1`<It(dlQp&WPi^X
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 1b df a5 1e 89 3e bb f9 bd bb cb 4d b8 ff 0b 57 fc be 5f 0a 43 e0 b6 45 f7 08 0a b1 07 f8 b9 8b 3f 7e ac b4 1e 7b ea f0 9c 35 8e ff fe f3 51 c0 7f 6d 0f 80 80 19 20 00 a1 ff c5 ac 0d 99 4b 81 db c0 b7 40 06 e6 6b 5f fa d2 97 03 27 b8 40 09 36 90 82 5c c3 81 78 f2 30 07 d6 8c 61 55 0a 23 4f 0f 70 b7 bb 12 e6 ce 05 81 39 9c 10 ee 67 c0 16 46 88 01 b4 13 21 09 4d 58 42 17 f4 e0 70 29 38 83 6d fc 00 af 56 8d 07 63 33 a4 e1 f8 fc 95 30 21 08 0c 7f 92 62 99 0b 97 c8 c4 0c 95 21 0e 10 a0 c3 05 be 70 44 3e 3d 80 66 4d 74 cd 16 56 55 2d b8 c9 4f 88 60 0c e3 db e4 a6 35 13 88 27 87 ab 19 83 0c 80 65 3b c1 c5 4d 8c f1 d3 da bd d0 60 3e 0f 68 2c 8b 78 cc 8d a7 d8 68 2f 2f c2 11 6b 72 73 81 ac 4c a6 04 b2 c9 66 76 0a 93 00 0e 16 30 00 3f fe f1 8d fa 32 5c c2 5e a0 38 Data Ascii: >MW_CE?~{5Qm K@k_'@6\x0aU#Op9gF!MXBp)8mVc30!b!pD>=fMtVU-O`5'e;M`>h,xh//krsLfv0?2\^8
2025-01-02 05:12:38 UTC	16384	IN	Data Raw: 6e f4 16 86 70 9b 08 97 60 23 bf bd d1 ff 20 14 ca 69 17 56 77 a4 4a 07 5e 7b 12 2c 50 e4 28 cd 49 30 05 c3 c5 4a 15 5e 53 48 8c a1 d5 04 f4 65 2c d5 00 5d bd 57 ca 18 f3 89 3c 55 03 d5 49 80 44 bd 30 bf e6 9f 00 00 be e2 87 03 06 6a 28 89 02 0a 9c 31 f0 87 0c 8a 38 08 14 13 97 12 b4 d0 02 54 28 ca 18 3c eb 3c 09 24 43 fc 1c 33 2d 70 20 2d 00 14 c0 4e ad f5 d6 6a a9 b8 cb 1a 67 6a 70 90 b4 07 ed d2 d3 99 3d 61 b3 cd 1a 64 af 98 f6 68 a6 91 6d 8e 69 70 b3 bd 0b 1d 07 15 03 36 90 6e 0e 39 71 48 64 b8 24 8c dd 6b cb 74 f6 2e ee ac b0 46 0d 35 cc 30 03 e3 5f 38 fe 78 0d 2b 38 be 02 e3 33 38 c1 78 e3 8e 63 2e 83 13 2b 82 2d 53 dc 66 83 3d 1a 1d 10 a4 5e 42 b9 46 fe f1 19 a2 6a 77 74 d8 1a 14 91 f1 59 39 ba e8 62 46 05 10 14 a1 06 0f 22 5d b6 f6 68 3d 55 50 69 Data Ascii: np`# iVwJ^{,P(I0J^SHe,]W<UID0j(18T(<<$C3-p -Njgjp=adhmip6n9qHd$kt.F50_8x+838xc.+-Sf=^BFjwtY9bF"]h=UPi
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 2a 1c 42 c3 cd 84 d5 38 50 1b 2d 0c 44 ff 48 a2 2e 1d 74 71 22 3b 1e 6a 18 62 83 34 d6 68 e3 8d 0e c5 71 01 45 06 61 b2 0f 04 32 3c 15 09 2d 2c 20 95 93 4d 87 e4 43 55 55 ee 40 e4 92 48 48 59 94 13 94 15 21 99 54 95 3d 22 44 25 49 26 11 f8 07 93 9f b0 10 91 4f 2b ac d0 d3 4c 22 49 e9 91 48 33 6c 52 d2 4f 6b 54 f0 43 11 3c fc 71 c0 0b 46 32 22 03 0f 3c f0 83 84 1c a3 e8 f1 87 0c 11 f1 40 06 98 ea 8c 11 47 1c 22 c8 e0 81 07 7d 09 21 5f 58 74 a1 83 44 77 68 b1 f7 5c 0f 5f 79 f0 40 83 63 e4 c5 97 10 1e e8 20 42 0e 39 30 e0 00 73 99 6a 5a 58 01 71 49 20 04 4a af 10 0a 1a 26 8c 50 06 89 24 98 45 04 99 66 85 00 db 12 b0 c4 0e 2b 1a b1 c2 02 7b 81 4b 48 fc 51 1a 8e d0 de 08 44 0c aa b1 36 5d 33 50 10 80 db 5d b5 d4 d6 db b7 b8 fd 16 1c 71 c3 b5 e6 da 1f c9 a1 6b Data Ascii: *B8P-DH.tq";jb4hqEa2<-, MCUU@HHY!T="D%I&O+L"IH3lROkTC<qF2"<@G"}!_XtDwh\_y@c B90sjZXqI J&P$Ef+{KHQD6]3P]qk
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: da 88 19 4e 9c 88 38 f0 e7 5c 9c 96 d8 ff 72 ea 8c b6 a6 82 13 6f 5b 7c 09 1d 4a b4 e8 00 03 11 0d fc b1 63 c7 00 00 03 06 e0 40 6d ca 14 ea 23 00 7f 9e 8a 19 b3 a5 ab 9f af 60 c3 3a ea c5 80 63 0a 17 22 d3 3a 94 48 60 a2 45 81 42 82 92 92 61 56 ad dd 85 24 25 a6 38 29 41 86 29 74 d6 a0 cd f8 a1 cb c9 32 55 0f 46 e0 dc 39 4d b0 05 63 ee fe fc f3 f4 29 41 a6 04 a9 04 29 da cc d9 90 83 b1 bd 28 6c 1a 4d ba 34 8c 36 45 1f 8d 51 d0 b9 35 a2 2e ff 7c 59 2a bd c9 05 e5 d4 b8 73 eb de 9d da d5 01 23 6b 66 8d a8 35 e2 07 0f 08 2c 78 97 22 83 64 d6 2d 63 10 8c b1 e0 05 ae d4 33 5a c4 a3 0d b7 35 62 cd 9a 11 dd 6b 7c ef ee 1d bc f7 f2 e4 c7 af 11 6f 1e 7d 76 12 da a4 c1 9c 81 64 4c 75 52 3f 48 f0 90 34 c6 55 30 5a e0 69 47 42 0d 33 cc 50 ce 7d bf 90 31 06 7c db 65 Data Ascii: N8\ro[\|Jc@m#`:c":H`EBaV$%8)A)t2UF9Mc)A)(lM46EQ5.\|Y*s#kf5,x"d-c3Z5bk\|o}vdLuR?H4U0ZiGB3P}1\|e
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: aa 20 a4 43 2a 6a 23 6c a4 cd 5c 0a 4f 06 12 1d 73 0a f8 1b 12 92 19 cc a2 8a 9c 5e 3b cf 25 77 d8 4d 8a d7 7a 61 d8 28 13 7f 39 ad 73 3b 83 43 6e c6 7f 96 0d 8d f1 cc 4c cd b8 d9 97 f5 7f 41 53 75 80 36 16 49 9a 25 ea 37 c2 88 05 cf 12 85 91 54 eb 69 1d 39 42 24 51 8b d5 d5 b5 dc 04 31 c8 09 b6 6c 38 58 bb 40 12 c2 f0 09 15 51 ff 9a 3d 38 d7 c8 d9 b1 11 fa 32 e4 07 73 1c fb 0b 89 13 a7 ff e7 ac b8 45 25 7b ad 0a 51 4d d1 24 7a d1 d4 2d 5f 2f c5 d5 f3 65 92 89 5c c9 3e 76 c9 22 fd 6a 3c 89 b9 ad 50 ac 91 91 5d cb b5 3a 8e 71 95 a7 18 47 b9 84 21 a4 1a 32 4d d9 27 0e 85 d6 91 8d 13 b8 80 c7 bb 80 b7 06 e1 61 70 9a 5d dc 93 21 36 8c 48 81 ac be cd f0 8d 8b 21 29 e2 b5 d1 33 59 0f 8a eb 6e df ed 6b d8 40 d5 7f 10 dd f0 30 0f f2 60 86 c3 db c8 fa 66 29 96 f8 Data Ascii: C*j#l\Os^;%wMza(9s;CnLASu6I%7Ti9B$Q1l8X@Q=82sE%{QM$z-_/e\>v"j<P]:qG!2M'ap]!6H!)3Ynk@0`f)
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 64 d3 3d c0 48 b3 07 5c a7 33 78 2f 7f c5 c0 c1 ec 21 ac a5 4a 7f c0 bb eb 11 02 3a e7 5a 7a e6 27 84 35 cd 7d 76 00 13 0c a8 18 c4 29 51 d3 9b 8e 10 06 60 8c 11 ee a8 c6 c1 c9 23 21 3c 0c 06 06 81 f1 f4 6b e1 0c c7 99 41 9c 93 c0 48 6c 55 40 dd 11 02 23 06 55 00 e3 ba 18 b7 71 79 91 17 c0 6a 71 fb ec cf fd 1c d0 fc fc cf fd 3c ff d0 1b 27 a5 b2 cc 0a 76 30 c4 5c 6c 09 f9 7b 2e 93 f0 27 40 30 06 cc 14 20 73 b5 03 1f 45 05 26 40 d1 53 bc 05 2a f0 51 66 a9 26 53 68 17 96 8b b9 1b 0c 12 eb 3c 12 80 a6 6f c4 25 ce 74 3c 5c 6c 0c 00 12 0c 19 28 4c c6 ec 9c 19 45 87 d2 36 6d 11 1e a1 ba 94 c6 65 91 70 1d fa ba 1e 1c 16 03 6e 10 21 9f 70 c8 dd 61 bb 1c 6b 20 f3 01 c9 c3 d7 06 64 e0 06 54 4d 00 57 90 49 20 4b 0a aa bc ca a3 e0 07 5c c0 bd 9e 3c ca e8 e7 d0 e1 2b Data Ascii: d=H\3x/!J:Zz'5}v)Q`#!<kAHlU@#Uqyjq<'v0\l{.'@0 sE&@S*Qf&Sh<o%t<\l(LE6mepn!pak dTMWI K\<+

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49858	123.6.18.17	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	610	OUT	GET /6d1a62e98f7abc0ea4a7ac9760cb2e97.gif HTTP/1.1 Host: ylg1.duyunfk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:40 UTC	417	IN	HTTP/1.1 200 OK Server: NgxFence Date: Thu, 02 Jan 2025 05:12:40 GMT Content-Type: image/gif Content-Length: 705232 Connection: close Last-Modified: Thu, 29 Aug 2024 10:31:14 GMT Vary: Accept-Encoding ETag: "66d04df2-ac2d0" Expires: Sat, 01 Feb 2025 05:12:39 GMT Cache-Control: max-age=2592000 X-Cache: MISS Strict-Transport-Security: max-age=31536000; includeSubdomains; preload Accept-Ranges: bytes
2025-01-02 05:12:40 UTC	1187	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 44 99 0e ad 01 00 f9 d8 d1 fe ee ad ff 89 72 00 32 ff fd d4 b0 b1 af aa d6 85 85 ff 69 58 ff fd 88 fe f2 73 94 87 84 58 44 ef b1 86 84 fb ab 8f fd 95 85 fe 53 46 fe 77 63 fc 6d 24 fc b8 a7 05 21 9a d0 ce b7 e2 29 d8 f2 b4 47 48 0c 96 fa ff 00 ad bb f0 ff 58 2a 28 7b cb f4 d3 97 ec eb eb d0 17 c2 ff 00 00 b4 5b 1a ac b6 cb 21 20 7f ff 2e 5d fb 40 f3 9b a1 63 55 6e a0 d5 0a 06 6a 64 5c ff 28 2e d9 30 30 f3 a2 dc af ae 97 6d 8a ad cf 97 31 18 4b 89 fb d9 69 22 52 94 d5 d4 f6 29 84 d5 92 00 00 2a 00 00 cf b3 ad f5 21 00 92 69 60 51 00 00 ff ec 56 dd db da fd ca 32 ee ed da 1d 6c 04 2c 2c 2e 21 63 a9 73 ef ff ce b0 8a 8d a9 d5 34 78 f7 47 cb fc ff 55 8f 68 00 00 ef b9 2f ed ed ca 84 f9 ff db ab 35 34 4f f1 af d4 f7 8a b3 Data Ascii: GIF89aDr2iXsXDSFwcm$!)GHX({[! .]@cUnjd\(.00m1Ki"R)!i`QV2l,,.!cs4xGUh/54O
2025-01-02 05:12:40 UTC	4608	IN	Data Raw: 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 52 65 66 23 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 30 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 33 35 42 33 46 36 37 45 36 35 45 45 31 31 45 46 41 35 35 36 39 45 44 32 46 30 34 37 41 34 38 35 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 33 35 42 33 46 36 37 46 36 35 45 45 31 31 45 46 41 35 35 36 39 45 44 32 46 30 34 37 41 34 38 35 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 33 35 42 33 46 Data Ascii: be.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:35B3F67E65EE11EFA5569ED2F047A485" xmpMM:DocumentID="xmp.did:35B3F67F65EE11EFA5569ED2F047A485"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:35B3F
2025-01-02 05:12:40 UTC	1536	IN	Data Raw: 6b 14 0c a4 eb b0 a7 0d 7b c1 18 fc c0 1f 7c c1 1e 3c 6b 23 30 00 1d 9c 6c 41 ba 0e 16 50 b5 2e ba a7 37 f5 a3 92 58 b7 67 d1 b4 4b 70 05 17 3b a2 cf 23 c3 de a3 c0 0d 0c c1 aa 57 c1 39 fa 0d 03 10 7a 15 9c c1 3e 7c c4 38 3b c3 af c1 05 b6 36 c2 46 cc 88 1d a0 b2 df 90 95 9c 27 c1 21 dc c4 9c 17 5e 13 9a a7 5c f0 07 a4 18 7a 72 29 2b 37 95 b4 ca 26 7b b2 22 0e eb 70 c3 1f 8c a3 a7 10 a7 12 ea 7d 5c 5b 8b 6e 20 b5 67 bc 4b b9 10 c7 b1 38 c7 76 fb c6 20 9b 0b 43 9b c7 5c f0 0d 20 fb a4 59 bb c5 67 71 c7 d6 a8 c7 e3 ff 44 c5 16 bc c6 79 99 c1 23 7c 98 1b 9c c3 82 1c b6 9c b9 6e ec 20 07 09 29 8e e3 78 b6 86 9a b6 a0 5c a8 6e 2b 9b e8 58 ca 71 1b 01 2b a0 09 7b 5c c8 95 6c 3b 86 bc c7 94 7c 3b 5d c2 05 35 78 0d 02 20 b8 0f 50 52 d8 b0 05 36 a8 49 2e 70 02 9d Data Ascii: k{\|<k#0lAP.7XgKp;#W9z>\|8;6F'!^\zr)+7&{"p}\[n gK8v C\ YgqDy#\|n )x\n+Xq+{\l;\|;]5x PR6I.p
2025-01-02 05:12:40 UTC	3072	IN	Data Raw: b0 c6 37 71 0d c5 85 14 c9 05 23 c7 8e 1c 23 1e 54 78 65 9d 38 51 19 31 6e 84 38 f3 24 46 97 0d 75 7e 1b 40 93 e5 cf 9b 32 65 52 2c b2 ee 1b 3d 3f 41 85 06 5d 99 10 e3 00 91 51 d7 89 1a 68 51 e3 92 90 23 a3 2e b1 00 05 4a 91 af 45 c0 7a 1d 6b 2c aa b8 2b 2a 2f 16 6c 33 42 94 d1 ac 51 e5 ce 15 94 34 e3 dd 95 1e f5 7a 8c d8 e6 e5 5c 90 72 7f ec 25 cc 77 6f 5e 82 c3 e0 06 66 4c b2 a1 20 c3 85 d5 4a 26 d8 46 9f 56 9d 24 35 3f f6 73 98 f2 e7 c4 8b b3 66 5d d2 c6 27 df 99 17 9b b2 4c ad 91 a2 d5 8a 36 11 e6 3c 2b 37 ae ff e3 cc 22 1d e3 6e bc 73 33 63 db 0d cf 7d f3 40 e1 41 02 02 04 1e 40 20 20 c1 79 02 09 09 a4 47 7f 4e 7d ba 74 ec d9 a1 5f d7 1e 1d 3a 12 eb db bd 27 88 50 3e c2 2a 0e ec d4 e5 ee cd fe b6 6f dc bf e5 8b 44 50 df 7e fd 01 08 14 61 eb 22 40 00 Data Ascii: 7q##Txe8Q1n8$Fu~@2eR,=?A]QhQ#.JEzk,+/l3BQ4z\r%wo^fL J&FV$5?sf]'L6<+7"ns3c}@A@ yGN}t_:'P>oDP~a"@
2025-01-02 05:12:40 UTC	1536	IN	Data Raw: b4 36 9f 92 c3 37 e4 8e d3 11 9d a6 aa 8e a5 fa 8e e8 88 00 f2 b8 c3 04 28 9b 74 3b 3c 17 64 b7 2c f4 c3 41 0c ab 6b c0 9c 09 6d 81 3c 60 c4 e5 81 ab 06 89 2b 47 8c 1e 17 80 10 0a 6a 2e 0b 60 ab 48 b9 10 17 40 81 48 f0 86 c0 12 45 1e 70 84 56 68 85 26 40 83 16 11 9f 8d ab d1 55 bc 91 56 84 9f f7 81 85 fb 51 3b 19 d0 46 5d 04 1f 6a ec 91 6e 90 01 6f 50 c6 05 b0 9f 64 5c c6 5d 64 52 19 28 c7 22 0d 00 47 38 d2 22 0d ac 3d 29 85 23 fd d1 27 fd d1 b9 73 46 0f 12 81 95 cb d2 22 ed 06 e1 fa 91 aa 8b 3a 6b a4 c5 31 dd 45 ff f0 f1 45 a5 03 c7 64 a4 52 9f 93 ae 5d f4 06 2d fd d1 e9 9a bb 5b 6c 2d 82 6c 3b 11 28 46 12 69 d3 05 30 3b 6a 08 d4 c0 22 91 b2 b3 01 b3 73 84 30 35 d2 95 73 84 2f ed 06 3b 55 46 2d d5 01 b5 1b 48 b5 2b 48 4c 05 d3 22 9d d4 2a 0d 3a 1f 10 bc Data Ascii: 67(t;<d,Akm<`+Gj.`H@HEpVh&@UVQ;F]jnoPd\]dR("G8"=)#'sF":k1EEdR]-[l-l;(Fi0;j"s05s/;UF-H+HL"*:
2025-01-02 05:12:40 UTC	3072	IN	Data Raw: 51 6f 55 60 ef fb b6 6f 55 10 04 f5 be 82 a4 c8 e4 90 6a 04 fe be 02 06 11 b3 05 61 ab 05 f9 03 2e c8 85 cb 28 55 4a 2c 82 da 74 83 3d c8 b0 75 6a 83 22 50 85 70 15 ca 2b ae e2 0d 07 65 a7 00 f0 0f d7 c8 2a ae 33 16 fe 18 2b fe bd 58 68 83 74 a5 17 fa ce e4 f5 1b 64 a7 b8 bd 2a fe 03 f3 26 57 fa 76 0a 62 70 9b 18 e3 82 65 00 70 0e 4f cb 5c 10 04 41 c8 85 20 e7 ef 21 c7 e4 1e 6f b2 71 3d 0a 3f 40 71 2b 6e 83 b7 08 14 4a fa 26 0f c7 a4 89 1d 09 9b 01 f1 2a 4f 08 bf 90 30 9e f4 70 1f 67 65 10 ef 70 66 ad e2 58 0e c4 ff 18 fb 72 a1 c4 e5 03 b0 61 2f 3b 80 70 6e cb 02 63 86 40 54 73 98 fc bf 11 e8 4a 68 75 81 ed db 00 57 0e a9 51 b3 33 3b 57 b0 ff 3b 84 ea 8c d6 43 08 67 0a 6c b2 dc 64 29 d2 1c cc 11 dc 80 36 8f 56 32 23 06 64 46 cb 20 c3 c2 f5 28 d8 82 95 f2 Data Ascii: QoU`oUja.(UJ,t=uj"Pp+e3+Xhtd&WvbpepO\A !oq=?@q+nJ&*O0pgepfXra/;pnc@TsJhuWQ3;W;Cgld)6V2#dF (
2025-01-02 05:12:40 UTC	3072	IN	Data Raw: 8f c5 f5 69 75 fd 0e 43 53 f8 18 36 d5 f0 ad 0f c6 e1 9b 58 1c c6 70 be f7 19 dc 8f b6 c8 0d 68 3b db 19 17 b8 d0 8d f8 c3 5f fe 1e 10 85 07 82 0f 7e 58 85 df 54 7e 38 09 fe c5 df d4 d0 1f 01 0a 20 c1 44 1b 95 49 c4 f4 49 5f 07 38 99 28 68 98 37 89 51 bc 70 4c f5 85 51 bf 1c 02 f5 11 1f f1 c1 8a 18 15 58 02 6e 1f f6 3d 93 f1 49 9f f4 41 20 18 f1 d9 12 bc 00 f8 95 20 f5 bd 99 3a b8 41 f6 f1 ca f6 bd 8b b2 fd 0b f5 7d 1f f6 f1 ca 08 d8 cb 37 a8 82 b5 50 0b b6 5c cb 18 94 20 83 65 df 4d 58 cb b6 50 0b 10 5e 8b 12 1e ff a0 4a 75 92 17 15 14 a9 fc c1 91 61 db 2b 59 40 a2 41 19 ae a4 d9 83 41 21 db 34 4c 2c fc 01 4c 64 9b 51 e8 83 05 b8 01 a6 01 0b b0 b8 01 59 40 21 3c d9 0a 15 92 a1 ae f1 13 52 b4 4c 29 95 1f 16 2d 81 1d 41 d9 43 50 e1 97 91 e1 de a8 03 16 02 Data Ascii: iuCS6Xph;_~XT~8 DII_8(h7QpLQXn=IA :A}7P\ eMXP^Jua+Y@AA!4L,LdQY@!<RL)-ACP
2025-01-02 05:12:40 UTC	1536	IN	Data Raw: 90 27 5b c6 47 73 f5 3f b3 b2 fd 41 97 9b ad 8f 7b 32 25 78 d9 4a a9 03 1b 80 a7 27 b3 b3 8f 63 f5 21 54 36 29 6b ee 12 8c 00 a1 bd 3f fc c7 ff fb 47 1a fc 0b 9a fc 3b da fc 13 1a 78 26 3c 2c 03 84 9f 22 50 8a 0c 2c 68 f0 60 91 11 ea c4 89 53 e7 61 44 ac 58 da 28 c5 aa 78 b1 62 bf 70 1b c3 89 db d8 f0 63 c8 8e 1d c5 7d 1b 41 09 a5 45 4a da 54 6a d3 e6 67 89 47 8e 0d 41 92 24 59 53 e6 48 71 4b 56 ba b4 48 11 e5 8b 25 1f 77 aa 54 79 51 e2 88 86 3c 8f ae fc 49 e9 8f ba 8f ea de 50 f4 79 d1 a5 b6 85 33 3b f2 ec f9 35 ff eb 06 62 1b c8 12 1b 41 f6 6c 1b 8a 13 57 7e 2d b2 6e a7 1f 94 56 e7 52 14 2a 72 5d 11 ac 28 bf c6 8a b9 51 dd 15 b2 62 37 60 b4 68 94 12 4c 8f 3d 04 71 c9 d5 03 72 2e 41 b9 b8 30 a6 3c 62 2d d2 94 15 47 a8 ea a1 4a 50 8f 5c 92 3f 43 06 ed 78 Data Ascii: '[Gs?A{2%xJ'c!T6)k?G;x&<,"P,h`SaDX(xbpc}AEJTjgGA$YSHqKVH%wTyQ<IPy3;5bAlW~-nVR*r](Qb7`hL=qr.A0<b-GJP\?Cx
2025-01-02 05:12:40 UTC	127	IN	Data Raw: be e1 a4 40 29 82 3e c2 b1 04 b9 cc b0 2d 2f 91 ab 47 d4 e1 86 19 5e 56 ae ea 50 85 52 4f d0 88 97 c6 d5 23 7d 73 69 ed 46 fb b7 c8 e2 15 b5 2d 44 09 7d c6 ea 91 9a be 27 71 e4 1b 5f 1b f6 c7 b5 be 9a 2e 71 23 f8 c3 64 1b 6b 81 e5 29 a8 18 1d 44 8a 36 f4 67 93 fe a1 a4 7c 9a 51 d0 06 fe 00 1e 0c e1 a1 ab d4 39 0f 02 57 f2 02 f6 74 c8 0d e2 db 8b 53 14 f2 17 d5 21 2f 41 7e ab ee Data Ascii: @)>-/G^VPRO#}siF-D}'q_.q#dk)D6g\|Q9WtS!/A~
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 6a 1c b7 3c f6 9d 17 42 16 29 02 1b 9c eb 15 b4 0e f6 b4 ef 3d ad 4b e9 6b bb d2 be d7 0f 78 00 a1 e0 48 ea 56 90 a8 43 1d 78 e8 92 05 2c ff 40 84 6b 9c 28 89 30 5a e2 18 65 e4 44 32 52 f1 89 2e 52 51 12 b1 b8 c5 2d c6 d1 c2 14 c0 f0 17 b1 28 24 18 3d f1 46 52 32 23 95 b2 14 81 55 10 80 4b 5d fa 92 01 c6 14 85 1a 5d 77 ad 85 73 e0 d2 36 d2 47 38 0d a0 90 81 cc d3 9f 0c 69 d5 42 19 0a c8 40 7e c3 fc 46 c0 00 4a 45 52 01 e4 50 80 3b 14 a0 c9 5d 04 22 10 4f 0e 43 2b 4e 50 87 30 04 81 94 a5 fc 02 ab 50 a9 4a 58 b9 ca 55 ad e0 05 2c d0 55 2e 5b 41 62 5a f2 94 27 0c 68 65 03 0c 60 00 16 70 86 b3 16 e8 8c cf 69 d9 73 9e df 84 d6 b4 d8 3c 4f 0c 68 e1 cd 80 a6 33 24 7a a6 4d 6c d6 b3 09 d4 dc 19 33 79 f6 50 7a 89 ac 56 11 8d 27 c5 e4 49 08 47 df 8a 57 12 85 01 35 Data Ascii: j<B)=KkxHVCx,@k(0ZeD2R.RQ-($=FR2#UK]]ws6G8iB@~FJERP;]"OC+NP0PJXU,U.[AbZ'he`pis<Oh3$zMl3yPzV'IGW5

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49877	104.160.179.196	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	374	OUT	GET /f3dab33316b44c64a6f119272fb4489e.gif HTTP/1.1 Host: 555ww666yy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	328	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 05:12:39 GMT Content-Type: image/gif Content-Length: 708549 Connection: close Last-Modified: Mon, 23 Dec 2024 08:29:11 GMT ETag: "67691f57-acfc5" psc-cache-status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2025-01-02 05:12:39 UTC	16056	IN	Data Raw: 47 49 46 38 39 61 14 05 04 01 f7 00 00 fe 01 04 fe 01 10 fe 00 00 fe 01 00 f0 03 02 ec 0d 01 d6 0b 02 e3 0f 0c ed 12 0f f2 24 0d f2 21 1d de 27 27 d7 28 10 cd 19 24 b8 1e 22 b3 20 11 b3 18 06 a1 12 0c 92 13 16 85 17 0a 82 06 02 70 12 0a 5d 15 0e 61 19 11 5b 23 1b 3f 19 18 24 15 18 1f 1e 23 24 22 3b 26 24 4a 33 2a 4f 4f 2b 53 4a 29 63 33 32 80 29 3a 8c 43 4f 6e 42 4f 59 48 53 4b 25 61 2d 2a 86 39 49 93 42 67 9e 40 75 99 56 6b 71 78 6f 77 8f 7d 84 93 8e 99 92 a6 9d 96 b1 8c 8a aa 79 74 a6 6d 5d a7 73 48 b8 7b 39 b4 8c 2d aa 74 2a 90 66 28 72 66 2c 84 4f 32 78 3e 25 88 33 21 95 48 11 a9 4b 14 b1 54 23 b4 67 12 c8 71 13 d6 66 22 d7 52 1f e7 43 31 f7 3e 37 f3 4f 20 f5 6d 25 f2 6e 09 fa 87 05 f5 92 06 f2 91 13 f0 96 2a da 90 28 d5 9b 13 e2 b1 13 ea b2 0f f6 b0 Data Ascii: GIF89a$!''($" p]a[#?$#$";&$J3OO+SJ)c32):COnBOYHSK%a-9IBg@uVkqxow}ytm]sH{9-tf(rf,O2x>%3!HKT#gqf"RC1>7O m%n(
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: ec 36 3a 9a 2b 58 5a 52 27 b5 a2 31 35 52 03 d8 2e a8 03 3f a8 43 2c 88 42 26 10 4b 42 21 54 5d 49 0c 26 60 02 cf 64 35 58 d7 55 26 60 42 b0 60 02 58 11 4d ad 74 b5 d2 6c 42 3c 1f 4d 59 3f fe 54 c4 b8 f5 55 6b 0c 28 c0 82 31 a0 03 3f 18 03 52 37 35 d1 26 2d 2c a0 c2 5e a7 c2 36 7a 96 67 b1 02 61 83 16 32 58 40 07 2f 36 d9 fd 26 b7 a5 ae 91 30 b6 64 ff c0 2d 25 03 68 55 83 05 dc d2 0f 14 09 b7 29 a5 05 64 f6 2d 51 00 68 8f b6 68 df 12 69 23 83 1f 2d 81 52 96 41 67 ef c8 7f 3c 76 6b ab b6 af ed c8 63 ab d2 0f 7c 56 81 10 12 81 f0 c1 04 3c 93 33 51 80 38 ed 00 0c 10 88 35 a4 01 13 10 14 a1 88 81 22 fc 87 37 41 93 73 13 8a 98 ec 80 65 a7 02 0c 54 d3 33 f5 93 33 f1 c1 24 1d c2 71 1b 8a 6f f7 ae 0c c8 02 67 c1 c0 32 fd 36 a6 d8 40 20 4c 52 21 0c 94 73 fb b6 18 Data Ascii: 6:+XZR'15R.?C,B&KB!T]I&`d5XU&`B`XMtlB<MY?TUk(1?R75&-,^6zga2X@/6&0d-%hU)d-Qhhi#-RAg<vkc\|V<3Q85"7AseT33$qog26@ LR!s
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 69 88 07 9f 8d 07 68 88 86 12 2b ec 15 b0 06 e2 c9 1c dd 11 6c 0f 70 da 6b ae ec 72 3c c7 dd 11 ec 65 58 1e aa 8d 04 59 a8 59 11 38 9e e3 61 33 bb 9e b3 55 f8 80 64 88 84 b2 1d c8 9c ec 1e 8c 2c 06 11 60 81 35 58 82 fb a2 5b bb 15 83 71 ad db bb 9d 83 f5 a9 49 5f 1b 1f be ad 1f e1 6e 49 c1 45 38 22 c2 8a 83 3b a2 59 53 00 95 94 9f 9c 9c 9f 97 24 b6 5f b8 49 5e 38 9f 5f 20 36 5e b8 dc f3 29 36 9a cc ee 9a 28 b5 cc e5 1f 97 38 49 13 6a 00 75 43 38 13 ba 36 59 7b 21 04 9a 21 f7 8e ca 19 a2 4a 25 e0 1f 17 3a a2 d1 48 22 31 d2 1f 78 53 ee 30 42 00 28 98 02 7a db dd 97 ac 85 b4 a4 85 5b 20 f0 df fd 5d b8 a4 9e 04 5f 70 df 2d de 04 48 38 6f 43 00 25 98 82 5b ab ef 32 ea 83 48 c2 8c 88 a3 38 0f 3f 0b 56 48 05 54 48 4c c1 d0 0b f3 65 39 96 63 4c 49 08 85 50 f8 fe Data Ascii: ih+lpkr<eXYY8a3Ud,`5X[qI_nIE8";YS$_I^8_ 6^)6(8IjuC86Y{!!J%:H"1xS0B(z[ ]_p-H8oC%[2H8?VHTHLe9cLIP
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 3d 84 20 08 bd 3d 01 32 10 09 b1 ad 06 90 d0 db b3 2d db bd 3d 62 30 e0 b5 ac fd db b3 ed dc d8 9d dd 43 b6 0c b4 ba 41 dd 7d d0 de 0d de dd 5d b8 40 b9 00 42 e9 b8 f4 b0 00 6d e0 06 27 e4 42 e4 36 43 4b 19 01 99 9b 42 6d 90 43 13 01 11 6a e4 0c f9 ad df fc 4d 13 14 77 11 f4 c6 0c ce f0 0c 88 30 07 cf f0 0c cb 90 0c 30 90 03 5b c4 03 02 91 03 3c f0 b3 34 90 06 6a 80 06 33 d0 95 5e c4 03 75 b9 d6 13 50 20 77 e9 95 5e 29 03 67 47 47 80 09 98 43 71 98 28 be bc 23 87 98 a2 50 0a cc 8b 09 a0 b0 bc a6 90 09 de 0b bd 46 21 0a 9a 10 6d 23 55 09 7f f4 47 a4 e0 bd 40 6e 0a fe 43 61 06 32 f7 15 5c c1 03 d4 39 16 67 31 49 40 e0 c2 4d 40 06 77 b1 07 82 90 c1 cb 89 08 79 00 03 33 00 d9 63 77 11 88 00 08 5d ee 75 3d 60 01 18 50 20 3a b0 02 5e 89 01 3a 50 01 6c 30 06 80 Data Ascii: = =2-=b0CA}]@Bm'B6CKBmCjMw00[<4j3^uP w^)gGGCq(#PF!m#UG@nCa2\9g1I@M@wy3cw]u=`P :^:Pl0
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 77 36 24 ef 25 71 2b 78 fd 72 02 18 20 19 2a 04 79 cd 80 06 d0 20 06 d0 40 06 d4 40 06 26 fc 0e f6 77 ed 88 97 7c 0c 84 10 fa 60 ed 3e 9c 7d 45 5c 10 1e 6b 3b 3a 6e 13 58 23 3d 6e c9 10 46 7c c4 53 84 3f 42 11 19 10 81 7b 1d 3b 11 38 44 7f 5f 13 0f 98 61 11 e4 e3 12 1c 5b 10 f8 40 10 d8 0b 46 12 61 19 38 a1 9a 44 a9 10 94 bc b0 16 98 0f 00 61 c9 0b 81 9f 22 78 ca f7 40 4a 8d fe 85 19 64 c0 11 92 8e 83 87 b8 9d ea c3 46 04 01 0c c0 00 0b c0 e0 09 0f a1 9d dc 29 41 9c 22 a2 36 64 3b dd fc cd e1 fc cd 09 84 88 2d 81 c4 be f7 ce 09 01 cf f5 3c cf f9 fc ce 23 a1 40 4c 8f 12 c8 49 d0 21 a4 d0 0f 41 cc cb 9c b1 0b 9d d0 19 7d 9d 64 ea d0 c7 1c 0c f4 69 32 0b 81 d2 2d 1d 7c 2f bd d2 d1 fc f5 90 ca 2a 0e 9d cc c5 9c 0f a2 82 d3 29 ca 9a f8 c3 6c 2d 56 14 b7 58 9c Data Ascii: w6$%q+xr y @@&w\|`>}E\k;:nX#=nF\|S?B{;8D_a[@Fa8Da"x@JdF)A"6d;-<#@LI!A}di2-\|/)l-VX
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: ac 81 18 54 6e 8e 7f 41 18 8c 01 1b b0 81 1b 0c 01 11 14 c1 12 50 6e 91 7f 01 8e 83 6e 95 23 e4 9b bd d9 de bc 4a 9e b5 ae ae 10 0b a1 d1 40 0d 9c af f1 32 81 4e 8e 6f f2 d8 2e ae e0 00 fe 06 cc 8f 0b d8 81 a9 9d 4f f1 9c 01 19 cc cf fc 5c 99 f9 90 0f f7 d6 80 16 04 10 59 16 da 19 40 6f 0d fc af a2 55 6f 0a 90 6f f2 94 c1 12 a4 4f 0a 88 c1 ac 25 65 f2 3c 5a 1d 3c ba 4e e2 c0 0c bc 80 f5 3e e5 12 00 5f 29 28 c2 0b b4 c0 0b 18 1b 13 e0 5a 56 72 d0 07 49 db 07 71 10 22 2c 83 3c a0 c1 1e 98 41 9c af 64 c6 e5 8c d5 1e 30 35 c0 03 3c 50 c3 64 d6 50 10 c5 c1 06 bf c1 1b 38 c3 33 78 c2 a0 6c 42 24 40 43 1c cc 43 1b cc 77 29 ba 01 1d d4 75 d1 24 02 21 f4 41 be d8 41 33 30 c3 33 24 f0 65 f2 10 0c cf 30 66 56 8c b7 db 20 1a e1 f0 67 3e a6 43 6c 04 55 8f af 4e f6 a2 Data Ascii: TnAPnn#J@2No.O\Y@oUooO%e<Z<N>_)(ZVrIq",<Ad05<PdP83xlB$@CCw)u$!AA303$e0fV g>ClUN
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: b4 a1 49 19 47 fb f3 b4 5c e4 ac c1 9a ab b9 1a ba 1c 1b b8 6c f4 2f be 8c 03 46 1b 4e e0 09 51 00 4c 2a 48 82 f6 89 60 02 f8 b7 81 f3 1e 24 98 02 5a c3 84 48 a2 04 0e 06 a2 4c a0 1c 69 d3 84 c6 c1 84 50 68 f5 c7 d3 04 51 88 75 dc bc 0c ce ac f5 6a c3 75 d9 59 66 1f d6 e1 dd f1 f5 63 f6 75 5f ef 75 da d1 9d 5f 37 b0 a1 db cd c1 dc 1e 29 48 02 ed 41 62 26 c6 37 7d 8b 02 7c 73 b7 27 96 37 04 78 b5 b9 71 60 04 38 82 4c 77 e0 82 03 b8 c1 e4 76 b8 f9 83 b3 e1 1f 89 06 63 52 1b 8c 63 d3 9f ff c1 20 c2 61 a1 02 32 b9 79 a7 f7 7a 97 20 0a 02 e4 00 02 85 5e b0 f7 7e f7 f7 93 cb 77 40 de 77 75 c0 1a 1c ca 1a 1c 22 05 e0 29 ba 52 58 05 83 3f 05 48 3e 50 53 50 85 66 28 22 23 12 83 33 f0 81 24 8a 00 06 b8 80 26 ba a5 57 98 05 67 86 57 5a a6 22 33 b0 3a 21 58 86 fe c4 Data Ascii: IG\l/FNQL*H`$ZHLiPhQujuYfcu_u_7)HAb&7}\|s'7xq`8LwvcRc a2yz ^~w@wu")RX?H>PSPf("#3$&WgWZ"3:!X
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 20 0b c0 2e ec c1 4e ec c3 6e ec c5 8e ec c0 ce 0b c9 03 ec 6d d3 ec dc e3 ec c9 b3 ec 6d 33 ed c4 4e ed d6 2e 0b c6 e0 0e ea e0 0e ed c0 0b 9c 00 82 c8 92 4b ee c3 2c b9 55 40 24 78 5c 4c 66 8a 8f c2 bb 4a 4a 5e 9c e9 89 3f b6 5c c1 24 c9 f8 97 36 38 36 ef f5 5e 8a 46 c6 ef f8 ae a4 4a 56 ef 8d ce 63 b9 05 66 9b d3 8a be 45 5e a8 83 af be a5 35 bb 45 62 bb 05 64 0d f4 f0 da e2 f0 eb 65 f1 c7 e8 65 70 b6 5e 83 16 3e da f8 66 78 f6 f1 0c bd 31 1a 04 41 34 d6 41 fd e3 40 27 ef 3f 94 06 36 ab c3 68 89 f6 f2 95 16 0b 27 3f f3 91 a6 40 0f d4 41 1d 84 8f 94 96 41 fe fe 83 6a ab 50 41 19 24 0b ab b0 8f 3f bf 40 1e 34 f4 a2 46 6a 26 6d d2 fe 08 d3 6d 83 f4 2a ad f4 31 0d 43 34 1d d3 32 7d b3 0d 29 11 31 e4 6a b1 76 91 3d c4 b3 16 b9 11 44 1d 12 d1 e6 91 20 d9 6c Data Ascii: .Nnmm3N.K,U@$x\LfJJ^?\$686^FJVcfE^5Ebdeep^>fx1A4A@'?6h'?@AAjPA$?@4Fj&mm*1C42})1jv=D l
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 31 e3 e7 68 49 df 7f 8e 15 16 21 0d 96 c1 18 b2 ca 17 76 e1 10 1c 01 11 46 d4 05 2a d9 96 ae 61 4c 34 78 e0 59 21 19 60 60 19 ea 00 05 52 c0 06 a2 e8 1a ea 20 98 83 59 07 66 e0 2c 6e 80 95 39 20 07 38 80 95 d7 ae c0 ad 89 04 40 00 07 ae c8 03 30 e0 03 64 a0 04 4a b4 44 c7 43 9b 6a de 04 46 fe e2 92 43 07 74 20 90 56 a0 05 68 54 0d 98 00 0a b2 20 0b b0 20 0b a4 a0 09 e4 80 fe 11 3a 61 12 0e 01 97 eb e0 11 9a e1 0d 36 6f 41 20 6a 49 bd b9 a1 c8 d4 9d b9 54 4b 3f 00 1f 6c a0 09 e6 e1 1e ee e1 03 d6 5e 48 84 e4 1e 50 2f 9d ed e1 06 78 e0 8b 02 01 f6 20 e4 a4 36 8f eb 19 24 0e 40 81 05 ea 89 11 16 e1 11 1e 01 11 da 03 10 f2 20 0f c4 80 0d 82 c0 08 4c 42 09 96 80 0c d0 23 9e fe 6e 04 80 46 b7 af c1 0e 36 3f 1b be 01 68 66 a1 64 8f 81 17 da 24 fc 58 80 05 00 49 Data Ascii: 1hI!vF*aL4xY!``R Yf,n9 8@0dJDCjFCt VhT :a6oA jITK?l^HP/x 6$@ LB#nF6?hfd$XI
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 05 58 90 06 e8 c0 07 c8 c0 0e e8 1e 15 51 d1 07 90 80 52 28 85 57 c4 40 0b c0 80 65 d8 42 2b 94 c2 2c 64 82 26 b4 c2 2d dc 42 30 84 02 27 84 82 30 74 c3 37 64 6e 39 94 03 21 c1 ed 1c fe cc 81 f7 79 01 53 06 c1 3b b3 a9 29 b8 99 9b 82 16 29 5c 56 fa 3d c3 74 68 74 3e bf 9f 9e 92 07 9f f2 3d a0 86 c7 48 81 07 49 ed 94 79 10 fe 2b 58 34 1c d0 29 00 22 e0 43 27 a0 ca ba c2 2c d0 94 2b c8 82 3d bb c7 4a e1 bd fb 51 60 23 c8 42 53 a9 58 53 65 e0 02 24 c7 88 fc f4 11 a8 60 ac 72 95 0d 92 08 4b 0b 40 e9 83 15 98 1f c1 90 d8 f4 ea 3f 07 12 30 89 8d dc 95 4f 4f 81 ee eb 7e 49 ef f4 ee 47 81 72 b8 c1 75 e8 e9 65 11 3f 2a 5c 56 2f 64 2e 31 cc 42 5f cd 82 3a 1c f8 dd 0a 03 97 5c 38 31 04 43 30 90 49 3a b4 43 75 74 96 15 76 7f 67 41 42 1b b6 6e a1 6c 62 a4 8c bf 34 1e Data Ascii: XQR(W@eB+,d&-B0'0t7dn9!yS;))\V=tht>=HIy+X4)"C',+=JQ`#BSXSe$`rK@?0OO~IGrue?*\V/d.1B_:\81C0I:CutvgABnlb4

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49878	104.160.179.196	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	374	OUT	GET /dd611258bd2c4f1a9cd4bcf648f7ef2e.gif HTTP/1.1 Host: 555ww666yy.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	329	IN	HTTP/1.1 200 OK Server: nginx Date: Thu, 02 Jan 2025 05:12:39 GMT Content-Type: image/gif Content-Length: 1023445 Connection: close Last-Modified: Sat, 21 Dec 2024 09:32:40 GMT ETag: "67668b38-f9dd5" psc-cache-status: HIT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Accept-Ranges: bytes
2025-01-02 05:12:39 UTC	16055	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 fe 01 00 ff f5 70 b0 8f 21 d5 ac 95 fb d6 b2 fd b3 b3 60 8d 54 69 10 68 ff fb 8f fe f1 d2 25 00 01 8d 0e 5b ef ab 6a fc da 6f fa b5 91 d7 90 27 f9 d6 91 d6 91 06 fe f7 b2 4f 62 a3 b3 d0 f9 85 25 84 fc d8 d3 f8 95 28 fd 51 50 db ba 46 9b af f4 d5 01 03 b7 69 05 dc 53 31 24 52 26 d6 8b 6d b4 6e 27 ff cc 2b 0f 24 70 f4 52 26 fb 95 49 d6 ac 2b 2b 53 53 d6 ab 0b 0d 00 01 9f 52 9d b1 01 06 f6 92 6e fb 93 8f fb 2a 29 2e 4b 9b d5 b2 6d d5 92 4b fe f1 50 4f 11 91 70 95 f5 00 10 fa 00 53 ff 92 4e 27 02 23 8f 5f 96 93 fc 70 6d f9 47 10 b3 6c 4a da bb a4 d5 98 86 90 70 2c d5 b6 d7 d3 6f 4e b3 91 6f 02 22 b2 d1 73 07 a4 d8 b2 70 6c 4c 57 6f e6 4d 4c 28 8b 91 6f 03 22 d5 fa 29 0b f9 6d 4d 8c 8f 47 94 01 02 49 01 01 f3 93 09 d3 73 Data Ascii: GIF89ap!`Tih%[jo'Ob%(QPFiS1$R&mn'+$pR&I++SSRn*).KmKPOpSN'#_pmGlJp,oNo"splLWoML(o")mMGIs
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 55 14 8c 81 00 2c 6a 2b 20 55 52 31 c1 08 e8 80 21 60 e7 1e 90 01 22 0c 02 28 70 82 00 30 58 2f 08 00 35 70 82 8a fe a5 e0 dd a4 1c 52 4f 03 c8 a7 74 50 e9 5d 08 25 18 5c 04 14 f8 13 52 08 07 0f 34 40 14 b4 16 1c 94 00 0c e4 c0 0a 68 16 e0 60 40 22 b4 40 2d 24 19 92 35 e8 2b 28 01 00 fc 01 11 98 42 1b 80 02 22 c0 41 14 ec c1 ae 12 e8 11 80 e8 1e 20 c2 36 b4 25 59 fe 01 1b ee 01 35 80 83 21 f8 e8 9a 65 82 37 78 83 a9 a6 d3 1e a4 83 72 e2 42 14 d4 43 4c ae 93 00 08 ff ea 05 30 81 2d b4 82 39 50 41 09 3c c0 13 6c 43 a4 ae 99 38 84 80 8f ee 01 5c a2 80 00 70 80 0d 69 e3 64 72 4d d7 49 69 f1 45 a9 c4 4a 01 1a f8 00 de 80 00 14 60 2c 08 6c 07 01 cc 83 9f 12 01 0e 64 00 1b 68 56 0e 00 c1 12 64 17 1f 1c 5c 07 b4 c0 08 20 d9 83 b2 25 44 8e 41 15 c8 63 9f 46 41 17 Data Ascii: U,j+ UR1!`"(p0X/5pROtP]%\R4@h`@"@-$5+(B"A 6%Y5!e7xrBCL0-9PA<lC8\pidrMIiEJ`,ldhVd\ %DAcFA
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 7b c0 39 85 06 88 f0 6a 7b 18 c4 20 8e a0 87 32 78 00 cd 47 18 04 22 8e 21 00 12 74 80 0f af f0 c6 d5 64 3b 0f 0c f0 a1 05 c8 1b 01 a0 a9 a0 8d 17 c8 d6 b6 23 00 00 00 46 90 81 e8 8e 8a 8a 6f f5 01 15 5e 91 81 c8 a1 e0 08 d5 a8 c2 8d 33 60 8b f1 92 e0 15 9e e0 06 15 b7 e0 03 51 6d 21 0a 15 0b 84 92 b7 c0 84 12 40 a1 72 2f 53 29 b1 86 a5 c6 2d 06 60 9a 04 84 23 b4 10 c0 83 1d 80 01 0a df 0c 43 01 7a aa 88 01 dc 62 1a 51 d8 82 3e 8f ad cf 23 30 21 0a 3e 48 41 10 74 27 80 0c b4 80 0f 00 50 02 43 8f d0 62 01 54 e1 02 1b 78 c5 06 00 ff f0 6d 18 3c f7 08 3e 00 01 0c 74 f0 6d 20 07 22 a3 83 30 c0 20 40 41 69 17 f5 42 de 02 18 01 09 10 e1 29 01 5c e0 bb c5 5c ae 8b 98 40 05 12 08 60 d3 d7 e3 d1 11 04 20 aa 3d 28 fc 18 19 a8 9c cb 22 ae 82 1e 20 00 a6 56 be 75 7b Data Ascii: {9j{ 2xG"!td;#Fo^3`Qm!@r/S)-`#CzbQ>#0!>HAt'PCbTxm<>tm "0 @AiB)\\@` =(" Vu{
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 10 d8 c1 19 60 29 4b 20 28 e2 03 0e 08 c4 11 f6 a0 07 01 98 83 01 ee a8 c9 12 96 30 04 0c 14 33 0e 8c e0 83 ea 94 f0 87 43 f0 c2 11 7a 00 c5 1e 40 d1 09 4b 64 d1 12 51 b0 04 13 2e a0 84 0d 00 e0 0f ad c8 57 2b 4a d0 0a 49 ca a2 04 25 f0 c0 4a 7a 21 8e 3c 1e 43 00 55 90 54 2b 46 f0 8a 07 d8 2b a7 02 e0 c4 05 ae e1 47 4b 84 c0 10 24 19 c4 c1 56 b2 87 21 04 14 2a 4e 51 c1 1d de 00 ca 00 94 82 17 a5 ff b4 18 2a c1 42 ca ad 8c 22 94 7d d3 05 1d c0 00 86 58 be 12 08 50 a8 65 35 f6 60 00 53 1c 02 0c 39 f8 40 0e c2 10 06 98 c4 81 a4 69 30 26 ea 5e 01 03 63 e0 90 28 65 d8 c2 1e 72 09 02 28 94 00 6d 10 b4 dd 03 5a d1 0a 9d 5e 40 00 b8 d8 83 00 9e e0 46 76 b4 c2 16 02 d0 81 12 9e 20 80 0b 3c 81 50 c7 c0 85 2c 22 70 41 1d 9c a0 04 b0 3d 93 12 84 8a 8b 56 fc c1 9e 83 Data Ascii: `)K (03Cz@KdQ.W+JI%Jz!<CUT+F+GK$V!NQB"}XPe5`S9@i0&^c(er(mZ^@Fv <P,"pA=V
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 70 73 09 1d 00 42 1a 30 d0 81 44 ae 92 a7 c3 93 58 ad 04 1a 50 7a 4e 6c 03 46 b5 a4 2b 8b 7a d4 78 26 d6 86 63 19 8b 54 d8 c0 88 38 d0 81 0e 3b 78 01 04 e4 c0 85 52 48 40 a5 6c 3d 69 00 79 d2 00 02 b6 c4 17 1f 35 1d 1b 0f d5 a7 3e 7d b6 b5 ad d5 45 66 21 10 53 99 2e 21 11 54 c0 e9 2b a8 a8 2a c4 22 f6 92 89 0d aa 3e 83 6b d4 e1 29 81 0f 3a 68 01 4e a5 0a 48 d9 ca d5 b5 6c 45 c0 67 d5 aa 0b 62 16 d0 98 e4 52 60 5a 75 51 8e 06 94 14 ba de 35 a9 d4 ba 0b d6 f1 96 d4 b3 9d 3d af 2e 38 04 5b d8 ca 76 9b dc 5c 01 57 a8 60 57 9c e6 54 af 54 04 27 15 81 37 02 1d e0 14 a7 4b 90 ef 12 48 00 03 12 30 c0 01 f3 d8 26 04 e4 4a 80 af 42 d7 ad e3 85 ae 78 21 2c 61 f0 96 34 00 db 6d 80 58 3d 6a 4c 0a a1 35 27 16 2e 47 39 c8 fb 60 0a 83 37 c1 10 60 af ff 5c 4d 9c 5e 06 9f Data Ascii: psB0DXPzNlF+zx&cT8;xRH@l=iy5>}Ef!S.!T+*">k):hNHlEgbR`ZuQ5=.8[v\W`WTT'7KH0&JBx!,a4mX=jL5'.G9`7`\M^
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: e0 5e d1 77 19 69 84 0e 98 d9 4f c5 b3 32 7a ad 70 bf 1b 03 68 fd 14 b8 89 47 22 64 33 6a a2 88 dd a3 40 ef 7a ae b8 3e 1b af 7f ff 0a b2 01 83 92 2b 7b 09 89 10 7e 82 ff 6e 46 7a 9f 1b 00 1b 38 77 ff fd 9f 00 7e db b4 e9 9c d0 19 9e 01 f2 df 55 8d 92 72 08 d5 0a 7c cb b7 7c 1f fb bd 1f 05 ba 5e 0f 38 00 06 89 dd c3 31 8a ea cd 1a 56 54 20 08 aa dd fb 89 20 57 7c 1f 03 88 e0 67 79 dd 12 10 98 6b 2d c1 ee b5 40 fe 29 98 f0 bd 02 83 29 81 0d d2 20 0d 0a 9f f0 29 18 55 61 40 07 60 00 14 d4 0f 09 ac e0 03 ae 80 f7 69 5f eb 89 20 08 b6 9e 8a 80 ff e0 d7 05 40 39 34 40 39 94 42 3c b8 ce 2a c4 40 39 60 21 04 7c 96 fa bd 1e e8 a9 1f fb a9 c8 67 7d 56 56 90 e1 7e 2c 61 37 f4 c0 0a 80 9e 19 4e 60 56 7c 00 09 84 41 0e 2c 41 f2 c4 df 0a cc 9f 92 8c 61 57 68 df 0b a8 Data Ascii: ^wiO2zphG"d3j@z>+{~nFz8w~Ur\|\|^81VT W\|gyk-@)) )Ua@`i_ @94@9B<*@9`!\|g}VV~,a7N`V\|A,AaWh
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 28 00 16 a0 d8 20 64 02 0f 55 01 09 70 9d 17 0c 1c ab 75 a0 0a 44 c2 0b f4 58 00 04 40 ac 31 5c 61 41 51 18 0c 5f 99 bc 48 17 f4 40 01 b4 57 19 48 0f fe f0 1b f9 94 8f 07 e8 81 ef 1c c1 34 90 00 98 3d 1b 22 14 9e 36 28 c1 2b b4 00 b8 51 81 11 de 94 34 74 95 f4 3c c0 2b 78 ff 02 00 50 41 15 30 57 5d 09 e0 6e 35 dd 2b f8 5c 41 45 41 03 50 61 15 40 da 11 64 83 27 6c 80 12 3c c3 fa 0c 82 14 b4 02 f3 f8 40 0d 59 42 14 6a 55 15 c0 00 14 6c 1d 00 79 94 ae 7c 17 78 05 80 c9 38 84 09 4a 41 a3 28 c2 88 f8 05 01 9c c6 00 10 40 06 2c 4c 1d 88 5e 14 2c cc 16 b8 c2 e8 b1 84 f9 71 03 00 a0 d6 08 98 03 5a 45 c1 16 bc 40 06 2c c1 fa 6d 00 00 74 22 15 64 40 06 8c de 0e f8 80 39 ac 5f 27 5e 80 21 14 d4 11 08 00 fd 48 61 0f a1 9b 2d 98 43 0b 98 83 07 60 9d 00 5c 80 00 ec 50 Data Ascii: ( dUpuDX@1\aAQ_H@WH4="6(+Q4t<+xPA0W]n5+\AEAPa@d'l<@YBjUly\|x8JA(@,L^,qZE@,mt"d@9_'^!Ha-C`\P
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 4c 21 17 f6 80 02 4b 38 c0 2a 78 60 21 1e f3 78 0c 22 38 e0 74 22 cc 23 20 f3 68 00 07 d0 01 08 58 50 40 0b 57 00 05 20 28 82 04 4b 5c 21 0a b0 28 42 2c 38 40 22 ac 00 dc 1b da 85 35 78 6d c8 24 f4 fa 9a f3 aa a1 8b 2c 88 68 07 be 81 41 a5 2e d5 03 39 e4 a2 19 75 30 c1 f9 cc 67 09 44 0c c2 ff 7c 65 10 df 15 5e 00 86 37 dc 81 0d 8a 20 00 fe ba 57 3e f0 0d d3 12 47 38 26 28 1c b0 02 99 84 61 05 53 b8 82 08 2d c1 85 2b 70 01 09 2c 0c 1f 22 ca 70 04 44 1e 83 26 04 10 c5 1f 01 a9 00 0e e2 a2 7c 1e 78 04 03 e0 85 05 11 32 81 00 55 c4 41 11 0c 20 88 32 5c b3 0b 1c 44 02 16 6e a8 49 77 e1 70 07 1b 9a c6 49 a2 01 4a 87 41 20 88 03 18 22 10 30 45 c8 24 02 81 01 41 c0 62 1d a6 29 ad 69 4a b4 9a 75 a8 a2 e1 b8 30 99 17 14 60 05 72 6b 43 11 b8 f0 02 1e c8 4e 0e 3c 20 Data Ascii: L!K8*x`!x"8t"# hXP@W (K\!(B,8@"5xm$,hA.9u0gD\|e^7 W>G8&(aS-+p,"pD&\|x2UA 2\DnIwpIJA "0E$Ab)iJu0`rkCN<
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: d1 a0 eb 45 7c 6a 00 1b 6f 00 02 18 80 17 08 02 ef 7a 29 61 55 e0 f0 72 00 22 e3 82 b4 93 00 4f 9c d5 cc 9a 90 f5 74 fb 4b 50 85 4b 90 09 2e 80 00 08 b8 7c 2e 28 05 2e d0 05 ca ba 2b e6 30 03 d2 8d 2b c4 e7 02 47 64 19 22 73 00 3c b8 02 c6 ca 04 df ec c9 a9 0f c1 10 c4 82 2a 28 00 39 c0 02 39 c8 04 44 d8 82 ff 1e 78 78 ff f6 73 16 80 04 2e 30 cd 29 10 e3 7e e7 e0 37 68 02 15 50 fe 26 00 02 91 27 74 84 48 6c 7c 41 86 e1 18 c2 dd fc 80 1d 80 81 e5 2d 48 1e 60 81 30 60 01 2e d0 b5 23 40 e8 22 e8 d6 23 b0 84 3a b0 04 26 b8 00 08 70 85 37 78 c9 37 f0 02 36 58 81 06 08 87 22 28 03 fc 05 85 f4 0f 47 06 00 88 0f 74 2e 81 b9 44 87 cd 07 35 96 2c 5d 61 e1 e0 0a 92 88 4c 82 44 44 82 87 c7 80 2b 10 78 bc b8 f2 f0 ca 15 2c 41 82 30 61 52 84 0b 8c 20 03 b0 0c 3a 72 65 Data Ascii: E\|joz)aUr"OtKPK.\|.(.+0+Gd"s<*(99Dxxs.0)~7hP&'tHl\|A-H`0`.#@"#:&p7x76X"(Gt.D5,]aLDD+x,A0aR :re
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 02 26 f0 e3 37 78 83 4b 68 82 4b 70 e7 2a 08 02 c7 52 73 c7 12 04 77 ee a6 99 64 81 1c c8 81 1e 40 01 14 a8 82 15 28 80 23 30 74 46 67 74 39 18 00 08 68 83 41 e8 85 41 38 06 4b 3f 86 46 47 81 22 70 80 b5 d9 03 14 a8 03 7c 9d c9 30 80 80 22 40 81 5e c0 03 14 c0 05 25 0c 03 7a 5d ca fa 7e 83 f9 ec 01 69 90 e5 3e 1b c8 16 72 0c 5a 95 21 81 b3 46 1e 98 28 20 98 c9 d9 33 11 0d 68 06 42 40 84 23 b0 04 85 2c 83 44 b6 84 22 28 83 af 71 00 3a a8 73 1b 78 01 24 b0 84 32 48 24 6c 2f 03 50 d8 02 4b 70 84 32 90 83 0f 18 74 b3 c3 02 14 b0 84 2b 00 bb 3a 40 81 63 40 76 50 d0 03 75 7f 81 97 2e f5 4c 67 74 5c 58 f7 3a 78 81 26 48 34 14 d8 02 5d 50 84 d2 9a d0 32 30 f5 22 a8 74 2c 60 85 48 70 4a fa 66 ca f9 66 80 dc 21 ed 2c a5 24 2e 3d e3 ff 67 b5 8c d8 b0 dd d9 e3 9f 7e Data Ascii: &7xKhKp*Rswd@(#0tFgt9hAA8K?FG"p\|0"@^%z]~i>rZ!F( 3hB@#,D"(q:sx$2H$l/PKp2t+:@c@vPu.Lgt\X:x&H4]P20"t,`HpJff!,$.=g~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49865	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	367	OUT	GET /i/2024/10/28/10ss8i9.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	594	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 86874 Connection: close Accept-Ranges: bytes Age: 12972 Cache-Control: max-age=43200 Etag: "671f9ec8-1535a" Expires: Sat, 01 Feb 2025 01:36:27 GMT Last-Modified: Mon, 28 Oct 2024 14:25:12 GMT Vary: Accept-Encoding X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: b19232975c92cd21ee64b1e751fa3b14 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache05.hnlycm01 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:39 UTC	15790	IN	Data Raw: 47 49 46 38 39 61 18 01 18 01 f7 00 00 00 00 00 ff ff ff f4 91 94 d8 a8 aa c3 a8 a9 48 38 39 8c 30 3a 9a 3a 43 b6 87 8d e8 0e 2f 88 15 2a ed 74 89 e8 20 48 38 08 11 a9 29 41 78 28 38 df 58 73 f2 98 a9 f8 a8 b8 4e 08 17 71 14 28 9a 15 37 e8 a8 b8 53 18 28 ef 3c 71 f8 c8 d8 ca 97 ae 28 08 18 f8 08 9d d8 a8 cb f7 0b c8 d8 58 d2 18 08 18 f8 e8 f8 2c 18 2d 39 28 3a 9c 33 a9 b8 68 c6 b9 79 c8 ae 58 c8 d8 b8 e2 a1 54 bb bb 68 d9 c4 a8 cf e1 c8 eb 8a 45 a7 a8 68 c8 ba 78 d8 cb 9e e0 bd 7f e4 e8 d8 f2 a8 68 d8 a7 78 c8 89 50 b9 a8 78 da 53 4c 5a a4 8a db 7c 6e bf 08 08 4a 08 08 18 28 28 38 c8 c8 e2 e8 e8 f8 38 4a 97 87 96 cd 08 1d 64 17 35 85 5a 6f a9 b8 c0 d7 a6 b4 d6 cd d8 eb 8c b4 e8 b6 cf e8 69 af e4 0d 5f 98 14 82 b4 8a cc e7 17 a1 d0 b8 e8 f8 4c c8 ed 98 e8 Data Ascii: GIF89aH890::C/*t H8)Ax(8XsNq(7S(<q(X,-9(:3hyXThEhxhxPxSLZ\|nJ((88Jd5Zoi_L
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 2c 32 24 4f 42 25 70 b2 28 8c 42 24 83 b2 28 00 c0 24 90 b2 28 40 42 29 a0 c0 fb c5 9f f7 18 9c 0d 0f d8 a0 b1 e4 81 85 62 28 f6 ae f7 d4 70 0d 63 cf a8 f2 f2 8e ea 68 4b da 32 30 1f f1 11 0b c3 56 31 b1 75 35 b1 a7 12 ac 55 f1 83 24 ac c3 3e 24 91 3f 88 c3 32 f0 67 18 c7 d7 d6 de 1f 9a 6d ed 16 87 2d dc c6 17 5b 11 43 35 50 03 50 01 95 83 0a a4 79 cd c2 1d 32 ad 1c e7 31 64 1e 02 1a f4 c3 de f6 ff 43 69 fa 03 3a 14 c0 f7 ca 82 b2 a9 21 3c 09 1c 8c fa 59 f6 f8 00 24 0c 34 41 17 b4 41 1f 34 42 27 b4 42 2f 34 43 37 74 41 97 82 fb b9 1f 3c 18 5a 02 a7 6a 03 56 a2 03 f6 b2 e1 d9 68 0d c7 b2 25 f2 32 0e df e8 4a 02 67 28 96 2a 3d e0 82 3d a4 c3 5e 15 00 d4 c6 02 12 f5 2d c1 b6 26 c1 de 97 38 14 51 3f 68 81 3f 30 83 dd 11 24 66 aa af 20 ba 6d d8 a2 6f d8 1e 83 Data Ascii: ,2$OB%p(B$($(@B)b(pchK20V1u5U$>$?2gm-[C5PPy21dCi:!<Y$4AA4B'B/4C7tA<ZjVh%2Jg(*==^-&8Q?h?0$f mo
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 63 6a e1 2a 9d e4 b8 25 64 7f 85 64 19 96 58 54 cd 64 7d a8 07 4f 40 a9 a7 82 1e f0 75 e0 75 18 c4 c0 9d d0 09 ad 0c ad b4 a1 1d 11 07 19 5b e5 86 8b be e2 74 dc 28 c6 d3 45 ac 5f 5a 36 3f 5c fe 97 67 f5 17 a7 d0 e2 c6 7b b5 00 89 1d 43 90 29 0a 75 d0 18 0d 30 d8 b5 4d 06 72 1d 07 82 2d 05 6a 86 72 90 31 57 58 cc 4a b6 e1 e0 a5 cc 71 c4 2d 6d 96 db 00 35 64 71 26 d8 44 ae b5 d3 d8 1d e5 6d e4 97 ff 7e e4 73 4e 4f 9f 56 69 18 ce 07 4f c0 2d 7d 70 05 c0 31 d3 74 50 d3 d6 0d e2 11 08 5c 06 12 41 08 15 41 48 cd ce 58 e8 05 61 78 06 27 de d9 c7 e1 6a 6b 95 e2 e3 4c 51 2a ab 06 ce 68 06 5e 2e 14 c7 ab 68 67 60 06 f3 1b 06 82 42 07 c3 e4 ca 02 e0 68 db ac 50 c5 11 65 1a ca 8c b2 d6 e2 3b ae 48 6b 30 06 55 d8 29 da 20 61 45 56 c6 b9 2d 6c 24 f5 60 36 0c 53 0d 6c Data Ascii: cj%ddXTd}O@uu[t(E_Z6?\g{C)u0Mr-jr1WXJq-m5dq&Dm~sNOViO-}p1tP\AAHXax'jkLQh^.hg`BhPe;Hk0U) aEV-l$`6Sl
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: e9 32 9e e8 88 5e e8 32 6e 03 55 00 08 80 90 eb bb 1e 08 55 a0 06 80 20 05 ba 2d 08 83 20 08 c4 7e ec 6e 70 0f 09 90 00 18 40 0f 80 6d 05 82 e0 06 a1 10 01 02 10 01 d6 1e 01 18 b0 ec 0c a0 ed d7 de ed db 9e 00 df 8e 01 dd 4e ed ce ee e6 6f 70 0f 16 b0 ec ea be ee ec de ee ee fe ee ec 5e 0f 6e c0 06 6d 40 ef 7e 40 ef 6c 90 ef f7 ce 06 fb ce ef f9 ee ef fd fe ef ff 1e f0 fa ce ef 7e 70 f0 08 ef 07 6a e0 07 80 00 ec 6a e0 f0 ba 1e f1 12 0f 08 81 40 f1 bd 1e 08 81 20 05 19 af f1 18 5f f1 13 ff f1 1f 0f ec 6d 00 08 23 0f ec 82 20 f2 0d 3f f2 0d 1f f1 c0 0e f2 20 5f f1 1e df f1 32 ff 2f 05 bf fe f0 73 30 07 b9 5e 05 38 5f 05 3c df f3 3b 5f 05 1e ef f2 24 ff 06 6c 60 05 c9 2e 00 cb 0e 01 6e b0 f4 4c df f4 4e ff f4 50 0f f5 f7 60 05 ba de 06 6e d0 0e da ce 00 db Data Ascii: 2^2nUU - ~np@mNop^nm@~@l~pjj@ _m# ? _2/s0^8_<;_$l`.nLNP`n
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 7d db f1 c1 0d da 40 0d fc dd 0f 0c dd d0 13 dd 0f 12 9d 0d 0a fe e0 0d 5e e1 15 be e0 1b be 0d fc 00 e2 23 1e e2 db 00 10 d4 40 0d aa 1d e3 33 5e e3 a5 1b c9 a7 9b ba a5 40 0a a0 3d e4 a9 3b e3 05 a1 da 4d fe e4 53 3e bf 4d de e4 29 7e a1 ad 7d a1 d5 e0 e5 5d 1e e3 51 de da 37 3e ba 09 9a ba 75 9e ba 3f 3e 10 2a de e2 91 5d d9 85 5e e8 97 5d d9 e7 60 d9 9b 7d e3 33 de 0a ee 01 14 16 80 de cf 7d 01 dc 80 ea cd fc db dd 00 ea e9 3d ea a9 fe ea a9 1e 03 b4 9e de a7 9e eb cd fc 1e ac 80 e2 d9 c0 0d da 21 ea cf 1d 1e b8 de ed df 1e ee e3 de 0d 04 40 dd f7 dd 0d 2e be e2 fd 40 0d ff f4 be e1 d3 c0 0f d2 80 0d fc 1e f0 05 3f f0 0b 3f 0d 0e ff f0 0d 1f f1 05 ff ef 1b 5f e2 f9 de e2 f5 fe e2 2d 1e ef 97 be da 7f 1e c9 45 5e f3 49 7e e9 2b 1f e3 27 1f e8 2b be da Data Ascii: }@^#@3^@=;MS>M)~}]Q7>u?>*]^]`}3}=!@.@??_-E^I~+'+
2025-01-02 05:12:39 UTC	5548	IN	Data Raw: a8 40 0c dc fb cc e7 fb b4 9b 7b b4 db 7b 9c f7 7c c0 f3 fc b5 cb b9 bd cf 39 9f af 80 81 cd 84 00 7d 65 fd 0c d1 21 bd 04 2b 22 bb c8 83 7d c8 07 bb e4 c1 44 55 ac 02 e9 91 5e d8 87 bc 23 79 0c b1 38 e6 44 37 26 5d 98 3b bb af 3b b9 1b 7d 09 0c 3a be e7 b9 b5 9f 00 a1 6f bb b7 87 fb cf e3 f9 0c 90 3b cf 1b 3e c0 c3 3b e2 f3 b9 b6 0f 7a cc c7 7c b7 f7 f9 0b f4 f9 b4 d7 b9 bb eb 3c b4 e3 79 bc 8b 7b e5 13 7c 9d d3 3b e6 9b 80 12 57 9b 5c e8 72 71 39 e6 2b b9 4d d9 e3 c2 b8 7c bd da bb be ef 6c 82 d0 12 0c e9 cd 43 44 ba 3e 9a 1f 08 da ef 6d 63 ea 72 63 82 4c 22 7c 02 e2 8f 7b ff 09 c0 80 0c 18 ff f1 b3 00 0b 18 7f f2 2b ff f1 cb 00 0a e4 bd 9f a7 c0 0b 04 40 f5 e3 fd 09 90 00 0b 54 3f 0a 90 40 df 6f 7b e0 a7 80 09 54 7f 00 bc 00 e1 bb c0 cd 13 7e fa c7 b9 Data Ascii: @{{\|9}e!+"}DU^#y8D7&];;}:o;>;z\|<y{\|;W\rq9+M\|lCD>mcrcL"\|{+@T?@o{T~

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49868	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	368	OUT	GET /i/2024/12/05/1300-200.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	591	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 199338 Connection: close Accept-Ranges: bytes Age: 4 Cache-Control: max-age=43200 Etag: "67516cd6-30aaa" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Thu, 05 Dec 2024 09:05:26 GMT Vary: Accept-Encoding X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: c1992a0eaca7c2065d63db6b1779b5e2 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache06.hnlycm01 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:39 UTC	15793	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 6a 1a db 6d 53 97 f8 00 f7 ff ff b3 ff fe 4c ff fe 6e 65 56 64 91 0f 12 a4 50 09 b1 8e 69 4f 02 af 1a 9f fb 55 1f 0f 95 65 a7 15 08 07 fe b3 03 ff d3 03 75 44 cd d2 b3 af 46 12 71 03 6a fa 69 2c b8 f5 65 65 dd cc fb b2 00 d4 b6 94 91 fd 93 02 ff 00 07 97 69 dc 33 00 89 f3 dc d0 a9 d4 ec b7 88 ee cf ac 97 6e 04 b3 f6 d4 b3 fd d6 28 90 00 b6 b1 af b3 01 d9 44 b8 b3 d3 ce b7 d5 f9 d4 4b aa 77 ef d4 66 df f6 b2 70 50 25 93 fb 72 08 f4 b3 2c 02 b2 40 f8 d5 92 5e ac f8 8b 70 71 69 41 2e 22 00 52 a7 dc b3 6a 00 98 c6 98 f0 ce 6d 07 dc cf b4 ad 94 d6 f8 d4 6e 08 57 ac db ef f5 ff 66 24 fb b2 ad ae 00 af 10 d9 fd aa 93 32 91 8c 8d ce 97 93 03 90 36 9c 66 ef 55 24 ab 88 53 f2 8a 6a 4b f9 b4 8d b5 ad 8f b0 71 d7 f5 b1 f4 d3 b1 Data Ascii: GIF89ajmSLneVdPiOUeuDFqji,eei3n(DKwfpP%r,@^pqiA."RjmnWf$26fU$SjKq
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 0a 56 e6 05 9a 03 a3 2d e0 07 5a 20 36 ed 00 16 62 41 43 dd 66 09 70 0d 6e 62 1a 16 54 e0 00 8c 40 0b 06 27 0d d2 e0 07 b6 66 50 f8 e0 50 8c 5a 55 30 61 60 ac 43 09 e0 83 6f ee a0 6d b2 8d 49 bd 85 55 10 21 51 50 20 12 5a a0 05 2e c2 22 58 e0 05 4a 40 a2 8d 00 12 8a 27 16 10 42 6b ee 40 54 54 80 08 b0 e7 97 cd 14 1f 18 1b f1 0c db 7e d8 a1 7d a2 c5 30 8a e2 7d de a7 5a 04 c6 e7 08 86 e4 44 86 f1 08 a2 80 1a 0f de cc 94 c2 a8 82 82 aa 9b f1 b0 9b c4 a5 c5 6c a8 ce 04 a0 45 27 ea c5 59 79 c1 30 58 a3 6d b8 8e 85 26 4f c4 d5 8d f7 2c 4f 73 f0 21 c1 ad 85 25 ae a2 bb 5d 46 f5 84 07 c8 d5 55 bb 21 43 2b 32 8f f3 34 87 6d 4c cc 2a 8e e2 27 0a 88 c5 7d 87 5a b9 68 55 c1 68 58 b8 a2 77 6c 56 87 74 c8 ca 71 c8 63 dd 9c e7 d8 ff cf 98 b0 5c 91 36 47 6a b1 48 00 61 Data Ascii: V-Z 6bACfpnbT@'fPPZU0a`ComIU!QP Z."XJ@'Bk@TT~}0}ZDlE'Yy0Xm&O,Os!%]FU!C+24mL*'}ZhUhXwlVtqc\6GjHa
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 4f 69 20 ac 47 84 b2 62 48 cf fa 74 4f 62 50 0c f3 1c 0d 90 e0 40 21 e4 4e 8b 30 c1 11 24 ac 10 1a 86 fc b8 41 02 5d 08 ef c4 01 6d 92 b0 45 80 ce 07 bc 1f 7c e8 86 6e f0 80 0b c5 50 0d cd d0 0b ed d0 09 6d 87 0d f5 50 0e 25 d1 0e 45 50 f0 f8 0a 22 72 94 59 b8 8e 6e d8 4f 2b 1c 80 09 8d 83 f4 90 0e 65 53 0e 1b 50 0c 2c 80 ce 32 4c cf fd 8c 51 c2 ea 81 2d 9c a2 2f 4c 0d 25 b3 01 26 7b 4e bd 92 4f f7 ec 51 04 d4 2b 2c c0 33 61 a3 10 1c ad 0a 1d d5 cf 1e 75 cf 1f d5 ab 20 b5 0f 6a ac c6 2f 75 91 50 10 86 67 a8 05 2d 48 04 79 50 81 39 30 45 54 4a 04 27 61 92 27 e9 02 56 94 d3 57 fc 82 55 88 12 04 20 82 3d d8 02 79 20 01 02 e0 06 7d d8 45 2d 98 04 0a 68 a5 1f 30 84 0f 38 54 43 68 25 64 40 d4 46 4d d4 0f 68 28 2f 61 87 66 ff b4 b5 5f f4 92 4a ad d4 2e 09 05 30 Data Ascii: Oi GbHtObP@!N0$A]mE\|nPmP%EP"rYnO+eSP,2LQ-/L%&{NOQ+,3au j/uPg-HyP90ETJ'a'VWU =y }E-h08TCh%d@FMh(/af_J.0
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 10 02 be d0 89 9e 68 02 4c 40 06 6b a0 89 4c 60 05 3d d3 05 56 b0 8a 4a b3 a4 84 61 11 48 62 11 de e0 0f be 20 13 1c f3 37 3f f0 09 69 30 0c 64 03 12 20 d1 0c 1c 61 02 c7 a8 8c c3 88 02 2c 81 36 c2 d0 0c 03 61 02 6f 03 71 7f c0 12 37 55 04 cb a6 71 67 83 36 29 30 36 0d e0 02 27 17 8e 2b a7 72 4a f5 8d e3 78 38 27 27 72 27 e2 54 e6 98 8e a8 13 74 2e b1 8e e6 98 55 5b 45 03 9d 63 16 9e 73 16 9c 93 01 f0 48 03 64 b5 04 54 75 8e eb 98 56 2e f1 36 69 10 0a 2e d0 56 01 c9 80 c8 d1 47 68 04 29 b3 d3 0f 0b 59 19 0a 80 75 54 87 19 94 a1 3b b1 2a 59 b3 c0 96 39 79 ab b8 5a 00 04 a0 ab 39 79 1f a6 11 58 d7 90 00 dc 70 ab 04 30 0e 82 07 19 15 a0 5a b5 1a 07 bc 9a 93 61 00 59 87 41 03 3d 90 93 c5 5a 0f a7 45 3d 3d b9 ac cd 5a 00 ff 24 42 3d e7 51 2c 78 99 ab b8 3a ac Data Ascii: hL@kL`=VJaHb 7?i0d a,6aoq7Uqg6)06'+rJx8''r'Tt.U[EcsHdTuV.6i.VGh)YuT;*Y9yZ9yXp0ZaYA=ZE==Z$B=Q,x:
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: a0 00 0a 5c 00 48 8a 2d 15 31 31 4c d4 f2 91 40 51 4b ba c4 4d 4e 89 4c c4 52 97 6a e9 95 b0 21 da 76 20 50 12 a3 50 fe e8 da 8c a9 50 b6 ed 87 28 c5 db 28 65 9a 28 05 54 3a 05 18 57 55 54 7e e5 18 17 41 55 68 45 1b 8e a3 57 60 85 10 24 a0 19 25 80 1a e9 6d de 6c 05 df 7c c5 57 9a c0 08 8a 60 df ae 21 f0 3c e2 16 fc 0a e0 96 f5 73 e0 e4 59 72 66 9f 9e 85 17 6c 26 5a 0f ae 59 1a ae 61 b0 25 5b a3 01 24 38 c6 00 7e 45 0d 9a 00 0a 38 b2 5d f2 d1 e3 bc 65 a0 c6 c7 00 b2 94 52 b2 b4 10 44 c6 e8 7e aa 5f 26 72 a0 64 21 32 d7 d5 27 e3 71 5c bf ce af 66 a1 64 4e 2e 5e d0 8a e2 68 40 5c 7d 12 58 3a 72 24 4a 26 5e a9 65 17 04 86 5d 29 25 ea 8c 2a a9 8a ae ea e0 4a 27 6e 01 dc 7e 45 5f 9b 80 23 23 76 24 8e f2 aa e2 05 ab b6 8a ff 64 d5 06 fd d6 15 5c c7 15 dd 0c 00 Data Ascii: \H-11L@QKMNLRj!v PPP((e(T:WUT~AUhEW`$%ml\|W`!<sYrfl&ZYa%[$8~E8]eRD~_&rd!2'q\fdN.^h@\}X:r$J&^e])%*J'n~E_##v$d\
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 8b 30 c0 25 b4 90 24 c8 48 20 38 9e 8a 30 eb 4e fa e4 b5 62 6b 0b 48 43 41 6c 0f d8 b5 9d 66 f9 c7 35 64 c2 13 85 01 11 1c 03 18 1d 41 54 6e 81 06 50 01 02 b8 c9 bb 9e 09 15 04 d2 16 9c 81 1d 84 91 1d 68 c1 13 d9 01 f1 15 18 f0 05 5f ef ad a5 81 09 1f 5c ba a5 1c 65 41 9f 60 4a 08 f0 11 1a c8 c0 08 98 c3 08 d8 a5 14 a0 81 16 d0 43 0f 68 41 3d ec 41 1b f8 41 0d 2c 01 a5 15 01 fc 44 4b 2b 8c c1 0f cc 4a 63 a2 40 ba 4d 82 64 6e 52 11 5c d0 25 04 82 1e d8 5f 1e f8 40 b3 70 66 8e 39 8b b1 f8 00 8f 8d 18 25 50 02 0d 08 20 92 39 84 43 00 59 a3 b9 66 00 58 60 02 62 07 10 e5 e6 b3 35 a3 a6 82 ab 6c 4a 89 34 65 42 5b 15 e7 3b 14 84 0e 7a 03 c5 9c 46 36 78 c0 2b 79 00 3a 10 8c 36 68 cc 6e ac 53 33 58 e7 3b 65 a7 76 96 1f 3d dd ff 00 77 5a 43 0a ec 1f 0a 48 00 78 a6 Data Ascii: 0%$H 80NbkHCAlf5dATnPh_\eA`JChA=AA,DK+Jc@MdnR\%_@pf9%P 9CYfX`b5lJ4eB[;zF6x+y:6hnS3X;ev=wZCHx
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: d8 bc 24 58 89 45 58 87 4d 58 84 2d 87 b4 ac d8 7a d5 d7 8d f5 58 7c 1d d9 8b cd 58 ce 24 d8 84 bd 58 86 1d 59 96 c5 57 4a c4 10 8c 7a 59 99 dd 9b 6b b8 80 46 b1 d9 60 c0 59 9d bd 59 9e cd d9 9e 35 06 6a 28 c3 04 f4 b2 39 9a 91 00 d8 59 9f 3d 92 d6 64 4d 57 43 5a a7 ed 59 9c 0d 80 f3 fc 24 9f f5 d9 0b 10 07 7a 32 42 10 44 da 0b f4 10 00 4c 92 a6 ed d9 ae 35 42 3a 7a da aa 35 5b b4 85 5a b5 3d 5b 9e 3d b4 d5 2c 41 9b bd 5a 38 8a 32 9d 2d a5 a5 5a aa 23 54 94 9d 05 24 65 5a 26 b6 7d a3 89 e2 90 23 c4 cd b4 65 5b c3 2d 5c b4 85 b4 5a fa 90 bb 3d c2 7e e0 b5 a8 cd 11 2b 44 dc b5 a5 dc 60 28 83 e4 ec 07 1b 40 81 9d bd 00 5f b3 07 e4 c8 93 c3 ad dc b5 4d 83 64 2a 50 6a d0 59 67 7a c1 c5 5d aa c0 05 11 b2 9d 87 06 40 86 70 ff 58 a8 08 95 d0 1a 18 01 6c db 01 3d Data Ascii: $XEXMX-zX\|X$XYWJzYkF`YY5j(9Y=dMWCZY$z2BDL5B:z5[Z=[=,AZ82-Z#T$eZ&}#e[-\Z=~+D`(@_Md*PjYgz]@pXl=
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 11 3a 11 b1 b5 0c 11 3a 06 61 b5 1c 0b 58 1e 80 99 11 81 0c 2d 9b 12 fd 68 ab ce d7 9a 2f cb 9a 15 30 08 ac 09 00 5c 00 14 33 d6 7d 5b a0 7e db 37 5e 0c a0 03 cf d3 7f 17 84 7e cf a3 b7 56 d1 62 30 80 3d da 23 16 b5 10 9f 1a 50 00 fa 47 0f 61 90 42 b5 c0 9d de 59 3c 47 f1 16 ee 93 82 68 80 06 51 a0 b7 03 8a 41 e7 67 a0 3a 90 42 f9 05 9f a9 91 5f 92 51 00 3d 60 3b ad bb 81 89 f1 0b d8 19 bb c4 50 00 0f e0 17 77 b0 9e 28 56 82 2e 06 14 9c fb 82 f2 a3 05 69 a1 82 07 36 3f 05 40 0e c4 a0 0d 5c c0 05 46 60 a1 6f 00 64 5c 90 43 d9 60 1c c7 b1 03 3d 16 84 52 16 a2 d2 91 bd 4b 88 65 5c 70 09 72 50 43 07 c0 b9 2e a6 03 35 70 85 53 58 85 61 f6 1d e4 41 1e 65 76 a3 5b c8 1e 36 83 45 3a 71 86 92 e5 45 3e 2a 79 50 30 1a 03 c4 a4 ff fc bb bf 4b ca 0d fe 2b 40 00 2c c0 Data Ascii: ::aX-h/0\3}[~7^~Vb0=#PGaBY<GhQAg:B_Q=`;Pw(V.i6?@\F`od\C`=RKe\prPC.5pSXaAev[6E:qE>*yP0K+@,
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: a3 60 3c 15 ed 42 21 f4 41 c1 c6 0d 31 54 2f 5a 40 0d 32 e6 61 d0 30 75 46 14 10 15 f3 5b 4c f4 31 1b 33 fc 78 37 78 7c 47 36 60 74 46 a3 0f 12 a5 a3 2f 97 87 c7 32 d1 12 f1 ca 13 3b f1 91 dc 12 58 28 e9 e4 a4 b7 f8 56 8e 54 80 ef e4 d2 52 15 4d ae 3f a0 b4 3f d0 c8 3c be 17 7c 27 25 7c 23 85 4a 29 cc 50 d0 97 4f 02 a5 c2 a2 f2 89 16 ac c1 a6 a8 44 4a c4 4e e6 37 c0 fa 6b 44 ee 37 7f 89 e4 45 7a c4 4a e8 cb 19 7f b2 4e e9 54 1b b9 51 1a d1 ee 4e f1 f4 ed c8 11 50 bf 71 1f 1b f8 81 eb 11 51 0d 35 53 3b 55 53 29 78 53 31 38 83 33 f8 82 5f 55 83 ab 41 83 37 f5 83 2f c0 18 34 95 84 2f e0 83 45 18 85 ab 61 85 ab c1 18 56 d8 18 5c 38 86 4f 78 86 5d 78 84 5b 38 86 65 18 85 35 55 87 45 78 86 4b f8 87 3f d8 84 83 78 87 7f 78 ff 86 1b 55 84 49 d8 84 31 58 89 41 b8 Data Ascii: `<B!A1T/Z@2a0uF[L13x7x\|G6`tF/2;X(VTRM??<\|'%\|#J)PODJN7kD7EzJNTQNPqQ5S;US)xS183_UA7/4/EaV\8Ox]x[8e5UExK?xxUI1XA
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 98 00 5b 5a 8b 18 64 74 71 00 5f 0a 4d 16 43 33 74 82 4c 56 e1 3d e9 32 61 c3 75 94 01 0a 54 83 4c 3c f1 a4 9d 03 7a 23 c3 31 9d 86 15 3c 03 69 60 e9 3f 78 c3 79 18 c0 0f d8 4b bf 78 c3 db d0 85 9e f6 b9 b0 23 62 84 e4 ad 44 e7 c5 2c 58 cc c7 38 c8 25 be 90 40 0d 2e 41 c1 c8 37 18 39 b5 5f 80 91 37 c0 64 88 08 e1 ea 1e c6 70 fb 63 58 3b b8 57 fb d6 48 0c a3 8a 14 e5 92 0c 7d 71 86 55 57 44 6c 56 bb 91 77 b5 5a 6b ff ab bb 27 6a 56 7f c4 bc 1b f9 ea c2 48 3f f0 c0 bd 07 40 8a 03 a1 90 04 c9 90 dc 3b f0 5a 2f ee 86 3b b8 b3 43 28 f8 0a 18 c5 f2 bc a7 60 87 0d 3c c2 1b 79 5e e3 d9 f2 cc 82 69 df 3b f2 06 79 62 78 64 2e 10 3c c8 4f 3c 44 1a 82 f4 12 a0 ad 8c eb 2d cb 68 62 3f 39 3e fe b6 8f 5d 7c 3f 80 89 c8 e3 bb 4b b4 d5 cc 5f 40 03 a0 f9 ef e4 ca 85 c9 84 Data Ascii: [Zdtq_MC3tLV=2auTL<z#1<i`?xyKx#bD,X8%@.A79_7dpcX;WH}qUWDlVwZk'jVH?@;Z/;C(`<y^i;ybxd.<O<D-hb?9>]\|?K_@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49863	106.225.241.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	361	OUT	GET /z.js?id=1281318611&async=1 HTTP/1.1 Host: v1.cnzz.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	564	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/javascript Content-Length: 10194 Connection: close Date: Thu, 02 Jan 2025 05:12:39 GMT Vary: Accept-Encoding etag: W/"11366216631888960513" cache-control: public, max-age=300 Via: cache6.l2cn1802[82,82,200-0,M], cache6.l2cn1802[84,0], cache12.cn3693[93,93,200-0,M], cache1.cn3693[94,0] Ali-Swift-Global-Savetime: 1735794759 X-Cache: MISS TCP_MISS dirn:-2:-2 X-Swift-SaveTime: Thu, 02 Jan 2025 05:12:39 GMT X-Swift-CacheTime: 300 Timing-Allow-Origin: * EagleId: 6ae1f19517357947593581995e
2025-01-02 05:12:39 UTC	3965	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 74 2c 69 3d 22 68 74 74 70 3a 22 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 74 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 2c 69 3d 30 2c 73 3d 74 2e 6c 65 6e 67 74 68 3b 69 3c 73 3b 69 2b 2b 29 7b 76 61 72 20 65 2c 68 3d 74 5b 69 5d 3b 69 66 28 68 2e 73 72 63 26 26 28 65 3d 2f 5e 28 68 74 74 70 73 3f 3a 29 5c 2f 5c 2f 5b 5c 77 5c 2e 5c 2d 5d 2b 5c 2e 63 6e 7a 7a 5c 2e 63 6f 6d 5c 2f 2f 69 2e 65 78 65 63 28 68 2e 73 72 63 29 29 29 72 65 74 75 72 6e 20 65 5b 31 5d 7d 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 7d 28 29 3f 22 68 74 74 70 3a 22 3a 22 68 74 74 70 73 3a Data Ascii: !function(){var t,i="http:"==function(){for(var t=document.getElementsByTagName("script"),i=0,s=t.length;i<s;i++){var e,h=t[i];if(h.src&&(e=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(h.src)))return e[1]}return window.location.protocol}()?"http:":"https:
2025-01-02 05:12:39 UTC	6229	IN	Data Raw: 2e 65 74 5b 72 5d 2e 72 74 29 2c 74 3d 6e 5b 70 5d 28 22 7c 22 29 2c 65 5b 76 5d 28 74 29 7d 69 66 28 30 3d 3d 3d 65 2e 6c 65 6e 67 74 68 29 72 65 74 75 72 6e 21 30 3b 76 61 72 20 63 3d 6e 65 77 20 44 61 74 65 3b 63 5b 55 5d 28 63 5b 4d 5d 28 29 2b 31 35 37 32 34 38 65 35 29 2c 69 3d 74 68 69 73 2e 43 2b 22 3d 22 2c 74 68 69 73 2e 65 74 3d 68 28 65 5b 70 5d 28 22 26 22 29 29 2c 69 2b 3d 74 68 69 73 2e 65 74 2c 69 2b 3d 22 3b 20 65 78 70 69 72 65 73 3d 22 2b 63 5b 45 5d 28 29 2c 69 2b 3d 22 3b 20 70 61 74 68 3d 2f 22 2c 73 5b 66 5d 3d 69 7d 63 61 74 63 68 28 74 29 7b 4e 28 29 7d 7d 2c 48 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 5f 74 3d 65 5b 6f 5d 2e 68 72 65 66 7d 63 61 74 63 68 28 74 29 7b 4e 28 29 7d 7d 2c 42 Data Ascii: .et[r].rt),t=n[p]("\|"),e[v](t)}if(0===e.length)return!0;var c=new Date;c[U](c[M]()+157248e5),i=this.C+"=",this.et=h(e[p]("&")),i+=this.et,i+="; expires="+c[E](),i+="; path=/",s[f]=i}catch(t){N()}},H:function(){try{return this._t=e[o].href}catch(t){N()}},B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49864	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	367	OUT	GET /i/2024/12/05/200-200.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	591	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 190607 Connection: close Accept-Ranges: bytes Age: 4 Cache-Control: max-age=43200 Etag: "67516cd6-2e88f" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Thu, 05 Dec 2024 09:05:26 GMT Vary: Accept-Encoding X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 16f79fffc8e180288894b2127d724896 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache01.hnlycm01 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:39 UTC	15793	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 e6 7f 00 ff f2 92 e9 04 ee ff fc 02 55 01 76 d6 b1 fd 6a 0c dc 6b 02 90 03 e6 ee 87 05 b2 e0 a1 9e f2 d5 fd 9d 63 a7 03 ef 16 a5 8e ab ff fd 6b 70 01 ad dd 5c ef ef bb 24 4b 00 90 94 5d 13 ff f7 50 d0 ab 54 33 00 8b 4f 03 b3 b4 a2 d0 f4 ce 2d fa da 45 f9 d8 6b ad 5d d8 94 01 ce fe d5 02 ff b6 03 71 59 96 05 02 23 dd cd f6 ff fe 2b a7 6b 62 ff 67 67 22 00 52 ff 09 08 f7 d7 d3 bb 01 d0 d6 d1 d7 0d 00 4e cd b6 cb 5d 4e 6f f2 d7 b2 8b 0d f0 be 8c 56 d6 b3 35 f1 d7 93 cc 6e b6 f2 b7 fc cf 91 f1 9b fd fb b2 83 29 be 24 f4 b2 2b d2 f6 b6 c8 cf 8e c8 2f 2f 4d 7c 2b af 94 2b c3 b0 10 eb 76 27 8c ef 86 fc f4 8d cc d0 97 31 80 fd 92 4b 2d 7f 35 2d 69 10 00 69 de c2 8f d6 ff fd e6 ca 54 05 6b 57 8f 23 f1 dd cc 2c 6d 2f 15 00 5a 05 df c3 Data Ascii: GIF89aUvjkckp\$K]PT3O-Ek]qY#+kbgg"RN]NoV5n)$+//M\|++v'1K-5-iiTkW#,m/Z
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 12 02 81 10 e6 a1 f2 86 0e 24 41 c0 c7 91 81 fd 31 85 0e f7 15 45 59 a0 53 08 d1 df 27 44 fe 61 64 65 50 8c c8 46 82 4d 1a 35 d5 0c 51 c0 49 51 5c 73 59 c7 19 04 99 32 b2 05 38 11 19 c4 47 98 87 1d 95 24 78 20 22 66 88 9f 00 38 b6 ca 9c 09 04 6a c8 14 2e a8 a8 63 4c 82 90 26 88 10 87 4d f5 ea a2 8e d6 82 c8 b1 d9 58 1a d3 14 7d 4c 9a 5c 4c 33 6c f1 6c 00 15 8a aa 1e 84 7b 45 17 00 a6 83 98 06 80 b6 2e dc 27 5e 21 dd 4c 73 e6 24 db 55 32 45 30 ea 39 70 64 25 33 95 22 a0 ad 8a f8 6a e7 a2 b9 d5 92 14 2e 93 6d 24 44 71 53 21 91 17 67 db 3a 09 09 24 03 67 5b 25 a6 a2 36 f4 2d 66 32 80 69 6f a2 ac 72 c2 eb ff 46 ee b9 4b 2f 66 85 74 34 2f 4e 1b 4b 35 88 0e 45 32 2a 8b 5a 88 e0 92 8b 51 82 5d 3a 2a cb cb 2e 33 5b 33 55 fe e1 29 b4 15 bd e6 70 a9 01 44 8a 02 25 Data Ascii: $A1EYS'DadePFM5QIQ\sY28G$x "f8j.cL&MX}L\L3ll{E.'^!Ls$U2E09pd%3"j.m$DqS!g:$g[%6-f2iorFK/ft4/NK5E2ZQ]:.3[3U)pD%
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 50 15 a9 82 a2 2e 33 9f 48 94 ed 4f c7 48 87 db 2e 31 b7 bb ed 6d ff 0b b0 3a 48 02 7e d5 59 16 90 a2 fb 02 85 5c 4f 2c f7 7f 6d b4 6f 4c e9 ba 52 53 ea 53 bd 0d b5 6e 81 91 59 4c 16 ec f5 c5 dc 24 65 7c 5b 50 57 d0 96 34 98 18 40 6a 4a c9 08 d8 62 2a 96 96 a6 55 e7 02 9a 19 82 31 2c 36 a3 e8 64 68 7e 51 50 d4 99 f2 f3 af f9 95 43 56 4d 2b 52 5a 4e b2 0b 78 c8 6f 29 b9 59 c3 fe c9 76 9f 79 48 aa 55 97 f8 5d c0 fa b7 94 0d a8 f0 03 07 a0 88 3e 11 b4 ac 14 2a c5 01 97 10 d1 02 53 15 bd fa 14 e6 7e 31 ca 5b 3a 78 31 a5 ba 55 e7 8b 03 cb 60 c0 56 f9 0c 28 68 af 46 d1 6c da ea a2 d4 c7 ef 65 67 8a 9b c9 c4 a1 12 79 8c ce fd ab 0a 16 4a 53 62 36 98 c1 32 9d 31 8d 69 3c c9 e9 72 94 a6 e8 ac 27 17 5d dc 4a 7c 9e b2 87 0d 70 03 2b 1b 5c 58 1e 50 f8 80 56 b0 d3 1d Data Ascii: P.3HOH.1m:H~Y\O,moLRSSnYL$e\|[PW4@jJbU1,6dh~QPCVM+RZNxo)YvyHU]>S~1[:x1U`V(hFlegyJSb621i<r']J\|p+\XPV
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: a3 a9 25 79 06 4c 49 c0 56 73 7a 84 a6 f0 7d 8b 37 df 71 1d fa 0e a2 87 3f b8 e7 04 f8 01 4c ef 94 82 07 a0 80 29 32 57 0a 53 0a 31 96 18 a9 9c 21 7f 97 b0 40 23 6e e4 8f fd f4 c3 25 0d b3 12 98 5a a7 34 a1 10 2a 84 2a 6a 46 eb 0a 73 1b b4 51 6a 4f 21 f1 82 72 d4 02 28 6a 55 e6 83 67 70 c3 60 f0 d3 8f cb e4 8c 59 3a 62 59 ae a8 73 15 93 95 ca 64 48 a1 0f 1a 9b 28 2c 05 61 05 3f 67 a9 d8 65 44 82 43 4b dc 89 11 61 93 9a 78 a2 06 1d 3c c0 41 52 3a 80 99 d4 3e 53 c2 05 29 68 25 63 aa 4f 97 5e d4 b7 24 dc 88 20 2e 64 62 63 44 b2 a0 ee 20 09 2a b0 bb d8 7b cc 26 48 c0 5d 45 ff 90 0c a2 0b 0d a1 d2 c2 a0 88 c4 70 42 89 5c 33 96 92 14 d8 45 6d 16 c1 23 44 be 24 71 47 42 d4 72 10 57 50 00 bc 2e 34 0b ac 9c e1 0a 44 f8 99 6f 38 15 92 b3 29 48 8b 5e 70 c3 46 28 a3 Data Ascii: %yLIVsz}7q?L)2WS1!@#n%Z4*jFsQjO!r(jUgp`Y:bYsdH(,a?geDCKax<AR:>S)h%cO^$ .dbcD {&H]EpB\3Em#D$qGBrWP.4Do8)H^pF(
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 64 bc c4 35 96 bd 0e 40 01 6e 4c 01 1b 10 c5 9c 08 6a 75 4c c6 f0 19 c2 0b 56 ca f1 16 6c 96 d0 01 33 a0 c9 65 4c 01 00 70 c6 12 e8 71 f2 b7 03 99 fc c0 14 00 c7 7a 47 86 81 d9 01 1a eb 02 ac 7c cb 05 50 8c 2c 40 c6 14 d0 00 c5 58 c2 bf bc 00 c8 c8 01 b5 4c 01 34 ac b1 08 30 00 4c 66 c8 cd bc 01 d6 f7 c9 1b dc cc 42 dc cc 91 8c c4 bf bc ff c4 46 86 c9 ac 4c cc 9d 2c 01 e6 7c ce e8 8c 00 be 6c cb 0e e0 03 e8 fc ce 53 27 01 16 fc b0 70 26 08 6a bb 08 08 90 00 23 40 01 fc dc cf 0e c0 01 50 bb 90 9a 38 6a bf db cf fc 0c b8 bc db bb 49 09 01 d0 aa 02 6f 60 d0 32 d0 d0 71 60 d0 51 d0 d0 00 00 d1 d1 8a 02 06 4d 01 50 20 02 3a 30 03 50 1b 6a e0 9b c9 fc ec 00 08 d0 70 9c 88 c7 06 1d bf 81 dc cf dd 5c a7 50 b0 d2 9c 2b 84 2d bd d1 9c ac 8c 3c c9 01 3a bd d3 3a dd Data Ascii: d5@nLjuLVl3eLpqzG\|P,@XL40LfBFL,\|lS'p&j#@P8jIo`2q`QMP :0Pjp\P+-<::
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 43 1d 51 65 35 ff 34 3c a3 3e 82 39 cc 3f 48 e1 9b df 64 65 23 a6 12 4a 1f 22 b3 33 cd f4 c4 66 56 40 a2 54 6c 86 33 d0 c4 e2 3b c3 37 4f 65 3e d3 13 cb c3 48 3e 33 51 ce 7d 54 85 87 a6 cc a6 30 13 d9 4d fc e4 af 00 6a 04 a7 45 9c d7 cf f5 61 71 11 1c 33 8d 04 0c 40 51 03 0c 80 7f 0d 6c 26 2c e9 f9 87 01 4c 94 a2 12 c0 28 2a 34 fa 4a bf 99 e8 84 1f 05 29 f8 36 73 ce 4f 1a 93 7d b1 ec 26 2b 1f 80 80 0e a4 20 05 a5 4b 41 07 76 fa 80 46 62 62 90 87 f0 24 49 0b 71 84 cc 19 a0 a6 3f 98 02 04 96 0a 01 ae d4 cf 00 e1 82 67 24 39 61 a1 3f 48 e0 01 1d 48 2a 53 97 8a 83 14 20 c0 00 12 70 05 67 86 aa 27 93 1a 15 01 29 d8 ca 56 9d fa 55 33 e4 4c 1f 61 24 24 1e 05 ea 08 ac 0a 29 08 f1 50 80 1b f6 ea 86 a2 34 d5 74 f9 db 9c 21 31 e8 d0 33 49 00 01 77 a5 81 1b ce c0 d8 Data Ascii: CQe54<>9?Hde#J"3fV@Tl3;7Oe>H>3Q}T0MjEaq3@Ql&,L(4J)6sO}&+ KAvFbb$Iq?g$9a?HHS pg')VU3La$$)P4t!13Iw
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 5a 5c d3 3e da d3 67 80 9f 77 fb 8e 66 0c c4 18 7c 5b 9c 00 19 f2 44 cd 72 50 d5 56 5d d5 08 2d 07 34 ab cd f3 31 85 04 4a d5 59 ad d5 15 5d d5 a2 bb 07 31 bc 0d 74 6c 56 c1 c7 9e 58 dd cf 58 fd d6 07 4d d6 58 18 d4 43 ed 15 dc 5b 95 6e 20 d6 fc ac d5 56 bd d0 58 1d d2 8d 5a d7 41 fc 0d fe 20 01 37 99 d7 57 9d d8 7d 7d cb a9 ba 14 c8 70 48 34 8a d8 8a 3d d9 5a 7d 98 00 1d b0 26 6b 87 21 00 02 70 70 8b 94 fd d9 e1 89 01 28 4a ba d3 cb 89 51 2a d9 9f 7d d5 e1 a9 02 90 1c d8 4f 7d 71 e5 bb 14 2a 0d 19 87 ad d7 15 ed 7e 0d 60 d6 02 77 ac c1 67 ff 9c 74 60 d4 fb ac d5 b8 ad a0 ee 61 b2 56 41 2e c1 67 04 2c f0 db c0 2d d6 a9 99 9f 82 bd 57 c1 a3 7e 79 0d dc fb 4c 07 e8 9c 9f 78 15 cc 50 bd 50 d9 40 c1 8e db 1e 03 c2 d2 67 90 da 56 5d 92 66 9d cc 1f 9c 72 76 70 Data Ascii: Z\>gwf\|[DrPV]-41JY]1tlVXXMXC[n VXZA 7W}}pH4=Z}&k!pp(JQ}O}q~`wgt`aVA.g,-W~yLxPP@gV]frvp
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 90 02 90 e2 ac 95 98 a1 69 4a 79 51 50 fc 29 1f 88 98 cb 77 4c a2 57 5b 28 64 9e 17 32 ac 24 fa 5a 8a c8 da 62 5c b0 15 52 23 5d 4b 89 01 70 50 14 cb f9 43 53 e6 52 80 77 f4 e4 32 b5 58 2b 3c c0 71 52 ab 12 f2 29 a0 e8 2c ff bc ec 40 18 17 25 63 3e 2e 12 2e 6d eb 3a 5d 78 3d e0 66 55 25 a8 69 79 88 d9 49 dc 96 6e d2 45 df 6c 2b 31 4f 7e 8c b7 ba e8 5d 60 1c 79 38 89 ee c2 eb 05 a5 fd 83 7b 6d 11 5e f4 66 57 1f 87 29 ec 71 91 9b de fe a2 37 b7 b7 80 07 65 2f 09 8f 5a 08 70 16 3a 0d a6 7f 4b 91 96 fc e5 d5 a4 0b 8e 30 33 e1 75 3a 13 5c 37 b3 f9 a8 85 37 1d 05 8f 33 f2 a3 a2 93 d8 f0 24 e6 39 8b fb 26 a9 ae 76 c0 93 84 57 7c b3 5a 70 50 c4 be 51 ee 94 e4 28 5f 10 87 c2 c4 da ad 9b 8c 4d 3c 42 16 fb b8 12 cd 4c 6b 7f e7 69 e3 bd c4 37 c7 91 ad cd 91 7f ec e3 Data Ascii: iJyQP)wLW[(d2$Zb\R#]KpPCSRw2X+<qR),@%c>..m:]x=fU%iyInEl+1O~]`y8{m^fW)q7e/Zp:K03u:\773$9&vW\|ZpPQ(_M<BLki7
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 04 21 92 6f c8 01 b2 12 61 43 46 90 a5 75 91 83 25 20 85 80 b3 55 ca 49 67 cd 48 c4 fc 62 24 08 1c 9e 12 8b 44 8b 8a 19 80 58 88 86 40 30 92 8c 24 1b 4b 24 90 03 26 46 72 07 0f e0 d0 25 15 11 09 04 e8 00 00 2e 10 c2 97 24 26 10 0f 19 07 05 91 14 a5 2e 4a c1 1d 53 46 72 06 12 58 c1 29 5a b9 03 58 e6 60 67 9b a0 a6 08 d2 f0 06 00 c0 12 00 7c 98 01 02 84 d4 31 2d 0c 62 00 84 e8 51 71 8a 09 98 7e 02 e0 a1 00 48 00 d1 3c 22 93 6d 92 0b 91 0e 80 28 00 64 d0 48 96 34 34 a3 1a 6d dc f6 24 61 d1 5b c8 63 06 73 81 95 ea f0 27 89 73 6a 34 a2 08 88 c8 03 66 3a 53 0e 38 14 a2 0b a0 a9 4e 1f 50 cf 97 e6 60 25 9c 70 d7 10 d9 00 d2 97 3a 00 0a 83 5a a5 22 fc 92 c7 3d 89 f1 0d 19 75 80 54 25 8a 0d f4 e4 cf 10 42 ff cc 01 54 01 20 55 07 20 81 77 f0 30 81 1a b9 ca 55 a9 ca Data Ascii: !oaCFu% UIgHb$DX@0$K$&Fr%.$&.JSFrX)ZX`g\|1-bQq~H<"m(dH44m$a[cs'sj4f:S8NP`%p:Z"=uT%BT U w0U
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: f4 6c df d4 c2 d0 01 52 cf f6 2c d0 01 48 1c 04 70 30 f8 f3 4e f0 68 f0 06 6b 8f ed 08 20 28 40 64 d1 c6 3e df c0 de 01 7d f0 06 b6 ff 06 6e 7f c6 33 8e e0 74 7f fb b6 cf 01 2e 70 ed be 6f fb 33 20 01 ce 54 25 ec 4c 03 c3 ef 02 09 a0 03 50 80 ea 50 10 fd cf ef fc d2 af 03 2c 00 05 c3 bf 03 da 9e 27 99 8f 02 b6 ef f8 7f 30 fc b6 bf 03 2e 20 fe e6 7f fe b6 df 06 97 0f 0b 66 60 eb c3 df f6 91 9d 06 be cf 07 39 e0 03 fc 2b ff be 0f 05 08 e0 03 74 00 08 68 6f 83 83 3a 1d 6a 75 7f 8a 8b 8c 7f 4c 3f 38 39 7f 38 1d 95 96 95 2e 84 6f 3b 97 1d 1c 69 6f 00 84 00 50 1d 33 a2 a1 9a a1 39 6a 26 8d 8a 65 26 0f 3a aa 1c 0f 0f 08 b9 ba bb ba b7 1c aa 33 06 7f 6a 8c ae 08 b4 6f 32 1d 7f aa 6f ff 09 1d 2e a8 cd d3 d4 39 03 26 65 8a ad 06 3f 50 cd 33 35 a0 9a 00 73 69 e6 a9 Data Ascii: lR,Hp0Nhk (@d>}n3t.po3 T%LPP,'0. f`9+tho:juL?898.o;ioP39j&e&:3jo2o.9&e?P35si

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49866	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	370	OUT	GET /i/2024/10/28/1300-200_1.gif HTTP/1.1 Host: cc777img.dqsldz.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	595	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 221556 Connection: close Accept-Ranges: bytes Age: 25140 Cache-Control: max-age=43200 Etag: "671fa4f9-36174" Expires: Fri, 31 Jan 2025 22:13:39 GMT Last-Modified: Mon, 28 Oct 2024 14:51:37 GMT Vary: Accept-Encoding X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: e8e2902ff254338ad94d14a7f17097ae X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache01.hnlycm01 Strict-Transport-Security: max-age=66666
2025-01-02 05:12:39 UTC	15789	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 00 00 ca 75 78 94 7f 80 d9 c4 c5 c7 44 52 a2 99 9a a7 2f 3f eb ab b3 fc 04 2c fc 0d 34 db d4 d5 d0 08 2a fc 1b 41 fc 32 54 fb 51 6d fb 6c 84 fc 84 98 fc 9b ab fc b1 bf fc c0 ca ba b4 b5 c3 9c a4 ab a6 a7 8c 75 7a b6 ac af ed d4 dc 9a 86 8d fc ca dd fb d9 e6 e4 cc d6 28 21 24 fb f4 f7 18 16 17 e4 d4 dc a2 8b 97 f8 04 8c fc 04 94 fc 0d 94 f4 04 94 f4 0c 94 fc 04 9c cf 04 84 c1 04 7a fc 0c a2 f3 0e 9e fc 14 a4 fc 1c a7 fb 26 ab fc 37 b3 fc 4e ba fc 66 c4 fc 04 a4 f4 04 9e ec 04 9c fc 86 d2 fc 9c dc 76 6d 73 fc b4 e6 16 0c 15 f6 ec f5 0d 04 0d 5c 54 5c 67 5f 68 35 2f 36 dc d4 e4 4c 49 56 3d 3b 50 04 04 0d 09 0c 17 13 1b 30 22 30 54 18 25 40 6d 7d 88 ba bc bd 08 16 1c 49 6e 76 8b 90 91 a1 b4 b6 04 0c 0c fb fc fc 0c cc b4 1c cc Data Ascii: GIF89auxDR/?,4*A2TQmluz(!$z&7Nfvms\T\g_h5/6LIV=;P0"0T%@m}Inv
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 61 55 b2 65 24 46 7d 6c c3 12 e5 42 fd 0c ad 2a 24 49 29 4c d2 92 f0 02 25 0d da 92 a0 f2 92 e8 c2 24 6d 02 2c 73 df f7 c9 f2 f7 dd 05 2c e3 b2 2e e7 0f ff 64 25 57 fa f2 28 f4 72 fe d0 c2 30 8b 32 2e 34 ec f9 9c d7 59 3c a7 8c 4c a1 33 ca ac 8a 30 a1 8b 6c 05 98 01 12 8a 90 99 12 8e 19 1d 15 c5 88 d0 03 1d 49 83 1d 41 21 86 c0 04 89 bc 51 89 64 84 32 1c 8c 59 20 0c 72 49 6c 97 1a cc 2d 44 ac ef 38 ff 57 3c 1b cc 37 4c 83 13 ca 93 db ee 33 3f f7 b3 3f ff f3 e2 16 6e 3f e8 a7 dc d2 43 13 ec ed 82 2a 68 23 2a e8 b7 25 b4 3f 51 5b e0 76 4a 82 0a b4 e1 2a ae 20 22 ae e5 5e ee e3 76 4a 46 23 ee e0 32 9b e6 f2 03 e9 3a e2 e3 6a 74 45 27 6e 47 5f ae 46 43 ae e6 62 2e e4 5e 2e e6 f2 83 10 7c 2e e8 ca 6e e7 ce 34 4e db 34 ea da 6e e9 7a ee 4d cf f4 ea f2 b4 50 07 Data Ascii: aUe$F}lB$I)L%$m,s,.d%W(r02.4Y<L30lIA!Qd2Y rIl-D8W<7L3??n?Ch#%?Q[vJ "^vJF#2:jtE'nG_FCb.^.\|.n4N4nzMP
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: db 67 84 8c 52 f1 a3 03 9b 1a d5 55 67 2b 3d dd 76 46 c9 e6 85 67 e5 7d 85 5d 78 dd e6 1d de 78 06 de 76 5e 67 e6 e5 67 7e 6e 5e 7f 7e 85 a5 09 68 e6 1d 68 a7 09 df 90 7c 85 ed 05 e8 82 e6 e7 76 36 de a5 59 1a 53 28 05 89 0e 5f e6 1d 54 ee 7d 5e e6 3d 5d 85 86 e8 8e 66 e8 a5 9c e7 a7 a1 49 e6 5b df 4f c9 54 9c d4 54 a0 14 4a 51 ad 07 49 81 97 06 64 06 52 28 05 fc bd 5f 4a ab 55 01 2e c0 ff 05 30 9d ff c6 69 00 e4 55 fc 12 9a 66 b2 19 39 93 a7 96 b1 06 61 c0 05 5d a0 85 ba 4c 60 9a b1 18 b0 40 a7 9a 69 2f 2c ba c0 ec 90 0f 97 f1 98 ba 84 8f 2f b3 33 0f 04 34 05 7e 4c 66 4d cc 18 3e 41 69 50 93 13 fc 4b 5b 58 cc 13 ac 26 7a 20 4c 15 8e e1 02 7a 57 ee 69 d7 07 5e 07 34 09 85 79 f5 cc 50 98 86 20 f6 eb bf 06 ec 22 7c 58 65 bb 1b 7a 10 82 5a 9b d8 7f 05 aa 9d Data Ascii: gRUg+=vFg}]xxv^gg~n^~hh\|v6YS(_T}^=]fI[OTTJQIdR(_JU.0iUf9a]L`@i/,/34~LfM>AiPK[X&z LzWi^4yP "\|XezZ
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 30 d1 14 30 d1 f5 f0 3f 46 1a 3f bd 5b 5c c2 60 11 08 e4 42 42 d3 21 0e f2 8d 1e 32 20 20 e2 42 14 e2 d3 42 1d bd e2 05 bd 2b d4 42 19 61 08 c2 80 09 45 0b 5f c3 ec 22 86 20 23 a4 e0 54 53 2d 0b 94 13 90 67 71 a7 f5 35 cd fa d5 04 56 f0 05 5f 10 06 fc 7b 44 53 50 05 50 20 d6 46 72 05 5d 00 d6 6c dd d6 6e 1d d6 57 c0 5f 53 10 06 5f c0 05 62 a0 44 73 0d 05 60 10 d7 fd bb bf 7e fd d7 80 3d d6 52 d2 0f ff 5f 6d d7 42 62 bf 88 7d 05 54 f0 05 62 80 d8 f6 3b 05 5f 5d 05 8d ed d8 f7 3b 24 6f b0 bf fe 90 04 62 f0 05 55 60 05 59 e2 07 fd e0 25 4d 10 26 f4 30 d7 9c 6d 05 0b 6c 1f 6a 12 20 0e 16 61 6c 12 c1 13 e6 03 60 80 05 54 40 db b4 bd 06 b8 4d 05 b8 fd 05 6b 00 d6 bd cd db 5f a0 06 c2 3d dc c4 fd 05 63 40 b2 23 9b dc 26 d6 03 63 f0 05 54 30 06 ca ea 10 3d a0 04 Data Ascii: 00?F?[\`BB!2 BB+BaE_" #TS-gq5V_{DSPP Fr]lnW_S_bDs`~=R_mBb}Tb;_];$obU`Y%M&0mlj al`T@Mk_=c@#&cT0=
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 0b cd 22 51 0a 38 6c 0a 75 72 20 36 5c b4 f8 84 54 cf 5a e7 48 99 96 69 f9 21 49 bf c1 f4 e4 b8 6a e3 8c 38 e6 16 47 8f f4 fa 12 27 90 23 5b b2 27 bb 47 c8 76 41 4c b2 90 e9 e1 90 8d 94 1f 12 19 42 3e 60 6d 57 72 4b e3 16 7e 78 6d 07 ea ef d4 68 6a 44 72 60 93 df 54 93 43 c1 4d 8b d2 70 19 77 4e fb 2f 72 29 17 72 45 59 b7 77 5b b7 6d 1b 94 31 2b 4f 11 f0 4e 44 b9 4f 28 57 4f 2a c8 4f c3 24 af 50 90 ff b9 b3 4d 4d 2e a8 dd 22 35 08 2a 80 1d 40 00 04 76 70 76 77 50 77 3f f5 98 37 25 77 3b 05 2f 99 19 99 7f 77 9a cb db bc 2b 21 e2 28 53 5a 1e 4e 9b bf d9 e3 ce 68 31 a3 65 9b a1 d7 5e 98 15 0b 75 6e 33 b9 45 bf 39 b3 e2 a6 c5 9d b7 57 0c c7 97 34 47 f3 0b 29 ee 59 f3 39 34 c9 d0 bd 08 3a c1 19 dc c1 1f bc 7e 91 c1 26 36 61 13 b0 41 17 58 a1 6e 88 91 2f da a6 Data Ascii: "Q8lur 6\TZHi!Ij8G'#['GvALB>`mWrK~xmhjDr`TCMpwN/r)rEYw[m1+ONDO(WOO$PMM."5@vpvwPw?7%w;/w+!(SZNh1e^un3E9W4G)Y94:~&6aAXn/
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 6e 93 d9 99 ed 43 36 67 b3 3a 70 33 ba 12 f7 bd 9c c2 b4 86 b3 67 ea cb 32 d5 ef cf ac 02 37 ac c2 32 1d 53 cf f8 8b af e1 82 2e 10 43 bf a8 1a a0 a9 da a8 69 83 a9 21 21 34 c0 ab a2 39 c3 37 94 8d 8a c5 43 00 64 40 af 1d a5 3e 67 61 d5 6c 21 35 60 30 c2 d2 94 30 bc 43 4e f5 84 32 b8 43 4d c2 d1 7e 53 1f 0b 6b 1b db 84 02 45 4b c3 07 f8 01 3d a8 f0 b4 9d 14 48 20 1b d8 94 44 71 26 db 83 97 8d b4 39 ff a7 4d e0 30 48 7d 83 3b 90 1b 33 74 aa 29 68 b6 11 b7 6c 8f 11 a2 27 78 02 4d 37 b1 77 e2 74 8a e7 f4 e1 58 a2 7d 8a 5c 52 21 f5 50 b3 c5 8c 77 05 7c 7a f1 1a c7 78 8e f7 27 c9 45 75 8f fb f8 8f 03 79 90 53 48 87 58 f5 85 64 6f f6 36 1e 57 87 90 57 8b 75 93 3b f9 93 a3 90 ef 8d d1 9a 18 b2 98 24 d8 84 79 51 48 a6 82 28 00 c3 a2 f2 49 4a 56 b2 e8 d6 b5 a0 08 Data Ascii: nC6g:p3g272S.Ci!!497Cd@>gal!5`00CN2CM~SkEK=H Dq&9M0H};3t)hl'xM7wtX}\R!Pw\|zx'EuySHXdo6WWu;$yQH(IJV
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 63 6e bc 62 34 ee 37 c5 43 0a 73 91 bc 16 b2 85 60 7d e3 ae 88 f0 76 24 98 89 bb 63 64 0d a9 87 c9 63 8e e3 38 67 ed 63 d8 33 89 68 65 9c 83 34 64 b9 a3 18 99 5a 1c 70 ed bb 47 86 19 89 7c 2a 9b 4b 99 9e eb e4 4c ce 86 75 95 f1 9f e1 15 7b b8 49 b4 19 d8 b6 79 c9 9a 1c e5 7e f5 71 b7 ea 71 b7 d2 ba b3 4a e5 ad 9b b6 24 4f d8 1f 35 e0 10 d9 c1 c3 f6 1b 87 b5 e5 9f 42 aa 64 08 66 13 cf 2b c3 21 e6 8f ff a8 bb c1 e1 06 5d 2e 08 7b 21 08 6d 08 07 78 50 06 70 10 87 6b 0e 07 70 18 3c c3 6b 09 88 a3 97 d7 b1 05 d3 1b e7 78 2e 1e a3 18 0a 9f 55 8a cb d3 bc f7 ee 4b da e2 59 d3 fa d5 d2 fa 06 e1 2a 0b 77 00 0b e2 92 da e4 e2 67 eb 19 05 81 26 99 b5 db 5a ca 34 68 af 9d ae f0 a4 b5 24 20 4d f4 ec 02 31 a0 b0 29 b0 82 30 70 9f f3 72 8d c6 e8 bf 26 78 83 b2 55 3f bd Data Ascii: cnb47Cs`}v$cdc8gc3he4dZpG\|KLu{Iy~qqJ$O5Bdf+!].{!mxPpkp<kx.UKYwg&Z4h$ M1)0pr&xU?
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 10 1d 79 7b bf f7 0f 93 30 92 94 30 09 8b f0 0f fd 80 92 03 41 0f 92 40 09 22 29 10 8c 30 92 8d d0 64 ff a0 08 8d e0 7b 8c ff 70 92 17 d1 08 8f 30 09 89 80 7b b8 87 10 89 e0 92 b8 a7 93 11 d1 64 9c 40 1d a6 d0 32 fa 26 5a 2d 03 6a f4 86 6b ce e7 18 64 95 56 66 86 24 93 f1 33 e2 b1 95 da a3 38 5d 09 27 40 a5 3d ea e7 3c 90 26 3c f8 47 96 2d 05 7f 7f 66 22 2f d2 23 6e b9 3c 2a c2 3c f5 c7 22 f8 27 68 e3 87 90 98 e6 80 10 d9 4e 7c 09 0b 08 e8 1c 08 f8 97 06 e8 97 7e b9 94 d4 61 4f 9f f6 90 11 59 81 ac 97 1b a9 46 3f 56 35 6b e8 c3 81 9f 75 1d 1e e8 81 22 38 82 cd b0 99 b3 d0 0c 9d c9 99 2c 18 9a 2d f4 0b b3 40 9a c3 f0 82 a8 79 4b 8c 67 34 be 84 77 34 58 0b ee 00 0f 08 53 3c 71 f7 74 eb 30 0d b6 75 5b 46 d0 87 d0 c2 5b 54 f8 9b c5 05 88 c5 15 72 58 a8 85 c6 Data Ascii: y{00A@")0d{p0{d@2&Z-jkdVf$38]'@=<&<G-f"/#n<*<"'hN\|~aOYF?V5ku"8,-@yKg4w4XS<qt0u[F[TrX
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 6f c4 f0 42 c4 b8 4f 2d dd a2 14 5e 02 1b f0 a8 5e be c5 fe a0 01 c7 e4 af 22 ce 25 16 e8 05 22 e2 8f 2f db 6f 5e bc 05 25 ff 8c 83 39 0a 47 56 8e c2 bc a8 8f 2b 55 01 bd ce 8b 31 19 86 27 fc 25 1b ea 04 4f 28 c6 2a 68 88 cb 5a a9 cb bc 0c 02 61 e9 29 66 49 71 cc 0c c5 30 30 30 6e 66 31 ea cc 34 4d 33 26 85 e1 18 14 82 16 e4 61 1d 6a c1 16 6c 6b cf 72 80 1e 76 60 88 fc 20 07 3a e0 1b 6e 00 24 7a d3 23 26 87 72 74 03 37 c4 46 6c 86 13 41 c8 06 37 78 40 09 84 33 10 7d 60 1d 2c c0 71 e8 c6 2d a8 c3 56 9c 83 18 fe 01 57 18 67 d6 92 e3 57 ec 68 58 1e 27 d8 22 a7 23 b0 50 d4 aa cd d0 ac 29 11 11 91 a4 d2 93 9a 68 10 08 4a 0d 38 20 0f 68 70 01 9f 04 02 0e 01 0a a0 96 23 39 ea f0 6f 74 cd 26 7a cd 2d f9 b0 d5 22 c7 23 e2 e1 a2 8c a0 03 aa 6d 3d c1 10 3d db 33 06 Data Ascii: oBO-^^"%"/o^%9GV+U1'%O(*hZa)fIq000nf14M3&ajlkrv` :n$z#&rt7FlA7x@3}`,q-VWgWhX'"#P)hJ8 hp#9ot&z-"#m==3
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 55 a0 e1 64 da 70 e8 86 07 be 26 71 38 c2 a4 b5 0d 08 ce c6 09 1e 87 dc 3c 8e b9 b5 60 a8 89 d5 75 70 c7 ff 91 1a e7 84 66 ff 45 29 27 e8 7c ce e8 84 07 2f 88 ce aa f9 e0 b1 60 14 11 2a 13 75 f2 42 b2 e9 c2 28 24 61 77 e2 1a 50 31 e1 13 ee d4 4b c1 14 14 4a 61 f4 34 48 8a 58 21 16 d2 42 7a 80 03 2f 68 0d b6 45 93 b4 81 21 35 41 9b f8 74 cd 51 6d 1b 37 99 cd 56 69 95 57 91 9b 1b de 0f 1c c6 21 72 96 95 1d e6 a1 03 29 28 9d 48 50 2e c8 82 5d f9 e1 1f 56 90 05 bd 03 5f 8d 43 28 74 00 61 11 01 22 0e dc 10 0c 81 22 7e a8 87 2e a2 23 2a 1c 74 59 d6 73 29 1d 72 11 9d 0f d8 8b 0f 18 e2 28 8e a2 89 0a 4c 26 76 56 67 71 e2 be 44 63 74 8d 62 10 ac 43 3c 9c e2 10 0d 11 07 21 0a a2 dc 49 2e 6c a6 7b c4 e2 ca 29 cb cb e5 e2 cc f9 e2 6f 51 4b ce a9 5c 38 50 03 b9 1c c3 Data Ascii: Udp&q8<`upfE)'\|/`uB($awP1KJa4HX!Bz/hE!5AtQm7ViW!r)(HP.]V_C(ta""~.#tYs)r(L&vVgqDctbC<!I.l{)oQK\8P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49869	52.219.132.71	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:38 UTC	378	OUT	GET /wns1300x200.gif HTTP/1.1 Host: sezhang.s3.ap-southeast-1.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	416	IN	HTTP/1.1 200 OK x-amz-id-2: +RfJ2UYxFxk+paVnXf4r7jpW+jRWTlvurQGcvKDL5v+BN/iNjvhoT68gpbYMrXOJv9QzwBt2/xQ= x-amz-request-id: Y40P5XWTE7QZNG6X Date: Thu, 02 Jan 2025 05:12:40 GMT Last-Modified: Tue, 10 Dec 2024 11:40:45 GMT ETag: "6f3da74816d4b2b65413f732991f8c10" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: image/gif Content-Length: 569641 Server: AmazonS3 Connection: close
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 fa 00 10 03 02 16 06 02 17 0b 01 1c 0a 08 1d 03 04 1e 12 03 21 14 04 2b 0e 03 2e 15 11 2e 21 13 3b 32 24 3f 23 1b 4a 3b 2f 4d 35 20 56 46 36 5c 54 42 17 00 02 18 04 04 21 03 04 2d 04 05 67 4f 35 69 5c 44 6b 62 47 79 5d 3f 7a 63 41 7c 6c 51 85 75 4f 86 71 5e 89 7e 5e 2f 11 08 3d 04 05 40 15 0e 4f 21 1d 69 52 42 7a 42 23 8b 6f 4d 99 7d 63 a1 89 73 40 06 09 5a 3b 2f 8b 63 45 99 79 61 79 51 3e 98 6e 65 4f 0f 0a 4f 15 10 40 01 08 60 21 1f 3e 00 05 15 00 00 33 02 07 17 00 00 62 38 1e 37 00 05 41 02 07 44 00 07 1f 00 03 1f 01 03 2c 00 05 2d 25 1f 3e 38 2d 76 69 5f 0b 06 04 4c 0e 07 2e 00 03 0b 01 00 66 26 3b 21 00 04 29 00 03 1a 13 0c 54 46 24 5f 49 21 95 77 4c 9c 82 62 5e 1f 15 55 50 40 7e 6a 40 98 82 4c 9f 89 65 a5 98 77 a6 9b Data Ascii: GIF89a!+..!;2$?#J;/M5 VF6\TB!-gO5i\DkbGy]?zcA\|lQuOq^~^/=@O!iRBzB#oM}cs@Z;/cEyayQ>neOO@`!>3b87AD,-%>8-vi_L.f&;!)TF$_I!wLb^UP@~j@Lew
2025-01-02 05:12:39 UTC	608	IN	Data Raw: f1 b7 86 6b eb 84 a8 53 6e b8 f9 90 41 ba ae 6b 55 6e b5 53 b9 ab 01 d4 78 01 08 c0 8d e3 b8 8e 33 5b 03 a4 03 2f d8 b4 b1 96 66 03 cc 35 12 47 83 11 44 ff 66 ca 9e 72 8d 02 e9 59 26 f6 2b 3f 79 bf c6 b2 61 4b 49 5d 41 89 96 b8 55 2c 2b 09 5e f1 f2 38 47 51 fc fa 72 93 02 b3 30 9f c1 30 53 ec a3 88 81 06 0c 80 03 2c e6 b1 69 4a a7 20 c1 02 5c e9 a7 b4 a9 17 30 81 31 52 66 67 ad ac cb aa 56 13 34 c1 18 95 11 a0 07 ba a0 03 7a 9f 27 01 12 18 ba a1 77 41 12 28 fa 69 ad 56 14 48 41 18 40 7a 01 97 26 2f eb 6c 6e 7b 4b 1a 38 c1 f0 09 9f f0 dd a9 6b b2 f3 0c 0c ad a2 c2 33 d4 32 83 70 33 2d a1 d2 a3 09 a8 00 09 e7 33 c1 49 ad cf 22 27 6b c2 70 c5 38 60 73 0f 34 ae 13 34 09 4e 67 1e 88 44 34 50 03 8b 45 43 47 97 a0 33 e8 d2 f3 86 b4 55 84 f7 06 d6 97 48 98 44 4c Data Ascii: kSnAkUnSx3[/f5GDfrY&+?yaKI]AU,+^8GQr00S,iJ \01RfgV4z'wA(iVHA@z&/ln{K8k32p3-3I"'kp8`s44NgD4PECG3UHDL
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: e7 be 44 5c dc 4c ef 5c 87 c1 80 29 50 bb e5 2a 8e ae 3e 06 0b a0 c2 23 98 c2 28 8c c2 e4 b3 bb 48 8e 04 2f 2c af f2 ae b7 f2 a2 77 8a bc 83 f4 db 77 ca cb 37 7e e7 f4 68 7c 61 f0 c6 86 1d 4a 0f 55 3f e5 9e 2d 03 fa 93 e1 df 49 ab ef c2 94 4c e1 f1 87 6a 6b c3 1b a2 1f e7 9d de 09 22 6e bc 82 fa 77 6b 7f 00 44 2e 81 03 a1 19 5b 56 26 58 42 60 0a 17 32 64 78 06 d6 29 61 99 2c 55 b2 b8 08 10 a0 3b 76 38 ce f1 e8 d1 40 81 90 02 48 96 1c 40 f2 11 3b 6f f6 58 b6 c4 e7 92 25 3c 76 82 02 00 b0 09 60 10 3b 78 2f 79 c2 e4 d9 6d 1d a1 9b 41 88 16 55 64 f4 68 52 a5 92 96 32 75 da 14 aa d3 21 3a a6 56 9d 60 95 08 d5 ab 5a b3 76 e5 fa d5 ff ab 55 1c 59 25 8c 35 5b 16 ed 59 b5 69 d9 ae 75 db 16 ee 5b b9 6d b7 86 ad 7b 57 6c 5c bd 73 b1 82 c5 fb d7 6e d5 b6 11 6e 12 86 Data Ascii: D\L\)P*>#(H/,ww7~h\|aJU?-ILjk"nwkD.[V&XB`2dx)a,U;v8@H@;oX%<v`;x/ymAUdhR2u!:V`ZvUY%5[Yiu[m{Wl\snn
2025-01-02 05:12:39 UTC	1024	IN	Data Raw: 09 05 0f 22 24 98 70 e1 41 08 33 1c c6 00 20 71 62 10 8a 15 2f 2a c2 98 71 a3 24 8e 1e 3b 7e 0c 29 72 24 48 92 26 4b 7a d4 a8 f2 64 ca 95 16 5d c2 8c e9 43 e6 4c 8a 01 2c 0a f0 91 73 a7 80 1d 4e ae f0 39 13 74 28 51 3e 49 16 f0 14 b0 40 c3 97 a2 4e f9 5c 89 1a 55 8c 93 06 05 72 16 48 80 64 8b 98 3e 5e b7 78 35 b3 c5 0c d9 b2 64 c3 a0 45 db e5 88 81 a4 6e dd 2a 68 e2 65 6e 14 ba 75 ed ce 3d 32 a7 6d 81 06 72 ef e2 05 2c d8 6e da c2 61 cc 1e 4a 9c d8 6b 1f 31 8e c5 18 8a 2c d9 50 17 a4 03 04 5c ce ac 79 c0 89 2d 69 3e 83 56 23 7a b4 16 07 7c 2f 27 90 a2 a6 cc ea 32 ae 5f bb 1e b3 a1 c3 81 03 27 b0 c0 ce 0d fb 02 ed 06 54 74 b7 ff 81 ad a6 04 88 0f 26 8c 1b ff 61 e2 07 f3 e5 ce 3f 7c 38 f1 fb 75 f0 ea d4 af 93 79 92 e7 07 72 e7 cc 95 83 f7 ee dc 04 f9 f2 26 Data Ascii: "$pA3 qb/q$;~)r$H&Kzd]CL,sN9t(Q>I@N\UrHd>^x5dEnhenu=2mr,naJk1,P\y-i>V#z\|/'2_'Tt&a?\|8uyr&
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 23 06 26 2d 73 31 cc c0 02 f6 15 91 4d 46 32 95 f9 e1 66 12 90 04 34 b8 2c 66 ee e1 42 c2 d4 64 01 2d e8 0c 38 6a 98 82 55 10 90 81 31 00 27 37 57 38 41 6f a6 93 46 d6 10 07 39 5d 83 ce 77 b8 03 1d e8 94 2d 6b 58 5b 5a 1a 9a 06 b5 e5 d4 31 90 e0 69 ce 77 c6 73 9e f4 b0 47 6d 68 83 0f 1f 50 c0 82 b7 41 d2 3c 26 5a 50 de 2a 49 20 4a fe a7 41 0f 0a dc 84 1a f1 80 0a f0 c0 70 9d 60 44 e2 18 b1 03 0b c5 c1 13 0f 20 dc 03 36 d4 21 1a 54 ce 73 b2 9c 25 2d 6b b9 1f d0 dd 2e 97 ba c4 1d eb 78 e9 4b 2b f1 2e 98 c2 44 9d 92 48 f7 4b 60 ea c0 77 ca 0c 5e 9a d2 b4 19 8a 41 b3 78 6f 32 15 fa 22 c5 be f6 49 cf 9a a4 ca 54 f9 ba 89 3e 44 a5 ff 4f 9b e2 8c 9f 37 cb 09 4e 6d b2 6f 7d a3 da 66 a3 4e 95 2a fb 0d 8f 8a 2a eb 1f 3d 1d 68 cf 0c e2 33 9f c7 4a d6 02 f9 e9 cf 7e Data Ascii: #&-s1MF2f4,fBd-8jU1'7W8AoF9]w-kX[Z1iwsGmhPA<&ZPI JAp`D 6!Ts%-k.xK+.DHK`w^Axo2"IT>DO7Nmo}fN*=h3J~
2025-01-02 05:12:39 UTC	1024	IN	Data Raw: 36 d1 08 54 f0 89 4e f1 80 86 9e e6 d4 a7 3d f9 89 21 74 12 54 06 96 d5 05 87 4d 8a 51 ab 9c 80 2a 59 a9 ad 35 70 ab 11 98 58 01 26 42 c5 a9 5a 36 62 07 21 20 41 09 28 49 ab 77 9c 40 98 27 50 00 ac 18 80 2a 64 d6 4a 99 9e c8 15 26 7a 80 09 eb 68 50 5f 3b e8 c4 9b 46 90 46 2e 24 6b 69 6b 18 01 b6 66 e0 cd 6f 86 13 9c e3 14 67 39 b1 85 00 65 61 6a 63 ff f2 17 3b dd 89 85 0a 11 23 89 33 4b 22 32 a6 01 c2 99 fd ca 5e ea 22 46 28 3e 48 2f 05 f9 42 0b 32 82 42 bb 42 b1 09 62 08 e4 0d 16 58 96 17 12 00 31 88 5e 2c 00 12 6d 61 45 53 88 82 58 ae 21 53 8d 20 63 3b 3d 56 2e 2d fc a2 1c c6 28 07 24 4c 96 06 35 5c 21 83 c2 4a 11 08 99 79 ff d0 50 10 63 16 59 c0 c2 c9 d0 e0 07 9d 91 a3 1c bf 30 44 d0 50 e0 05 f1 18 0d 69 21 68 e8 6d ce 96 36 a4 1e 35 a9 4a 65 6a 53 9d Data Ascii: 6TN=!tTMQY5pX&BZ6b! A(Iw@'PdJ&zhP_;FF.$kikfog9eajc;#3K"2^"F(>H/B2BBbX1^,maESX!S c;=V.-($L5\!JyPcY0DPi!hm65JejS
2025-01-02 05:12:39 UTC	1749	IN	Data Raw: 18 41 12 c0 6b c1 e6 54 61 0a 49 78 c2 90 c8 30 5e 89 4b 9c 0c 56 40 06 28 a8 d9 41 c8 73 90 bd 93 df 43 79 52 11 8b 4a ac 50 f3 ec 59 0f 0c fd c0 07 1a fa f7 c5 3c 24 fd 07 36 70 20 83 cd e2 89 9e 60 a2 a8 1f fc 06 05 09 b1 60 d0 d1 42 18 c4 30 85 5a 51 73 c4 19 1e 00 02 2e f0 dd 01 5d b0 0a 3d d8 c1 8a 7a df 7b 2e 50 81 8c cb bf 02 85 9d df fc 2b a0 51 0c 13 5e 83 8b 61 0c 60 17 e0 30 8e 73 d4 a4 26 fb 94 27 3e 56 e3 08 3c f8 83 9f 28 b1 22 06 a0 80 84 22 10 c1 08 40 60 02 1e 7a 20 0f 5d f0 c2 33 20 11 82 ea 04 a2 14 0b 90 c3 28 b2 cc 65 3c e1 b2 3d f9 32 78 b0 85 3d 51 86 31 33 25 35 42 14 1c 50 33 34 6b 25 08 7c 40 6d 31 ff 94 29 60 97 50 98 06 4f 00 05 21 50 81 25 b0 8e 05 18 85 70 10 15 3e 1b b4 59 b1 15 13 24 c1 46 98 86 69 c0 84 12 78 02 0c dc 01 Data Ascii: AkTaIx0^KV@(AsCyRJPY<$6p ``B0ZQs.]=z{.P+Q^a`0s&'>V<(""@`z ]3 (e<=2x=Q13%5BP34k%\|@m1)`PO!P%p>Y$Fix
2025-01-02 05:12:39 UTC	9000	IN	Data Raw: df 72 48 e1 1a ae 88 2c 0d 8a 64 bb d7 78 8d d8 00 97 cf 9b bb 0d 18 01 38 e0 05 54 68 82 27 70 20 c0 6b d5 12 08 81 0d f8 bb e5 c0 a0 42 94 3c ec c0 d5 99 8c 49 f6 52 00 56 18 05 47 08 04 16 c2 af 00 98 1b 39 d8 82 9e f4 49 fb b8 be 1f e9 01 66 4d 90 03 99 85 80 2a 30 d9 a3 56 68 a5 85 da 60 96 6c 0d 01 2a fe 22 46 4b 00 05 08 81 12 78 83 10 08 11 09 22 d7 0b f2 5a 4c 00 83 6d eb 30 02 19 a1 42 80 d7 b4 a4 57 1f c8 00 da d8 02 7d 45 56 b9 ac 01 80 95 34 5e c8 05 bb ec 32 8e c5 04 28 30 06 85 bd 04 16 e1 81 10 20 21 38 b8 00 1a 78 3b 67 78 87 2e e8 83 65 48 06 f4 60 11 2c 6b 05 07 48 11 47 c0 e3 2c 33 86 5d 88 57 e8 63 db 4d 26 33 13 15 cd d1 2c 4d 51 7e 40 b4 2d 01 d5 93 a7 45 0c 81 3f c8 05 68 58 87 75 88 86 3e a1 06 5c ba 4d 96 89 da 54 b9 e5 11 6c ff Data Ascii: rH,dx8Th'p kB<IRVG9IfM0Vh`l"FKx"ZLm0BW}EV4^2(0 !8x;gx.eH`,kHG,3]WcM&3,MQ~@-E?hXu>\MTl
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 5c 5f ff 5a 73 c3 a9 22 10 27 b0 00 1c 6a 51 8b 5b 20 a1 10 b8 50 46 34 ce 71 0e ec aa 10 74 a6 53 fa 65 73 70 59 d5 69 b6 75 3b 78 83 c8 8c a6 00 14 53 9b 16 c4 48 49 03 66 f2 02 9c 78 4c 01 d9 01 0a 20 34 73 5b 40 90 62 b7 df fb 8a 34 20 f1 0c 3f fc 82 17 b9 30 46 2e 72 21 c3 61 18 c3 e6 4b 61 07 74 c7 b7 3e bf ff 9d ba e6 bb c3 20 52 b1 85 60 5c 01 03 83 90 05 e3 be 2b 88 24 fc 65 04 14 10 c1 11 de a1 de 76 b4 83 1b 50 28 20 32 1a 71 51 a9 23 03 f4 6f 40 6d 7c df e0 0b 62 58 80 82 34 b8 c0 80 0f fc 17 92 93 5c 83 fc 21 0b 83 71 03 81 d0 51 18 f7 28 e4 d8 d1 46 d0 85 00 97 46 3e bb d0 c5 2e bc 40 81 21 be 47 3c d3 48 49 27 42 81 89 ff 99 75 c2 13 a0 50 f1 26 a6 81 89 f2 a8 78 1a 41 89 6f 23 36 50 81 10 90 e0 9e 5a 18 07 3c 5a b1 0d c4 94 e6 01 5c d4 da Data Ascii: \_Zs"'jQ[ PF4qtSespYiu;xSHIfxL 4s[@b4 ?0F.r!aKat> R`\+$evP( 2qQ#o@m\|bX4\!qQ(FF>.@!G<HI'BuP&xAo#6PZ<Z\
2025-01-02 05:12:40 UTC	1024	IN	Data Raw: 45 82 98 fb 1f ce 33 42 f4 64 60 7d 5e 48 81 03 32 80 5f fd 82 3d 89 32 2e 64 0c 16 10 19 24 a0 62 10 34 b8 c3 1f 06 f1 87 cf ff 41 bb 17 80 fb 1e be 05 23 64 38 40 c3 66 34 c2 11 d2 98 46 10 57 c2 f5 ae 1f 31 89 a5 74 62 07 31 01 bd 83 00 04 0d 4c 21 08 1d 27 01 01 33 1e fe 9b 47 6d 2b cb 9f 67 0a 50 18 87 38 50 21 4c 18 6a e6 15 2f 13 54 0f 36 d1 4c 4f 8a ab 04 b5 78 44 94 55 80 82 14 78 c1 7c 24 f8 14 a8 20 bc 29 5a 58 e1 0b a6 0a 47 16 0e 92 85 35 b0 ea 19 87 08 bf 0f 93 40 01 e3 c3 b9 f8 ff 1d 81 13 38 60 fd 1d 29 d3 ae 84 42 23 e4 48 23 ec 80 b8 6c d2 1b 0c 8b b7 70 d9 06 54 13 26 60 02 32 ac 4b 15 30 9a f2 41 c1 14 b0 4b 38 55 ff 01 a7 95 0b 15 a0 8b 15 d0 42 16 98 8b bb 28 da 14 bc 87 05 c8 c1 05 d4 df fd e1 5f 0b c6 d3 aa c1 60 0c ca e0 0c 96 5a Data Ascii: E3Bd`}^H2_=2.d$b4A#d8@f4FW1tb1L!'3Gm+gP8P!Lj/T6LOxDUx\|$ )ZXG5@8`)B#H#lpT&`2K0AK8UB(_`Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49871	52.219.132.71	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	375	OUT	GET /150x150w.gif HTTP/1.1 Host: sezhang.s3.ap-southeast-1.amazonaws.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	415	IN	HTTP/1.1 200 OK x-amz-id-2: 9s02sxrIcrHHU1QUj7+jke21Azkh4YTDd1xNZYau8/2HhGrxAImBIprPeYHI2GAq5xI8vlBdja0= x-amz-request-id: Y40S4V4RZA79M6GD Date: Thu, 02 Jan 2025 05:12:40 GMT Last-Modified: Sat, 23 Nov 2024 11:59:46 GMT ETag: "816e33f667b33b9dc57759242fb983e0" x-amz-server-side-encryption: AES256 Accept-Ranges: bytes Content-Type: image/gif Content-Length: 91488 Server: AmazonS3 Connection: close
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 fc cd 4e fe 10 10 f3 b8 4b b7 87 2e 89 56 0d f8 d5 d5 ff ff ca ff f7 77 22 11 05 aa 72 09 ff e7 a8 97 65 0c a6 00 01 fa d6 87 ff f7 56 35 22 09 d9 06 07 c9 03 05 08 00 00 ff ff 00 ff f7 68 ff f7 aa ff 00 00 d1 c6 38 ff de 95 99 87 52 8a 58 1f f7 ce 77 9b 92 23 b9 00 01 aa 98 6f 8f 78 48 ba ba b9 f6 99 9a 8e 01 01 ed 08 08 da cb 90 d7 cd 71 f6 af 39 56 34 11 75 69 4a d6 cd a7 f4 d3 00 cd 9a 48 9a 66 23 0f 08 00 f4 b6 b5 68 43 14 d4 95 02 64 39 0d c8 a6 55 f5 9a 01 d4 bc 88 d2 b6 b5 d6 ca 51 d9 a9 36 76 49 16 eb bd 60 fa d8 79 f8 6e 72 b9 a7 6d d2 cb c8 45 26 06 d5 95 95 74 67 33 97 75 36 45 28 10 ff e7 9c 18 10 02 fe 38 00 ce 6c 6c a9 74 23 77 57 23 f4 d5 3a e5 d8 ac f8 cc 69 fb 00 10 a7 69 25 cc ac 66 6c 63 18 ca 97 Data Ascii: GIF89aNK.Vw"reV5"h8RXw#oxHq9V4uiJHf#hCd9UQ6vI`ynrmE&tg3u6E(8llt#wW#:ii%flc
2025-01-02 05:12:39 UTC	609	IN	Data Raw: 0a a0 c0 84 3a 34 e0 83 ed 3c a2 a8 12 9b d8 a0 c8 75 71 a7 87 e8 a3 e1 56 d7 d2 93 3e 92 55 87 1b bf 18 97 52 88 81 15 86 47 5c e7 01 04 78 01 52 b0 f0 85 23 8c 81 00 ff 58 ae 13 b6 f0 81 46 a0 e2 61 47 60 c1 16 5e c1 85 d0 b4 53 11 e0 ad 03 55 0c 5f 31 69 48 e9 43 17 17 2b ba d6 05 4e 0f 86 8c ef 08 c9 15 af 44 78 b5 f7 d8 be ee e5 d1 0b 0a c0 70 85 2c e0 c2 09 40 10 c2 a4 ac 00 0a 64 07 02 d9 03 a0 01 1e e0 d0 88 2d 54 73 01 5b 37 03 1e fa 10 86 29 a0 e0 15 1f 88 86 22 f4 b0 82 15 c0 81 1c f1 00 03 ff 0a c2 63 bd d4 b7 87 be f3 9d fd 8a 61 df 91 aa 89 f0 ef 44 38 4a ee 15 11 0f 4b 58 02 0e 67 d8 c3 19 e2 a1 07 02 58 e1 16 2f 50 48 5b a0 01 91 30 00 98 b0 07 d8 f4 4c ad 40 40 88 90 03 4b 00 05 55 f6 4c 7f 35 00 f5 20 0c dd 27 03 82 10 48 83 e0 01 8b 70 Data Ascii: :4<uqV>URG\xR#XFaG`^SU_1iHC+NDxp,@d-Ts[7)"caD8JKXgX/PH[0L@@KUL5 'Hp
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: f0 0c 52 04 1b cd e5 87 56 70 2f c7 38 06 b1 c0 05 52 50 02 4e 10 39 3e 70 0b 38 80 0d d5 20 00 0b 30 06 7a 90 07 2c 70 06 e1 a0 00 51 f5 0f 66 b0 09 91 b0 07 9b 30 00 47 f0 05 0a c0 0b 0b 20 0f ab 00 07 6a 80 0b 1f ff f0 41 53 30 00 d1 40 7b 4b 87 8f 7c 37 8b a6 06 72 b6 b8 5a 44 09 94 44 c0 05 5b 30 06 53 c0 05 04 90 00 09 00 03 6d d0 3f 0f 80 09 79 b0 05 6d 30 03 9c d0 06 09 60 08 19 10 08 86 30 0b 4e 80 04 fe 70 0b 0b 60 0d b4 23 0f 04 70 04 6d 00 0a 31 80 08 5a e0 05 09 f0 0e 66 30 00 70 b0 07 7b 40 0a 0b 40 50 a4 b0 02 04 60 06 e1 20 03 6b 50 0f 7d f0 77 56 40 0a 8f f0 8a b1 68 5a 44 99 66 df 36 1f 69 06 72 05 d1 8f fd 48 94 b5 68 94 6c 68 05 eb a3 07 85 10 04 04 d4 0a 50 c5 06 c2 d0 06 5c 19 04 5c b7 00 09 20 03 1f 90 07 96 94 07 27 e0 03 2c 40 01 Data Ascii: RVp/8RPN9>p8 0z,pQf0G jAS0@{K\|7rZDD[0Sm?ym0`0Np`#pm1Zf0p{@@P` kP}wV@hZDf6irHhlhP\\ ',@
2025-01-02 05:12:40 UTC	1024	IN	Data Raw: 00 04 af f0 01 34 10 62 9a 0d 50 08 e0 e6 61 08 08 96 72 0b c9 c0 c4 10 ac 10 27 80 bc 44 94 5d 29 14 1b 96 32 4c d8 6d 9e da 95 00 12 e7 2c 57 ea 55 61 1e f7 bd b5 08 d8 cc 85 10 b8 08 d1 f0 08 ca 30 4c 82 57 1d bd 26 04 74 90 07 ea e2 2c 0a 21 04 32 26 c4 b4 63 f5 a8 22 e6 0a e1 e3 09 10 03 00 87 dd 9c 7f 10 00 f9 99 a1 39 4c e9 3c 10 cc be 10 b4 05 58 27 a0 4b 82 07 12 c3 df fb 09 a1 cd 6e 9a 85 b6 af 10 75 40 d4 64 d6 21 8c 31 26 f6 45 69 ce ff cf 53 62 1e 3f eb 1d 5c 9e 29 10 89 db 21 70 95 7c cb df fd 48 54 6c 3d 05 fe 33 16 58 99 a6 fe 40 6e 5f 12 74 d7 46 a4 10 b5 5f 57 d3 2f ff a4 03 10 2d fe 0d 24 32 70 a0 15 83 08 07 aa 7b 60 d0 20 0d 87 04 23 4e a4 58 d1 e2 45 8c 19 35 6e a4 c8 a5 90 0c 68 20 65 fc 83 f6 0f 24 45 34 ff 68 74 c1 38 64 a0 4b 87 Data Ascii: 4bPar'D])2Lm,WUa0LW&t,!2&c"9L<X'Knu@d!1&EiSb?\)!p\|HTl=3X@n_tF_W/-$2p{` #NXE5nh e$E4ht8dK
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 14 18 c9 0b 2d c0 f2 8a 80 79 77 10 08 32 5a 07 82 75 06 c2 1d 02 b6 5d 5e 07 98 df 87 36 e8 f7 11 e6 9d 74 90 5d 51 96 b5 6f 47 4b bf 6a 04 aa bb bd 48 eb b7 ed 9d 94 1e ad 27 d2 da f2 dc 2f 8a c0 a0 da e7 31 a8 61 97 bd fc b3 e2 88 2c 77 fd d4 75 d6 51 fe 77 e0 81 39 9e 5f 39 37 cf 1d f8 69 ef d7 7f ec 96 47 d8 1f 7f 8a 68 0d 74 6f e8 5e 45 6a 77 bb db e9 4e 7c 06 99 47 04 c4 d7 c0 05 0e 44 7c 93 42 c6 d7 1c d5 ac 45 71 ef 72 8e d0 53 f7 3c 26 ff 8e 48 1d d0 68 95 62 47 01 02 95 40 04 fe 03 02 23 c0 9d 0a dd 67 b4 32 e1 ae 80 89 6b a1 0c 6b a7 c2 7f 48 2c 77 10 00 06 0f 57 e8 90 14 b6 70 1e 37 9c 88 03 bf 37 10 07 d6 6e 5c 61 12 47 08 12 58 c3 88 a0 cc 08 0e 81 c0 b6 1e 55 80 43 18 10 81 10 40 19 d4 5c 38 bc 1b ce eb 86 ed 83 00 d5 be d1 c2 1d e6 2e 81 Data Ascii: -yw2Zu]^6t]QoGKjH'/1a,wuQw9_97iGhto^EjwN\|GD\|BEqrS<&HhbG@#g2kkH,wWp77n\aGXUC@\8.
2025-01-02 05:12:40 UTC	1024	IN	Data Raw: 37 86 40 d0 6f b6 4e fb dc 9b 05 2f 37 ee 9f 15 ea 60 9e 0e ea 56 c8 08 ed 06 e9 70 b6 1f ce fd f9 ea 79 9a 66 ee dc bc b7 db 65 a0 cc 13 a2 71 36 23 de fe e7 6a 84 fa 3e 64 cb 74 0f ea 1c 67 ba 77 7e e8 f3 0e fe 01 5d 78 d2 85 33 1c eb 43 6e 7f 6c 90 5d e2 c6 9a 73 08 e2 06 5c f0 10 7e a8 cc fb ee 47 3b bd 9f 02 c6 95 1b 62 f3 e7 91 fe d9 ec e5 2e 3b fb 84 e2 3e c4 52 ec b1 17 fe 1f d1 25 62 60 78 bb 7f a7 93 df 79 38 2b 04 f0 b3 de 41 7e 10 9c c0 41 a0 61 fc 3b c8 2e a4 b7 9d 43 40 8c 67 66 03 5a 04 9a f6 03 05 fe ec 67 0d 93 db f5 06 c7 ff 9b 41 e0 cf 67 c5 9b 60 c3 f2 07 3a 06 1a 24 79 0d 99 87 70 02 77 90 08 38 22 38 3d b0 9b 41 72 d6 3a 04 2a cf 84 c3 2b de 40 04 b8 40 20 4a 70 1e 07 a4 0d e3 4a 88 90 13 36 8c 1d c1 d1 a1 06 eb 36 41 cf 29 8f 01 22 Data Ascii: 7@oN/7`Vpyfeq6#j>dtgw~]x3Cnl]s\~G;b.;>R%b`xy8+A~Aa;.C@gfZgAg`:$ypw8"8=Ar:*+@@ JpJ66A)"
2025-01-02 05:12:40 UTC	1749	IN	Data Raw: 07 46 89 d5 48 59 c6 8f 20 43 8a fc a7 81 cb 2b 2e 96 82 51 54 d8 24 98 25 6b 5a ae 54 23 96 43 9f 82 2b c8 68 40 83 16 44 4e ab 57 1f 1f 44 79 25 85 07 0d 4b 3a ad 8c 5c ca 74 69 14 43 a1 42 65 91 b7 4a 01 a5 55 d0 06 4e 61 f1 af 15 8b 5f df fa f5 53 03 ae 99 30 19 32 0c 41 43 43 43 09 86 06 fa fc f0 c2 a3 e7 5e 2b 24 78 5f 4d 91 93 c1 03 0f a3 29 2c 91 a0 a1 2a 18 0b 3d 75 9a 2a 5e 6c f0 c4 bf 18 8f 1c 23 01 83 e6 17 a5 50 8d ea 35 0b 67 4e 5e 90 7b 24 37 60 39 61 c0 40 16 71 e2 34 e1 58 80 25 0f 26 4c 04 08 2c 48 b0 62 8f 9f 1c 1b 74 90 3b a3 05 97 8e 52 b2 2c 29 21 ec a1 11 97 5f 47 58 60 61 51 c9 31 e3 e7 8b eb a8 93 2e 10 c9 89 53 28 1e c9 01 f5 22 c8 17 19 3c b4 70 ff f9 97 43 4f b2 14 32 b3 19 48 15 23 0f 01 1c b1 5f 2c 98 bf 40 43 6c 4c 5c f4 e0 Data Ascii: FHY C+.QT$%kZT#C+h@DNWDy%K:\tiCBeJUNa_S02ACCC^+$x_M),=u^l#P5gN^{$7`9a@q4X%&L,Hbt;R,)!_GX`aQ1.S("<pCO2H#_,@ClL\
2025-01-02 05:12:40 UTC	9000	IN	Data Raw: 62 50 e3 0c 8c 30 1d 01 cc 78 ca 3c 4c 01 ff 07 3e 80 82 0c b8 60 20 5e 38 0a 09 c5 84 c2 18 16 00 85 dd 2d 41 0f fc 42 e2 bc 5a 31 c1 4f 98 01 0a 2b 90 01 36 b4 71 85 7e 34 43 0a 8b 70 5d 36 a1 68 d8 d9 59 ba cb 1f 2e 1f 7a d1 f1 05 74 e8 60 01 81 8b 81 1e 00 b0 82 05 b4 61 0b ec 3d 01 6c da 73 0f 33 2c 20 06 2c 00 ab 0f f6 bc 85 09 fe 63 0d 7b 20 c6 1a d8 c0 06 62 78 82 0d 6d a8 07 22 88 f1 85 35 c0 01 0e 2b c0 f5 19 0e d0 e8 7e 18 c0 03 54 88 34 fa 64 b7 d1 a7 62 5a 20 2d 90 c6 a0 48 ac 8c 52 70 a1 12 dd 20 c6 02 94 e0 07 1b b2 06 14 36 4c 06 11 12 83 8a 18 08 21 01 af fe aa 22 ac f0 b8 17 20 e1 1f 03 c0 c4 3f b0 a1 05 38 6c e2 0b d4 a0 44 02 a0 e0 84 3b 91 a2 1a c8 d8 0f 1c d6 e0 07 6b 1c 40 54 fd 08 47 23 1a 11 04 3a e0 03 7d 4f 9d 9d 6f e7 0b 84 0c Data Ascii: bP0x<L>` ^8-ABZ1O+6q~4Cp]6hY.zt`a=ls3, ,c{ bxm"5+~T4dbZ -HRp 6L!" ?8lD;k@TG#:}Oo
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 04 00 0a 66 30 b8 2a ff 64 38 f9 81 09 32 f6 5f 28 b3 2f 3f 1b b8 bf 02 c0 c8 f7 0f d0 96 65 98 d0 06 12 fa 0f dc 39 05 d5 20 05 8f 10 50 54 d0 99 04 f7 00 98 60 08 39 a0 07 d4 40 0d 1b 30 2e 78 60 0e 4e 50 07 24 70 06 6f 3c 00 ef 10 09 53 10 05 f1 f3 6b 8c c1 2a ce 02 0a 09 00 0b 2f 90 25 23 f9 0f ea 20 10 28 92 3b d9 65 05 8f 20 05 35 a0 04 52 10 03 0c 55 1d d4 28 0d 62 16 8b ba 85 00 d7 2b ab 5b d0 06 a8 80 04 57 70 05 32 a0 0c b1 a0 03 40 07 5c 8f 30 05 78 40 98 78 00 b2 32 20 07 86 c7 02 28 80 01 70 40 0c 03 30 05 ed 01 04 8f 50 48 42 c5 52 c8 d5 c5 e6 f7 08 78 c2 18 7a 90 09 02 91 5d 0f 50 07 32 d3 05 fa a0 77 e2 40 09 af 60 8c 1a 20 0d 29 16 bd ac 18 8b 56 27 71 79 00 03 7f 06 0e f6 f0 02 24 90 c6 c8 b6 08 72 80 0a a1 e0 01 04 b0 09 67 a0 0f 22 03 Data Ascii: f0d82_(/?e9 PT`9@0.x`NP$po<Sk/%# (;e 5RU(b+[Wp2@\0x@x2 (p@0PHBRxz]P2w@` )V'qy$rg"
2025-01-02 05:12:41 UTC	1024	IN	Data Raw: ae 0f 50 08 b4 24 da 92 90 fb b4 c8 a7 21 0c e9 7c 24 17 17 ff 53 d4 bc a2 93 e4 a1 00 b0 3e db 10 c0 34 0f c2 c1 17 23 40 11 40 08 ed 07 b5 71 69 a1 20 04 40 85 20 a6 47 3e f2 80 d0 fc 5a dc 97 30 b9 3f c4 50 85 63 65 8c 8e 1b 3d ca bb 9d 64 0b 16 5e 6e 20 d9 e2 cd 41 eb c0 e4 e6 91 83 29 f2 75 a0 9b ec 11 07 a1 3f 4e 9e e2 4e fb 35 da 81 bb 99 b5 a0 08 67 70 d3 61 f5 d3 07 11 be 7c 3d db d0 82 29 70 7a b2 ad 4e 55 32 0b fd 60 8a e2 01 94 eb 89 7d 51 82 f8 f2 19 31 39 f0 81 57 a1 72 ca fe 88 29 9a 1e 4a 58 65 60 33 d1 60 c6 79 eb f3 3e 89 4b 5a 6a 13 6f 41 e0 bb 45 8e c2 2b 57 02 8b f2 92 03 6c f0 ce 33 72 c0 e8 23 37 d3 39 f8 70 0b 99 7d 84 7b 71 9f fb 33 9f a9 89 68 1c 45 19 7d d8 7c 7d 86 c0 07 54 28 a4 20 11 e4 9b 10 fe 81 00 93 c8 52 f0 59 22 fc 48 Data Ascii: P$!\|$S>4#@@qi @ G>Z0?Pce=d^n A)u?NN5gpa\|=)pzNU2`}Q19Wr)JXe`3`y>KZjoAE+Wl3r#79p}{q3hE}\|}T( RY"H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49880	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	366	OUT	GET /i/2024/11/09/150-150.gif HTTP/1.1 Host: hongniu.getehu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	556	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 31752 Connection: close Accept-Ranges: bytes Age: 4 Cache-Control: max-age=2592000 Etag: "672e772f-7c08" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Fri, 08 Nov 2024 20:40:15 GMT Vary: Accept-Encoding X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 5e359f7f40c67a44d712ec80f6df9773 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache02.oversea-GM-FRA2
2025-01-02 05:12:39 UTC	15828	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 e9 93 02 da a9 00 97 68 11 ff 58 4b ff ca 15 ff fc 77 c4 4f 09 ff fb 57 df a7 96 15 0e 03 f2 a1 00 f6 97 00 9e 24 07 db cb 1a ff cb 00 db 70 00 d5 61 01 b1 6a 56 ff ea 4b ff af 00 ee 04 08 fd ff fc ef db a8 a2 a7 98 b5 c9 a8 00 54 10 ff 0f 12 75 2b 01 d9 cc 8b 76 eb 53 fb e7 00 9b 52 0c da cf aa 5a 23 03 fe fa d6 ff 8e 2d 6c 6b 50 ff f9 48 79 43 06 ff fe e9 f4 d7 8c 51 0b 00 f4 aa 08 00 d6 00 ff dc 4b ff ca 00 9c 40 01 ff 6b 26 be a8 09 be 96 0c 54 ad 34 34 9d 1a ff 35 1f f0 d8 0d b9 3f 00 38 de 20 e5 3a 25 fc ec c6 7b 4f 15 d3 96 10 dd 00 00 f3 b3 00 d5 b8 6e ff c9 36 b0 88 14 b0 ae 6b df b9 0d dc 90 3f ff eb 5f c9 5f 00 c1 87 12 ff eb 00 cf b7 14 b6 91 3f f6 c8 32 f9 92 00 ab 75 09 f5 dc cc d9 d4 d0 00 ae 00 fe fd Data Ascii: GIF89ahXKwOW$pajVKTu+vSRZ#-lkPHyCQK@k&T445?8 :%{On6k?__?2u
2025-01-02 05:12:39 UTC	15924	IN	Data Raw: cd 41 13 94 82 ea 44 52 15 34 62 1f 80 c0 51 f6 41 1e 68 03 71 16 83 33 28 00 31 7c 03 38 ac 60 1d 40 e4 2e f0 80 0d ec 42 5c 22 00 e1 69 64 04 c8 93 1a b4 22 0e 80 80 1b e8 42 1a ec 42 76 4e 99 77 3e d3 5b ca c1 42 ee 02 75 b6 02 5e d2 83 1a b8 82 1a d4 25 03 44 40 3e 20 40 7c 82 c0 29 d6 01 0a 9e 83 1d 64 02 2c 4c 80 28 1c 00 3c a0 20 2c 6c 01 29 74 43 1b 4a 00 36 8a a6 c7 10 c1 3d f8 da e6 2c e8 36 86 43 21 d1 26 1b e4 1e 6d 76 20 5e cd 41 0e 68 9b cc 34 07 23 cc c1 1f 56 e5 35 2c c3 30 68 83 0a 10 c3 32 38 03 31 24 5d 87 94 41 1a 20 80 01 f8 65 04 bc a8 2b 18 88 42 f2 00 8c 22 40 1a 38 81 0d c8 a2 0d d4 c2 5f ba 41 74 32 00 3d c0 68 2d a8 81 1e 68 24 7d 5a ff d9 2e a4 01 08 b8 27 03 bc a7 1a 34 69 1a c8 68 2d a4 81 16 b8 86 1d 20 03 01 28 82 97 0e 8e Data Ascii: ADR4bQAhq3(1\|8`@.B\"id"BBvNw>[Bu^%D@> @\|)d,L(< ,l)tCJ6=,6C!&mv ^Ah4#V5,0h281$]A e+B"@8_At2=h-h$}Z.'4ih- (

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49879	147.160.191.176	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	367	OUT	GET /i/2024/11/08/1300x200.gif HTTP/1.1 Host: hongniu.getehu.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	558	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 241438 Connection: close Accept-Ranges: bytes Age: 4 Cache-Control: max-age=2592000 Etag: "672df28a-3af1e" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Fri, 08 Nov 2024 11:14:18 GMT Vary: Accept-Encoding X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 8466afc14cd968bdb4aa2ad5c64102ce X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache01.oversea-GM-FRA2
2025-01-02 05:12:39 UTC	15826	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 53 23 2c ac 6f 47 c3 ff 5c 22 56 ff 9f ff 53 ff ff cd a3 d5 fe 70 56 5d 00 6e ff 00 50 f7 ff ab 00 50 0a 2f bc 6c 15 52 ff 10 ff d2 17 ff 5d 46 9a 4a 1e 99 68 1e 95 b3 fe 36 78 d9 32 04 00 ff fc 00 d8 d4 d4 00 54 00 cd ff 76 31 95 00 00 9b ff ff b3 25 77 25 00 00 dd 00 ff d3 58 00 8a ff 77 47 23 cf 0c c8 52 00 00 2e 23 26 fc d7 00 52 25 00 dd 8e 00 ff cc 00 ff ae 00 ff d2 ad 00 45 e6 ff 8e 00 b4 b3 b1 bc 46 23 dc b1 33 ff b1 8a 00 be 2d ff 33 14 76 23 2e 0d ef e3 56 99 60 9d 23 00 a4 d3 ad 00 d0 21 d0 db ff 00 6e 00 ff d3 85 e5 64 00 de 8f 36 65 29 47 37 9a ac b7 92 00 be 88 0e 9b 45 00 c0 44 00 12 0a 23 be 8a 3c 00 92 b7 ff f7 00 d6 b7 00 75 48 00 8e 8f 00 34 f3 00 dd b2 61 c0 00 00 ff b0 5e e3 8b 00 00 94 03 95 90 Data Ascii: GIF89aS#,oG\"VSpV]nPP/lR]FJh6x2Tv1%w%XwG#R.#&R%EF#3-3v#.V`#!nd6e)G7ED#<uH4a^
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 28 0f 03 2e c1 b2 70 80 24 dc c6 71 5c 90 6b 44 66 3f d8 06 38 b8 83 07 1c 03 89 19 46 8b 3d d8 ef 04 00 10 c8 06 65 8a c0 24 ec 81 39 54 41 13 44 a0 29 28 44 64 ed 01 94 39 c0 09 38 40 3e 14 80 07 80 59 00 e0 83 3e dc c6 3c 34 01 10 f0 e6 21 18 8f 3f 34 45 3c e8 c0 07 b6 e0 3a b4 e0 0b 76 43 68 02 80 c8 14 00 1b 14 46 0e 5a 9a 0e c5 19 ad e5 c8 9a e1 10 3a b4 02 84 46 68 84 5e c2 7b b0 c7 3d c8 c3 38 d0 07 7b 28 12 7e b0 c7 8b 44 c5 3d f8 43 88 c6 47 0f 54 49 8d dc 47 78 8c 68 54 60 a1 78 a8 a8 3f 00 80 89 ba a8 3f 80 81 a5 49 c6 f6 28 08 8e ea 99 9e 88 59 1e b6 52 af 19 09 87 60 48 87 8a c7 3b 1c 00 8d b4 a8 88 a2 08 7f 94 ff c1 38 b4 08 7c 74 c2 7e c0 87 8c 1c e9 79 58 c0 36 0c a9 78 b8 07 7f f8 c3 21 c0 e2 8e 9c c5 4d b0 12 29 61 08 92 a4 92 b8 95 a9 Data Ascii: (.p$q\kDf?8F=e$9TAD)(Dd98@>Y><4!?4E<:vChFZ:Fh^{=8{(~D=CGTIGxhT`x??I(YR`H;8\|t~yX6x!M)a
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: f6 a4 97 cf 2a ad f8 3b ad 06 95 3f 7f 61 d0 08 4d bf 05 fd 17 00 38 84 50 88 ad 87 b1 82 a4 58 32 0a e0 33 01 44 40 0c f0 89 11 25 d1 12 25 89 9b 08 2f 9a 89 b1 fa ca c5 e6 22 9f 0f a4 9a a7 0c 4a 10 08 b2 a0 18 2e 3d 60 08 46 08 90 49 80 00 e6 02 01 68 48 45 9d b8 09 ca 61 08 25 30 31 2b 58 05 aa 51 02 20 c5 98 21 bb 9a f6 ea 1f e2 49 19 26 0d 09 19 54 20 8d c0 2f f7 2a 01 55 a0 1c 13 a4 1a b6 69 30 45 5b 20 e4 e9 0d 49 80 51 1a 63 30 00 33 30 33 6d 00 0c 10 1c e2 81 06 1d c3 98 c3 21 02 22 c0 00 3d c0 00 e3 42 9f 8e 68 23 56 58 52 2f 4d 19 8c 7c 89 41 45 02 dc 52 52 1f f4 84 0c 04 37 51 a4 9b 55 38 d3 3f 14 00 11 05 d1 48 ff a5 54 10 bd 53 39 35 c1 36 f5 45 0c e0 54 3d e4 d4 00 04 32 2f c5 98 1c 74 0c 34 50 92 16 08 83 1d 62 0c 37 60 83 56 75 55 36 50 Data Ascii: ;?aM8PX23D@%%/"J.=`FIhHEa%01+XQ !I&T /Ui0E[ IQc0303m!"=Bh#VXR/M\|AERR7QU8?HTS956ET=2/t4Pb7`VuU6P
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 01 5e 00 02 22 50 83 e9 d0 2f fc 67 02 40 20 80 40 fa 59 fd e7 7f c5 d2 02 3c 40 04 dd 45 01 0c b0 01 26 40 2c 7b b7 31 25 f0 8a e2 b0 5a 30 15 06 fd 27 04 61 50 0d 56 50 a6 21 e3 2f 1e 60 37 36 23 82 0e 70 0c 1e f0 0d ab 20 36 70 f0 09 52 10 5e 73 1a 34 33 88 5d 32 18 06 56 80 06 01 80 0d 0e 12 04 29 98 06 e1 65 35 6e 93 22 e6 55 02 e8 b5 34 0f 00 00 6b 02 02 4b 20 2f 44 f0 31 e7 c2 03 1b 60 04 46 90 59 a8 0a 85 e5 10 09 0e f0 7e fd b2 01 0b c8 07 5c b8 01 5d c0 00 7d 73 57 a4 86 38 6b 58 15 87 03 61 0c 16 11 68 c8 67 79 46 61 1d 21 38 c8 fa 90 dc 50 2d 0b 80 60 4b c6 0d 9d 03 ad cf e3 39 1c 90 08 82 38 88 00 00 04 5f 10 08 ff 6d d0 06 58 70 3c 4d 20 0e 91 90 04 bf 20 09 ab 20 89 c4 d0 0b e9 3a 89 2b 50 00 0b d1 3b fa d7 04 0a 70 ab 3e f6 ad a3 18 04 58 Data Ascii: ^"P/g@ @Y<@E&@,{1%Z0'aPVP!/`76#p 6pR^s43]2V)e5n"U4kK /D1`FY~\]}sW8kXahgyFa!8P-`K98_mXp<M :+P;p>X
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: e0 13 7b a8 cf fa ec 00 cc 41 1e 74 60 03 5c e0 8a 14 e2 10 3e f2 8d 18 ad 07 5e 81 d0 50 04 0e 90 21 16 15 a1 1e 3e a1 d8 d6 c0 34 ea 41 28 0a 20 16 ad 88 1a 90 41 36 26 42 0d 40 c1 0e 6d 15 0c b8 61 7f 9a b1 14 de 01 0d 86 c9 02 00 01 10 0c 40 18 6c 00 0c 84 c1 16 50 a1 17 76 00 0e 76 e0 01 56 61 08 94 63 39 96 23 91 96 20 16 96 20 91 e0 60 04 ce e0 3d ae ed 01 62 20 06 1e 80 5d 35 4d d3 b0 68 15 40 60 db 06 69 07 84 81 3e f0 83 3e 40 c1 97 d0 02 14 5e 20 0b 32 21 13 04 52 11 80 60 07 3c a0 09 dc b5 3a e0 40 93 88 c0 cb d6 e2 43 b6 81 43 e4 62 43 66 e8 74 34 44 97 2e 96 1b 0e 01 99 8c c9 54 3b 62 24 57 24 e1 4a b2 46 18 6e ff 64 5f a4 94 20 ae 64 45 d6 19 dc a2 e2 d8 69 9c 80 72 27 83 92 27 c1 84 17 54 0e 66 71 f2 66 73 d6 26 85 32 67 5d 16 66 85 f2 e5 Data Ascii: {At`\>^P!>4A( A6&B@ma@lPvvVac9# `=b ]5Mh@`i>>@^ 2!R`<:@CCbCft4D.T;b$W$JFnd_ dEir''Tfqfs&2g]f
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 20 98 fd 04 42 16 54 47 1d 90 82 19 c4 00 32 30 40 01 f1 80 18 08 90 09 ac 02 07 50 41 35 dc 01 07 f0 c1 78 10 c1 3c c4 03 2e f8 c3 4a f2 80 0e 14 c0 0e a4 41 16 e4 83 40 ec 41 15 20 c3 2f 94 90 7f dc c3 3b 14 11 13 91 83 25 a8 91 3f d4 18 08 a4 10 05 f0 c1 21 50 40 09 a8 41 13 15 91 89 f8 83 fa 3d ac a6 12 11 ac fa c3 3b 34 2c 60 58 49 9f 49 81 84 40 47 20 bc 6c 35 34 20 69 4e d9 cc 36 a0 95 65 19 8f 48 c9 90 88 d1 93 30 49 6b 1a 09 98 f5 ac 93 c8 e6 94 24 c9 21 00 83 72 f9 50 89 30 ed d2 82 2c c8 36 ad 5f 38 2d d3 46 2d d5 46 ed d2 4a 6d d6 5e ad d5 1a 46 19 74 02 a0 71 a7 22 49 52 27 6d e7 77 02 1a 3a 55 92 21 e9 e0 39 1d ff 5a 12 f6 c9 31 b1 c4 b7 0c 1a 12 3a 5d e7 9c 28 39 b6 05 5a c0 ed b6 90 1d da 96 a7 10 16 a8 b3 b1 ad af 90 5d a3 cc c4 47 80 21 Data Ascii: BTG20@PA5x<.JA@A /;%?!P@A=;4,`XII@G l54 iN6eH0Ik$!rP0,6_8-F-FJm^Ftq"IR'mw:U!9Z1:](9Z]G!
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 8c b5 d8 8d 45 bb 92 15 d9 8b 65 d9 94 65 bd 90 e5 d8 ff 12 d7 22 b2 bd ba d4 02 3e 11 a3 37 c8 00 0f d8 00 20 30 94 35 2a cc d4 e9 01 06 58 85 35 50 bf 4b c1 14 4e 89 c3 9f 8d 4c 05 f8 02 1d a0 07 42 d0 84 74 38 a3 08 50 41 06 20 94 08 20 14 06 c8 cc af 8d 80 08 60 80 d3 bc 15 d4 cc 24 10 e5 80 1d 60 86 47 60 06 5c 58 84 54 48 85 55 50 00 0f 98 01 55 fa 40 1b 00 04 2f 80 89 15 88 42 6d 28 81 1d 58 85 79 69 83 36 d8 a8 91 d0 9a 1f 73 01 77 70 01 49 40 04 50 00 05 42 78 05 63 82 82 4e 38 84 af 3d 84 0d 08 ce 21 00 dc 14 60 01 10 50 41 59 a0 83 3e e8 03 3a b8 80 ac f1 32 08 ac 86 34 c8 84 31 78 07 2e 44 86 2a 60 03 fc 5c 35 2f ff e0 cf 17 90 a7 31 f8 04 1d 70 1a 34 92 04 35 84 84 55 12 06 1d d8 03 dd 6d 51 53 70 86 b3 79 5c 30 f0 87 53 68 01 28 78 85 33 58 Data Ascii: Eee">7 05X5PKNLBt8PA `$`G`\XTHUPU@/Bm(Xyi6swpI@PBxcN8=!`PAY>:241x.D`\5/1p45UmQSpy\0Sh(x3X
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 78 87 07 55 a9 02 99 ab 02 99 23 20 54 92 59 2a 39 33 05 7d eb b7 0f 4a 5e 53 80 00 03 40 b8 b3 40 b8 26 53 34 7f ab b8 7e 2b 01 38 40 5a a8 07 2e 36 23 b8 85 4b b8 13 20 01 a4 35 2f c6 22 59 9b 5b 2f 9a bb 00 d6 b9 b8 7a 23 56 d0 91 37 8b bb b8 8d 9b b8 a6 fb b7 a8 0b 79 ab a9 9b d2 d2 2e bc b9 00 a6 a0 6f a6 40 9c a8 70 9c 24 e8 59 c6 27 01 b0 c8 19 f4 89 36 c8 39 3a ad 35 7d 20 53 55 ee c9 0e 96 00 a3 ba 6b 09 bc 35 80 17 71 19 7b 35 62 17 71 9d dc e5 a0 78 63 a3 14 da 2d e4 30 34 22 23 31 24 36 58 d7 35 17 cf 70 bc a7 d5 a0 38 d0 36 ed e7 11 f7 67 3a 05 c6 5d 9f f9 bb b7 25 36 ef e0 37 a2 a3 2d 53 e0 bb de cb 7e db 57 11 ff d2 59 60 98 43 49 94 d3 38 c9 40 61 86 a3 39 16 86 02 11 56 38 2a ea 60 09 dc 38 88 c3 39 8a e3 39 81 c3 82 5a 50 be e8 75 36 0c Data Ascii: xU# TY93}J^S@@&S4~+8@Z.6#K 5/"Y[/z#V7y.o@p$Y'69:5} SUk5q{5bqxc-04"#1$6X5p86g:]%67-S~WY`CI8@a9V8`899ZPu6
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: ed 66 43 97 74 3f 4f d5 78 16 8f aa 13 be 7e d3 01 47 6f 46 bf 10 49 f8 ab 44 33 8e 72 0b ee 43 4b 14 0d 3e 34 a5 9a cc 33 b8 b4 4c 7b 00 7a 17 35 a5 52 aa e0 d8 34 a5 1c b6 4e 1b 76 62 df f4 7b d7 f4 7b f7 f4 4f f5 d4 61 c9 f7 63 61 96 51 db 37 4d 1d 95 51 17 35 52 61 36 61 e5 d7 33 2a 55 d6 28 95 52 65 8d 53 c3 e0 53 01 98 63 31 d5 e9 3a b5 55 d1 95 5d d3 b5 80 5f d5 5c 17 f8 5b 7b d5 5b c5 55 57 23 18 5b 85 35 5b ab f5 59 8d 35 83 89 55 2d 9f 6b 59 af 60 59 01 b3 59 19 40 59 5b c9 57 bf 72 2b 81 f5 84 2f 38 5a 3f f3 33 2d f8 57 59 78 5a 59 f8 85 5b 98 82 77 35 5a 45 d5 57 d1 60 57 6f f8 68 04 58 23 04 18 55 45 35 88 db 15 ff 5e 8d b8 5e e9 95 5f 0d 76 89 11 56 7e 13 d6 7e 21 15 8a a3 d8 89 41 96 51 03 16 7e 21 36 60 21 36 a5 14 36 8b bb b8 8b e3 14 8c Data Ascii: fCt?Ox~GoFID3rCK>43L{z5R4Nvb{{OacaQ7MQ5Ra6a3*U(ReSSc1:U]_\[{[UW#[5[Y5U-kY`YY@Y[Wr+/8Z?3-WYxZY[w5ZEW`WohX#UE5^^_vV~~!AQ~!6`!66
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 01 ac c1 3c a5 47 71 19 d7 3f dc c5 41 56 d7 06 44 42 c8 89 57 7b 1c 1e 08 b0 86 90 39 d6 29 61 07 66 2c c1 66 e8 c0 37 34 01 1c bc a4 79 74 d7 f3 fc c3 09 b8 c0 e8 39 c0 9d 84 85 9d a4 83 07 ac 83 97 79 87 10 94 c0 1d 94 00 28 94 01 5a 14 80 3b 78 80 5b ae 43 37 94 83 ec e5 17 18 00 00 46 38 4f 69 20 23 04 cc 06 ed 38 08 7d 50 58 7d 50 58 85 25 1f 61 16 a6 61 fa 87 7d 1c 45 4b f0 07 14 2d 48 63 36 08 85 34 98 18 69 18 fa 8d 1f f8 8d 18 89 a0 58 14 0d 08 15 a5 58 86 1c 48 1a 01 ff 86 04 dc c3 3f b0 00 52 50 df 8d 9c 66 52 8c c3 8e 1c 05 20 b9 ce 8c f5 88 92 10 52 fe 05 59 93 88 01 2b e0 c1 1f 24 d9 b7 dc 0c 02 e2 8d 99 48 0a 04 b8 c0 3e 58 4a 9b 40 a0 26 59 ca 95 4d e0 27 d9 57 97 e5 49 0b 68 20 a0 3c 40 07 b2 5b 18 04 c1 2b 9d 89 9b c9 d9 3a 06 a3 3a c4 Data Ascii: <Gq?AVDBW{9)af,f74yt9y(Z;x[C7F8Oi #8}PX}PX%aa}EK-Hc64iXXH?RPfR RY+$H>XJ@&YM'WIh <@[+::

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49872	111.174.12.113	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	364	OUT	GET /img/tyc-sihu150x150.gif HTTP/1.1 Host: monkey.p2ld58.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	612	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 220928 Connection: close Accept-Ranges: bytes Age: 3 Cache-Control: max-age=7200 Etag: "676da7de-35f00" Expires: Sat, 01 Feb 2025 05:12:36 GMT Last-Modified: Thu, 26 Dec 2024 19:00:46 GMT Vary: Accept-Encoding Via: cache51.yzmp,cache05.hsct02 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: ab677a0032c490f741f55a185e6f14fe X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:39 UTC	15772	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 97 8a 69 65 46 38 ac 84 75 66 54 43 a4 7b 6c fa ee b3 9b 73 65 9f 9f ff 29 15 0e 16 16 15 34 1f 16 49 33 25 fe 00 00 ff ab b0 8f 69 36 be a5 64 84 5b 4d 53 37 29 ee d6 8e 59 54 42 b9 92 82 e0 96 27 66 54 3b b2 8a 7a 2a 2a 2a 35 31 29 fe 69 68 c3 ac 6a 99 16 51 7a 71 63 ba ae 83 ff fd d7 c9 b8 89 cf c3 7d ad 75 50 85 79 58 f7 d0 73 58 51 3b 86 77 66 97 01 01 fe fa c6 93 69 59 ff d7 d7 d4 d4 ff ff ff ff d8 c9 96 64 64 ff ff fe e4 99 90 88 28 20 93 73 6c 59 eb dc a7 40 27 1b 90 84 5d ca 95 4f c7 8d 6d 74 58 32 b5 a7 79 33 2b 22 00 00 ff 79 53 43 76 67 47 8b 63 51 49 42 33 ef b1 47 cb be 7b e2 4e 2d 84 61 53 22 22 21 72 51 42 bb 9d 5d a2 94 6a c7 b4 72 a6 76 36 35 33 31 70 4b 3a 7b 59 4b cf c5 82 94 6d 60 6c 64 53 a7 9b Data Ascii: GIF89aieF8ufTC{lse)4I3%i6d[MS7)YTB'fT;z***51)ihjQzqc}uPyXsXQ;wfiYdd( slY@']OmtX2y3+"ySCvgGcQIB3G{N-aS""!rQB]jrv6531pK:{YKm`ldS
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: c7 3c 18 25 65 4e 66 44 5e 64 66 d6 c3 66 5a 26 74 d0 ff 41 3d 48 26 4a 82 26 74 1c c1 63 56 64 57 4e e6 29 94 82 65 ea 82 2e 58 a6 64 aa a6 69 6e 42 0e 44 a6 67 9a 26 74 54 c1 68 3a a6 57 3e 8d 63 6e 02 74 d4 80 6f 42 87 2e 64 26 72 5a c3 1b e0 42 08 c8 61 10 3c e7 63 42 e7 73 42 26 74 e6 c6 6d 4a 27 76 1e 01 5e 1c 67 74 52 67 10 a8 dd 93 f0 06 77 4e a7 41 d6 c0 46 04 c8 4c 3e a7 da d5 c0 11 78 67 2d e4 46 f0 e5 06 79 6a 81 79 d6 86 0c a0 26 79 4e 27 78 6e 44 0d 8c e7 73 6a 67 7f 3e 26 80 6a c1 7f e2 45 7a 62 a7 77 7a 02 1e cc c3 37 84 c0 74 36 e6 73 42 68 10 48 28 85 3e a8 85 46 e8 85 4e 68 86 56 28 86 76 a8 86 7a 28 87 7e a8 88 86 28 89 6e a8 89 82 e8 89 8e e8 73 7a 02 3c 34 c2 04 3c a7 83 c2 e8 74 c6 e8 3f ce a8 8d ca 28 8e d6 68 8e d2 28 8f de a8 8e Data Ascii: <%eNfD^dffZ&tA=H&J&tcVdWN)e.XdinBDg&tTh:W>cntoB.d&rZBa<cBsB&tmJ'v^gtRgwNAFL>xg-Fyjy&yN'xnDsjg>&jEzbwz7t6sBhH(>FNhV(vz(~(nsz<4<t?(h(
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 45 a0 03 3a e0 4b ff e0 4c c9 41 18 84 0e 98 80 c2 e8 94 13 a1 10 56 21 45 c4 93 0f c5 4b 19 63 d0 29 03 aa b3 84 a8 33 eb 4c 11 f2 68 c0 91 d9 bc 3f f3 ce d1 22 10 eb 18 3d 4b e1 cc 45 90 90 35 73 15 85 ec 43 19 42 96 6a 8b 95 8b f1 01 1e 90 03 af bc 90 c4 90 81 73 c4 4b ef db 84 da 2c 42 bc a4 4a 13 08 87 32 00 9a d0 f3 b3 46 c8 80 27 a0 03 bc 4c 50 95 ec cf 2f 58 80 82 49 88 a0 58 47 1e 28 03 a0 bb 49 e2 91 0f 0d 95 be c6 93 27 4e e1 22 c5 d4 94 00 c8 c7 ee bc 0c f3 02 4f 49 a0 43 3b b2 23 1a 00 c1 0a c1 20 50 48 81 b6 81 08 8a f0 9e 65 41 96 89 90 0c c9 70 0d 33 30 8e 44 d3 84 05 85 c6 b2 24 a0 0e a0 83 09 c8 cb 70 48 03 37 58 00 5c f9 47 cc d0 81 37 c0 4b e0 ac 4d 2b d8 84 58 c8 00 4a 19 88 7d 29 a3 0b 5a 82 45 90 c7 e9 83 4e c5 a3 82 86 88 18 26 91 Data Ascii: E:KLAV!EKc)3Lh?"=KE5sCBjsK,BJ2F'LP/XIXG(I'N"OIC;# PHeAp30D$pH7X\G7KM+XJ})ZEN&
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 32 00 1b e4 fb 5e a5 73 a8 10 f4 66 c6 42 15 f7 90 29 3b f2 ae b8 58 a6 4b 2c 78 bb 85 d1 38 f3 c2 dc b9 44 6b 6b d1 0d d0 a0 89 22 c2 b7 56 b7 1c 84 36 a7 2a 65 be 48 f1 09 97 3d 8b b4 20 50 92 f8 ea 41 f0 c9 ed 8c 6e a5 2c 4c 4d 5c d3 0a 07 48 ca fd 49 a9 4e dc 26 7b 84 8d 1f 87 97 5e 98 94 bf b0 95 5f 3d 55 7f 69 6e f0 03 91 14 03 39 b0 ab 6e 21 ed b7 1b 6e 93 ae 41 13 ce f3 e4 eb 71 9c 91 89 d4 0a 20 e3 f0 4f 5e c0 45 31 07 05 bd 0c b5 7f 68 78 18 59 27 c6 36 8a a4 a0 0e f8 d8 50 2b 90 ec c8 3c fa c4 57 de 6e a7 78 6c 7f d2 4d a8 0a 6e 90 08 c1 69 2a 1a f8 4f 37 c6 54 73 4f eb 2d 00 85 2e 70 e9 31 e0 06 76 e7 21 d0 a1 a2 71 74 8a 2d 90 03 c5 7a 9f 77 97 90 a8 9d cb 5f b7 79 33 09 92 5f 31 b0 1f 20 a4 72 db a4 ff 58 de e8 17 b1 5b a1 6f 27 02 b8 86 dd Data Ascii: 2^sfB);XK,x8Dkk"V6eH= PAn,LM\HIN&{^_=Uin9n!nAq O^E1hxY'6P+<WnxlMniO7TsO-.p1v!qt-zw_y3_1 rX[o'
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 98 3d 3d e6 2b 3b 9b ce 41 17 fb 73 56 4d 70 47 c3 dd ce 30 57 30 17 5e 9d ee a7 0b 24 c1 a2 d6 b8 84 73 e1 04 2a b4 74 de 0c d6 3a a3 23 8d 6c 6d 57 b9 f1 51 0e 73 b1 af 9c 6a 53 a7 fd e6 aa c6 06 9b 49 ed 6c ff 7b bb ba 01 0b 5f b5 ab 17 bc 70 2d 47 c5 d1 8f 8e 4a de d5 bd 71 51 af 5b ec e7 86 70 2e 52 d0 1b 6a 48 42 d1 0c 6e 40 96 91 9e e5 dd f3 3e cb ba c6 74 16 80 7e 16 33 fb c3 d9 d0 91 bc c0 a3 6d 73 9b 23 3e 2a e4 76 f3 c2 b7 6c 15 06 bf da d5 a6 0f bd b4 4b 6f 69 32 57 d8 15 23 34 7c 9f 4b 3f e1 e0 5b a5 f9 ff 88 b4 da 45 9e 7c 5a 77 7a f9 63 16 be 55 88 ae ed bb 4f 7f c1 ce b7 fe 9a 8d 8e ee 71 fb a3 fd 4e ef fe af 31 d9 83 49 5b ef 15 60 82 3d 47 aa f5 5f e3 2d 9e a7 a9 40 a8 25 5f aa b5 9f da fd 5f 85 7d de e9 f5 9d fd bd 9a f8 a9 5f f2 f5 d9 Data Ascii: ==+;AsVMpG0W0^$st:#lmWQsjSIl{_p-GJqQ[p.RjHBn@>t~3ms#>vlKoi2W#4\|K?[E\|ZwzcUOqN1I[`=G_-@%__}_
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 03 18 53 05 ab 97 a1 91 20 60 83 08 18 cf 9d 9e a2 80 05 78 ce 73 4c c0 42 19 be f0 9a 2b cc d2 27 45 8a 29 eb 72 d9 b6 95 10 e5 64 45 30 04 6f 90 99 50 27 28 d4 09 3e 1c 82 21 78 40 55 aa 4e 75 aa 55 cd 6a 56 93 4a 55 ae 56 f5 37 99 c4 a2 02 e3 b2 a0 2f 26 67 02 55 48 a9 05 c4 48 a6 31 ed 61 9f d6 41 95 4c 11 30 06 97 2c 20 0d d1 29 02 45 b1 d0 85 ee 14 c5 48 f3 c1 a3 4d 68 90 01 3c 92 2c 26 11 50 c3 18 6a 58 04 1e 1c 0f a1 c5 8c 2c fe 32 4a 55 39 68 95 07 72 58 82 1c a2 c3 d9 90 84 24 b3 99 5d 42 17 40 db 85 8f 22 ce 9b c1 29 ab c5 d8 5a c1 50 8d 89 13 e7 82 a9 2e 4f 58 d3 9b ff 52 34 10 58 48 c3 ac 14 a0 86 2e b8 24 67 f8 aa 4c 65 74 05 1b 11 e1 73 01 7c 54 ca 12 0c 51 c4 14 6c c3 a9 0b 15 84 21 1a 8b 55 1e 54 17 ab 9d cd ae 56 96 c0 5d ee da 90 bb a6 Data Ascii: S `xsLB+'E)rdE0oP'(>!x@UNuUjVJUV7/&gUHH1aAL0, )EHMh<,&PjX,2JU9hrX$]B@")ZP.OXR4XH.$gLets\|TQl!UTV]
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 1c 34 0a 17 5f a0 06 8a 20 1f fb c5 19 c8 d0 06 fc da 06 ae 60 0b 5f 09 92 56 47 11 db 49 ac 02 40 09 5a 87 4a 10 30 6a 5b e0 04 5e 77 6e 34 f1 08 44 50 1e 34 d1 49 eb 22 24 ec f7 0f f1 77 ad 49 31 7f 59 61 10 fc 38 6a 04 f5 5b 19 ea 59 7f 04 42 0b 30 8c c3 18 0b 76 b7 ae ff 70 03 2f 0b b3 c0 d7 48 2c 3a ae 2b ff 8a 11 5f 20 2c 57 a0 06 b1 10 0b 7f f0 03 bc f5 96 fb 2a 07 5d b7 0d 56 27 5c 04 60 b4 ce 80 75 d1 06 8e db f0 81 5b 00 01 3c 10 89 dd e7 03 60 d0 06 34 f1 12 a0 92 00 39 41 19 98 21 24 bc 77 6b b9 87 8b ce 29 56 de 85 a5 04 05 56 5c e5 59 10 b0 53 68 f0 15 7e e0 07 3a 52 75 6c 00 a8 7c 60 10 f9 49 00 16 00 91 18 f1 77 18 c1 09 0a 01 52 13 70 11 dc 13 2b 68 e0 06 b1 b0 09 9b d0 0c 6f 30 13 45 82 0c d3 60 3b ae 20 07 ae 00 01 4f cb 68 24 9a 9a df Data Ascii: 4_ `_VGI@ZJ0j[^wn4DP4I"$wI1Ya8j[YB0vp/H,:+_ ,W*]V'\`u[<`49A!$wk)VV\YSh~:Rul\|`IwRp+ho0E`; Oh$
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 1a 3c 54 e8 51 04 19 03 19 30 f0 8f 80 ff 53 dc 4e b0 2c 89 80 cc 4d 17 43 30 87 6c d9 42 a5 52 0a 1f 10 34 41 e8 da 75 f8 59 51 03 03 44 64 97 f8 9f 9b eb 03 e7 76 31 38 21 d6 c0 85 06 13 0e 1c a3 24 21 9a b6 14 ff 45 a4 88 20 f6 95 22 8a 0d 8a f9 fe e7 9f 1a 35 b1 ae f0 5a d0 1f b3 e6 cf ba f8 02 b4 01 48 eb e2 0f a2 50 e3 89 b0 7f c6 19 0c 81 56 24 71 cf 3d 34 ae c0 a2 36 02 c0 70 06 8c 0c c1 10 80 80 14 e4 d0 8a 09 92 7c a0 c2 09 da 72 db 22 2c 33 98 f3 c1 87 39 d0 4a c1 8b 25 ae 3a 68 ae 08 f6 33 68 80 85 4a 30 68 a1 f1 0c 1a 63 af 81 d4 1b 4a 35 05 c6 18 60 09 96 36 1a e8 0f 35 1a 8b 25 ca 58 62 e1 af 3f 64 30 8b 45 b3 01 57 1a b0 04 96 be 18 e3 35 a1 58 63 ed 9f 56 84 52 20 b6 d8 16 f8 22 8d 4a 0c ba 0d 0c 30 2e 10 e0 02 30 52 e0 8a 89 7f 86 f8 27 Data Ascii: <TQ0SN,MC0lBR4AuYQDdv18!$!E "5ZHPV$q=46p\|r",39J%:h3hJ0hcJ5`65%Xb?d0EW5XcVR "J0.0R'
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 35 c4 63 31 f2 ba 8f fb 40 03 9f fa 87 44 7a 30 63 f0 9a 61 74 28 d2 c2 31 7c c1 17 b9 28 08 82 b0 0b 0d 2a 98 87 70 02 45 23 46 a5 20 1f 18 52 8a 70 e0 0e 64 90 c2 7f a0 86 09 04 3d 3a 40 c8 87 d8 84 37 88 00 0e eb 82 22 60 82 1e 64 82 1e e8 c2 81 1a 1d 1e c0 12 e4 52 1c 50 e9 02 31 68 2b e5 e8 8a c1 c2 16 58 ab a2 a0 43 1a bb f4 0b 2c 64 2c fc d0 b4 cd 8a c7 70 70 15 50 98 11 89 52 38 1c 9b c5 a0 74 84 62 d2 28 cf 23 15 d6 2a 8d b6 29 03 d0 fb bc 42 54 8a 66 e0 85 03 7a 08 7d e2 86 79 18 80 27 90 01 19 b8 c3 3c 34 2a 55 42 19 48 4a 44 4d 60 82 22 30 84 81 42 8b 01 f0 ab 81 ea c1 11 99 22 e5 f0 0a 4a 04 b7 7f 40 06 73 54 aa d4 49 9a 04 b8 94 a6 11 92 69 58 00 ff fb 30 2c fd e1 1c 26 0a 04 51 78 0b 0f 82 3c ed 53 0a 7b 21 08 2a 70 c3 a4 84 80 1b 19 98 82 Data Ascii: 5c1@Dz0cat(1\|(pE#F Rpd=:@7"`dRP1h+XC,d,ppPR8tb(#)BTfz}y'<4UBHJDM`"0B"J@sTIiX0,&Qx<S{!p
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 11 cb 98 8b dd 96 74 02 d7 ed 3b f1 53 84 3f f6 4d f8 81 04 b0 d4 96 0a 97 7f f8 1f b0 47 17 0c 85 80 c7 62 e2 b1 bb 02 d8 c1 05 3f d0 01 25 b0 8f c8 c1 02 ef 9e 8e 22 d4 a1 11 5e f1 73 3d 9a 7f 70 79 4e 1b 95 55 b5 44 34 f8 01 7c 55 e6 83 35 4c 2f f3 71 f2 2d 0b ff 32 0c 7a 56 06 03 27 d0 84 ee 7c 0a 23 5f 43 84 06 6c a3 e0 6d 19 78 83 71 88 2b 55 68 29 aa af f6 47 40 03 49 b6 c2 9d 68 e6 ba a0 6a af 19 87 9d e1 99 f2 1b 15 ef 58 7d aa 66 eb 4d 5b 53 03 d6 dd b8 99 ee 0f a6 1c 27 45 86 b9 eb d2 98 1f 55 e8 d8 06 77 31 0a 8c 49 73 b3 cf dc c0 3f ac 91 00 08 43 3c fe 11 2c 68 82 60 87 82 09 11 16 fc d7 61 50 c3 0e 09 25 fe 9b 30 06 c1 3f 6a 77 08 e2 a2 46 ed 1f bc 04 b8 24 3d 52 b0 e0 47 80 2f 45 d2 0c 11 b4 c5 e5 96 73 ff 22 28 e0 36 6e 1c 2e 05 3a 22 a8 Data Ascii: t;S?MGb?%"^s=pyNUD4\|U5L/q-2zV'\|#_Clmxq+Uh)G@IhjX}fM[S'EUw1Is?C<,h`aP%0?jwF$=RG/Es"(6n.:"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49873	111.174.12.113	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	364	OUT	GET /img/tyc-4hu1300x200.gif HTTP/1.1 Host: monkey.p2ld58.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	612	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 784465 Connection: close Accept-Ranges: bytes Age: 3 Cache-Control: max-age=7200 Etag: "676da7df-bf851" Expires: Sat, 01 Feb 2025 05:12:36 GMT Last-Modified: Thu, 26 Dec 2024 19:00:47 GMT Vary: Accept-Encoding Via: cache11.jnmp,cache03.hsct02 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 5306894885b08f1c5d69f9006cb41369 X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:39 UTC	15772	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 00 00 25 22 22 ff fe b3 6a 44 2f cc b7 72 fe d5 fe ff ee 2a e5 0b a8 ff fe 91 ff fc 4d a2 ad fa ff fd 6c ba b2 aa aa 0a a1 98 77 68 48 fb 00 ff b2 fe fa 66 64 e5 01 f7 ba aa 6a 03 98 fd 01 65 fd cd af 94 ff 51 f3 10 68 01 01 d2 ff 90 03 64 d1 cc 8d ff 6f fe aa 77 66 fe 98 01 ff 90 ff 28 11 0a b7 ac 95 20 9a 01 67 02 73 a4 62 9f 72 66 4b b4 89 42 52 44 31 94 88 6d b3 9b 24 60 22 a0 fa db dc ff d8 02 71 12 d2 f4 d8 af 44 22 11 63 65 fa fc 71 30 30 22 11 ab 22 00 ff 00 00 12 01 66 b6 09 d0 1c 06 96 cd cc 77 8d 66 32 ff ad ad 89 55 44 da dc ff ff ff 00 af d3 f9 fb b1 04 6b a0 f7 d4 04 03 d2 4d 02 db 69 05 62 98 58 12 50 b1 e6 59 b0 34 cc 00 d5 ae d1 96 8d 89 5a 4f a1 ce bb ad f9 d6 6e f8 d2 4f f5 b5 4b ac 00 0e f4 d9 91 52 4d Data Ascii: GIF89a%""jD/r*MlwhHfdjeQhdowf( gsbrfKBRD1m$`"qD"ceq00""fwf2UDkMibXPY4ZOnOKRM
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 4d 1f da 5c ff df 5a 8e 66 c3 90 66 e2 1c 8c 71 dd 8d db 39 65 6a 22 d7 67 b2 a5 df bc 66 6c 2a 17 f5 89 66 6e 51 57 15 e0 a5 6c 46 17 cf 70 80 75 91 0f 70 8e 60 70 92 20 f8 84 97 71 1e 67 78 0d c3 02 92 8e 38 b0 10 88 8c c4 00 9c 5d 1b 9c 80 2f 2c 83 04 d4 4e 7f b1 df eb 0c c5 49 a8 17 00 3c 04 f4 ac 8e 06 ec 44 39 48 c0 36 a4 44 32 0c 83 06 88 84 17 28 a7 44 74 44 f4 00 80 f1 7c 97 f6 d8 83 ed 50 18 f8 11 a7 07 5e 57 b8 19 c3 25 4c 41 13 91 c1 0b 7a 01 2f 54 c2 1e d4 20 24 c0 01 2b 68 82 37 80 c2 2b ec c2 83 ee c2 2e 74 02 91 09 46 14 48 c2 19 94 00 39 0c 81 3d 02 43 29 40 41 87 16 61 3f 28 50 13 76 42 0a 69 61 0a ad a1 16 48 11 32 12 86 61 5c 50 05 79 63 b8 49 c3 13 e4 46 0e f5 94 6b f8 10 1d de 01 1f ce d9 6f fc d4 4f 69 82 3a 10 62 82 b0 e8 5e 38 02 Data Ascii: M\Zffq9ej"gfl*fnQWlFpup`p qgx8]/,NI<D9H6D2(DtD\|P^W%LAz/T $+h7+.tFH9=C)@Aa?(PvBiaH2a\PycIFkoOi:b^8
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 4d 90 81 3b ff 30 88 3f 38 9e 2e 70 ce ba e8 9f 09 cc 06 2e c0 1f d1 2a 88 41 08 8b 33 30 88 04 6c 9f 0a 30 88 3c 00 0b ae 14 0b 50 e8 0e 53 e0 0b 2e d1 40 03 82 21 e4 f0 c0 e6 a0 35 c5 70 0c c8 98 31 46 43 41 07 61 c1 15 44 c3 3d d3 33 3d fb a0 2e 62 8c 29 54 a2 27 52 42 2a b4 c1 f6 e8 c2 2c 6a c2 ff 10 b3 4e bb 32 28 a2 b2 30 31 a0 17 55 42 24 ba c1 2b 02 d1 1b 44 51 f5 d0 c2 04 0a 22 fe f0 41 2f fc c2 eb 28 90 31 24 c3 13 5c 43 18 9b 33 24 55 52 17 6b 8d 6f 80 10 27 e5 50 d4 78 d2 34 74 c1 38 8c 41 08 12 91 2c 7d 0c 3c 2c 34 48 2b 47 1f ab 35 30 85 11 1b 5a 33 42 53 06 42 d4 43 33 1d 24 6c ec a6 6c c4 c6 44 82 02 6b 92 00 10 f0 b6 4a aa 40 29 51 92 51 83 06 0d d8 86 6d 60 26 0d 40 26 46 48 11 c5 28 8c 22 43 13 5f aa 35 53 c2 25 3b 29 b6 6c 28 01 5f c3 Data Ascii: M;0?8.p.A30l0<PS.@!5p1FCAaD=3=.b)T'RB,jN2(01UB$+DQ"A/(1$\C3$URko'Px4t8A,}<,4H+G50Z3BSBC3$llDkJ@)QQm`&@&FH("C_5S%;)l(_
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 45 b4 60 11 ff 05 38 99 dd f8 02 7d 40 a3 df f8 02 3a 8a a3 15 d8 07 36 ca a3 40 9a 81 95 d9 99 44 5a a4 46 7a a4 48 9a a4 23 b8 09 9e e0 6a 8d f8 4b ea 89 68 8b d6 6a 69 b7 2d c6 20 3d 38 39 62 c5 50 15 ba 84 1b 2d 89 0c c5 00 9b 12 22 9b 97 b1 9f d7 52 86 b8 a9 26 81 f4 2a bd d9 a6 6e fa 9b c0 49 67 b4 96 6a c4 19 60 90 74 9c cc a3 9c 95 77 15 cd c9 48 8f c1 7c 30 95 8f ce f3 76 13 f6 a5 9f e7 4a d8 99 3d c6 b1 56 8c da 9d c4 a6 87 37 09 9e 86 c8 7a e3 b9 1e df 31 05 31 f0 a4 28 36 1e b5 d7 9e 46 85 57 f0 e1 0b 2f 9a 94 e2 76 58 d5 50 0e 50 00 00 cc 04 95 c6 10 67 69 22 0e 26 60 02 6d 10 0d 96 75 7f 02 5a 4f f4 c0 1f 0a 95 34 51 76 03 51 93 64 0e ba 5a 62 69 24 09 d7 04 fb 94 34 28 64 96 4c 53 43 35 84 ac 23 f4 7e 3e 04 25 1f 8a 21 e6 10 0d 3f e6 05 c2 Data Ascii: E`8}@:6@DZFzH#jKhji- =89bP-"R&*nIgj`twH\|0vJ=V7z11(6FW/vXPPgi"&`muZO4QvQdZbi$4(dLSC5#~>%!?
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 94 38 a3 89 ff 3a 9d 73 22 9d d3 39 23 a5 22 f5 60 75 f6 b1 0f 43 45 3f a3 d0 c3 4a 64 20 17 b5 23 a7 69 18 4c c0 3b bd 8e 49 e4 33 3c c7 53 ec a6 a4 3c 6d b2 26 37 75 26 d7 70 53 d5 f3 3c c1 44 53 43 35 7c dc 53 ee be f3 49 ec ce 0e ed 13 c1 e4 a1 3a 0f 35 a4 84 92 28 31 25 48 e5 ca 56 3b 62 40 0f 71 5e 8a e8 29 09 87 22 26 4f a6 2e 6f 19 24 00 d1 66 88 cd 60 4a 2c 33 4f 58 c0 41 1c 36 54 81 3a b4 1d 56 94 1e 9e 20 2f e9 a1 1d 7c a5 05 c0 c5 a8 06 47 1c 82 ef 04 ce 85 04 70 c5 45 bd c3 15 cb b2 1c 8c a1 16 d5 4a 9f 72 94 ad da aa 56 95 f2 56 0d 13 48 89 34 d4 68 20 19 99 14 5f f3 55 5f f7 35 1a bd 8f 4a ff 15 60 03 56 60 07 f6 6b 36 c1 11 3c 21 41 f0 03 5f d4 71 4b db 91 4c 4d 6e a3 e0 63 47 be 03 35 a9 e4 2f 43 84 3e a6 a1 36 bf 43 04 43 a7 23 2f 47 0f Data Ascii: 8:s"9#"`uCE?Jd #iL;I3<S<m&7u&pS<DSC5\|SI:5(1%HV;b@q^)"&O.o$f`J,3OXA6T:V /\|GpEJrVVH4h _U_5J`V`k6<!A_qKLMncG5/C>6CC#/G
2025-01-02 05:12:39 UTC	16384	IN	Data Raw: 14 24 62 2a ff a5 6b 61 e5 42 92 a4 5a 69 d7 11 2c c3 4a 00 6a b3 a2 85 08 f2 a8 08 fa a5 3c 06 02 2e 7c 01 2e e0 c2 03 36 2a b6 da 02 b6 be 42 66 ea 23 67 5a 5b 69 b6 29 91 ea 29 7a a4 26 90 7a c0 c4 25 49 99 ba e9 12 36 61 e7 1c 43 81 3d 61 14 de 81 bd 56 e1 15 ea ab 6d da 26 6e 7a a1 70 0e 67 6e a6 61 f0 fc 93 9b c4 ce 88 49 18 8b 6c 22 71 26 8f f1 d8 88 1a aa 58 73 0a dd ee 30 54 1c 02 1d 44 0d dd 1d 56 6c f4 70 2c 1d 2e 49 1e 4a d4 46 69 a7 92 e4 0e 48 85 88 78 02 19 49 95 e7 ca 66 9d 7f 36 22 7b c2 a7 d8 41 d9 cb 2a d5 51 91 ca 4e ad 1d 79 e2 e7 db 9d c1 96 79 99 1e d0 c8 27 ba ec d0 72 40 80 aa 59 35 7c 28 9d 99 8b 89 32 ed 86 1a 4b b9 bc a2 84 2e 8b 87 82 10 3a 2e 6d 54 5d ad f6 6c c3 87 9a 00 45 41 c3 35 88 43 39 44 68 87 7e 63 8d 4a 40 d7 96 6d Data Ascii: $bkaBZi,Jj<.\|.6Bf#gZ[i))z&z%I6aC=aVm&nzpgnaIl"q&Xs0TDVlp,.IJFiHxIf6"{A*QNyy'r@Y5\|(2K.:.mT]lEA5C9Dh~cJ@m
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 7b 2d 10 a3 2d 71 71 80 c6 14 31 5c 89 7b 11 87 db 39 16 17 ca b4 2d 5c 35 00 d7 04 01 5c 92 6b db b0 fc b8 88 3a 02 b7 25 b9 80 26 11 97 a0 5c 6f f0 0f 8f f9 0f 97 60 9c c9 95 5c 63 fa 04 03 70 ce 05 81 0d d4 dd 0c 01 10 00 c9 ac 86 72 b8 ba b8 3c 10 8d ff b0 98 c8 50 10 94 70 05 e3 5d de e4 4d de a3 1b ce ca 75 05 5d 0d ce a5 1b 06 42 00 df f2 3d df e9 dd dc cf 9c 5c 15 d5 10 92 a6 05 34 0d 15 96 f6 9d 7e 38 92 24 95 9d 64 b1 14 d2 1b bd aa 13 9e ed 33 d3 fd 3d 74 08 9b 26 3d dd 77 1b 42 80 d6 f2 9e 5a 44 17 35 55 89 04 3b d1 11 ba d0 97 31 46 50 13 80 d1 c2 34 3a b9 0c d0 fa e1 45 13 76 64 04 94 0d 1d ae e8 8a a1 75 89 47 22 4d c0 d6 fa ae 5a b9 95 49 c2 0f 07 da 1a 1e da a2 c4 18 3b 30 dd 24 34 3d e4 44 fe 6a 4b 95 35 da 92 76 3a d9 c1 e8 47 6a 11 2c Data Ascii: {--qq1\{9-\5\k:%&\o`\cpr<Pp]Mu]B=\4~8$d3=t&=wBZD5U;1FP4:EvduG"MZI;0$4=DjK5v:Gj,
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 94 c8 00 b0 2b 83 0c f2 f9 ba b6 d6 04 5c ba 3b fd 62 58 51 43 9f 5c 65 0a ca b8 65 a4 0b 74 ef d3 53 24 15 a2 27 75 e0 ec d3 52 27 2a 21 74 00 72 e3 0b a0 ef f6 25 ec 16 26 66 a3 a3 61 a2 a3 97 58 c2 43 d5 a0 d5 f8 8c 3f 9c 38 8b a5 54 03 97 8b ab 18 25 ff c6 3a dc 50 7c bd 0c 97 39 05 63 fd 60 fa 34 a9 53 8c b5 b3 fd b8 8f c3 0d fa 72 73 5c de f4 69 2a 52 25 b7 0c 83 7f 94 fa 17 15 a6 59 9d eb 36 0b ee 74 05 2e 75 8d b1 a2 85 f8 5a 0b 55 35 f4 05 90 69 d7 aa ab bc 22 b7 1a cb af e4 19 c4 a3 78 49 01 09 b2 80 04 a0 43 1e 96 e1 25 01 40 16 68 d5 1e 5e 92 24 ef da 78 b9 9c 05 51 c2 ae ef 5a 93 c7 43 3f ea 5c 86 86 60 05 c3 c3 5c c5 9c 8a 90 ca 3d cc a0 22 fe 60 22 34 81 2c fc 81 28 9d 8c 8a f2 21 9c a3 ce b1 95 2c 16 94 ea 1f a6 ec 89 1a 1b 08 1f dd d2 1d Data Ascii: +\;bXQC\eetS$'uR'!tr%&faXC?8T%:P\|9c`4Srs\iR%Y6t.uZU5i"xIC%@h^$xQZC?\`\="`"4,(!,
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: f8 8d e3 78 8e eb f8 8e f3 78 8e d7 c2 86 c8 62 1b 31 a9 16 38 99 16 80 33 b9 c6 ed 55 e1 d4 7c ab 30 53 bc f3 3d 17 ee 8d 0c 5c 7e eb f0 0d df f5 95 2b 9c 3a d3 37 53 38 8d 3c e3 37 7f 27 d5 b7 1e 6e 40 93 79 63 0b f8 88 39 08 ce 20 6e 62 4a 76 8d d6 a8 ff e8 da 68 9c 27 f1 32 3c 78 66 c7 f6 44 77 f6 e9 1c 52 45 e7 2b d1 89 36 67 05 2c e3 44 29 69 7b 69 a1 eb 2b 6b b7 b6 9a 4f 41 04 ce 36 1b 77 4a 8a 43 3a 67 25 c3 23 b0 f8 8c 5b fa a5 63 7a a6 6b 3a 58 d4 78 8f 7b fa a7 83 7a a8 8b fa a8 cb 4c 2d 78 c2 96 13 38 77 a7 c3 9c 18 f9 4b 68 01 91 27 b1 9a cb 7a c4 ed 35 5e 33 6b 0c 9f 77 ae 9f 62 3b 1b df 89 15 51 7b 17 b6 5d ba b3 ad cb 77 96 a3 ba 4f 11 36 15 69 1c 10 a3 08 8e 94 79 99 0b 78 8f e2 db b2 f7 9e 53 e1 e8 b9 1e 78 9b cb 39 f7 9d 25 66 57 49 c3 Data Ascii: xxb183U\|0S=\~+:7S8<7'n@yc9 nbJvh'2<xfDwRE+6g,D)i{i+kOA6wJC:g%#[czk:Xx{zL-x8wKh'z5^3kwb;Q{]wO6iyxSx9%fWI
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: fe 73 49 7d ad c3 71 c2 8b 33 60 ba a4 c2 05 c6 ea 6d 02 cc af 18 4c ec ca c0 96 63 60 0d 66 cc 61 42 d6 58 39 26 af 46 eb 7e e5 0a 15 3e d7 cc 6c 6c d7 fc 87 c6 a6 6b b2 fb 39 c3 d6 d6 f1 fa e1 37 78 83 3f 14 f5 b2 86 83 c7 06 6b b0 88 75 20 b8 43 12 fe ff 39 19 d6 f4 3b ac e1 c6 96 4d 50 7f f5 66 8d 75 5a 5f 96 2e a6 5a 7b 5c 6f c1 e8 6f 33 76 6e 33 b6 47 2a 20 50 08 4f 47 3f 70 63 77 2e 00 d6 7e 8c 85 fd 6e d5 a6 02 98 5a f0 7f 50 64 d8 1e f1 02 a8 84 5f b6 93 4a 38 f7 4a 70 4e 75 5f 77 76 6f 77 77 7f 77 1e 87 ee ce 5e f7 53 40 f7 4a 90 d2 63 ef c5 d7 fe e7 7d 37 65 79 6f 76 85 ae 71 d5 ce f7 02 70 94 13 67 58 49 10 51 7c 77 67 26 48 03 be e8 e4 70 cf ce 81 df ce 02 68 e3 12 29 6d 53 0e db 3d ce 77 55 86 09 ed cc 77 23 0f 49 44 de 0a 17 28 83 fe 2e 70 Data Ascii: sI}q3`mLc`faBX9&F~>llk97x?ku C9;MPfuZ_.Z{\oo3vn3G* POG?pcw.~nZPd_J8JpNu_wvowww^S@Jc}7eyovqpgXIQ\|wg&Hph)mS=wUw#ID(.p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49859	123.6.18.17	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	610	OUT	GET /b38048b5589bcfb538c627481211202f.gif HTTP/1.1 Host: ylg1.duyunfk.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:40 UTC	414	IN	HTTP/1.1 200 OK Server: NgxFence Date: Thu, 02 Jan 2025 05:12:39 GMT Content-Type: image/gif Content-Length: 47056 Connection: close Last-Modified: Sat, 19 Oct 2024 09:07:13 GMT Vary: Accept-Encoding ETag: "671376c1-b7d0" Expires: Wed, 11 Dec 2024 13:50:56 GMT Cache-Control: max-age=2592000 X-Cache: HIT Strict-Transport-Security: max-age=31536000; includeSubdomains; preload Accept-Ranges: bytes
2025-01-02 05:12:40 UTC	15970	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 85 00 d7 15 27 b6 b3 ad 6c 6d 2c 96 18 13 42 42 43 b3 a8 92 06 09 0e 94 90 8a 75 73 69 8d 86 75 f0 af 0e 6f 6c 4f 62 27 24 dd 72 38 8c 8c 4e db 45 29 48 4c 13 08 25 26 cd bb af b3 8b 37 dd 31 24 2b 2e 0b a9 9b 8a 33 33 24 fd ed d9 32 46 16 55 56 22 45 45 36 0d 13 25 45 45 23 54 54 54 ea 13 28 dc db d7 56 56 35 e6 6b 19 dc 36 33 55 53 47 5e 64 2a dc 8d 16 d7 02 32 df 74 19 eb 31 26 ce 00 32 76 4c 2d a2 96 75 47 54 21 28 32 25 13 23 12 5e 5a 51 dc 12 2f 24 32 33 4b 4a 48 a0 a2 9a e3 59 1f 39 42 42 49 52 36 ce 01 23 21 16 12 de 52 21 54 48 24 d6 63 5a 78 77 7f df a2 13 eb 21 2a 62 63 50 4a 52 46 53 4a 36 9b 9b 9e e7 bf 0b b5 3c 34 18 18 1d 63 61 67 29 29 29 31 31 31 20 21 20 d6 21 29 de 29 29 39 39 3a d6 29 29 3a 39 2f 29 29 Data Ascii: GIF89a'lm,BBCusiuolOb'$r8NE)HL%&71$+.33$2FUV"EE6%EE#TTT(VV5k63USG^d2t1&2vL-uGT!(2%#^ZQ/$23KJHY9BBIR6#!R!TH$cZxw!bcPJRFSJ6<4cag)))111 ! !)))99:)):9/))
2025-01-02 05:12:40 UTC	68	IN	Data Raw: af 3c 84 14 f7 55 b0 b7 fd f2 89 47 1a d4 35 a7 88 4f 6e 9e 73 85 4c 24 98 33 ef f9 45 92 22 74 d0 04 bd e8 c1 ed 10 d2 87 9e c8 a5 27 c4 95 4e 07 1d 41 2a 1d 75 d2 0e 04 ea 55 cf ba d6 b7 ce f5 ae 7b fd Data Ascii: <UG5OnsL$3E"t'NA*uU{
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: eb 02 67 00 d8 13 a2 87 9c 11 49 a5 4c 48 7b 0a 52 80 3a 29 b8 fd ed a5 a2 80 da df 3e f7 ba db 3d 06 78 cf fb dd ef 9e 77 f1 cc 5d ef 69 ff 92 dc a5 70 02 bd 03 60 f0 76 1f 7c e1 d5 fe 80 07 d0 1d f1 8a c7 7b e3 1f 20 10 2d 48 5e ed 02 d9 7b e2 1f 9f 78 05 10 c2 f3 9f 0f fc 88 e4 5e 78 11 1c e2 f4 87 80 3c df 45 a0 00 43 b8 1e 11 ae 57 00 0a 38 5f 7a 22 bc 3e f6 b3 5f bc e6 77 bf f9 b4 e3 bd 10 c0 0f be ef 09 e4 fb 13 50 40 01 c1 07 fe 03 74 9f 78 43 24 1f f6 88 10 fe e5 8d ef fc e7 27 bf 06 cc e7 bd f6 eb 7e fb 42 24 02 ee 7e 67 42 ff e9 81 df 7d 0a 64 df f7 26 20 ff ed 5d 9f 08 d8 ff 9d 02 ea 5f ff eb 0b 21 82 f3 6f 5f fb d1 bf fd f0 c7 73 f8 f6 43 5f ff 96 97 78 f1 37 7f ea e7 04 06 98 76 03 18 7c dd 57 08 e6 a7 7a f7 e7 80 be 67 7d e2 47 01 04 a2 05 Data Ascii: gILH{R:)>=xw]ip`v\|{ -H^{x^x<ECW8_z">_wP@txC$'~B$~gB}d& ]_!o_sC_x7v\|Wzg}G
2025-01-02 05:12:40 UTC	14634	IN	Data Raw: 57 20 6d 00 bf 9f bc cb 40 3a bd b7 ea 31 bd 07 53 b5 d3 50 2d 15 55 d4 13 5d 84 96 40 e6 18 61 85 c3 00 0c 10 9d 0c 0b ca 0d ab 7c df 14 3d 6c 05 55 01 27 51 4e fb 65 f0 15 99 a5 c9 32 7a 50 04 ce 6c 07 25 bb 1d 10 36 99 b3 53 42 d7 6c 78 2e e5 3e 4b c7 cd 59 90 1d 4c 94 02 03 31 08 05 31 00 0c b0 9b 31 35 64 16 1b 4d d1 a4 74 83 9b c7 59 32 53 16 1c 3a 29 70 d0 0a b1 02 72 c4 52 a4 17 aa c3 16 d0 bb c2 44 19 71 07 14 7d d0 4e 30 02 6d 50 04 45 c0 08 1c cd 08 48 97 cd 2b 16 32 c7 7a a6 3a 54 d0 12 cd 10 00 f0 03 2a bd d2 2c 9d 1c 19 fd d2 1a 5d 04 2b 30 d3 34 ff bd 02 3b f0 04 0c 10 99 72 57 12 c6 70 d2 4a d4 42 ca 91 1c 2d 3d d4 2d fd d3 7a 34 02 34 71 0a 4a bd d4 c0 01 d4 4b 0d 1e 50 0d d5 41 2d 0c 54 5d d5 47 7d d5 17 ad 47 7e b0 d5 5c cd 14 c9 61 d5 Data Ascii: W m@:1SP-U]@a\|=lU'QNe2zPl%6SBlx.>KYL1115dMtY2S:)prRDq}N0mPEH+2z:T*,]+04;rWpJB-=-z44qJKPA-T]G}G~\a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49876	175.6.201.25	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	359	OUT	GET /i/LD/SH132.gif HTTP/1.1 Host: tycjb777.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:40 UTC	528	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 122363 Connection: close Accept-Ranges: bytes Age: 61678 Cache-Control: max-age=2592000 Etag: "6734946a-1ddfb" Expires: Fri, 31 Jan 2025 12:04:41 GMT Last-Modified: Wed, 13 Nov 2024 11:58:34 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: d08b98bd1c9c65eeb3fcf80f600f6a46 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache02.hyct
2025-01-02 05:12:40 UTC	15856	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 ae ae b0 71 71 72 c9 dc ff bb d4 fd 91 92 92 f2 d9 fe bd 63 10 d7 e7 ff fe cc d7 59 43 06 2a d5 ff d2 b1 24 9f ac da aa 5b 6b aa 80 04 5a 9e ae eb d2 31 20 b6 f9 fb f6 4e 71 fe 52 ff 00 01 fb f5 6f 5f 14 14 fc f9 91 fe fa ae 10 10 12 94 f4 ff 9f 1f fe 4c 4b 4d a0 64 9b c6 71 fa 54 fe 2c 21 22 24 9d 95 54 b7 51 fc c8 98 23 eb eb eb f2 dc 48 ff 95 c9 02 07 06 fe 26 6a 8f 1e 18 88 fe 6f 69 67 a2 21 5f 6c ef f7 ff f3 da b4 d2 ff ca fe 17 28 ff c6 00 17 32 54 d1 8f fe da d9 d9 c3 c3 c3 dc c5 28 2b 59 cb 43 f1 ff dc cb a8 e3 ef ff 6e 23 40 fe b2 b5 f1 d6 6d ff fe ed f0 b5 2a 4f 6c ce 6f f5 ff ad ff 94 d5 b4 b0 ff 4b 73 d5 ab 71 ff 6f b8 4a bd ff fc 8f 91 71 88 d2 f9 ec fd ae f2 ff 4c d8 f8 c4 8f 10 33 33 35 fe b2 d1 b0 70 Data Ascii: GIF89aqqrcYC$[kZ1 NqRo_LKMdqT,!"$TQ#H&joig!_l(2T(+YCn#@mOloKsqoJqL335p
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 2c 07 a1 88 38 de c7 06 00 2b 02 47 02 09 8e 05 39 8f 90 44 0e 69 64 91 2d d4 22 4f 8e f7 39 61 0c 92 47 46 19 e4 8d 0c b2 01 e5 95 43 12 c4 20 08 2d 20 39 23 83 1c 60 49 25 93 4c 46 83 e5 99 43 fe d8 e5 9a 6c b6 e9 a6 9b 21 92 79 5f 06 00 bc 69 67 97 43 3a 21 a1 2f 77 da 59 20 83 75 b6 39 e4 97 06 86 69 27 3d 63 ca 89 a3 13 7d 36 da 82 9a 68 a2 19 a7 a2 f7 f1 19 e9 90 5d 26 7a 1f 01 78 46 da 42 00 11 72 49 e4 9a 84 02 18 a6 94 98 6a 4a a9 84 99 5c 3a ea a3 40 3a ff da e7 3c 75 88 28 4c 06 22 66 10 ab ac 6b 2e c8 a0 32 bc f6 1a 61 00 77 96 7a 9f a1 76 aa ba 6a 84 81 06 bb a6 0e 3a 38 6b 27 ae 0c 9e 10 40 0d c6 1c 40 43 1d 28 0e 2b ed a7 7b 06 ab 2c 54 8d d9 69 ac 7d c8 be 39 ae 3f 57 01 50 07 00 ee c2 5b 07 01 04 20 25 a2 95 df b6 60 cc 93 d1 b6 d0 ef bf Data Ascii: ,8+G9Did-"O9aGFC - 9#`I%LFCl!y_igC:!/wY u9i'=c}6h]&zxFBrIjJ\:@:<u(L"fk.2awzvj:8k'@@C(+{,Ti}9?WP[ %`
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: f3 80 01 2c 8c 01 2e 70 01 18 40 10 df bb c2 2d 5c c3 36 7c c3 5d 60 10 ee 4b c3 35 dc 05 21 e0 bc f7 10 be e1 7b 0f f9 90 be e7 29 b4 1b 9c c1 4a bc c4 4c ac c1 11 c1 01 00 50 0f 3d e2 03 fe e0 0b e2 9b 25 fd 50 03 12 9c bd 51 3c c5 55 7c c5 3b a2 c5 0c a1 0c 3b 52 01 17 d0 03 17 70 01 9b 70 01 a9 40 10 f7 7b 01 62 70 c6 69 8c c6 71 8c c6 72 5c c7 18 70 01 3a bc 23 70 2c c7 30 1c 02 df 2b c4 e1 eb 03 18 10 02 13 8c c4 56 2c c8 31 ff 0c 11 ee eb 23 68 fc c5 ca 5b 03 27 8c 10 8d dc 23 8f 9c c8 3e 22 c9 0a e1 be 5d d0 03 3d 50 01 9e 5c 02 15 e0 0d 32 ec 03 3d d0 08 a8 fc c9 aa 0c ca a0 dc 08 6a b0 00 a8 dc 08 0b b0 c8 04 e1 0b f2 2b ca aa 8c c6 96 e0 be 5a c0 ca ab fc cb be 1c cc 76 6c c8 47 9c b6 5f bc 2f c8 9c cc c8 fc c8 0e a1 0c c9 bb 23 5a 50 02 3d 20 Data Ascii: ,.p@-\6\|]`K5!{)JLP=%PQ<U\|;;Rpp@{bpiqr\p:#p,0+V,1#h['#>"]=P\2=j+ZvlG_/#ZP=
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: f1 0f 35 40 00 de ab 44 fc 2b 10 ff 1b c0 c5 4b c0 06 7c b7 3d 50 11 3d 70 01 13 5c c1 12 fc 0f 17 70 01 6e 80 12 17 20 06 14 8c 01 b8 4b 00 3c db 0f 2e e0 4d 1a cb b9 2a d1 0f 3e b0 14 01 40 02 24 b1 c1 ef 5b 11 24 10 00 51 db c2 2f 7c 21 24 31 c3 07 ac 12 f9 50 02 15 51 01 3d 00 c4 42 1c c4 02 a1 06 02 31 02 15 b0 c1 25 81 01 11 fc c3 02 51 0b ff e0 03 13 2c 10 17 00 c4 17 40 c5 56 8c c5 15 5c 01 02 61 c2 af ea 0b d9 11 c6 d6 31 c5 e9 da bf ff 70 0f 5c cc c5 9b 10 c5 02 11 c1 5a f0 ba 00 d0 ae fe 60 c6 68 fc 0f 6a cc c6 ff e0 c6 70 3c b3 00 b0 bb 15 d1 08 9c d0 c4 15 21 bf 9c 50 11 25 e0 c3 24 b1 00 10 ff 50 02 9c 50 02 10 b0 c6 23 e1 c2 24 e1 c3 20 60 c6 7c e1 c5 34 db 0d 18 d0 08 29 51 02 5c bc 12 00 20 10 e8 cb c9 8b 5c 02 6b 0c c2 3e bc c8 8d 70 01 Data Ascii: 5@D+K\|=P=p\pn K<.M*>@$[$Q/\|!$1PQ=B1%Q,@V\a1p\Z`hjp<!P%$PP#$ `\|4)Q\ \k>p
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: e1 bc 93 2c 10 da 2d dd 77 ad cb d3 2d d3 04 ce 10 4a 1b d3 30 8d e0 0d 21 c4 ff 00 05 0e 30 02 49 bd dc 30 ed dd 45 5c e1 13 d1 df 18 a1 05 17 30 e2 17 80 01 5d a0 06 83 10 02 d1 e0 03 e6 dd 05 2e 6e e2 2e ae 06 9b f0 c2 44 81 bc d2 1d d6 81 cd 10 d1 70 01 12 90 e1 1b ee d9 9c 2c 10 3e d0 e0 b1 9b d5 ae 3d 11 41 9e de 44 0e c3 0c 71 e4 0c b1 07 19 71 e1 86 7d c8 db 0d d6 20 8e 11 3d 3e dd 30 dd 08 2a fe 0f 59 1e e1 d3 1d d2 03 51 11 f6 9d 11 01 50 01 59 1e cd 84 50 d7 a3 f0 03 47 ae 06 68 5c c5 be f0 1d 96 bc cc 65 80 08 4e fe 0f 6d fe e6 71 2e c2 74 6e d6 77 ee e4 96 90 00 40 5d 11 88 50 06 89 ff 2d 11 88 ec e4 b0 3d 14 a2 1d 00 94 3d 11 cb 4c e3 be 3d 11 3f 90 e3 02 b1 e3 69 ae d4 ff ad 11 fe 90 da 0d c1 df ee fd 0f f9 40 11 65 00 21 a0 ce 10 a2 ce 10 Data Ascii: ,-w-J0!0I0E\0].n.Dp,>=ADqq} =>0*YQPYPGh\eNmq.tnw@]P-==L=?i@e!
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 65 de 83 6d 0c 27 4a 7c f8 61 b8 b5 50 3f 1c cd 52 28 ca c3 44 21 e4 c5 58 8b 20 84 e8 04 a1 62 ec 56 21 37 c1 ba d6 ff 61 47 fc 6f fb c3 ee df 09 07 2f e9 db 6f a3 82 67 d1 62 37 28 78 c1 7d fc f9 ff 55 c0 c9 72 b7 dd 5a 86 82 a0 11 b1 20 c8 0a a3 d9 c4 82 af 84 3d a8 3a 28 9a 9d a4 83 0f 82 ff 12 fc 67 c1 06 1f 82 90 a7 c3 26 fc 8f 3d 86 22 23 2f 3b f9 f8 22 6f 01 ab 20 e0 64 45 16 5b 84 00 02 7f 42 60 ed c5 f1 fc a2 af b9 92 84 da cb 46 1b 96 7b c8 c1 f1 a4 fb 87 84 7f 94 61 a8 a2 be f8 9b ca 20 bf a2 23 d2 c8 83 90 64 8c c2 8e 40 3c e8 ab f2 08 92 a0 44 de 38 49 00 ad 74 2c b9 e4 12 6f c8 1c b3 cc 04 d4 c1 c8 1f 5f 18 ea e7 a4 f2 4a b0 61 2e 82 fa 11 6f ad ac 1a b9 20 a6 87 2e 60 88 93 f3 da ca 73 4f 8c fc 3c 08 50 2b 1f fa ff 6a a0 01 b5 e4 b2 ab 01 Data Ascii: em'J\|aP?R(D!X bV!7aGo/ogb7(x}UrZ =:(g&="#/;"o dE[B`F{a #d@<D8It,o_Ja.o .`sO<P+j
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 23 70 61 07 38 f1 47 03 c3 f0 84 27 20 20 86 08 a0 61 0d 6d 78 43 1c e6 50 87 3b e4 61 0f 7d f8 43 20 06 51 88 41 9c a1 0c 6b 38 43 18 86 c1 0a e0 30 09 38 8c 60 02 19 3e 01 84 53 a4 62 15 ad 78 45 2c 66 d1 04 30 44 80 09 8c 00 8e 6a 40 c4 89 31 94 20 04 1f f8 c4 33 7a f1 84 6a 7c e2 13 d2 f8 46 36 aa 31 82 6f 5c 23 1d db 38 c7 3a e6 f1 89 26 a8 23 0c ed 18 c7 07 f2 11 8d 2f f4 22 20 f5 b8 c5 3f a6 f1 09 66 3c 24 1d f1 38 48 48 16 32 90 68 2c 64 04 65 f8 c5 86 50 c2 08 49 f4 22 0a 3d f9 49 50 7e d2 1e f6 c0 42 28 4d b9 c9 7f d8 a3 93 a7 fc 24 16 48 c9 4a 4f f6 a3 1f 9d 34 41 42 60 e9 c9 02 fc 03 01 9e 7c 82 2c 59 59 80 2e 1a c1 95 6e 7c e2 2e 41 e9 ca 5d 3e a1 00 58 60 26 33 0b 40 4c 14 3e c1 1e ff 78 42 33 ad 89 05 63 ff de 32 90 4f e0 81 11 28 b1 10 36 Data Ascii: #pa8G' amxCP;a}C QAk8C08`>SbxE,f0Dj@1 3zj\|F61o\#8:&#/" ?f<$8HH2h,dePI"=IP~B(M$HJO4AB`\|,YY.n\|.A]>X`&3@L>xB3c2O(6
2025-01-02 05:12:40 UTC	8203	IN	Data Raw: 76 bc 84 98 c4 59 b6 ac 6d 36 0e c6 1d ee ce 4e 81 d2 ca ee 04 b6 ed fd 6f 67 07 3c b4 e3 76 b5 ff b9 e1 2c 70 1c 4c 39 0f ce fe b7 9e ff dd 59 ae f2 b7 cd 05 f1 37 c1 f3 3c 70 80 87 16 b5 d0 95 38 49 0e 2a 64 67 b7 3a cf 56 16 39 ae 73 db 6b de fe 9b b4 6a 95 b3 56 31 8e f0 ec 66 1c 07 c9 d6 77 bf fd ad 69 86 8b 1c c2 f4 e8 38 3d 30 ae eb 85 de 3c 26 4f 0e b9 6c 4d 9b d8 87 bb d6 d4 06 f1 29 c3 5f de ea a5 33 fd df 41 60 f3 43 fe 19 f0 20 d4 f7 c5 56 e5 b9 d2 52 eb ec 25 3b d8 c9 15 bf b9 c0 9d ce 70 26 50 7a 0a ff c0 86 06 a6 30 05 05 04 3c ee 73 a7 bb bd 15 10 6c 86 d8 c3 ee f6 46 ee d7 03 9e d4 20 c4 9d ef 4d ee 7a 41 16 6e 77 bc 5f ca ef 73 ff 37 72 8b 8a f2 58 4e 35 e0 bb 3e 08 a9 03 3e d8 bb 03 f8 1f 3a 08 bc bd a7 6a e1 87 1c 5e ee 19 97 bb e0 9d Data Ascii: vYm6Nog<v,pL9Y7<p8I*dg:V9skjV1fwi8=0<&OlM)_3A`C VR%;p&Pz0<slF MzAnw_s7rXN5>>:j^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49885	163.181.131.209	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	377	OUT	GET /b9fb3076983380cf2d30af608afa0f94.gif.js HTTP/1.1 Host: vns2.ezrent.hk Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:39 UTC	675	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/javascript Content-Length: 116713 Connection: close Date: Thu, 02 Jan 2025 05:12:36 GMT Last-Modified: Thu, 29 Aug 2024 10:16:45 GMT Vary: Accept-Encoding ETag: "66d04a8d-1c7e9" Expires: Thu, 02 Jan 2025 17:12:36 GMT Cache-Control: max-age=43200 Accept-Ranges: bytes Via: ens-cache12.l2de3[507,509,200-0,M], ens-cache8.l2de3[512,0], ens-cache7.de7[0,0,200-0,H], ens-cache7.de7[1,0] Age: 3 Ali-Swift-Global-Savetime: 1735794756 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Thu, 02 Jan 2025 05:12:36 GMT X-Swift-CacheTime: 43200 Timing-Allow-Origin: * EagleId: a3b5839b17357947598451312e
2025-01-02 05:12:39 UTC	15709	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 d4 d0 ca cf b0 68 ff ff fd d2 c8 b1 69 66 53 d7 16 26 f5 ca 2d d5 ac 50 7b 7b 62 ff e7 01 db 2b 29 17 14 10 45 44 37 57 57 47 f8 e6 cd f8 e9 dc fa ee e7 af 96 6c 34 33 31 b0 a6 91 e9 79 65 ec 86 6c e6 66 57 74 73 5b 85 84 68 c7 af 96 fe f8 d8 dc 37 33 ff ef 4b f3 d8 bd 97 62 18 df 46 36 df 4d 47 b6 86 2e fe ec 90 da a7 2f d2 bb a4 94 68 30 ee d3 b6 e8 8f 91 ff eb 30 e6 b9 49 a8 75 2d 8f 73 4d ff fb f6 b4 71 4f 6d 51 2a 8d 18 0d 33 20 11 e8 b6 2e 33 31 29 cb 97 2d e2 54 49 24 24 23 fb db 00 fe e6 74 f3 db 8e f9 db 67 f9 de 79 ff f7 f6 b6 87 12 a8 9c 8a c9 9c 49 e9 c8 65 ff fe e4 87 57 26 28 28 21 28 28 28 fc f4 e5 f3 c5 c6 fc dd 57 85 7b 65 f7 e6 bc f3 df c5 40 3a 2f f6 41 38 75 45 19 ff fe ed 64 5a 4c ba 98 5c ea 95 Data Ascii: GIF89ahifS&-P{{b+)ED7WWGl431yelfWts[h73KbF6MG./h00Iu-sMqOmQ*3 .31)-TI$$#tgyIeW&((!(((W{e@:/A8uEdZL\
2025-01-02 05:12:40 UTC	16281	IN	Data Raw: 00 57 0e 00 5d 4e 01 09 5c e5 3b 8e c4 6b 5e 25 ec 10 cf 72 48 06 49 b0 25 66 d6 00 5c d6 a5 55 ae 42 26 c8 e5 00 04 cc f6 51 26 61 ee 17 fe b0 e5 19 7c 4c 59 cc a6 03 bc c2 80 21 e6 61 5e 25 09 98 a6 03 24 c8 1f e2 c6 2a b0 a5 12 f4 43 5e 9a e5 19 70 dd 8a 2c 24 c6 54 dc 38 e5 1f 45 9c 44 4b 34 59 c8 a1 26 6d 9a e5 11 9c 81 2e 4c 00 09 bc 42 26 8c a6 73 2e a7 6c 9a 25 38 08 01 13 2d c7 6d a6 04 5b 92 96 3f 98 a5 73 ca e5 14 58 a7 55 ea 02 7d 7c d1 77 5e a5 04 1c e7 02 28 41 28 c0 25 fc 68 5f 0f 7c a5 55 92 c0 68 6a a8 03 00 c0 11 38 67 75 9a a5 69 f0 e2 11 b0 e5 00 6c ca 76 5e e5 d5 ed 62 c1 90 cc 1e 2a 55 ac 59 52 7a 22 a4 b0 8d db 19 24 81 8e 26 41 42 1d c4 2a ec e8 2b f8 44 a6 e8 45 1e e9 03 09 ec 68 12 b4 02 13 19 ff 87 a5 58 20 17 21 69 12 d0 11 3e Data Ascii: W]N\;k^%rHI%f\UB&Q&a\|LY!a^%$C^p,$T8EDK4Y&m.LB&s.l%8-m[?sXU}\|w^(A(%h_\|Uhj8guilv^bUYRz"$&AB*+DEhX !i>
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 56 df c5 5c 4e d5 e1 df 50 df 36 35 e2 c5 e2 61 1f de 54 d7 b5 89 0f e8 59 fe 40 62 36 55 62 c3 b0 dd 35 ed e1 04 63 e2 97 f8 61 95 0d 0c f5 bd db 23 2e e2 fe 88 61 40 d5 62 04 23 da ff 33 6e 62 e9 bd 09 01 26 d5 fe e8 dc 4a b5 e2 c2 08 db 39 45 63 f8 52 e3 3b 66 63 11 be 09 2b b8 d7 0f 0e 0e 3d ce d5 fe 80 db 4a c5 e3 e7 92 84 4d 45 e4 95 f0 e2 a0 bd 89 12 5e e0 e0 38 5e 42 1e 8c 0f d8 04 4c 76 09 d6 5d 64 c2 48 d3 4d 78 e1 a2 c1 e0 35 ee e2 4d 95 64 99 b0 02 a9 9d 61 fe d0 dd 0c 1e 0c c2 1d e2 95 a0 64 7c 1d 0c 4d 7d 62 bc 71 61 3e 9e 53 31 8e 89 14 fe 0f 2c b6 65 48 5e 53 5b 06 04 4e 05 65 f3 15 66 e8 b1 5d 50 ae e1 9b 88 df ff 18 64 b3 1d 0c 8a 05 66 43 9e 53 60 b6 89 74 35 66 8c a9 66 36 5d e6 c6 ad 89 10 de da ff 70 06 4e 1d 5f 18 5e d3 e0 95 65 38 Data Ascii: V\NP65aTY@b6Ub5ca#.a@b#3nb&J9EcR;fc+=JME^8^BLv]dHMx5Mdad\|M}bqa>S1,eH^S[Nef]PdfCS`t5ff6]pN_^e8
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: a2 13 54 cf 26 01 17 fc 43 16 ff f0 c3 3f 54 d0 07 15 30 e1 07 3e e8 6c 7f 9d 5b 0b 2c 90 c0 16 7d 28 c1 41 06 40 07 30 c8 e2 09 05 2e f0 13 c0 f0 04 82 54 61 c1 7d 18 2b 31 7e 00 0c 62 e4 60 ff cd 3a 78 70 21 7e d0 8b 00 0c 78 12 3e 58 c1 24 f4 3c 09 58 4c 42 05 6f 58 a5 5b 4c b2 e2 49 e2 c1 31 05 c0 43 76 6b 1c 8e 7f 34 c3 06 e1 78 b4 33 77 cc e3 82 d4 40 5a 37 74 53 49 be 69 24 24 9d 86 c4 7e 08 80 1f 9e f0 04 1f 04 e1 0b 74 c8 47 09 7c e0 03 3b 10 e3 02 b5 18 00 0e b2 00 8b 0c 1c a4 17 60 1e f0 98 9f 71 e0 67 14 a4 0a ff a8 42 15 0a 51 85 00 14 5b d8 a4 36 f0 13 9e d1 0b 2f cb a2 cb b0 28 83 b4 97 fb e7 23 c0 64 35 aa 52 09 13 c6 a1 bf 54 d0 e0 0f 1b 00 85 a4 6b bc d8 58 6c a2 13 8c 96 f4 63 bf 6b c3 7f c8 40 08 f8 10 5d 54 05 b2 69 24 9d 8d 25 73 08 Data Ascii: T&C?T0>l[,}(A@0.Ta}+1~b`:xp!~x>X$<XLBoX[LI1Cvk4x3w@Z7tSIi$$~tG\|;`qgBQ[6/(#d5RTkXlck@]Ti$%s
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: a5 2c 94 33 51 66 30 0e 34 30 c8 e0 39 cd 8e f9 b8 38 6b a3 0f 90 cd 4b c2 73 89 8c 10 aa 30 10 ae a6 0a f2 a0 0a 30 3d 6b 65 76 b6 1e ff b0 c4 54 fc 08 86 50 a0 90 70 75 71 90 b4 49 db 5e 2a 40 65 5d a0 03 92 c0 b5 06 d0 89 0a bc 6b 65 e0 02 65 a0 ca 07 b0 02 6e c8 a1 04 e1 d0 22 49 ad d4 ba d0 0c cd b7 18 60 0d 10 ad 8c d1 2b 0e 82 da 51 82 6a d1 97 13 4d c8 22 04 66 e0 0d 20 40 ae 3b 20 0a 8c 59 88 36 3a d2 38 69 d2 4a 82 1c 29 dd cd 02 01 d3 7a bd d7 65 90 02 67 ab 0a 57 58 70 e9 f7 05 a5 c9 04 09 1b 6f 5f 40 5e 83 d0 06 42 ac 0a b6 50 0a 4c cb 5f 10 19 91 b6 17 02 bc ab 02 64 16 02 64 38 7c 02 01 a8 72 76 01 ba fc d0 7b ca d0 c0 75 d0 72 68 87 2a 0a d6 9a 54 cc 19 65 39 5d 45 26 92 22 01 35 a0 0e de a0 d6 45 20 0a 9c 20 b9 22 0d cd 73 ad 24 80 64 d7 Data Ascii: ,3Qf04098kKs00=kevTPpuqI^@e]keen"I`+QjM"f @; Y6:8iJ)zegWXpo_@^BPL_dd8\|rv{urhTe9]E&"5E "s$d
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 04 b0 02 f2 10 a3 23 a0 59 2b 50 0f 34 47 a0 a8 87 0f 0b 90 7a 08 7a 61 12 20 03 42 aa 11 8d 23 3f e9 c8 8e 25 d9 99 ee 58 0b 52 7a 96 58 80 05 73 40 00 73 70 a5 59 7a 01 27 a0 a1 b0 68 8b f7 58 78 e5 09 6a fd 08 5c d4 a0 4a f4 d4 05 2d 04 43 06 60 00 77 40 64 f5 19 02 1e 60 8c 1e 90 94 aa 20 09 a8 90 a7 79 ba 09 d4 64 04 3a d0 07 74 e0 04 a9 27 01 f7 d0 0f 44 da 7e a3 b8 72 db 85 7a 4d ff da a4 60 f9 0f 53 9a 92 d8 99 9d db 69 a5 59 ba a5 47 d0 a5 a5 09 a6 61 2a a6 c5 47 a6 c7 f7 05 02 51 02 30 40 4f 61 c0 60 ff 40 08 2d 14 47 6d 6a 00 d2 d0 46 77 10 6e 94 90 94 ab 0a 47 28 74 07 23 10 43 64 d0 04 1a 60 0b 80 5a 0f 5a 78 a0 88 4a 73 35 a0 33 f9 90 86 f1 97 86 ac d8 8e 52 1a a9 93 5a a5 58 7a a9 73 70 01 17 80 00 99 0a 7c 1d ca 01 82 27 a6 ac b9 70 d4 b6 Data Ascii: #Y+P4Gzza B#?%XRzXs@spYz'hXxj\J-C`w@d` yd:t'D~rzM`SiYGa*GQ0@Oa`@-GmjFwnG(t#Cd`ZZxJs53RZXzsp\|'p
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 73 b0 80 e8 77 7e 47 b0 83 50 33 7c 08 e1 04 a1 27 01 f5 80 08 d4 f0 0d 8f 90 79 ec 07 7f aa 40 6d 33 90 03 3e a0 02 25 20 01 fe 20 0c 60 00 82 75 a3 4f 1b 95 43 39 75 85 f1 16 83 80 a6 6c e3 f7 85 60 28 86 0d ff a8 83 66 38 2e 56 22 7c 06 71 7c ff 60 6c 8b 15 58 b5 50 02 3c 80 0c d7 60 74 7e 30 03 23 60 08 18 18 7f ff 80 03 23 e0 04 35 30 02 3f 10 04 9d b2 5c 3b 03 49 01 b8 5a ab 85 6c e1 57 6a 8a c7 73 8d a8 7b 63 c8 8b e8 87 00 ce 83 86 c7 e7 07 6a 18 7a 81 b5 58 42 a0 04 88 10 02 92 b0 0b 86 20 09 06 70 07 6f e7 01 23 80 03 02 20 02 b2 50 02 c0 10 02 73 30 28 d0 b7 58 01 05 49 c0 a6 58 39 f7 6e 5d 56 7b 15 27 0e ba 68 83 e6 f7 8b 0b a8 83 47 c0 42 30 f0 05 71 e0 83 db 17 7a 73 b3 7d 9b 28 6e 94 90 08 92 40 8a 86 70 07 3a a0 03 c8 70 00 7a e0 01 e5 a2 Data Ascii: sw~GP3\|'y@m3>% `uOC9ul`(f8.V"\|q\|`lXP<`t~0#`#50?\;IZlWjs{cjzXB po# Ps0(XIX9n]V{'hGB0qzs}(n@p:pz
2025-01-02 05:12:40 UTC	2803	IN	Data Raw: 3b 89 fb e0 90 02 14 bc 50 8c 62 cc 42 05 66 e1 c2 2c 74 0c 87 b8 bb 5c d3 fc 87 34 22 9e e4 03 36 58 20 14 b2 b7 40 1b 20 b0 25 46 84 62 1f 95 b8 44 ce 75 82 8e 19 b4 44 38 a0 90 8a 27 5e f1 8a 56 bc a2 25 48 b8 b8 2e 3a 0e 8c 63 e4 80 11 ec 90 05 16 52 12 8d d2 cb 21 c8 fa 07 02 1e c6 f1 1f 73 ac e3 49 f8 48 c0 66 b4 24 1c 7d 64 e5 1f 01 d9 b5 0d 08 10 8f 50 28 46 df fc f6 41 45 e6 12 8b ac e3 a2 09 29 46 8e 2d 50 32 05 14 00 97 28 44 52 88 4c 8e 31 8d 04 8a 15 ba 3c e9 46 50 c2 f1 70 27 d9 c0 20 09 68 83 94 ff 58 73 80 36 10 25 4a 96 c1 ca 3e 2e e3 95 b0 04 22 1e 9d 01 08 74 a6 13 9d 79 b8 83 2e af 68 80 12 fa 52 48 e4 08 a3 18 db 31 89 16 e4 53 9f f9 54 84 1d 84 c9 4c 59 e9 f0 93 a1 fc 00 2f 4e b2 ca 05 26 23 25 c9 c8 e0 26 58 f2 4d 70 22 d1 19 62 a3 Data Ascii: ;PbBf,t\4"6X @ %FbDuD8'^V%H.:cR!sIHf$}dP(FAE)F-P2(DRL1<FPp' hXs6%J>."ty.hRH1STLY/N&#%&XMp"b

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49875	175.6.201.25	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	359	OUT	GET /i/LD/SH131.gif HTTP/1.1 Host: tycjb777.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:40 UTC	530	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 1430876 Connection: close Accept-Ranges: bytes Age: 80927 Cache-Control: max-age=2592000 Etag: "6734946b-15d55c" Expires: Fri, 31 Jan 2025 06:43:52 GMT Last-Modified: Wed, 13 Nov 2024 11:58:35 GMT X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: a0812610737ba2b47faa1c4cbb75dc08 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:39 GMT via: cache04.hyct
2025-01-02 05:12:40 UTC	15854	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 a3 52 1f fa 9f de 64 0a 11 49 96 d3 51 58 61 f7 d6 2b 5e b1 1c d7 f1 fc ab 8c 6a 98 11 19 fe 29 6d 2b 73 8f fe 6f b8 f0 ce b6 de 63 0b 67 ab d2 9b 62 a3 f9 db f9 92 cd fa 59 6d d4 ff f5 6e 32 b0 b8 db b9 ac fe fb 91 eb 10 1c 55 b2 ee ff fd b1 f4 72 e6 4f ce dc 4b 94 ba ff 4e ac 6e d0 ef 26 8b 94 48 6e b3 cf ac 96 07 f0 f9 d8 b1 24 f8 d6 4c 90 27 cf f8 d3 70 d6 91 4b fd f2 4d ff 33 94 32 49 5f 1c ff a3 32 91 b0 28 2e 55 5c 24 b4 d0 95 26 fa d6 8f 1b 69 fe dc cc b8 6d 94 f7 f1 b5 27 65 43 2a 31 51 8e f2 b2 4f 4d aa bb 25 aa dc fe 50 91 f0 b5 6a d7 d2 cb 6a 92 d8 fe ac c1 51 8d f1 be 93 f9 8b 45 3c 03 00 06 55 ff b8 bb b1 fc 8a ba da fd 8a c7 8a 68 4d 92 92 92 b6 6e 3b d3 45 44 b9 25 4a fe 69 8e 2f 28 2a b8 97 86 da af Data Ascii: GIF89aRdIQXa+^j)m+socgbYmn2UrOKNn&Hn$L'pKM32I_2(.U\$&im'eC1QOM%PjjQE<UhMn;ED%Ji/(
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 0b e3 15 de 5b a6 e5 33 80 cd 70 a5 8b d9 74 9f 70 92 9f d8 10 ce fa 65 8b e0 60 cb f9 25 67 e1 d0 8d dd 9c 8d 77 81 97 a9 1c 4e e2 18 4e 0e 9c d8 1e a8 c1 79 45 8e 1a 30 44 1c f4 e6 e7 48 4c e1 c0 8a e2 d4 57 07 9c 58 14 2c c2 02 68 ca 7c 89 8a f9 84 98 0b dc c0 7b c1 0e eb 40 20 03 c6 8e 13 d2 67 89 d9 ce 7d 4d 98 ef 50 20 48 e8 c3 f0 5c 83 3f 08 c3 20 1c e8 87 89 59 f3 dc 40 6e e4 4e 0b 44 c1 0a 54 41 15 00 02 32 d0 40 e5 34 84 1a c8 a0 0c ee 41 15 0c c5 89 39 4e f5 f0 c6 0e 36 04 89 02 e1 10 36 44 07 00 c1 44 dc 4f 12 de c0 48 14 50 47 a4 45 15 86 c4 01 b5 c4 95 c9 e1 5b bc 63 99 74 46 43 40 40 2c 24 42 2c 74 02 93 41 00 09 35 84 23 e4 43 e4 fc 81 46 a8 ff 20 52 1c 05 20 fc 01 9c 3d c5 56 6c 45 4c a4 01 05 50 80 9e bd 90 96 fa 99 0b 05 da 05 cc 90 0e Data Ascii: [3ptpe`%gwNNyE0DHLWX,h\|{@ g}MP H\? Y@nNDTA2@4A9N66DDOHPGE[ctFC@@,$B,tA5#CF R =VlELP
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 44 84 ab 51 ae e5 6a 00 e6 e2 86 02 64 ae 06 20 2f 02 3c 9b 02 e5 9a bb 11 81 27 78 1b df 51 d0 1c 4c 1b 0b 80 d0 09 7d 82 0b 54 1a 52 20 9a c1 11 9c 04 19 02 02 a0 3d 65 09 41 82 61 9c fc 3a 51 10 08 18 e8 11 30 57 18 1c 27 70 c1 19 c4 41 0b d0 07 bc e9 81 d5 99 81 d8 c1 9b 6c 20 c2 6c 68 9d f1 8a 41 19 64 9d e8 0a c2 21 24 a2 19 30 03 f5 72 af e1 2a 2e e2 12 1e cd 41 00 04 50 31 32 a0 42 17 a3 c2 fc 02 93 2c f4 1e 2f 44 13 30 f4 1e 1c eb d2 f1 e1 1f 20 13 b2 fd 31 32 20 33 1f 33 e4 0f 24 73 53 3a a4 01 f6 a1 43 33 e5 0f fe 48 08 66 30 9f 01 7a 86 2b 0b c4 40 7c b2 3d 85 20 06 3a b3 02 32 33 20 30 c4 35 b3 a0 dc 88 36 66 7b 8a 77 30 21 0e 2a a1 13 7a b3 36 ff e3 21 22 3a 80 51 6c b3 7b c0 b3 69 d0 33 3e f3 33 a8 88 34 b1 00 45 43 23 a2 66 b8 33 13 52 87 Data Ascii: DQjd /<'xQL}TR =eAa:Q0W'pAl lhAd!$0r.AP12B,/D0 12 33$sS:C3Hf0z+@\|= :23 056f{w0!z6!":Ql{i3>34EC#f3R
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 80 30 36 74 e3 35 2e 00 01 7d 73 60 45 a8 84 10 36 a5 54 ca 84 4c 58 38 97 00 05 15 66 61 19 86 08 a0 a3 04 05 00 03 cb 63 62 3f b6 87 25 06 86 75 28 86 65 88 86 68 08 67 6e fa 06 13 e4 09 24 e0 09 60 e0 07 72 ea 09 50 40 02 30 00 03 6e fa 86 65 08 87 69 0a 86 82 8a 85 22 a6 85 a0 13 3c a3 30 0a 30 50 00 99 13 3b d2 b3 64 08 c0 09 d8 53 02 8c 28 18 1d 40 05 d2 f0 65 5d 90 07 5a 26 08 97 e8 65 ef b3 89 5a 36 66 f3 73 6c 03 e4 3f 59 b4 3f a7 9a 00 a7 3a 40 fc 53 40 6f c6 8a 30 20 06 b0 88 8b b0 58 03 6e 08 00 09 e0 00 05 b0 67 24 a0 8b 1e e4 41 77 50 68 c2 28 8c 6a 20 11 5b d0 68 13 21 11 c9 d8 8c 84 b0 11 33 e4 8c d1 a8 43 0a b1 12 28 01 44 7b a0 13 47 a4 8d ff 45 14 44 a3 06 44 6d 40 44 e3 88 37 2e 90 47 7c 81 70 4e 91 14 48 11 4b b6 d6 17 76 84 04 60 20 Data Ascii: 06t5.}s`E6TLX8facb?%u(ehgn$`rP@0nei"<00P;dS(@e]Z&eZ6fsl?Y?:@S@o0 Xng$AwPh(j [h!3C(D{GEDDm@D7.G\|pNHKv`
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 89 10 c0 0d a6 e0 06 ca 2b c3 32 8c 0d 72 a2 7d 44 e1 0c ce 27 c4 e6 06 54 d7 70 c4 44 d4 13 18 41 0c a6 40 c5 52 2c 55 31 61 0b b6 00 0f 5c 55 c6 62 87 77 6c 6c 10 7b 07 78 76 2c c8 7a 0c 11 7d 8c 57 1d 31 7a 22 d1 78 a0 d1 05 6a a2 7d 76 42 13 19 c8 7d c4 47 c9 a6 cc 88 ce 00 09 3e 02 cb 66 60 15 55 91 5a bd 8c 7e 66 40 7e b0 71 24 5c a2 25 64 31 d2 3e ea d2 d2 4c c9 9c cc 7b ba 67 05 2a 08 18 d9 80 83 92 b1 cf 1a 42 84 10 82 19 29 62 02 06 e2 52 e0 80 00 42 00 72 06 4d 81 86 40 be 6c 08 1b 13 4d d1 16 8d 08 73 28 87 22 6d 26 ba 07 cd 20 c7 d2 c0 e7 81 32 21 6b 08 80 af 26 02 56 3e 2d 29 fa 0c 02 44 e0 31 e4 ed d6 b6 32 2a 43 e9 00 3e d6 1f 43 d6 1f 13 a1 ff 13 36 d6 64 b7 f2 64 eb 91 30 0e 41 15 9c e2 d6 b4 41 d6 1e 41 1f 44 16 64 3f 56 18 98 60 d6 6e Data Ascii: +2r}D'TpDA@R,U1a\Ubwll{xv,z}W1z"xj}vB}G>f`UZ~f@~q$\%d1>L{gB)bRBrM@lMs("m& 2!k&V>-)D12C>C6dd0AAADd?V`n
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 86 16 24 9a 29 22 6a ae ea 04 12 68 d0 06 11 45 50 20 85 0f a0 90 53 30 c5 07 25 a3 a5 c5 81 ef 09 01 31 60 82 07 c4 42 7e 8d 82 00 a0 9a d4 f9 5e 15 fc 01 37 7e c1 1f 00 42 15 ec 01 09 4a 41 3e 38 06 3b c4 c1 37 de 9a 5c ac 10 b0 31 ac 5e 00 9b 14 d1 a3 1a d8 81 1d ec 41 85 4c 40 b2 31 1b 3e b2 c3 0c c8 01 2f 41 25 1a 1c 0f 0e f0 c0 09 b4 4e 67 30 02 0a 20 24 18 79 91 4f 36 a4 2f 9d c6 4a 52 92 76 b4 2c bb 89 db 3c 21 01 1a 80 c1 48 72 64 71 14 47 bd 29 92 21 f1 c0 25 30 07 0f 38 07 74 a0 40 17 4d 46 1e 55 d2 3c 79 07 3f d4 83 39 3c 41 6a 9c 87 c2 71 01 12 8c c2 28 90 47 15 00 80 1b 58 ad 6b 28 a5 2c 9d 81 0d 38 82 23 c4 c3 18 a4 4b 36 29 25 43 d6 c6 79 78 ff 2c ce c6 40 d2 b9 47 26 51 01 1b 24 25 88 28 53 f4 09 1d 58 3a 81 8a b8 40 8a 10 80 12 8c 88 10 Data Ascii: $)"jhEP S0%1`B~^7~BJA>8;7\1^AL@1>/A%Ng0 $yO6/JRv,<!HrdqG)!%08t@MFU<y?9<Ajq(GXk(,8#K6)%Cyx,@G&Q$%(SX:@
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: a0 07 7a 78 00 7a d8 86 91 2d d9 1c d8 06 95 5d d9 4d 58 d9 6d 68 d9 95 cd 81 07 48 d9 db 80 8d 9a 4d d9 e2 90 48 54 da d9 0e d0 8d 9e ad c8 8c bc 48 a0 9d c8 81 83 25 a2 0d 25 89 34 85 7f ca 25 97 64 49 24 f8 25 ed 78 38 ef b0 49 51 20 26 ef a8 02 02 18 05 40 60 03 9d d4 49 38 88 02 38 20 03 ec 70 91 29 40 01 04 10 bb fe b0 28 a7 34 b9 13 e9 27 18 b9 84 aa ac ca 61 38 01 c3 84 82 9a f3 90 9b 0b 91 13 01 4b 26 40 01 25 49 11 1c 70 92 8d aa 03 00 90 11 81 f2 13 a5 d3 11 28 90 03 29 81 3a a9 43 91 11 b9 04 23 49 05 12 c1 01 49 d8 cb 8b 12 12 1e f0 ba af fb 91 6b 1a cc a5 2b cc 82 2a 91 04 41 84 3a a8 3b 48 21 00 49 91 bb bb b3 bb ca 44 5d 39 71 02 0f 89 01 28 ff c0 01 26 58 82 25 28 54 34 a0 00 30 58 84 24 98 95 13 00 14 28 28 aa 42 29 01 5a 39 01 bb 6b 3c Data Ascii: zxz-]MXmhHMHTH%%4%dI$%x8IQ &@`I88 p)@(4'a8K&@%Ip():C#IIk+*A:;H!ID]9q(&X%(T40X$((B)Z9k<
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: c2 c2 41 aa 20 04 69 d9 b6 c5 52 05 72 f0 03 08 e0 2a 55 c0 0f eb 00 05 aa 57 2a 60 00 76 fa 62 30 00 50 3f 4a 60 3c 53 50 54 3b 75 09 85 c9 04 49 a8 08 8b cb b8 8c 3b 10 84 89 06 14 aa 38 79 97 97 2d 41 01 0d b0 2f 88 e0 0f 88 80 04 75 80 04 e9 d0 03 0b c3 78 0d 93 9a bb b0 0b ca 70 00 d3 f0 00 d5 f0 01 be e0 9a 1c f3 09 07 20 02 29 53 36 44 76 9b 81 60 03 04 60 7a b8 99 32 00 80 06 27 70 02 1a 80 38 45 b9 06 c5 49 05 fa 60 58 82 b0 7b bd a7 06 23 c5 59 73 50 34 a0 c0 08 a0 e0 34 4c 73 9d 16 80 7d 87 40 bd a0 50 9e 5b 30 08 01 10 00 df 1b 00 5f 10 be e0 1b 04 d7 c0 0d ca 75 09 c3 e0 0f e9 f0 03 10 10 18 64 d0 87 4e 80 04 03 2a 5b e4 67 7e b8 45 05 5d 60 37 ff e4 30 06 3d 10 0f fa 40 00 ed b7 02 35 b0 53 8c a3 33 f6 17 a1 53 80 7a 6e 28 0a e0 07 7e a2 30 Data Ascii: A iRrUW`vb0P?J`<SPT;uI;8y-A/uxp )S6Dv``z2'p8EI`X{#YsP44Ls}@P[0_udN*[g~E]`70=@5S3Szn(~0
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 30 65 33 72 5b 13 b5 5e cf 60 02 c0 72 47 53 b2 ee 16 f0 20 d7 71 5f 93 ef 24 13 3c 13 f3 74 51 ef 78 ed f6 6d f7 36 6f f7 2e 38 eb 76 79 f1 36 7a 95 f7 6d d3 45 6d cc 25 3d f9 e1 3d fd c6 71 24 67 ba fe 6f 00 9b 2b 3f f5 93 72 f2 4f 7c b5 6b 7c 15 47 ba 1a 67 3e a1 0b 6f cc 21 06 fa 80 11 c4 80 11 6a e0 81 28 20 15 20 02 0f 2f 20 be 10 20 0d 24 70 21 16 c2 1f 04 61 20 6a a7 16 e0 41 12 fc a1 16 06 22 44 03 21 0d 0c 75 77 10 ec 21 e6 83 04 1c e0 0d 30 67 22 56 10 1d d2 b0 23 d6 21 15 64 50 03 1a e0 07 cc 20 49 2d c0 0c 98 44 09 a0 a0 2b 4c 72 08 46 21 28 a2 e7 10 9a d4 46 84 a0 24 31 f6 df 08 a5 78 f0 c9 05 d4 40 0d 20 80 0d d4 60 17 bb a0 1e ba 94 85 e6 e0 ff 0d 84 27 81 c2 70 0c 1d 42 0e fa e4 4f 9c f8 4f 04 a0 2d 24 41 4e cf 42 09 3e 0e 50 2c 92 34 90 Data Ascii: 0e3r[^`rGS q_$<tQxm6o.8vy6zmEm%==q$go+?rO\|k\|Gg>o!j( / $p!a jA"D!uw!0g"V#!dP I-D+LrF!(F$1x@ `'pBOO-$ANB>P,4
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 86 1a 74 46 1c e8 43 0f e8 43 8e 92 d8 a6 9c 81 0d 74 81 3f 98 82 0f 1a 45 0f da 80 bc 20 21 92 16 43 3a cc 58 94 05 58 09 98 10 05 28 41 96 9c 41 57 88 6c 96 a0 41 09 78 42 09 d8 40 31 a1 85 ab 96 00 0c 88 1a 19 10 00 19 e0 8a 05 8c 41 3a 64 83 9c 06 86 39 d8 d0 31 34 5a 0d 2f 47 1e e2 c0 31 f0 03 21 f0 69 1f aa d9 29 9c 42 27 44 00 63 20 51 3d fc 81 9f 85 80 8c c8 02 fd c8 82 0b 38 f1 0d 48 62 0d be 03 a6 82 c3 34 08 f0 c5 55 81 01 af 41 02 fb c3 02 37 30 0f ac 2a 29 5a 5a 0d a8 45 ac 3a 80 fd c5 40 2e d6 62 2d a2 80 ae ca c1 3f be 1b 02 76 81 ad 50 41 0f 8c 43 22 11 46 39 1c dd 41 10 c6 60 80 99 bc f4 80 b5 02 9b 0d 60 63 26 64 ab af f9 07 01 83 41 7f f5 ff 17 b8 32 45 21 7b ab 06 5e 02 18 4c 01 27 20 40 bb ea c1 39 6a f2 2a 9d a3 89 74 88 89 cc 52 28 Data Ascii: tFCCt?E !C:XX(AAWlAxB@1A:d914Z/G1!i)B'Dc Q=8Hb4UA70)ZZE:@.b-?vPAC"F9A``c&dA2E!{^L' @9jtR(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49884	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	376	OUT	GET /i/2024/07/26/12872no.gif HTTP/1.1 Host: 69vvnstttaaa888.dzlndygh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:40 UTC	582	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 162820 Connection: close Accept-Ranges: bytes Age: 156647 Cache-Control: max-age=2592000 Etag: "66ab3a20-27c04" Expires: Thu, 30 Jan 2025 09:41:54 GMT Last-Modified: Thu, 01 Aug 2024 07:32:48 GMT Vary: Accept-Encoding Via: cache75.jhmp03,cache01.hnlycm01 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 7457e8b7ce5ddea5dcb72e9622d5e83b X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:40 GMT
2025-01-02 05:12:40 UTC	15802	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 ff 00 d3 aa 97 03 fe ff fb d7 02 54 1f 0b ef 64 5d b3 8f 05 fe 2a 11 23 23 22 ff fe 00 00 fb 02 ef cd b8 f3 dc 6f f8 b2 08 d8 d8 d7 bb ff 11 d4 bb 49 fe 15 cf 94 05 02 ef 56 ec d4 f4 0e f9 d3 2a f7 90 0b f9 b1 94 dc cc bb fa d2 51 ff 99 e5 73 06 d4 f9 da 96 2f 46 f5 d7 ae 06 28 fe f9 ff fc 4a d0 b1 30 fb b4 af b2 75 6b ee 00 98 f8 71 09 ad ac ab f7 b3 2a 07 dc 59 fc 47 28 ce 99 88 01 cf 99 ff fb 30 b3 88 75 dd d0 69 4e ff ee ed 02 60 d3 92 09 f0 53 01 57 2e 73 91 6e 02 6a ff dd 17 9f 9d 70 6e 6b 6e 4b 01 fc 31 27 9f 2d 52 b9 99 88 20 4c 2f 1a 65 50 b6 6c 05 68 97 8b fa b6 4b d0 71 09 90 90 8f d2 8a 79 f9 6d 2e fa 8c 8b 4e 57 e2 28 0f 0a 4e 4b 4a b0 51 03 4a a7 76 93 66 51 f8 8e 27 a6 e4 e7 dd cc 54 ac da aa fb b2 6f 90 71 Data Ascii: GIF89aTd]##"oIVQs/F(J0ukq*YG(0uiN`SW.snjpnknK1'-R L/ePlhKqym.NW(NKJQJvfQ'Toq
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: d8 83 80 46 2d 80 8a 81 d5 fe 81 18 4c 13 a8 65 ad 37 b1 cb 09 e0 e1 1e cf 32 5f 88 1b c0 f5 12 48 2d 01 62 f4 80 a5 59 9a 21 c8 a9 4d cd ad 30 db 2d 62 58 81 21 f4 32 09 00 01 32 5b 5a 0f dc 6d aa 28 73 2f 3b 73 d1 f6 e2 2f fe 94 30 1a 2e db 08 15 12 28 1c e3 ba 0d 0c e0 9d 32 88 c3 1b 58 9d 8e f2 68 3e 30 03 3a 33 c3 65 4e c3 3b b0 c3 33 7c 6e 35 5a 63 38 98 ff 80 21 d8 00 5b d9 00 14 14 4e c9 1d 01 55 4c 48 f0 3e 8e 51 cc 84 0e dc c4 4d f8 15 4f 98 c3 ed 12 03 31 88 40 19 5c ce 5d 3d 34 50 58 8e ce 45 85 9b fa 23 eb a8 e9 9a 0a 5d 4b 30 6f ad 7c 02 43 ef 54 d6 d4 c1 f5 ca c1 14 94 34 d2 40 01 e3 f6 01 f0 54 00 03 50 80 09 30 00 69 d1 32 f9 66 8f 4c cf 4c 78 1c 96 33 d0 ef 2f b0 43 13 14 80 5b 72 a5 4e 07 83 a6 86 83 38 ac 01 ab 76 2a ab 32 80 2e e4 43 Data Ascii: F-Le72_H-bY!M0-bX!22[Zm(s/;s/0.(2Xh>0:3eN;3\|n5Zc8![NULH>QMO1@\]=4PXE#]K0o\|CT4@TP0i2fLLx3/C[rN8v*2.C
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: c9 a5 dc 67 c3 88 16 08 dc 6e 38 80 2c d8 dd 98 7a 87 83 28 d0 69 e0 02 2d 40 1c 2d 68 dc ba 05 84 a7 d0 82 16 20 68 d0 25 68 71 be 8b 55 d0 81 85 c2 82 23 d8 c3 cc 01 be 16 f8 dc a1 08 82 ac c5 0a 27 7d 52 34 8d d1 5c c0 d3 6a b4 84 0d b6 04 e0 95 de e8 9d 80 5c 48 8c f6 d0 de 0d 06 48 35 b5 5d 75 b4 81 90 3e d4 fb cd 0e 40 e8 dd fa 6d d4 c6 48 60 5c 64 60 92 ff ce 60 06 76 60 25 5d de 2e ad 67 72 b9 51 cd 80 82 dc a5 c5 3e a5 5e bc 32 03 e3 dd 69 f6 bd 46 fe c9 5d df 00 55 5a 24 5d 91 dc e0 1b ed e9 27 95 d5 ec b8 6a e8 cd d2 8c ab 60 3e 7d c4 5c f0 ab 04 1e a1 f2 65 df 96 46 d2 ef 7d 52 ab 1e e0 02 a6 0d 4e 05 6a 92 2e dd a0 86 51 5a c4 60 bb 9e c5 9f 56 de 0e 1e e0 18 bd 5a a2 08 86 e7 2d dd 19 0d 48 80 dc 60 fe 69 45 1b 98 d1 e8 cd 2c 4b d0 02 91 26 Data Ascii: gn8,z(i-@-h h%hqU#'}R4\j\HH5]u>@mH`\d``v`%].grQ>^2iF]UZ$]'j`>}\eF}RNj.QZ`VZ-H`iE,K&
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 9c 1a d6 37 ce a4 37 00 80 05 db 50 1e ac c8 02 2c d6 28 09 82 05 50 50 57 90 a3 1f fe 5a 07 42 b0 01 0b d0 07 9c 00 22 f2 b0 0e 6a c0 09 24 d0 22 36 f0 17 de 90 99 1b 92 63 3f b2 04 84 f0 05 12 d2 39 80 21 9f e0 60 c0 36 70 04 52 80 01 2a b2 09 e5 d9 c4 04 60 b1 ca 38 21 d4 c0 65 56 6c c5 0a ba 24 5d 33 26 46 bb 07 cf 90 14 8a 12 25 2d 5a 00 59 e0 0c 54 92 28 ff ec 60 43 79 d6 04 33 90 14 cf 50 41 bf 00 02 85 36 1c 5c e0 c6 46 7b 90 33 b0 00 df 00 02 07 c2 2a 93 b0 0d 4a 7b 00 6a 4b 67 34 0a 20 19 d4 03 0a 44 41 ec c7 3f f9 11 08 53 02 28 0c 00 03 7b 00 08 80 70 1c 49 8a a3 84 d2 7c 35 5a 28 e5 50 52 f2 73 03 44 bd b7 a6 8c 13 a8 ac ca 32 41 cb 9c 3b a6 2d 61 06 29 71 2d 74 10 30 67 3a 6d 1f 81 6d 05 91 10 7a ea 6d be fc 0e c0 3c 11 16 91 b9 23 61 43 c5 Data Ascii: 77P,(PPWZB"j$"6c?9!`6pR`8!eVl$]3&F%-ZYT(`Cy3PA6\F{3J{jKg4 DA?S({pI\|5Z(PRsD2A;-a)q-t0g:mmzm<#aC
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 40 51 39 75 97 53 d9 6d e9 b8 ae 87 d9 93 4f 0c 21 3e e2 97 ff 7a 8b 7b 05 8e fe f8 6d 04 62 4a 6f c2 4f dd b8 6f 9d d2 74 13 bb 91 2b 9b 2b 4c d7 95 1b 39 1c 42 33 96 1b d9 ae f9 50 a8 08 81 94 01 59 4d 71 8a b0 01 f9 1a 56 19 74 dd d2 90 03 f9 74 46 f3 23 70 20 b6 0f f9 b3 77 d8 74 7f 00 98 4d 13 de b8 10 90 3f e2 76 62 97 01 54 03 09 8e fb b8 7b 20 35 40 a0 ff 0f 9c 19 fb 5e 33 9a ad 87 10 aa 59 56 09 c1 17 85 e4 00 10 4d 7d d8 e7 3a 00 40 04 fa 0f 3c aa 8c e2 d0 a7 04 2f e6 c9 9a 77 5c 7c 49 7e cc 83 3c ee e5 3c ae 63 3d ac f7 7a d5 03 9f fd 67 00 c3 f5 3d be 33 0b 86 0b 3f fd 91 5e cf b3 a0 df 73 ea e0 53 21 0d ed 7e f5 d5 b9 18 f2 c0 77 80 14 b4 c0 3b 32 5a a3 49 f8 7f 45 58 a6 57 e1 a6 29 58 61 65 3a 62 25 3c 60 3d 38 62 3f bc ed 4c fa a4 2f 34 a5 Data Ascii: @Q9uSmO!>z{mbJoOot++L9B3PYMqVttF#p wtM?vbT{ 5@^3YVM}:@</w\\|I~<<c=zg=3?^sS!~w;2ZIEXW)Xae:b%<`=8b?L/4
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 30 83 99 c2 32 05 ac c0 95 68 18 e4 6e cb e6 ae 00 96 cc 32 2d c7 f2 e2 66 a0 09 fc 32 30 23 83 3a 7c 6e 31 8b ae 02 58 40 ac 10 c3 1a e4 89 02 c4 db 74 a5 ae ea ea e0 e9 f6 5b a2 c2 ee 39 13 43 a1 54 43 61 76 8a a4 08 6f a1 98 b3 7b a3 0a aa da 13 16 36 26 00 b4 f3 f2 c2 2a 7f 4d 01 b4 7a 54 1f 34 90 47 31 10 12 60 c3 39 68 af 38 88 03 36 f8 33 b9 8c 2f 83 31 ff 6b cb 01 6b cb b5 43 68 3a 81 13 a8 9c 1c 7e a6 2e 60 83 b5 0d 89 17 6c 01 12 dc c0 0c dc 80 45 27 1d 50 64 82 c1 b8 b8 8b 07 05 db 31 85 bd e0 d0 da c1 eb 23 ca 78 b8 f6 c4 2a 14 5d 03 83 f4 4e 08 99 47 a7 c2 8b 27 41 04 8b f4 52 cc f4 5b cc ab 07 21 5d 4d 67 f0 4f e7 e2 2e 3e 39 50 33 c5 2b d2 a2 c7 08 35 2c 8e 30 9c d9 04 c9 78 e7 92 a5 f0 4e 9f 62 0b 0b ec 2a 82 c3 08 cb 05 0a 00 e3 31 d2 e7 Data Ascii: 02hn2-f20#:\|n1X@t[9CTCavo{6&MzT4G1`9h863/1kkCh:~.`lE'Pd1#x]NG'AR[!]MgO.>9P3+5,0xNb*1
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 38 44 ad b1 4f 8c 13 b2 81 da ce 47 17 1b 6f 49 c9 27 72 f2 7d 51 80 e5 08 81 ad cd 6f 25 73 86 18 03 e5 f5 ba bd ce 25 92 02 d3 0b cd 20 18 73 4e f2 8f e2 30 6b 48 61 1b 56 f0 aa 92 a5 0d dd 25 1f c0 08 4f 97 ee d4 07 f9 0f 2e 74 0c 28 ed c3 8a ff 16 99 23 b7 f1 6d 25 2d c0 c9 a1 d9 d7 cf 4f b1 1b 3f a0 6b 8f c8 47 b7 7a c7 23 48 c4 8f 7d bc e3 3f b4 00 58 83 04 01 91 1f 95 5f 83 c4 77 0d f1 7f 81 04 48 8d 37 12 1c a6 26 e1 70 10 6f b0 26 59 a0 10 d8 60 01 15 60 2b 13 c3 10 dc 40 00 b6 82 11 17 67 62 22 72 0e b5 25 57 09 b1 3c 79 62 38 1e 16 11 e3 f0 0f 92 56 2f 26 40 01 1e 27 0e 9d b4 82 f4 72 7b 0b b1 71 3c d3 82 1e 17 11 22 f0 7e 3c 53 10 e7 e3 2c ce d1 7c 5c 10 6d ff c0 5c d6 47 48 83 44 70 4a 48 70 75 74 7d d4 d5 58 6a e2 5c 5c 50 02 aa b3 15 e4 c7 Data Ascii: 8DOGoI'r}Qo%s% sN0kHaV%O.t(#m%-O?kGz#H}?X_wH7&po&Y``+@gb"r%W<yb8V/&@'r{q<"~<S,\|\m\GHDpJHput}Xj\\P
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 25 0c ac 61 19 44 67 bd 2e 20 02 ba 6b 36 64 75 9a c0 9d 7a 2e 4b 50 02 a2 62 c5 be 38 ae a1 c8 27 d3 16 42 1c 00 0c e6 e4 a9 e3 30 4a 21 cc c9 cd 8c e1 1b 06 02 19 70 27 e5 be 24 c2 f8 0f 21 84 87 e2 22 50 19 94 a5 1b 2c 4a 59 c6 62 e6 72 85 dd ff dc 69 23 18 42 76 80 05 22 be 47 e8 5a 26 28 8c 66 5c 7e c1 87 06 cb 2d ac ec 84 d6 6a 20 0e a0 2c 82 cc 32 ba ce 2c ae 6e cb 5a cd 31 86 cc c6 c2 43 ca e6 a1 c6 34 c3 68 54 23 ec f2 65 ec b4 c7 5f 50 0f b2 9a a2 2c 0a 0b c7 f8 a2 ed fc 0e 2b 84 26 ca 8c 46 09 f3 2a 3b 62 ed 86 90 c1 08 5d 8d 2f a2 c5 1a 32 03 30 96 a3 62 fe 0e 88 6e b0 5c 5a 6a 68 ca 0e d0 06 af 2b 86 a3 01 31 e2 8f 50 c6 2c 16 0f 8e a0 b0 5c 74 6c 0a 63 e6 f1 68 82 66 24 8f 9e b8 0c 67 1a 80 0a 0f e6 5c c6 cc 5e 70 ec ed 82 62 62 e0 70 62 f0 Data Ascii: %aDg. k6duz.KPb8'B0J!p'$!"P,JYbri#Bv"GZ&(f\~-j ,2,nZ1C4hT#e_P,+&F*;b]/20bn\Zjh+1P,\tlchf$g\^pbbpb
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 60 0e 02 e1 02 2e 50 6e c0 1d 92 88 9a 03 05 61 12 fe 86 db 25 87 03 aa dd 59 f4 d9 0d 4a e1 6d 7c 0f da 1d d0 bf 28 61 16 4e e1 16 6a 60 05 d6 dd 64 dc 5d 97 2c 40 8e 15 9e 43 00 5e 47 cd 4c b1 cd 97 0b 99 a1 ce e4 8c b3 51 9b e2 d9 de 54 68 88 ff 84 f0 0c 47 49 db 7e 4d 1e 31 98 c3 82 00 d1 87 34 cd 88 14 11 16 58 01 14 e8 40 e8 15 82 12 70 81 15 90 9e ba 01 15 ba 49 01 97 e4 c4 1d b4 9e bb b5 03 3d 10 8b 19 fc 48 16 b0 04 c0 c9 07 f2 b0 c7 de b0 4d 96 d8 11 17 f1 1e 95 88 22 df 90 62 dd a5 5c 25 ba e2 2b ba 1b 43 e0 15 2c 02 c9 03 3c c0 1a 74 5c 7b 18 a0 01 80 20 3d 35 83 bf ec 4f fd 00 e1 09 06 63 62 a8 13 b7 70 61 32 6a a1 16 8e a0 f8 94 60 0a 92 40 34 4a e3 34 46 23 0e ae e0 0c ba 60 61 70 20 fc 54 da 32 62 9a 32 82 e3 07 ee 20 0f fa 0b 06 2d 63 06 Data Ascii: `.Pna%YJm\|(aNj`d],@C^GLQThGI~M14X@pI=HM"b\%+C,<t\{ =5Ocbpa2j`@4J4F#`ap T2b2 -c
2025-01-02 05:12:40 UTC	15946	IN	Data Raw: 88 38 0e 23 04 9b e0 86 24 7c 39 35 93 9a bc 7b 43 9f d3 04 c2 73 1a 0e 1b 05 05 00 42 4d dc 44 4e ec 44 4e 4c c2 41 2c 06 42 f8 02 52 2c 45 53 9c b9 39 bc 42 22 1c 42 2c fc 82 88 0b 9b 36 78 c3 a8 c1 39 49 b4 bb 38 9c 1a 5a ac 45 9e bb c5 5d ea ff b0 51 34 45 60 44 c5 2f b0 89 46 6c c2 9a 40 01 35 00 32 97 5b 87 51 b0 09 64 fc 30 33 c3 c1 9a e0 41 22 60 c5 1d 5c c3 a5 c1 07 6d 78 33 ed c3 a0 66 a8 26 3a 23 1c 96 50 bd bd 61 3d fd a8 ad 59 e1 28 e3 b8 ac 58 b1 9b 41 73 2c 72 98 96 6f 22 87 e9 30 07 5e e1 9b d9 e0 15 ef 10 be ed 10 2d e4 3b 3e 4c 1b 8d 7f 8c 22 7d ca 02 4e 53 02 ea 03 35 96 d0 81 1f f8 81 6e 64 17 c0 e8 be fe c3 10 47 62 08 f1 ab 9e 60 a8 2e 8d 9c 87 8b b4 b5 23 a8 ae 06 38 91 f8 db 3f ea d1 88 f7 ea 97 8d 82 1d 2c d8 18 a9 e8 48 f7 5b 98 Data Ascii: 8#$\|95{CsBMDNDNLA,BR,ES9B"B,6x9I8ZE]Q4E`D/Fl@52[Qd03A"`\mx3f&:#Pa=Y(XAs,ro"0^-;>L"}NS5ndGb`.#8?,H[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49883	111.7.66.168	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:39 UTC	375	OUT	GET /i/2024/08/11/u98s7t.gif HTTP/1.1 Host: 69vvnstttaaa888.dzlndygh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:40 UTC	581	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 97404 Connection: close Accept-Ranges: bytes Age: 828274 Cache-Control: max-age=2592000 Etag: "66b8929f-17c7c" Expires: Wed, 22 Jan 2025 15:08:06 GMT Last-Modified: Sun, 11 Aug 2024 10:29:51 GMT Vary: Accept-Encoding Via: cache65.jhmp03,cache02.hnlycm01 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: 5e8095a1ee3ddd1e02a48ef8d55a9ad0 X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:40 GMT
2025-01-02 05:12:40 UTC	15803	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 3d 00 50 4f 46 21 21 20 de 29 29 cc 29 2d b2 24 25 2d 28 22 10 10 10 8d 09 11 29 29 29 76 75 67 d7 18 25 10 18 18 18 18 18 08 08 08 18 10 10 18 18 21 94 91 90 91 18 1a 3a 39 39 42 42 3c 1a 18 10 d6 21 29 35 34 31 d6 29 29 29 31 31 67 67 57 92 27 28 10 10 18 cb 1f 23 77 0a 0d c0 c6 c1 a8 15 18 de 21 29 c7 bd c4 ce ce d0 f7 f7 f7 ff ff ff ba b9 ba 9c a5 a4 9a 9c a0 aa aa aa 00 00 01 ef ef ef c7 c7 c9 b6 ad b5 e7 e7 e7 ce d6 d6 de de e1 d6 ce d5 ee f7 f7 d6 d6 d9 f7 f7 ff e7 e7 ef ad b5 b6 ab ad b5 bb bd c6 ef e7 ef 05 10 08 b6 15 1f cd 96 08 c4 78 2a d9 51 18 de 46 22 cc 34 22 ff eb 00 e7 5c 18 e8 74 17 ff f7 00 dd 35 21 cc 6f 0f ad 50 0f c6 3f 18 b4 8c 07 94 2f 0f 80 7f 81 94 4a 0a e2 51 23 5a 5a 5b ee 91 10 b3 70 09 fa d4 Data Ascii: GIF89a=POF!! )))-$%-(")))vug%!:99BB<!)541)))11ggW'(#w!)x*QF"4"\t5!oP?/JQ#ZZ[p
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: f0 0d 59 cc e1 11 dc a8 06 19 32 f0 11 d5 61 01 63 a4 38 df 1c 78 11 8b 12 02 e3 0b 25 7c 5d ec 56 58 8d 3a b4 50 12 2f 5c a1 2e 54 41 c2 fb e1 e2 7e ae c1 cf fe 72 c7 ae 4b 31 29 32 be 53 dc 5b ff 24 a6 80 a0 4c 2e 0f 61 1b 0d 03 41 66 26 8c 9c 70 0d 74 28 e1 2e 12 d0 07 69 b4 f0 16 08 78 5e fa da 01 88 81 58 30 85 27 4c a1 f7 c6 38 c3 6c 98 f1 8c 24 ac a1 0d ef d7 06 1b 5e 2f 30 3b 14 00 bc 26 33 c7 4c fc 0e 2c 14 13 22 11 39 65 90 01 09 91 71 66 3b e0 42 96 f8 b1 07 22 c0 0a bb e8 83 30 84 b1 0b fc a9 41 18 67 80 df 23 be 10 3d 60 10 c4 18 26 94 22 30 d2 e8 3d d2 a1 91 93 a0 cc 64 1b 1d 39 07 2b 20 2d 3a e7 99 a3 68 a0 34 9e 20 f6 6f 32 bc ba d8 d7 6c 04 28 67 f5 c2 40 47 04 01 07 20 52 c8 06 1a e0 24 6d 28 84 3a 86 69 3a 6b 9c e3 04 87 10 44 24 ea 67 Data Ascii: Y2ac8x%\|]VX:P/\.TA~rK1)2S[$L.aAf&pt(.ix^X0'L8l$^/0;&3L,"9eqf;B"0Ag#=`&"0=d9+ -:h4 o2l(g@G R$m(:i:kD$g
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 86 59 d4 d2 8c 5c e4 de 96 a3 6b e0 33 40 37 8b 60 3a b7 58 a7 95 cc f4 04 f0 4c 1d 0f 1d 83 20 6b 1d 07 fa de c4 e5 94 45 01 09 cb 5b aa 63 e5 6b 4c 75 38 34 8a 4a ab 43 35 0a 61 68 b7 9a 63 9f 73 a0 c6 56 29 fd e4 39 6b 7a 86 9c 8e c3 81 bc b1 90 f4 92 7a 20 d5 10 48 21 ac 81 ea b5 21 51 69 ae 66 62 44 a1 07 3b 87 c9 ba 1a f2 3d 31 47 07 c2 0b 39 cf d9 d2 d8 84 25 28 3a 7d a0 56 8c 4f 69 8c 68 0a 4a 75 70 88 59 8f f9 c8 6d 78 22 23 19 57 2c a5 2c 52 99 c5 7c 2e 86 f3 f5 4e 7f 16 58 d7 72 3e 30 a6 05 fe eb 2c 9a 23 00 e3 16 b6 d1 c6 a1 d2 81 b0 f6 1d 84 93 b7 dc 8c 3d 8d d6 a0 13 99 4a c3 f6 21 bc ac 2e 01 db 11 7b 74 70 73 c0 77 ab 60 ec 7d dc e0 c7 ff 1a f7 9e 57 9b b4 00 4e 23 10 86 9e d7 c3 03 51 71 8a d7 dc de ea 0d 60 ce f7 25 b9 78 3e 57 12 a8 c8 Data Ascii: Y\k3@7`:XL kE[ckLu84JC5ahcsV)9kzz H!!QifbD;=1G9%(:}VOihJupYmx"#W,,R\|.NXr>0,#=J!.{tpsw`}WN#Qq`%x>W
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 43 01 c6 8f 20 43 8a 74 a8 11 08 47 05 15 2a 8c 5c c9 b2 25 45 05 41 4c fa 98 a9 d2 a5 cd 9b 2d 05 08 61 42 24 e5 46 28 40 7b e2 1c 4a d4 62 4a a0 40 a7 28 35 e9 44 40 d1 a7 50 1b 12 f9 69 52 a6 cc a8 58 b3 16 44 99 54 29 93 9f 11 b5 8a 7d ca 35 a9 0f af 60 6b 8e 5d 9b f3 ac d5 29 6e bf 5e 65 4b 77 24 93 a4 40 9c c4 84 1b 74 23 4d b5 75 03 4f ac 30 25 2f cc bc 77 cd 5e e8 99 52 a8 e0 c7 0f a7 36 de e8 a4 70 d3 c9 42 14 78 85 cc 39 72 49 c3 8d 89 00 05 db b9 f4 42 a5 96 6b 0a 68 6c 59 88 5e 8f a6 63 43 44 7a f9 a8 d7 d4 85 83 c0 96 1d fb 6c e6 d0 4b 47 cf 4c cb bb 37 ca 82 89 4f c6 cc 9b 7b 77 71 d9 65 53 bf 6d fe 9c 77 62 b9 50 2a 73 ac 4c bc 7a e7 cf 3c a9 82 ff 1d 0d d7 b9 77 c1 47 75 8f cf 5e 18 74 e3 f3 9c 6b 3a 61 1a 9c 3b 70 dd f0 21 1f 45 4c 3f fb Data Ascii: C CtG\%EAL-aB$F(@{JbJ@(5D@PiRXDT)}5`k])n^eKw$@t#MuO0%/w^R6pBx9rIBkhlY^cCDzlKGL7O{wqeSmwbPsLz<wGu^tk:a;p!EL?
2025-01-02 05:12:40 UTC	16384	IN	Data Raw: 1d c8 7b b7 15 50 10 7f 0b be 8c 31 bc c8 9b 05 06 61 bd c8 ab 02 65 f0 1f 0a 51 be 2d 00 0a a3 01 03 26 31 06 03 f1 b9 23 b0 bf a4 31 23 a9 23 07 9c a2 20 e7 e1 bc 0d 11 17 c4 0b 0b 1f 80 10 0c bc 13 0a d0 b8 26 a1 01 fc 2a bb db cb 24 5e 00 bd f9 4b b0 05 3c 23 23 40 13 0c 21 b6 05 e1 09 10 7c b0 35 f2 13 0d cb b9 30 cc b0 04 f0 ba 47 42 10 ba 51 c1 0c 61 2d 24 f0 07 33 9b 03 7f 30 b9 b2 e1 1a 09 91 b8 3f 61 1c 84 30 23 41 2b 23 4a cc bf 11 7b 1c ae 11 21 4b 41 08 9e 70 b9 4d 3c bd 3f 11 06 56 9c c5 22 9b 14 72 f0 c3 04 a1 c1 a1 b0 bf 23 c4 06 0d dc af 49 3c c3 15 82 08 90 ab c0 03 b1 11 da 2b 38 0e 3b 19 4a 81 1d 3f 41 c2 06 8c c2 f8 4b c4 22 5b 06 55 6b 23 03 8b 15 04 e0 10 6b a2 bf 12 7b bf 4a 9c 10 86 ff 90 c8 07 1b 14 32 3c c0 4b 1b 02 8b 3c c3 3b Data Ascii: {P1aeQ-&1#1## &*$^K<##@!\|50GBQa-$30?a0#A+#J{!KApM<?V"r#I<+8;J?AK"[Uk#k{J2<K<;
2025-01-02 05:12:40 UTC	16065	IN	Data Raw: 1a 49 94 02 fa 40 f7 75 41 38 85 44 67 31 ff f9 eb 8a 7e c1 9d 65 46 c4 18 e5 95 22 5c 68 2c 8a 20 e0 b7 b2 92 fa fe d2 67 b9 3c e2 49 11 7d e0 5c 2d 44 ad 96 fe 0a 32 5f 68 cf 57 1b 56 c8 ad 9a 9d 3d ed 68 8f 16 a2 ac 14 28 48 2d 10 ee 72 0f 54 d9 33 08 f7 e9 a1 7d 7d 0b 49 15 17 fb 47 36 a7 7b 69 64 fd 2b a0 a4 94 0e d2 c4 c7 fd 55 18 40 c8 1a ef de f7 ca cb 4c e7 61 73 bc da 73 d6 95 14 6a 3e 63 5a 45 55 de 34 af 88 07 24 aa 79 9f ef 18 d9 1f f9 ca d4 63 ae c2 84 73 7d c8 4c 8f f3 a0 a5 7e 4f 43 97 fd d6 e4 8a 36 ca a7 5e a0 67 05 43 eb 75 cf ca 9a 73 0c 5e 6b 7f e1 f0 29 f6 3c 3c 16 0f f9 95 e3 dc a2 d6 26 c2 b3 9a d1 67 eb b3 bb cf da f0 94 d8 0b 2d 50 5b c4 7e ff 7f 4b 6b fb 75 a5 51 50 cb df bd 1a 2f 87 fc 30 c1 6d f4 ed 5a 3d 4b c0 00 7f 62 69 11 Data Ascii: I@uA8Dg1~eF"\h, g<I}\-D2_hWV=h(H-rT3}}IG6{id+U@Lassj>cZEU4$ycs}L~OC6^gCus^k)<<&g-P[~KkuQP/0mZ=Kbi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49894	175.6.201.25	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:40 UTC	381	OUT	GET /jiamigif/tyxsc/xmspggTT2-200X200.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:41 UTC	579	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 124953 Connection: close Accept-Ranges: bytes Age: 4 Cache-Control: max-age=2592000 Etag: "67711026-1e819" Expires: Sat, 01 Feb 2025 05:12:37 GMT Last-Modified: Sun, 29 Dec 2024 09:02:30 GMT Via: cache78.yzmp,cache02.hyct X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: d7913d9d92b08f65960f20f3ae25494e X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:41 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:41 UTC	15805	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 ff e5 71 f1 d7 8a e8 9e 01 01 ff 00 ff d5 00 99 ff 99 e8 69 69 57 01 01 9f ac fd 00 6b ff ff e7 8c ff fa 01 f3 d3 d3 6e 00 d4 8f 00 ce b0 00 c8 fd fc a6 fc 00 01 5b fe 5b b3 00 00 b5 8d 6f db 9e e3 ce ad 72 cc b1 8a cb 00 c3 fb ff 30 fd cf 72 e8 d7 a9 ef d2 f1 ff ee a3 98 67 50 88 00 00 f0 99 99 66 ff 16 fe ee b5 fb 00 ba b3 a1 91 a6 72 50 62 00 00 f5 b4 b5 8a 4c 36 d4 da fe 00 58 ff 97 00 00 6a 90 ff cd 00 00 a1 fe 25 ff eb 9c fd ff 55 fe fa 98 ff f5 c4 d9 00 00 ff fb ee e9 00 01 ff e9 00 ff f3 bb 00 35 ff 71 6f 54 e1 69 d3 00 47 ff 71 32 24 b2 87 58 00 27 ff ca ff ca 65 77 ff ff c5 49 ff ec 92 ff f6 cd ab 69 dd ff ef ab de c7 93 78 00 00 70 25 1a cb 9d 95 b1 71 67 e9 00 bd 76 47 32 aa 97 13 d3 ff 30 ff f4 b3 01 d5 Data Ascii: GIF89aqiiWkn[[or0rgPfrPbL6Xj%U5qoTiGq2$X'ewIixp%qgvG20
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: eb 6c b4 8f 87 17 94 38 80 c0 b9 57 e4 a4 8f 47 e0 68 e4 03 a9 2c ee 5f 40 35 e6 13 6b 2c e2 fa 27 e7 92 87 cb 5f 5a 83 51 0e 5b 95 11 6d 8e ba 40 f9 4e 2a 19 60 74 15 e6 ee d6 b2 cf fe 0f bd 79 46 39 ba 8b 89 52 34 ab ef 88 f7 4d 65 70 c4 6b 65 3c 85 c8 93 d5 a2 ee ce cb 0a 7d f4 d2 53 3a b6 43 bf 22 9f 3c d3 4a b5 7d 6a c4 be 87 f4 9b c7 13 f1 eb 7d e7 e6 8b b7 2f f9 d8 87 a4 c8 f6 f0 c2 1f 3f 48 de a4 6f ff fd 78 ed cf bf 57 fe fb 5f 50 60 b6 3e 83 e0 25 02 04 2c a0 e4 d4 92 40 05 7e 0f 26 5d 73 60 42 bc 12 41 09 22 e4 29 15 b4 e0 41 82 12 35 0d 4e f0 25 7b f3 e0 06 43 12 42 11 1a 10 6e 26 cc 08 0a 53 88 11 8a 94 90 85 0b 8c 1d 0c 35 72 ba 19 aa 10 22 bd b3 e1 08 1d 92 43 1d 9e b0 21 a8 f2 e1 05 17 81 78 3d 21 2e f0 78 46 6c 61 f7 92 88 90 25 32 f1 20 Data Ascii: l8WGh,_@5k,'_ZQ[m@N*`tyF9R4Mepke<}S:C"<J}j}/?HoxW_P`>%,@~&]s`BA")A5N%{CBn&S5r"C!x=!.xFla%2
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 16 0b 0a 86 5a bd 0c d0 aa 33 3b af 75 83 a8 32 19 b5 86 d0 b7 88 ff 2b 46 7e 3b be 8e 4a ba 33 60 bc 6c 84 bc 53 1a b6 00 1b 92 23 5b 3a 71 5a 39 d1 2a ad 42 6b 6f ba 3b b5 16 66 a1 c5 db 48 ea bb 9a 82 3b 8a ef 6b 39 f1 0b 39 2c 59 bb 84 5b 37 14 90 9d 96 8b bf e4 65 be e8 fb 32 0c 60 9a e5 e8 33 28 2b a5 69 c9 a6 62 6b 8a 01 5c 39 03 7c 38 d1 6a 99 da 6b 38 b2 8a 97 0c 6c 5c fa eb 8d 0f ec 32 8b 40 be 8f 4a c1 80 fb bf a0 b8 c1 90 d3 c1 86 b3 b1 07 5b bf a4 da bd 07 59 c2 2a e5 c0 fc fb c2 ec eb 98 a1 28 c3 ef 8a c3 3c 53 97 06 ab 8b 07 6c 6f 36 4b c2 e7 e6 0f 27 5c 03 29 fc 3e fd 9b 98 30 fc 01 1e 00 07 5a bc c5 9d 9b b6 5c 0c 07 34 ec 32 d4 4b ad fe 40 0d 83 5a 9b 2d 19 c2 3c d3 b2 70 30 90 bb f9 bd 8f ba c4 30 f3 05 2c cc c2 3e 7c ba 40 1c c4 06 7a Data Ascii: Z3;u2+F~;J3`lS#[:qZ9Bko;fH;k99,Y[7e2`3(+ibk\9\|8jk8l\2@J[Y(<Slo6K'\)>0Z\42K@Z-<p00,>\|@z
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: ab db 28 96 18 1a 8e 69 8a 8e 16 7c 94 2a 9b c1 6e b9 c9 74 d3 c9 37 03 c8 37 23 c8 83 9c c6 6e 93 c0 4d db 33 5f 50 b9 7b a9 c6 5f 74 02 a3 09 9e 2a 75 02 2f ac bc a4 c8 cb 73 e3 cb 30 d3 b6 a0 6c c3 94 f9 bc 3d 43 b7 bb e8 bb 3c 93 c0 45 5a 90 35 29 ce 6c 24 ba c4 3b 03 b1 24 cd 79 bc b2 bb 5c 3a d8 fc 32 c0 0c 33 c2 4c 9d b2 48 c6 2f c3 bd 13 f0 ba c2 ea c6 bb 7b 90 b7 4b 47 0c 10 cb d0 6c 48 0c 70 96 6b 8a c9 f6 68 cd 6f 33 cf 2e a3 cd 37 13 ca 68 2c b4 8a bc 8b 03 dd bc 3a 1c 8c 3c 4c 3d 0f 3b 9a dd 68 48 a0 70 ac b7 6c c5 18 9c a3 67 2b cf 8b 1b c8 7f 0a 9f ac 2c c6 be e8 cd 3c 33 c2 06 ff f9 a5 13 f0 d2 c8 53 d0 cf 7c d0 5f 34 d2 80 3b 84 57 cc c7 3c 13 9b 8b bb cd d8 9b 8b cc 0c 33 37 2b 90 49 ed 32 d4 40 b9 d9 d9 02 4d ed d1 2e 2a c5 a0 bb b5 fa Data Ascii: (i\|nt77#nM3_P{_tu/s0l=C<EZ5)l$;$y\:23LH/{KGlHpkho3.7h,:<L=;hHplg+,<3S\|_4;W<37+I2@M.*
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: cc c2 68 b9 34 09 bc bc 5b d3 9e 19 8d 38 fd d1 82 79 be 57 8d d5 6e f3 b9 5c 9b ba f0 3c 8a 88 a0 d4 3d d3 b9 66 bb d2 c1 7c d6 b9 68 d1 43 ba 8b 59 ed 0f a8 4c d9 13 90 07 0e 8d ab 0b d9 c8 ce cc 93 35 80 d3 04 3d b1 19 5c 8f bf ac d8 4a 5d d8 13 7d d8 88 1d be ff 4c 90 8d 5d ce 8f 5d 93 94 ec 0f 70 20 d9 d0 98 07 19 7d 33 ea cc 9f bc cd 46 09 0d b6 7a 3c b6 c1 ff bd c6 c3 8d da f6 ac da 42 6b ad b7 b9 8b 53 ed c8 28 ba c0 af 5d c6 8f dc bb b7 2a 9a d9 fd 45 db fd b3 14 4b 8a 32 9c 08 3c f3 05 02 3b 06 65 ed c9 86 4d 8b 9f f0 da 8e 1d 93 e8 6c cf 06 d9 dc 9d 69 00 a4 0c 33 b8 da d1 8b 40 ae 55 3d df 3f 54 df fe fb d5 ed 2b b0 4f cd 33 70 b0 c1 70 a0 c9 9e 6c d6 2c 59 de 97 c9 8b 44 fc 32 b9 4b d9 bb 99 07 d9 7d 02 d4 4d c1 81 d9 8d 14 fe 3e 16 6e c5 d4 Data Ascii: h4[8yWn\<=f\|hCYL5=\J]}L]]p }3Fz<BkS(]*EK2<;eMli3@U=?T+O3ppl,YD2K}M>n
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: c8 9c 4c c8 93 bc c3 63 ec c9 80 fc c7 a4 ac c9 45 ac c8 9c fc c9 ac ac ca 8b dc ca 90 3c c9 a9 3c c8 b1 ec ca 7c 2c cb 40 6c ca b8 0c cb 96 6c cb bb 2c cb bc 4c bf 41 9c bb c4 7c c7 c1 cc b8 a2 fc c4 c1 ec bb c5 2c cc bf bc cc c3 6c cc c9 0c cd cf 5c cd ac 4c cd d2 4c cd da 6c cd dc bc cd c8 0c cd c4 fc cd 84 cc b8 e4 2c ce e1 dc cc e7 0c ca e6 6c ce ea 3c ce ee bc ce e4 cc cc e7 5c ce 88 1c ce a2 4c cf d1 1c cf c2 ac cf ef fc c8 f5 dc ce df ac cf 01 ed cc 01 2d cf c6 5c ce cc ac ce 04 6d b5 3d 00 c1 5e c0 c0 10 dd c1 12 9d d0 05 4d b1 25 00 c1 12 3c c1 fb 8c d0 f0 2c ce fc 90 08 16 cc 2f cf 57 5c ad 42 cf f7 2c cf f8 6c d2 29 8d ce ff dc d1 e3 bc ce 0a 1d d3 f9 dc cc 0a ff 6d d1 1d 50 04 ce 20 03 fa 73 05 6f 01 1d 72 a1 04 00 7d ce e2 d0 01 2f 60 40 42 Data Ascii: LcE<<\|,@ll,LA\|,l\LLl,l<\L-\m=^M%<,/W\B,l)mP sor}/`@B
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 63 c5 f0 cd 40 6f cf 52 8c 15 5f 78 c6 01 36 89 17 dc 15 5a 40 f9 13 c1 cd 85 23 83 5b 99 54 e9 4a 49 36 d5 55 40 35 6d 6c e1 7c f0 c0 55 9d 60 72 06 ca 2b 12 56 48 99 12 2d 26 94 95 99 dc 84 41 99 42 ca 20 16 c9 88 99 9c 0f 57 a5 f4 23 14 28 f0 15 3e 92 e0 03 22 10 ff ba 45 86 5e 3a 91 66 5d 7e 24 63 cb 2b 06 43 98 3d b2 06 4a 48 99 15 59 4e a1 1e 5e cc 64 56 b4 d6 14 84 b6 71 27 78 e9 8e 28 4b 79 c6 76 1e b3 8d f3 b1 61 e1 96 84 0e 3c 9e 10 a0 d8 1c e4 cc 91 d3 c1 6e 83 db 91 45 47 67 25 9b 20 19 60 48 b5 aa 57 bd 6a 56 98 a2 09 ac 8e 75 aa 01 6d 12 53 c8 5a d6 9d 30 45 94 6f bd ea 4e ec e9 00 94 e0 f5 aa f3 d1 84 26 a0 43 d8 a9 46 87 1e e6 77 92 3e c5 d5 33 64 d8 00 a7 15 1c c7 1a 86 1a c2 73 2e 82 75 55 b6 06 56 20 fb db ab 46 46 a0 89 6a 8a 63 83 1b Data Ascii: c@oR_x6Z@#[TJI6U@5ml\|U`r+VH-&AB W#(>"E^:f]~$c+C=JHYN^dVq'x(Kyva<nEGg% `HWjVumSZ0EoN&CFw>3ds.uUV FFjc
2025-01-02 05:12:41 UTC	10844	IN	Data Raw: 13 af 64 ab 81 0b 1c b5 08 e0 bc eb b9 42 f7 19 35 40 db 42 0d 5b 35 6c 53 35 50 2b 35 41 14 b5 55 fb bf 03 3b 35 3d 73 b4 3f 6c 1e 49 b3 33 f9 e3 c3 eb f1 43 3d 03 44 90 4a c4 43 3b 44 4b ac b3 e2 ab c3 40 ab 34 be 4b 34 27 23 35 e7 91 43 3a 1b 41 4a 3c b0 2c c4 44 6a 5a b5 06 8c c4 44 0b aa 66 7b c4 f7 91 45 42 8b ac 22 2b 33 26 b3 b3 9a 03 34 c5 6b 44 fc 59 45 f9 7a 31 4c 6b b0 69 18 44 c3 32 c6 e8 4a b0 64 7c 9f 13 60 46 37 fb 82 15 13 23 f0 ea ad 0f 1b c6 17 5c be 0d 03 2f f9 f3 33 0f 2b 2f 89 eb b1 70 04 af 50 32 80 72 9c af e5 c3 ad 04 53 c4 62 04 2f b6 bb c6 03 cb 46 0c dc c6 37 eb c6 ef fa c6 ee 89 c6 04 e3 ad 4a 6c b0 c8 e2 c7 f7 f2 47 6c ec c7 4a 63 00 f5 8a 29 10 92 c7 d8 a2 c7 f7 a1 c4 70 32 ae df 72 2d 77 bc 1e 32 d2 ad ff d3 82 c2 c8 93 48 Data Ascii: dB5@B[5lS5P+5AU;5=s?lI3C=DJC;DK@4K4'#5C:AJ<,DjZDf{EB"+3&4kDYEz1LkiD2Jd\|`F7#\/3+/pP2rSb/F7JlGlJc)p2r-w2H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49895	175.6.201.25	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:40 UTC	376	OUT	GET /jiamigif/168sc/168-1300x240.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:41 UTC	581	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 223344 Connection: close Accept-Ranges: bytes Age: 123 Cache-Control: max-age=2592000 Etag: "67555982-36870" Expires: Sat, 01 Feb 2025 05:10:38 GMT Last-Modified: Sun, 08 Dec 2024 08:32:02 GMT Via: cache11.jnmp,cache04.hyct X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 9d6642e89bfbdd709be00cac66c1d326 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:41 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:41 UTC	15803	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 ff 00 ad 9d 98 a9 91 65 fa db d8 fb d4 b2 01 d4 34 69 4b 15 97 d3 f9 e0 b3 ec 01 d4 fe 5a b1 f6 93 5e 9a ff f7 6d ff fb b1 0a 64 9e 8e 01 62 fb b4 90 bb 01 b6 48 f3 00 56 02 66 66 10 9c 29 28 28 58 62 ad e1 11 4e fb 6e 02 ff fb 90 00 f9 43 00 68 fc fb d5 4c 01 00 01 f5 b3 29 ff f4 4e b6 4d ef 9a b6 e7 11 62 04 fc d4 92 fd b1 af fe 96 94 d4 90 2d fb d4 6e fc d3 2d f8 b1 09 ff 69 69 b1 8d 21 d3 ab 93 b6 48 02 aa 03 fb f5 b3 4c ff cf 03 f7 90 70 f6 2a 2d d6 6d 06 6e 01 02 f9 00 b4 d5 00 00 1a 4c 6c 90 02 02 63 e4 f4 65 96 ab b3 02 01 d1 ef f9 d7 8f 6d d3 90 0b c9 00 88 d0 4f 02 d4 d5 d8 47 45 42 f8 b3 6f fe 29 00 b4 6c 09 25 99 f3 fc 4c 4c d3 26 31 93 4a 05 d3 70 29 d1 ba ad 11 25 61 50 75 c8 b3 6d 4e b3 6e 2a 00 73 c9 f0 d6 Data Ascii: GIF89ae4iKZ^mdbHVff)((XbNnChL)NMb-n-ii!HLp-mnLlcemOGEBo)l%LL&1Jp)%aPumNns
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 46 21 06 08 b1 c6 62 70 a4 05 13 8c c2 11 90 c3 13 35 6b 72 a0 22 2c 23 87 3e 3c e2 22 de b2 23 2e e2 2c 27 07 2b ba 07 2c 9a 11 14 bd 40 75 f8 07 b2 2a c7 a1 b1 ae 81 04 47 3a a4 46 2f f2 2b 3b 5e d2 33 5f 2b 3b 6e eb 84 b8 42 44 d4 58 b9 66 73 b2 38 ee 5f fd 95 00 3c c0 b8 42 23 1d a0 1a 76 1d c4 8c 18 84 ee f0 c8 37 46 c2 34 b7 a3 bf d2 c0 26 01 5b 48 ce ff 33 3d 8a d2 28 79 c9 29 ed 80 27 88 89 c2 2a ec 3e 03 41 0b 3a c2 1f c4 c1 21 c8 09 2b 00 c0 0e ac c0 c6 36 4f 43 fa c5 12 d0 41 36 ac cb 1e fc 40 22 b0 40 12 64 01 46 9e 1b 28 a4 c2 bc 01 e2 77 79 a4 9e 3c 13 bb 31 ca 48 92 64 4b 8e e5 4b 9e b4 4a bb a4 37 59 43 10 c0 c2 bf a5 0a c0 21 64 21 2c 01 24 6c 46 21 48 c0 0a 8c 00 23 c0 42 24 04 c0 01 50 80 04 34 9c 16 88 43 24 28 00 23 28 01 54 b2 13 d0 Data Ascii: F!bp5kr",#><"#.,'+,@uG:F/+;^3_+;nBDXfs8_<B#v7F4&[H3=(y)'>A:!+6OCA6@"@dF(wy<1HdKKJ7YC!d!,$lF!H#B$P4C$(#(T
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 29 9d 10 13 83 0a 28 9c 59 b0 01 59 8d d5 18 8b 04 39 28 84 03 50 85 03 00 00 73 56 80 57 00 1e 60 d5 a7 65 28 32 eb 71 02 3a c3 0d ef e1 1e 6d 66 56 d0 79 56 2a 83 58 a4 78 d8 86 e5 09 74 a8 57 32 70 45 32 70 01 19 90 81 24 30 03 1d f8 56 fb f9 c4 1f f8 81 28 48 82 33 f3 08 fd e9 80 67 f0 06 19 f8 81 8e 96 81 41 70 57 79 ad 57 4a 5c 32 0e a0 02 90 90 02 15 ff 90 88 05 d8 85 47 08 00 81 cd 15 2d 20 86 0d f0 80 ec d9 04 17 30 9f 89 8e 68 19 40 c6 c4 c3 0a 66 8c ea 4a 98 c8 19 ca 15 64 4b 2a 64 f3 58 3a e0 84 da f1 0a 26 23 0b 3a f0 cc 92 aa 1d b5 60 0c bc 88 2d 4b c0 21 ba f0 21 0c 08 02 57 d3 d8 2d 30 34 c6 b8 59 9c d5 03 36 c0 57 b9 60 89 78 ac 03 43 d8 69 22 28 01 36 60 83 2e 50 01 2a a0 82 2b 28 81 d7 65 00 62 e3 19 90 05 0b be d8 12 93 b5 34 6c 7b 46 Data Ascii: )(YY9(PsVW`e(2q:mfVyVXxtW2pE2p$0V(H3gApWyWJ\2G- 0h@fJdKdX:&#:`-K!!W-04Y6W`xCi"(6`.P*+(eb4l{F
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 75 fb 9c 0a a4 0e 0b c0 02 07 86 7c 9b d1 99 9d 19 b8 d1 67 9a a9 c1 06 4d 6c 7d e9 99 9e b1 b1 01 26 fb 07 82 a0 08 35 40 1a 5d 80 7d da e7 01 75 50 07 07 b5 01 08 e5 02 66 30 9b 6c b0 0f b5 51 09 b7 81 7e cf 80 62 35 6d ba 90 81 ba 32 53 4a ab 6b 1f ff c7 bd f5 e1 68 4e 32 45 ff 47 07 af fb 21 41 90 8c 2a 80 04 c9 f1 2d 1d d0 0a 64 50 09 25 60 02 1d 80 04 ff 73 a0 22 76 80 20 7c 44 d7 e3 15 64 4c 52 49 05 50 09 ad 80 22 44 f0 83 3d 22 a0 01 fa 82 1c 40 4a fb 61 4a 89 84 48 89 e6 1f 48 32 be 41 52 62 34 68 02 eb 00 65 f2 c1 06 73 00 84 a5 34 26 43 28 69 a7 44 4a 53 72 4a fd 71 49 4c 42 84 45 f0 a9 98 86 8d d8 88 0b ac 80 26 77 50 c0 c1 7d 26 ba 7d 86 b9 86 4d a6 c0 31 59 50 07 7f 50 00 75 4c 29 44 4a 29 73 88 4c 39 ba 4c 9f 92 28 e3 94 2a bd d6 29 de c4 Data Ascii: u\|gMl}&5@]}uPf0lQ~b5m2SJkhN2EG!A-dP%`s"v \|DdLRIP"D="@JaJHH2ARb4hes4&C(iDJSrJqILBE&wP}&}M1YPPuL)DJ)sL9L()
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 26 26 ce 25 2c 20 65 b4 20 1a df 60 11 f4 f0 a4 b2 40 5e 48 ce 7f 93 81 29 f2 97 b1 9d c2 4f ff f3 81 05 35 35 5a 03 f5 0e 0f b3 a5 15 b3 2f bb ec 66 e7 81 bb e2 51 e1 f1 35 58 f5 82 ff 2a e6 36 98 03 8a a7 33 3e 18 84 3d 63 84 8b a3 84 35 e3 b5 8b 43 2c dc 27 7a 54 78 85 15 d2 54 8b 40 54 57 95 19 a0 41 01 2e c1 7b 72 83 1c 54 95 51 76 b8 e9 2c d5 2f e0 07 ff 88 6b f5 56 0f e3 82 08 a8 88 5d a3 bc 80 d8 01 54 72 35 9e 18 5e 5d 03 0a 94 e0 3b e0 63 24 5d b2 39 3e cf bd a6 d2 8a 1d a4 8b 73 32 01 34 61 89 f8 75 5b ad 78 8c 7f 2f f7 9e 75 19 c4 41 be 79 af 85 5e e8 bc af d8 f8 90 8f 2c 89 4c fa 96 e1 00 e2 27 7e e0 a3 c0 1d e0 c0 e3 67 90 f9 84 8d 73 61 14 be 60 4c 14 60 02 60 e1 0c 7a e1 0c 14 60 86 7f ec ca 20 1c 12 14 40 02 c6 12 5d 07 e9 0c 20 81 c4 4b Data Ascii: &&%, e `@^H)O55Z/fQ5X*63>=c5C,'zTxT@TWA.{rTQv,/kV]Tr5^];c$]9>s24au[x/uAy^,L'~gsa`L``z` @] K
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: c0 09 b0 81 13 c8 40 78 88 b5 08 38 c4 39 d4 65 c8 a0 cc e6 b5 6d ac bd 6b ad 75 ac 18 c7 ab 25 5b e6 51 70 83 66 b2 0c c5 92 43 38 10 99 aa 5c c7 25 5c 0d 39 10 b2 75 bb e0 1d 4c 44 63 3a a6 d5 2c 84 af 41 8d b0 35 4d 4b d0 31 d2 40 54 50 f0 71 48 3c 6c 66 88 94 06 89 60 67 66 86 21 a7 84 22 63 04 13 30 41 05 20 b8 82 57 c0 25 1c 01 62 8a 04 0c 40 6c 11 82 ff e6 25 c7 c1 75 30 f8 82 33 81 1a 23 f3 2c fc e6 28 9b 32 ce d6 ac 71 86 78 bd 7d f2 87 9b f2 89 53 c5 04 8c 26 27 d2 32 77 ce 72 d1 ca ce 2d cb 38 2e d7 38 2f e3 f8 2e eb 78 2e ef b8 d2 12 84 c6 15 73 90 0b f9 90 a3 e7 d5 22 22 13 3c b3 34 67 73 82 32 b3 92 53 f3 34 3f f9 da 5e f3 2b 2a e8 d8 52 5d 75 71 78 cb 3c a3 31 fa d7 77 35 16 07 b8 41 00 50 03 49 03 00 5d 53 80 12 50 83 21 14 42 21 9c 01 32 Data Ascii: @x89emku%[QpfC8\%\9uLDc:,A5MK1@TPqH<lf`gf!"c0A W%b@l%u03#,(2qx}S&'2wr-8.8/.x.s""<4gs2S4?^+*R]uqx<1w5API]SP!B!2
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 7a 20 28 08 11 4f 50 82 41 04 2c bc 5d 87 a5 22 4e 29 70 02 15 c8 02 36 08 03 75 f8 e6 14 90 9f 31 28 03 1e 48 81 38 68 36 5b 20 84 b0 4d 12 67 4e 14 2b 51 9e 00 e0 80 ff 09 20 eb a9 9f 22 b9 92 6e 86 01 47 70 84 b9 7a 00 5f a0 00 3a 10 9f b5 ca c3 3e 11 00 3e 14 13 1e 88 5d 56 c0 01 26 47 16 25 f8 cf 7a 8e f2 32 f0 ab 4d e8 00 36 60 03 7e 9e 83 3b 41 92 43 ff a9 1f 81 a6 82 81 8e d0 48 90 04 40 70 17 25 90 83 2b f8 03 42 39 b7 b8 da c4 01 9a 2c 87 8e 28 11 20 51 0f 30 d1 2e f8 c6 0c fa 94 d9 45 89 c0 0b 69 87 a1 d4 ff 05 09 6c f8 02 82 28 87 50 cd c8 f2 3a 08 7b 2c 74 a0 26 eb 97 26 6b 7b 31 08 21 aa 15 6a 5c a4 67 ec 08 dc 6a f4 8d 29 60 b3 c3 2d 25 25 60 05 13 54 a7 0e 3c 6e 60 85 ad 96 6a 30 50 03 7f 8c d1 a2 23 75 53 3f f5 f9 4d f5 55 6f 6a ac ce a9 Data Ascii: z (OPA,]"N)p6u1(H8h6[ MgN+Q "nGpz_:>>]V&G%z2M6`~;ACH@p%+B9,( Q0.Eil(P:{,t&&k{1!j\gj)`-%%`T<n`j0P#uS?MUoj
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 5b 7d b4 15 4a 01 5f 7d d5 59 fd d4 55 4e d5 1b fa 08 54 0e d5 5a 70 c5 63 8c 0a 75 6d d6 3d 4c b4 1b 7a e6 d4 70 e5 15 da e6 51 fd e6 72 4d e7 22 6a 08 62 5e e5 52 bd ae dc 21 7e c9 80 0b 94 70 02 95 60 0e 28 80 0e e8 e0 0d de a0 0e 1c 40 04 e8 90 05 2e c0 03 eb e0 6b 03 c0 d8 eb e7 6b 53 ba 92 71 4b a5 70 5b 08 52 40 07 fc c7 97 36 88 1e 9b 2d 08 82 90 09 ff 82 c0 39 22 30 a6 52 22 25 7f 20 49 6c 54 ca 11 d8 59 a0 2c 81 75 4a ca e5 26 03 e5 76 5c 51 19 95 2d 02 38 2b d2 22 2d 32 37 6c 40 06 c6 a5 02 86 ad 04 d4 30 a8 45 68 0a b9 83 ba ba 9c 71 6f 99 4d 6d d9 ba 47 30 08 15 77 a9 d2 84 cc a7 63 3a 3e f8 96 73 49 08 a2 7a 5f 72 60 09 1c 60 09 7e e9 97 27 37 85 d4 6c 09 72 40 07 86 40 07 e2 54 06 53 98 5f 80 20 04 e8 9c 2f c0 59 df 0e e5 41 d6 bb 0c 6b f8 Data Ascii: [}J_}YUNTZpcum=LzpQrM"jb^R!~p`(@.kkSqKp[R@6-9"0R"% IlTY,uJ&v\Q-8+"-27l@0EhqoMmG0wc:>sIz_r``~'7lr@@TS_ /YAk
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 40 42 5a 05 58 02 50 a1 e8 54 8e a3 b9 04 02 74 55 a2 0f 78 e0 4a 33 12 b2 0c e1 8c 6d 20 8c 0c a1 8e 6a 46 11 50 92 24 c1 b4 2e ec 82 c1 8b ba a8 e7 c8 16 82 a0 26 f9 28 07 b6 6d b6 ba cd 0c 12 c1 71 95 20 84 2d 99 ab 01 ae 92 bb 92 0e 9c 23 12 24 e6 10 1e 00 10 d8 4a 5a 12 e0 1c ce 01 00 34 5c d0 1d 24 40 b8 b7 1b 20 5d 34 4f cc 60 71 4a 7d 6d bc 24 fa e9 ff cf 7f f8 41 18 fb b9 dd 6a c7 e7 dd dd cb fd de f1 1d 40 08 47 1c 0a 5b bb 09 c9 de e9 07 e0 6b 48 e0 f3 bd e0 0d be c7 86 bb b8 15 5e e1 2f 21 bb c3 84 81 7f a7 02 0a f2 e0 29 be e2 09 ae 08 76 aa 12 64 a0 a7 4a 00 09 30 60 05 42 9a 49 1d 3e d5 05 80 07 f6 d6 09 f4 20 48 b9 f8 fb 08 a3 00 c6 40 b0 d2 74 0c 64 9e 30 ca 60 0b ea 80 75 71 21 0d 44 c1 08 04 81 8b b8 c8 16 4e 21 04 1a e0 8c b9 80 13 70 Data Ascii: @BZXPTtUxJ3m jFP$.&(mq -#$JZ4\$@ ]4O`qJ}m$Aj@G[kH^/!)vdJ0`BI> H@td0`uq!DN!p
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 0a 4e 58 03 d5 29 a3 81 6b 8f d1 21 ca d9 21 8a 93 7d 23 84 7b 9d f3 29 c1 37 0e dd d5 c5 96 5f 3d 73 ab 84 d1 19 85 b8 88 9b 11 77 31 2e 96 88 03 b0 a4 11 b1 60 f3 ac 6c 9e a9 1c 9c 84 09 80 91 7a f8 8e 0e 69 37 c7 51 3a a3 b3 76 a8 38 7e 95 6e af a0 ae 41 07 f9 e8 f1 81 1a 2c 0c ed d5 ff 0e 42 c4 5c 16 3c 40 42 78 f2 45 8c 00 fb 88 e9 85 d8 1e 60 a0 41 ea 5e f9 46 b4 81 2b 30 6f 43 b7 6f 97 0b cd 1c 0e 44 81 3b 59 93 41 04 08 2c 36 87 68 6f 35 0d c2 0f 88 89 f7 72 34 41 bc 4c 53 0c 2b a7 59 c4 2c 90 53 4a 30 f4 fb 2e f4 10 1c c1 c4 ae a5 fb d5 ef 05 b3 e5 a0 57 b0 4b 1b eb 04 4c 40 d5 e9 f4 00 16 82 16 d0 41 14 03 46 ab 22 1a 4d 58 83 60 28 c0 5d 40 35 44 34 81 50 4f c0 5a 1a 7a 4c bb 5f dd c8 25 b0 b5 c6 5d 2b 07 a3 86 9a 09 84 a0 09 87 60 4a d5 86 d6 Data Ascii: NX)k!!}#{)7_=sw1.`lzi7Q:v8~nA,B\<@BxE`A^F+0oCoD;YA,6ho5r4ALS+Y,SJ0.WKL@AF"MX`(]@5D4POZzL_%]+`J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49890	36.99.2.62	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:40 UTC	386	OUT	GET /video/m3u8/202401/30/a2146fa33ff3/cy150.js HTTP/1.1 Host: x-hweu2.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:42 UTC	579	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:41 GMT Content-Type: application/javascript Content-Length: 20305 Connection: close Server: openresty Last-Modified: Mon, 08 Apr 2024 14:28:22 GMT ETag: "4f51-615969e1d14f5" via: CHN-HAluoyang-AREACT3-CACHE28[6],CHN-HAluoyang-AREACT3-CACHE27[0,TCP_HIT,2],CHN-HEshijiazhuang-GLOBAL1-CACHE75[7],CHN-HEshijiazhuang-GLOBAL1-CACHE27[0,TCP_HIT,5] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 992409063fd9ce5a77e7f0bfb158737f nginx-hit: 1 Age: 339154 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:42 UTC	15805	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 d8 b5 a8 fe 4d 19 b3 86 75 ff 0e 04 d9 a4 8a ff 2c 0d ce 8e 71 4f 2f 26 a7 af 18 27 13 0d ff bc bb 6f 72 21 d9 a8 00 d2 d7 08 ff 86 51 ff a2 a2 ff 45 41 9a 2b 21 d7 b9 b5 4d 49 2a 67 4e 00 ff ff ff c8 96 88 ea f3 02 ff 44 36 ff 36 26 aa 7a 6e 6a 34 2b ff 9a 64 51 35 09 8a 56 47 99 a8 d7 f2 bb 00 6c 45 34 d8 c3 a9 16 0a 07 ff 3a 33 db c6 ca ff 24 21 90 65 52 c8 a9 a6 ff 7c 46 72 59 47 d8 b8 9d 30 27 24 3b 27 10 97 70 64 e2 aa 8a ff ea ea ff 7a 10 b2 6d 55 8d 6a 00 98 a2 cc ba 8e 00 e8 d1 9c fd f9 c6 dc aa 93 fe 5a 1f ff a5 71 cb a3 8b ff 44 26 90 9c c8 ba 88 82 bd a3 94 6a 8a aa ff cb c9 ca 78 67 e3 b3 97 91 95 1b d3 9b 88 bb 97 83 8c 94 b9 ff 6a 33 d6 ad a4 47 14 13 ff 97 96 c7 99 93 e3 d5 dc ff f7 f6 ec d8 a2 ff d7 Data Ascii: GIF89aMu,qO/&'or!QEA+!MI*gND66&znj4+dQ5VGlE4:3$!eR\|FrYG0'$;'pdzmUjZqD&jxgj3G
2025-01-02 05:12:42 UTC	4500	IN	Data Raw: 90 b4 5a 70 0b b5 5d db 8b 10 d5 88 5c c2 2c ec d6 ba 6d 04 92 bc 01 1d 50 dc 8c a0 02 21 80 0d 0d ab ca 8f 70 d2 d7 20 01 00 d0 07 7d 20 dd 75 5d 05 78 2d 01 be 0d 00 5a ad d7 7b 9d c4 e4 20 ae df fa ad 8c 70 00 21 90 09 27 e0 02 89 cd 04 7b 80 02 49 30 c2 61 9c b1 92 7d 0d 61 4b 0d 85 70 df 32 8b d3 a1 fd 01 72 70 e5 eb f0 c0 00 7e b3 21 e0 b3 5e 1e ce 7c 10 c5 c8 0a d6 2d 00 07 96 30 e4 3e 40 e1 5a 20 09 6b 6e db a2 b0 de 28 9d db 25 7c 0d 4d 2b 08 12 e0 02 f8 0c e2 c8 4b 01 ed ab 01 f2 0b b1 89 80 02 da 7a dd 58 b0 07 86 30 05 86 ff 50 d7 51 c0 e2 65 20 01 2b 1e bc 76 7e 02 3b 0e de b8 dc e3 fd 90 00 8c b0 cb 07 db b0 59 a0 05 db 20 0a 49 80 d2 61 0c d9 1f 4b 05 b7 c0 0f e4 3a 02 60 60 0d 28 bb 0e 33 0b d3 3d 70 04 30 7b e5 b1 c0 c6 34 10 0b 6f fc 01 Data Ascii: Zp]\,mP!p } u]x-Z{ p!'{I0a}aKp2rp~!^\|-0>@Z kn(%\|M+KzX0PQe +v~;Y IaK:``(3=p0{4o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49889	218.60.100.167	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:40 UTC	378	OUT	GET /yhgifjiami/xyh/150x150.js HTTP/1.1 Host: yh88812345qwerasdf.lzaotw.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:42 UTC	765	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:42 GMT Content-Type: application/javascript Content-Length: 287975 Connection: close Server: openresty Last-Modified: Fri, 27 Sep 2024 16:11:41 GMT Vary: Accept-Encoding ETag: "66f6d93d-464e7" Expires: Wed, 11 Dec 2024 00:18:49 GMT via: CHN-LNdalian-AREACUCC1-CACHE52[10],CHN-LNdalian-AREACUCC1-CACHE35[0,TCP_HIT,8],CHN-TJ-GLOBAL1-CACHE104[6],CHN-TJ-GLOBAL1-CACHE35[0,TCP_HIT,0],CHN-HElangfang-GLOBAL6-CACHE29[7],CHN-HElangfang-GLOBAL6-CACHE69[0,TCP_HIT,0] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: dafd6c719ef2f72167ae19ee17f7123d X-CCDN-Expires: 630415 nginx-hit: 1 Age: 1961585 Cache-Control: max-age=43200 Accept-Ranges: bytes Strict-Transport-Security: max-age=63072000
2025-01-02 05:12:42 UTC	15619	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 99 d4 fc 9d 6e 08 b3 00 00 95 b2 f0 da b2 00 d1 00 00 f7 dc 8d f9 00 00 45 22 02 05 00 00 f9 d7 d5 ac 8e 0d f6 8d 8c 5c 9b f4 00 ff f6 28 10 01 0b 98 f3 ae 97 8a 7a f7 fb f6 d6 b3 e7 5b f9 d7 88 87 01 85 7a 08 61 ee 76 74 73 93 00 00 ff 50 95 f6 b5 b1 f6 73 72 d9 d4 d3 dc 98 00 5d 92 af d7 71 71 4b 8c 84 90 88 74 ff ee 75 9a 64 a2 d2 b5 b2 f8 b1 92 f6 6c 4c 30 22 04 f3 4c 2a f1 04 ef fc d7 f8 d4 b4 6f 8c 74 71 64 6f 9b f3 b4 70 d2 b5 91 d8 d1 b4 b6 ad 91 b5 b1 b2 51 69 e6 e2 08 69 f6 88 fb fc 29 86 01 68 5e d3 0a f1 01 a5 96 f6 51 49 4e 4c 49 d4 29 28 f6 8e 71 ae 94 6e 6b 4a 05 6f 01 00 fd b1 d0 d6 4f 4c c7 d7 f6 6d 67 58 cf b0 1f d2 98 77 f7 2e 25 6a 4e 2b 6c 51 4a e0 cd 95 f6 b3 f9 8d 72 47 d4 ef fc d8 4d 2c 2f 2a Data Ascii: GIF89anE"\(z[zavtsPsr]qqKtudlL0"LotqdopQii)h^QINLI)(qnkJoOLmgXw.%jN+lQJrGM,/
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 66 e7 69 fd e7 0a 2c 38 86 f4 05 94 5a 50 9a a8 f9 90 ee f0 0c fe f0 0c cf a0 04 61 79 69 ff 20 02 f3 b0 81 ca 38 18 89 59 10 e3 08 05 e4 79 76 86 b9 69 d0 14 0c 48 65 7c dc 87 1e 5a d9 6e 46 68 92 b3 82 9b 45 e6 7e 28 49 69 e0 67 11 d0 89 62 6f 69 3d cf f0 0b ff f0 0c 2d 90 57 5a 72 63 b6 f8 0f d6 20 99 c6 b7 6e 57 d0 a0 1d 45 91 5b e9 12 02 79 90 29 71 49 cd 26 6d e8 46 87 75 b9 8d 29 39 73 a0 49 86 6c 69 0e 00 7a 9a 63 d0 04 4a a0 0e bc 91 87 ef 06 18 4a f0 0c cb e0 a3 58 d9 8a 2a b1 9b 20 39 5a ea f0 0c dc 09 7e d9 25 10 4a 80 91 97 b8 a3 da 68 75 59 29 7e f6 d9 72 3b 09 a5 dc f0 9f a6 f9 90 62 d0 04 ad 12 01 bf f0 a2 cf d0 01 1a 38 10 2f 0a 2c 6b fa 4c 81 e7 a1 04 ff e1 0d 98 e7 95 61 fa 12 85 29 89 48 f7 0f f3 d0 02 cf 54 10 87 ba 5a 73 0a 72 24 b9 Data Ascii: fi,8ZPayi 8YyviHe\|ZnFhE~(Iigboi=-WZrc nWE[y)qI&mFu)9sIlizcJJX* 9Z~%JhuY)~r;b8/,kLa)HTZsr$
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 77 e0 82 4b 59 82 75 b8 44 25 48 80 25 c0 44 60 28 44 2e 03 c2 8b 03 17 cf ea bf 8d 61 17 23 8c 89 18 50 87 60 e0 85 08 98 87 71 18 87 5e 88 81 65 d8 90 65 58 06 6b 68 02 7f e8 00 59 54 c7 2d 4c 0a 6b 08 06 75 0c 06 e5 73 99 83 b1 86 7f 50 c7 79 e0 01 4b 41 00 18 f0 87 7f 08 86 63 49 80 7d 54 c7 7f 88 01 7e 0c 86 1f 68 ae 63 19 07 ff 7f 90 01 fd 51 46 89 0c 86 18 80 02 11 00 06 75 d4 c8 04 88 81 75 9c 87 22 28 c9 71 98 87 60 b0 06 06 d3 23 a9 70 0c 4e d1 27 21 f4 ac d9 c3 10 be 99 81 67 d8 49 6b c0 80 65 d8 49 19 b0 06 6b d0 28 19 e8 85 2d 6c 01 a1 54 87 9f c4 00 43 ec 85 67 58 06 a5 5c 8c ea e9 9f dd 71 c8 7f f0 87 65 00 07 1e 28 13 04 88 81 7f 00 87 67 68 48 a7 54 87 67 80 c7 ab 5c 86 22 80 82 0e 78 ca 71 e0 81 09 4c 80 2b 98 87 67 20 4b 11 48 00 11 78 Data Ascii: wKYuD%H%D`(D.a#P`q^eeXkhYT-LkusPyKAcI}T~hcQFuu"(q`#pN'!gIkeIk(-lTCgX\qe(ghHTg\"xqL+g KHx
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 2a c4 e0 17 2f f9 65 ca d6 a8 84 8b 9d e1 0c a7 00 87 3a 42 f1 8f 0c 16 a2 67 ff f0 40 31 3d a0 c4 c8 64 23 06 37 94 08 07 09 90 37 69 98 23 1b 2d 98 48 07 fc 94 37 73 54 d1 1c de 48 9e 44 9a f1 8c 33 48 d3 1b 96 fc 42 84 08 17 84 2f b4 40 82 d1 e8 c0 0d e9 f9 0b 71 4c 20 1c 12 f9 02 29 f1 08 3d 66 58 64 95 5f fc 5f 2e b9 a1 45 19 cc 6e 06 cf 70 c7 17 af 58 b5 16 10 d0 0f 59 61 e5 51 4a a0 84 3b 34 13 94 62 30 9d 32 5d f1 0f 3b b6 0c 5f 19 f3 20 be ce 70 33 15 a6 13 94 1e 78 e6 29 9e d1 82 2f fc c3 10 e1 7c e9 3f a4 e1 01 69 94 ed 17 32 98 48 33 40 f9 0f 31 fc c2 92 ff b8 98 27 37 d9 c9 89 b4 e0 1a 9c f4 a7 44 94 d0 b2 fb 4d 64 18 fa 92 88 39 94 41 8c d1 71 e3 95 55 f4 ea 5c e4 50 4b 19 fc 02 a2 5c 9d 68 33 5a d0 cb 25 90 93 9c a7 ff 2b 84 12 0a e1 87 75 Data Ascii: */e:Bg@1=d#77i#-H7sTHD3HB/@qL )=fXd__.EnpXYaQJ;4b02];_ p3x)/\|?i2H3@1'7DMd9AqU\PK\h3Z%+u
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: cb fa ae 04 09 23 40 a2 bb 06 e5 8b 4d d3 b7 51 3b d1 f4 a6 57 08 00 24 08 60 e1 82 2a c4 66 7c a0 13 9b 16 70 46 84 6d e1 21 4c 35 02 58 f5 4b 46 40 3e cc 61 aa f1 6b 55 fd ba 90 05 0c a2 c3 e9 51 ac 40 80 e0 a3 6d 86 f6 95 6f ea ae 6b cf a5 10 d0 82 d6 ac 6f 95 ab bf 70 aa 99 6f 22 00 16 df ac 4b 25 09 02 09 67 34 81 0f 87 38 04 1f 2c 3b 88 17 23 00 10 46 40 60 02 8d 39 63 64 0e a4 ff bf 3b 16 21 4c 07 a2 49 1f bd 95 b6 df 4d 6c 25 65 2a 8e ee b6 d5 c0 67 19 c4 18 96 b9 39 99 9a 74 c6 6d 9d 42 9f 09 02 56 21 83 95 20 a7 b8 e5 59 ae 90 cb 25 1a ef d1 67 91 a5 5d c5 61 04 88 84 95 4d 7b 3e f4 2b 1b 1d 61 00 bf b4 aa 06 f1 6f 41 0c 1d e1 ca 32 99 c3 06 49 07 2a 5f 7b ac f5 9c 82 69 5a c6 a3 a3 09 9b eb 7f f0 d3 1c 53 90 ea 6c af 7b 8a 5f d7 45 ae f6 b3 d9 Data Ascii: #@MQ;W$`f\|pFm!L5XKF@>akUQ@mokopo"K%g48,;#F@`9cd;!LIMl%eg9tmBV! Y%g]aM{>+aoA2I*_{iZSl{_E
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 35 87 0c 62 10 58 18 c4 6f 30 07 84 24 00 81 4b 69 4b 12 16 00 99 84 05 70 e7 01 50 10 e4 3f ae 90 1f 93 bd f1 25 b0 18 44 12 02 b0 85 05 24 a1 72 35 41 40 26 f8 d0 c7 bb f1 61 01 4d c8 44 bc 8e 68 12 f1 1d 72 10 4a 3b 61 4d 1a 82 80 2b 64 a2 09 0b e0 c3 15 38 06 c2 91 45 86 82 c8 63 09 4b 92 a7 3f a8 d8 04 87 74 c1 db f3 62 62 42 93 11 d3 24 8f 1b 23 14 df e8 ca a8 38 0f 69 36 d9 0d be 92 66 12 95 ff 89 0c 85 ff 6a cc bf a8 f9 2d 63 72 11 85 74 41 9e 09 bf 72 42 e5 89 0c 16 95 e1 a6 2e a7 89 4e 61 46 53 64 dc 94 1e 08 db 79 b2 fc 9c 73 9a 26 69 1e 34 f5 72 99 27 71 b3 64 50 24 19 30 e7 e9 32 48 42 53 97 e6 34 a1 24 d3 27 49 64 ea 92 5b c7 2c 28 9c ae 19 cc 10 52 70 92 0e cd 94 24 63 52 b2 97 9c b3 9f ba 13 a6 da 4c 6a 51 32 06 f3 3e fa 0b 5a 7e 26 09 34 Data Ascii: 5bXo0$KiKpP?%D$r5A@&aMDhrJ;aM+d8EcK?tbbB$#8i6fj-crtArB.NaFSdys&i4r'qdP$02HBS4$'Id[,(Rp$cRLjQ2>Z~&4
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 46 39 f1 10 0d 06 80 05 22 00 74 37 06 6e f7 f4 93 e9 74 78 ca 30 05 8c 51 08 8d 09 94 f8 a8 7d c1 20 8a c0 90 5a 4d 40 5a c2 c0 79 56 97 00 45 00 0f 7c 18 95 f0 d0 7c c8 f2 90 62 89 8c 5d 57 0a be 95 13 74 51 01 3e 80 91 68 f7 9a 3f 30 3e 56 f4 91 cd 50 08 8a 51 08 8e 71 93 dd 84 57 55 c7 95 06 b3 05 d0 b4 0d e6 40 69 1a 88 0c 33 57 7d c1 60 59 e0 a6 52 37 d5 47 42 79 69 4d f0 05 f9 c5 02 2c b0 04 3e 94 94 a3 c8 94 df 24 02 fe 28 54 91 c4 79 da d2 04 fc ff e5 5a 58 29 55 f1 d0 04 ec f3 95 a6 59 9a 64 89 17 f9 e7 03 cd 78 2f c5 00 57 75 d5 02 7d 03 30 2d c0 4d dd 74 80 9b 89 30 5b 80 0c 30 19 94 93 45 0c 4d 05 78 d5 f7 72 bd 20 77 c7 e0 6e 3c a7 98 0a f7 00 1a 73 55 9b 84 82 94 39 8b 71 57 4c fd 48 30 22 80 99 06 70 85 57 a0 4e a8 46 0c 4d f0 9f a0 17 49 Data Ascii: F9"t7ntx0Q} ZM@ZyVE\|\|b]WtQ>h?0>VPQqWU@i3W}`YR7GByiM,>$(TyZX)UYdx/Wu}0-Mt0[0EMxr wn<sU9qWLH0"pWNFMI
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 05 90 30 84 20 50 3f f6 43 1a a4 39 13 5f 89 af 18 c8 95 f8 9b 23 ac 49 95 b8 6a 14 85 88 80 3e f3 26 f1 c1 9a dc d0 8e 65 30 00 ed 50 00 58 aa 39 32 31 9a 4c 6a 0a e6 89 06 ff 82 87 2c 70 05 ca 73 8e 69 b3 3a 61 8a 8e 9f aa 0e f3 98 01 0f 04 c1 8f 28 04 90 78 8c 13 5c bf 20 30 9a 2a 70 ac 67 00 8e 39 29 81 9b 78 33 53 0b 11 cd 79 0f b8 7b 14 47 60 45 af aa 35 76 01 2f 0b 5a 87 c4 63 a0 56 80 8d 4c 8a 2d 09 31 05 e6 39 bc 11 60 01 04 b0 3e 4e 5c 32 e3 12 81 31 6c 81 66 68 01 27 f3 0f ef c1 07 25 00 41 54 7c 0c 39 b4 c3 39 9c c3 3b b8 11 7d 23 86 78 98 13 75 68 21 5b c4 9a f9 5b 08 b4 80 88 67 a0 16 39 cc a2 c0 59 af 98 d8 81 70 f9 85 66 1b b9 5f d0 07 a6 82 c4 58 8b 20 53 48 c0 ed 50 0d 16 28 84 2e dc c4 47 03 ac 4f 4c 9d 6b c4 38 b2 a0 2e 77 99 81 ff f1 Data Ascii: 0 P?C9_#Ij>&e0PX921Lj,psi:a(x\ 0*pg9)x3Sy{G`E5v/ZcVL-19`>N\21lfh'%AT\|99;}#xuh![[g9Ypf_X SHP(.GOLk8.w
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 8a dc dd 44 26 c3 11 2a 71 07 ca ad c3 f4 1b 36 68 dd ad ec d9 95 0d 8a f7 e4 b1 8f 51 a1 09 5a a4 02 0a 3c e0 41 31 46 6d a0 65 04 63 06 d6 48 f2 78 1f 80 ed fe 3c 95 3f 7b ae 14 0b 87 59 f3 f7 de 3c b8 8e 7c f8 b9 13 da be 62 df 8d d8 63 de 22 e6 10 69 ef f5 f5 f8 ee 4c 27 44 d4 ad 61 f5 be 83 e3 e4 c1 90 81 35 26 6c 94 18 ac 16 e6 dc dd b0 c7 3d c1 5b b1 db 7c 53 61 d6 e6 db dd 18 79 dd 61 56 d2 c8 3d 23 2c 2c 21 da 2f 77 d3 02 9c 10 ad 0a 17 6f 65 44 dc 6d af 38 a0 85 26 34 c1 74 d6 a7 82 07 7c 3f f9 38 fa be 8c 65 cc a0 da a8 e6 7a b6 bd 8e 9f b0 b3 db c5 91 35 fb a6 42 4f f9 86 cb ee c4 b3 e3 f9 ef c3 98 bd db d1 f0 d1 b7 56 b6 68 e3 26 bd 17 aa c2 d9 3a 50 fd ea 25 10 02 d8 d7 fe e4 df b7 ba ff 0c 22 30 e7 80 07 08 e6 fe b9 e5 cc 8f 3b bd dc e9 97 Data Ascii: D&*q6hQZ<A1FmecHx<?{Y<\|bc"iL'Da5&l=[\|SayaV=#,,!/woeDm8&4t\|?8ez5BOVh&:P%"0;
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 19 22 03 7d dd c4 3b d4 58 83 f7 06 62 8a 4a 9d 05 2c ca 53 10 1c 9e 07 b4 2b 5c e1 1f a7 20 95 43 60 f1 05 1f 4d a4 07 02 04 06 bf c6 11 ff 0c f9 ad 4f 00 3f b8 53 99 44 f2 84 0c 64 a1 74 5c 33 00 37 12 b1 be 0c 80 a1 58 54 81 df ba b8 11 92 83 29 43 19 2c 80 db fa dc 00 0f 9f 44 45 3e f2 0b a0 77 74 b2 06 11 82 42 70 b5 19 8b 01 36 e1 33 c5 81 a1 07 77 98 5e 11 a8 57 3d 08 c1 04 14 93 69 1a 30 42 b8 be 11 79 84 34 06 80 47 f9 46 a0 8c 8f c9 48 0b 77 bb 5d 1b bb 45 21 e7 50 e5 08 19 a8 d4 61 48 92 12 f4 b8 84 33 a0 70 43 48 9e 22 15 60 b4 c1 14 01 ac 0c bf 26 e3 86 24 6a 61 81 96 32 40 f3 1c 08 b4 1e 44 4f 09 4a 30 c7 15 61 71 af 17 ed 08 73 c1 58 82 08 05 20 98 c2 84 04 19 a3 83 c7 f9 50 a2 26 ec 08 c4 0d 5e b2 c9 54 e4 c7 8d f0 95 e9 4c 9a 8a 5b 6b 04 Data Ascii: "};XbJ,S+\ C`MO?SDdt\37XT)C,DE>wtBp63w^W=i0By4GFHw]E!PaH3pCH"`&$ja2@DOJ0aqsX P&^TL[k

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49892	175.6.201.25	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:40 UTC	382	OUT	GET /jiamigif/tyxsc/xmspggTT2-1300X240.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:41 UTC	581	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 281740 Connection: close Accept-Ranges: bytes Age: 6 Cache-Control: max-age=2592000 Etag: "67711016-44c8c" Expires: Sat, 01 Feb 2025 05:12:35 GMT Last-Modified: Sun, 29 Dec 2024 09:02:14 GMT Via: cache69.jhmp03,cache02.hyct X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 315a6e75527ac37cc0a176f7c65b7389 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:41 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:41 UTC	15803	IN	Data Raw: 47 49 46 38 39 61 14 05 f0 00 f7 ff 00 d6 ce d0 fc d8 aa 1d 20 fc aa 6d b1 fe 22 04 d2 aa 97 a2 a0 f4 25 05 04 ff 68 67 ff ee 4e cd 66 00 ee b6 2e 6e 48 26 23 74 ea fd af ae b0 d2 f9 51 00 00 1c 8c ed 0c 50 a6 ef d3 29 ff ff 00 b5 8e 29 cf 96 8e f9 b5 09 6b 9a e7 d7 d7 f6 d7 b6 76 69 6e a7 70 49 45 d9 b8 de d4 93 2b d5 ab 2d f7 d8 90 dd cc ba 93 4d 06 b6 93 8e f4 90 03 61 5d f5 f9 90 8d 6e 8a ac fc 2e 1e da 8e 0a 4a 04 da 0d 2a 5a d4 b2 4c b3 b1 b6 f3 d9 71 f9 d0 08 b1 72 28 b7 8b 72 5f 93 45 92 6c 2a f9 f0 32 d2 91 70 0e 47 70 b6 90 4c 13 62 03 fe 45 23 ee 76 01 91 70 6d 70 2a 08 f3 b5 91 8e 4e 2a b1 73 6e b1 4f 05 8f 2b 06 d5 94 4c 44 2e 2b 8e 50 49 b0 6f 4d 92 6a 4d f7 4b 42 f3 b7 6e da ee f7 d4 4d 08 fa 90 70 b2 6b 0c 6d 2f 2a d9 46 45 f0 b8 4a 4a 45 Data Ascii: GIF89a m"%hgNf.nH&#tQP))kvinpIE+-Ma]n.JZLqr(r_El2pGpLbE#vpmpNsnO+LD.+PIoMjMKBnMpkm/*FEJJE
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 66 68 06 e6 95 30 0a a3 70 01 17 c0 80 68 6a e6 52 7a 00 6c 82 98 a4 48 86 0f cc e6 07 28 5f a7 59 49 32 7c 00 6f a2 66 a6 6d da 6f 0e e6 15 5e c9 98 d0 26 6f 32 81 bd 40 09 65 92 a6 59 2e 0c 75 62 44 c7 7c 0c e8 8c 0c 4e 6d db 1f 8e 14 2d 54 0d c9 a0 5b bf 49 8e c3 a8 0d 9e 81 14 11 1c 44 22 de cb c6 f8 db 7a 72 67 41 34 41 d3 10 03 11 88 cd 0e c8 c4 0e 30 84 0f 10 83 52 5d 04 1c 8e 04 2d 44 89 b9 89 e7 b5 28 0d 7c 7a 27 ae 48 9b c6 ac 8d be 79 e6 7a 16 68 43 04 8f 54 4c 45 c2 19 85 23 2e 16 72 a4 a2 5c 38 81 27 ba a7 87 12 8d e4 84 28 64 8d 63 53 f4 62 e7 9c a8 d8 84 cd e7 3c 0c 8b 12 4d 33 cc 95 52 80 96 38 ee e2 2e 92 16 1a 04 4c f0 5c 28 55 18 03 64 c9 82 13 2c c4 d2 40 96 d5 bd 05 24 ce 8e af e4 a8 61 00 43 8f a2 ff 41 7b 62 82 90 a6 e3 dc 1c 0b 92 Data Ascii: fh0phjRzlH(_YI2\|ofmo^&o2@eY.ubD\|Nm-T[ID"zrgA4A0R]-D(\|z'HyzhCTLE#.r\8'(dcSb<M3R8.L\(Ud,@$aCA{b
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 00 29 37 1c 01 6d 63 0b 58 68 c4 46 94 03 39 e0 9a 1a e0 36 0b 88 82 1f 68 82 2f 68 06 65 20 04 c2 e2 9b 3e b0 29 44 68 4f 23 40 1b b9 3c 9c c1 91 d0 08 5d 0c af 11 86 46 fc 82 f7 32 c6 c0 ba 27 d2 39 00 06 90 20 fe f8 d0 e3 c0 45 10 ad 80 b5 ba 82 b4 b2 86 f9 c8 85 31 98 01 3f 30 89 a5 aa a7 f4 f9 82 e7 5a 2b d6 88 04 21 39 51 e8 82 00 2e 51 2e 8f ab 00 b7 e2 8f 22 fa a1 60 22 13 a9 ba 81 20 9d 81 2b b8 01 eb 61 81 3e 50 52 3f 60 01 18 a8 9e 65 f4 03 a7 8a 9f f5 d1 52 fe eb 25 f6 81 ba f5 41 1f 1f 2d 2d d8 38 80 b4 7a 2d a0 8b 1e ff 49 22 99 9b ae dc 1a bb eb 12 12 11 d8 b8 d2 ea 83 e7 01 89 d2 92 07 d8 60 1d 99 1b 03 38 c5 45 1b d2 38 e2 82 47 97 2b c5 e7 4a a1 7b dc ab 03 12 d3 d1 7a 82 08 a1 2d 76 44 07 1b f2 21 d8 ff 81 80 1c ba a7 cb 33 9f 1e 92 9f Data Ascii: )7mcXhF96h/he >)DhO#@<]F2'9 E1?0Z+!9Q.Q."`" +a>PR?`eR%A--8z-I"`8E8G+J{z-vD!3
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 33 6a 73 e9 81 19 33 77 3b 3b 6a a3 bd 63 71 bd 15 a4 9b d3 03 b6 d3 09 60 e0 0c c3 a3 35 3d 17 3c 6b d3 73 4b 07 40 5f 90 a4 b3 65 a4 e1 88 5b db 99 2c 3f 4a 74 69 17 8e 99 61 a4 62 3a a6 64 5a a6 97 85 5b 2a a5 2c 81 f2 59 32 5a a6 6e ba 39 20 80 40 28 10 3f 74 7a 68 ce b7 a6 b1 e1 a5 6f 4a a6 d0 a8 1e 1d 94 95 76 8a a7 81 b5 a7 6e 1a a7 c1 b1 40 88 8a 2c 72 07 a4 84 1a a4 9d 01 02 d0 85 19 60 e0 96 19 54 a9 00 f4 a7 97 1a 28 64 92 7b df 55 08 50 40 79 93 f7 45 2b d2 91 3a 89 7b 4d a0 08 3f a0 23 23 30 24 c2 20 92 46 19 5f a8 17 ab f4 35 5f 48 02 0b 2f 09 0b 2d b0 0e b4 00 00 b0 a7 ab 6c 70 5d 24 52 26 54 42 46 5c 10 46 30 51 08 64 64 43 3b 50 00 c2 d0 5e c8 37 24 1b e6 43 23 70 a7 d4 1a a8 b8 89 a0 96 9a 41 7e 54 21 ff 3e 60 05 2d 56 11 57 40 0a c1 e2 Data Ascii: 3js3w;;jcq`5=<ksK@_e[,?Jtiab:dZ[*,Y2Zn9 @(?tzhoJvn@,r`T(d{UP@yE+:{M?##0$ F_5_H/-lp]$R&TBF\F0QddC;P^7$C#pA~T!>`-VW@
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 42 44 e4 42 b2 14 00 78 b3 47 48 24 51 13 95 20 80 c0 4a 29 69 43 06 e4 43 98 f4 48 dd c0 ab 66 cd 2c 15 75 40 6a 87 93 40 10 08 e6 e0 48 18 69 1b e6 e0 94 a4 11 13 91 f3 3c c4 2d 55 b5 84 55 a3 e8 53 52 85 e3 5c 45 0e 76 a0 0f e4 8d de ec ad 50 08 05 4c 03 05 15 a8 e0 11 9c e0 9b d6 31 50 e8 04 15 1c 41 51 1c a1 de fc 6d 1f c5 49 52 8a 89 4e 42 40 18 6a c1 02 94 21 1d 9c 21 97 38 60 2a c1 c4 e3 9a 60 08 c8 84 01 0a 21 55 4c e5 2c 11 84 57 ca d5 21 c8 8f 07 9c 2a 57 e0 ca 57 da 75 57 7c 25 33 8e 68 58 98 48 8d 8a 00 2a d5 80 01 a6 e1 dc a6 c5 07 9c cc 0b ed 83 3e 5a 66 06 e2 c5 a7 82 e0 07 40 6b 1a ec 23 12 68 83 01 10 ab 68 e0 e0 0b 6a 80 01 fc a0 09 8c 20 06 a6 c1 a7 5a 26 19 6a 20 32 93 a1 08 d4 40 62 be 40 03 b0 e5 ff 59 62 80 07 7c 4f 0d b2 a0 a6 28 Data Ascii: BDBxGH$Q J)iCCHf,u@j@Hi<-UUSR\EvPL1PAQmIRNB@j!!8``!UL,W!WWuW\|%3hXH*>Zf@k#hhj Z&j 2@b@Yb\|O(
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 94 45 4d 4b 01 98 40 31 68 c3 0f d0 0a aa 54 42 28 50 d4 c9 61 2b 46 e5 14 48 16 80 05 6c cb 4d 75 64 b0 c2 02 4f d5 40 b7 e4 5c 11 7c 41 33 94 c3 34 70 41 13 70 41 d0 69 d9 2f 6c 98 4c 7a 81 17 d4 4b 4d d4 8b 18 28 9d 55 35 09 d8 69 d5 30 2c c3 02 58 dd 54 0d 88 54 dd 84 d7 99 69 4e 8a dd 93 34 a5 0e a8 1d da a1 1d 3a 0c 81 1a b0 c0 0d 54 25 1e 0c c0 1c c0 5d 14 10 56 19 d8 9d c7 4e 01 15 74 c1 63 09 81 15 9c 01 23 9c 01 24 a4 ec 19 74 03 24 c0 c3 df a9 01 b8 dc 00 e0 69 c0 59 9e 81 c9 2a de 0d f8 41 7c 32 40 10 7c ec cf 4e 41 60 7a cd e5 59 4d d5 cc 86 d7 b8 62 d4 8c 0c 2f 48 42 e8 99 0d e9 8d 68 88 de 96 63 a2 5e ea c1 0d dd e8 81 1e c4 c1 01 70 c1 01 84 a6 52 b1 e4 52 49 ab de f0 cd 1d f4 0d ef 0d 1f da aa ed ee c5 ff a6 f1 24 d4 db 4a 8e f3 ad 1f e7 Data Ascii: EMK@1hTB(Pa+FHlMudO@\\|A34pApAi/lLzKM(U5i0,XTTiN4:T%]VNtc#$t$iY*A\|2@\|NA`zYMb/HBhc^pRRI$J
2025-01-02 05:12:41 UTC	16384	IN	Data Raw: 8d 82 4c 20 02 6b 4c cd 03 b0 1e 76 1b 01 0d 68 8c 7a b8 03 09 88 00 09 18 59 09 40 b5 af 40 35 b1 f8 98 4b 20 0b b3 98 47 17 38 03 7b 14 85 c1 00 06 17 18 48 5d b3 8b 5c cb 59 5f 03 b6 42 58 8a 10 08 00 3d ea 01 66 2b b6 1e 38 4b 0b 08 57 68 1b 0e 62 9c 81 81 04 56 80 7c 02 6d f3 22 0f 38 17 aa bd 84 70 63 0d d9 88 0d 95 dc da 36 b0 81 ea 50 8d 26 60 37 0b 28 82 e8 e1 34 0b 20 02 b4 49 9b 1f 28 04 64 c1 22 b7 dd 0e 83 83 db a5 4c ca a6 ac 5b a6 8c ca a8 dc 80 13 c0 5b 36 98 4a a9 11 0f 86 63 4b f9 68 39 fa b0 b9 00 99 b8 b4 14 cb ad 34 dc 62 aa cb c4 dd ca 61 f3 85 59 90 5c 5f 78 39 f5 a0 dc c9 0d a6 0a e1 10 c2 fd 4a f4 20 10 c8 f5 dc f3 e8 b9 47 91 14 14 59 9f d2 dc 3b d6 54 80 aa b3 c8 c9 28 02 d6 54 3b d6 34 ba 34 ff 70 5d c9 e0 08 4c 18 0d 2b 98 dd Data Ascii: L kLvhzY@@5K G8{H]\Y_BX=f+8KWhbV\|m"8pc6P&`7(4 I(d"L[[6JcKh94baY\_x9J GY;T(T;44p]L+
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 78 61 7b 74 32 14 59 d3 a9 8e 46 09 35 80 07 b0 20 0c 16 20 04 4b 10 00 b3 20 0a b7 90 74 0f 20 07 76 34 54 3b 50 9c 6c c0 05 c9 c0 01 7d 50 06 28 f0 16 73 50 73 10 b0 02 44 10 03 16 80 06 af 03 0d ce e0 0d 32 87 05 41 39 3d 54 e0 0c 4d 80 06 c7 80 02 8e 70 04 54 b0 b7 0e 20 0a 00 50 9c 88 21 98 6c e4 3f fe 08 15 91 e1 8a 51 97 19 18 70 08 56 c7 19 2b 70 07 d9 90 09 3e 90 02 14 40 01 2f 10 bb b3 2b bb b5 ab 99 9b f9 01 31 90 0b 17 60 3e c2 43 3c 72 80 08 b2 19 9b c3 3b 9b b3 f9 4d b5 49 4e 1c 00 03 69 20 02 01 30 02 41 50 0d 46 b0 44 1c d0 53 64 a0 26 27 70 06 ee 40 03 0b 80 1e bb 88 7c 98 e7 4f e1 bb 4f 0c d0 07 16 00 42 6b cb 02 f1 79 03 fc 51 51 19 a5 01 3d 30 7b b4 17 00 b2 17 0c 01 40 7b f5 8b bf 01 e0 20 01 90 0a ff fd 8b 04 18 75 9f a7 27 51 bc 37 Data Ascii: xa{t2YF5 K t v4T;Pl}P(sPsD2A9=TMpT P!l?QpV+p>@/+1`>C<r;MINi 0APFDSd&'p@\|OOBkyQQ=0{@{ u'Q7
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 18 a4 20 2f 06 d7 89 ba f0 2d 54 37 2f aa 04 13 ac 48 4d 76 80 0d 4a a2 36 46 00 c2 c8 a0 10 a0 20 0e e2 40 45 07 b1 77 57 94 0c 36 20 0b e2 a0 0a 1a e1 00 78 b7 77 e3 70 12 94 d7 77 57 b4 0f 8a 2a 04 62 81 18 0c 60 03 1e 31 91 16 a9 91 1a 00 48 13 c4 3b 9c 74 12 33 d1 48 e5 a3 91 88 34 42 92 40 3f 58 a7 42 b0 37 d7 e0 c3 00 ba b7 40 5c 29 02 76 71 43 ac 00 95 64 31 4d b1 f7 44 a6 8d 91 f0 77 4c 67 a9 01 ac 80 43 36 a9 01 f6 57 d9 1a e9 7f c7 14 7b 7b 09 7b e3 97 02 fa b7 81 b1 d7 0e 38 21 db cc b0 4a 38 21 82 ad c9 82 d1 a0 07 1c 01 1d 39 d8 1c 3d b8 83 41 f8 83 45 38 84 49 78 84 4d 98 1b d5 11 1f 55 78 85 59 b8 85 5d f8 85 61 18 1e 4b 80 16 6e 60 a4 6c f8 86 71 18 87 51 6a 1a 5c aa 87 d1 40 1b d2 41 a9 d2 c5 a6 6c 0a ff a7 d2 65 88 81 ca 22 8f 38 bc b0 Data Ascii: /-T7/HMvJ6F @EwW6 xwpwW*b`1H;t3H4B@?XB7@\)vqCd1MDwLgC6W{{{8!J8!9=AE8IxMUxY]aKn`lqQj\@Ale"8
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 00 a1 98 01 9b c8 c9 2f 0e 92 fa ae 89 01 e8 a9 39 2c 1c 31 34 41 35 8d d9 88 ad c0 1f 30 23 a9 24 29 95 1e 4b f1 d1 12 d8 58 06 48 74 00 5d f0 ca 30 78 98 ad 48 00 b0 9c 4c 04 43 f0 03 4f b0 05 97 80 4d b1 4a 18 c4 01 07 0b 0c 14 d0 63 0b a1 43 1e 6a 08 37 20 41 25 2a 80 1b 7c 40 17 2c 94 16 30 17 65 92 1e 43 69 82 1b 6c 2c 25 08 6a bf b8 c1 e8 05 5c 19 f4 cb 0d 13 c3 a4 12 c3 36 2c 03 00 c0 54 1a 11 71 c8 54 cb 4c 19 44 09 88 6a 53 91 2a 47 64 41 3a 9a 2a 35 92 86 ac 26 95 cd 60 5c c8 c9 59 0b ec 4c 3e 18 02 23 bc 81 21 80 31 d2 cc 40 43 a0 90 3d 16 5d 3c 11 9d 41 80 15 5d 0d 64 0b 3c 40 f6 fd e3 d3 bc 0d 69 4c 66 af 64 1f da 3c 9d 9c 61 40 04 6c ab 1f c3 dd d3 40 16 e0 24 56 45 06 b2 b6 12 72 e3 9c 5d 0b 6c e4 41 28 ff 16 da 95 e4 d3 d8 81 2e 70 c2 24 Data Ascii: /9,14A50#$)KXHt]0xHLCOMJcCj7 A%\|@,0eCil,%j\6,TqTLDjSGdA:*5&`\YL>#!1@C=]<A]d<@iLfd<a@l@$VEr]lA(.p$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49870	123.6.18.115	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:41 UTC	608	OUT	GET /cdbcb1b08e2d9dc97758d1ca7b53357b.gif HTTP/1.1 Host: vns3.ezrent.hk Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:43 UTC	417	IN	HTTP/1.1 200 OK Server: NgxFence Date: Thu, 02 Jan 2025 05:12:42 GMT Content-Type: image/gif Content-Length: 309347 Connection: close Last-Modified: Mon, 06 May 2024 15:21:00 GMT Vary: Accept-Encoding ETag: "6638f55c-4b863" Expires: Sat, 01 Feb 2025 05:12:41 GMT Cache-Control: max-age=2592000 X-Cache: MISS Strict-Transport-Security: max-age=31536000; includeSubdomains; preload Accept-Ranges: bytes
2025-01-02 05:12:43 UTC	15967	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f6 7f 00 ca 0c 12 31 5b ac 96 95 93 ec 67 5f fe 4f 0e eb 8e 91 b8 0b 10 ef dc b4 b3 da fa fd 8f 0f fd fb f8 f3 a3 67 9d ac de fc 6e 0a ff f9 eb f8 d5 d2 00 b5 fc f6 00 00 fe ad 18 fd 71 21 6f 9c e7 f7 b0 ad f5 cf 58 44 99 10 00 6a ee d9 8c 8c fd fb da 00 91 f6 ff ee bc cf cf d4 f7 ef db f1 a4 eb 55 cc fc f7 e9 cb 0f 0f 10 9f 6a 15 fe 33 00 d6 ea fd fe c7 23 fb d0 95 fd 85 27 e3 2a d9 49 0b 96 fd bc 21 01 02 fd d0 d9 ee d4 27 29 69 68 65 fb 42 f3 2a 8a c6 ae 90 6d bc 60 55 cc b2 ab f7 4e 29 0a 21 ab d6 ad 8f f5 2e 2a 07 95 d0 1b 68 04 6d 8f aa ec eb ec fd db ec b6 0a a6 f3 b3 8b 51 1b 14 d1 16 bc 5e 60 aa fc ed ec 01 73 cd 5d 67 e9 d5 52 02 d8 16 1c ff ea f6 03 81 b0 36 50 f1 f4 35 56 da 6b 06 6c 1f cb 9e 05 07 b0 87 1b d6 90 Data Ascii: GIF89a1[g_Ognq!oXDjUj3#'I!')iheBm`UN)!.*hmQ^`s]gR6P5Vkl
2025-01-02 05:12:43 UTC	68	IN	Data Raw: 50 0a 0a 97 b9 9a 9a 48 87 75 07 20 d7 22 43 5e fa a5 7d 77 78 39 91 21 5f ea a5 1d 95 8a 05 d5 91 9f 88 50 60 50 13 91 77 78 6e 87 2b c5 59 79 75 47 04 d0 d9 15 04 18 79 19 68 2d ce 99 88 3b f0 37 d9 20 Data Ascii: PHu "C^}wx9!_P`Pwxn+YyuGyh-;7
2025-01-02 05:12:43 UTC	2440	IN	Data Raw: 9d 9a 29 78 38 c2 65 cb 29 39 3b 80 5a 7f 18 39 d3 59 81 97 33 a7 10 38 06 01 10 a7 ce d0 01 8c ba 9c f4 88 0d b1 f5 a6 e0 b6 9d f7 a6 ff a6 96 18 16 df 19 10 ea 59 a0 d8 d0 92 fe c9 94 32 d9 93 14 ba 9e 12 da aa b0 5a aa f7 a9 aa b3 ca 94 68 11 a1 47 01 a1 b1 4a a1 49 59 5e 11 8a 92 43 69 9e e7 b9 aa 3c 99 92 b9 20 ac 4b 89 a0 09 4a ab 0f 8a ab 7a 80 ac bb 6a a1 58 89 a1 52 09 31 3c d8 a1 20 9a ad 30 58 7b 23 7a 72 60 99 7b c2 78 00 e2 2a ae 29 5a 4b e3 7a ae a6 80 ae be 48 03 4a 38 ae 78 85 0a ea ca 06 4b a7 a2 00 14 af 7c 99 8d f1 4a 03 41 27 08 ea aa a4 b0 71 72 ab 61 af 02 2b b0 86 19 af ba 66 b0 54 ea 0a c5 81 b0 54 b8 08 f0 6a af 1b 44 99 e2 d4 0a 57 8a a5 21 79 9b cd 02 12 1a bb b1 1c cb b1 83 4a 78 1d 1b b2 1c bb 9a bb 19 79 08 95 91 10 c8 8f e0 Data Ascii: )x8e)9;Z9Y38Y2ZhGJIY^Ci< KJzjXR1< 0X{#zr`{x*)ZKzHJ8xK\|JA'qra+fTTjDW!yJxy
2025-01-02 05:12:43 UTC	1273	IN	Data Raw: eb 02 51 0c 19 aa 90 a1 b6 ed da b1 1d c8 2e 74 5b b1 6c dd 51 5c db 16 be bb 92 26 49 c8 8f 37 5a 14 cd d2 27 70 00 44 1d b2 94 e1 16 16 e9 a8 b0 19 f8 b2 ad d3 17 6b d6 9a 93 7a 85 2a 04 8d 1b e7 d3 a3 bf 81 be c2 0d f7 6f 68 c4 af 20 ff 7d f5 5e c7 a4 cd 12 7f e0 be 13 ec 96 18 c3 cc 28 cf 5d 63 e0 32 dc 4d 87 8a 80 ce e0 37 cd 2c dd 1d c0 e0 37 ce 8c 63 ce 39 5a 45 d4 d5 86 1c 76 e8 e1 87 1d a4 d4 c2 49 5a a9 d3 81 55 1b e6 d1 59 89 10 c5 f4 e1 8b 30 6e 18 62 42 2e c6 68 a3 8d 2c ee 84 ff d4 8e 35 e1 c4 e2 41 25 0c 55 13 03 4a 2d f5 d1 4b 14 3c 65 13 51 3e fe 48 85 8e 08 30 40 a4 91 47 3a 45 13 52 59 39 09 e5 94 54 ee 83 e4 95 4c 3a b9 15 8a 1d 82 25 e6 88 37 fa 63 26 42 aa 91 c5 4e 61 a5 c5 e9 16 3a 70 e6 c5 d7 67 73 3a 54 27 09 7e 11 86 d6 00 8f 91 Data Ascii: Q.t[lQ\&I7Z'pDkz*oh }^(]c2M7,7c9ZEvIZUY0nbB.h,5A%UJ-K<eQ>H0@G:ERY9TL:%7c&BNa:pgs:T'~
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: fe 8a 16 46 c4 62 15 0f 00 c5 2b 6a 47 75 fb e1 22 2e 26 fb c5 d6 ad 2b 8e 16 ad 28 53 d0 68 22 12 69 a5 7c 15 79 23 c6 1c aa d9 cc e2 03 60 a4 35 6d 69 97 e7 d1 d6 ba f6 b5 b0 e5 9e 10 8e d7 bb 2d 60 8c a2 c2 33 69 3a 50 4a 12 03 42 0a 21 77 1a 80 d5 62 ca d4 75 c4 74 82 55 ab c0 04 d2 f2 d2 e4 da c5 4d fc 0b 0c 69 36 d9 3f 5c 26 70 2f 99 cc ee 62 f4 07 54 e6 ca 92 94 51 43 87 75 d7 51 19 97 9e a6 97 e7 5d a5 04 a1 1a b5 cf a0 f2 96 c0 ec 1a 58 67 63 9b c8 90 05 6c 5e 15 95 09 55 c5 36 b2 1a 82 85 d1 94 5b 77 ff ee 76 9c 62 d1 8d 0d 71 1d dc 28 b6 9a 60 44 28 63 1b 33 58 05 3c cb 59 ad be f6 b0 5c 06 50 e7 84 c0 d9 0c bd 46 ce 16 d8 02 22 22 40 77 89 2b ae 6e 9e 5a 74 02 3e 23 57 4f 0a 79 ce b2 ec 7a 89 8c 67 4c e3 1a db f8 c6 38 ce b1 8e 77 cc d9 ad ec Data Ascii: Fb+jGu".&+(Sh"i\|y#`5mi-`3i:PJB!wbutUMi6?\&p/bTQCuQ]Xgcl^U6[wvbq(`D(c3X<Y\PF""@w+nZt>#WOyzgL8w
2025-01-02 05:12:43 UTC	11128	IN	Data Raw: 89 4d 30 67 4c 40 da c8 b6 d1 43 e6 4d c0 03 01 8b 98 08 3d c6 0d e6 19 a1 14 e1 cb 25 05 49 76 33 7d 9d 6f 88 8f 18 98 09 5f 26 4d f7 75 d3 84 ea 3a 1f 02 07 c8 33 5b 68 b3 5e 6e 30 87 2d d0 01 34 85 19 41 06 20 6b a7 3b 33 60 91 09 fd 6f 9a 10 c3 d1 c9 8c 40 cf a3 ad d0 60 e6 aa 66 f4 22 04 32 fd b1 e8 13 e5 23 18 41 0f f8 33 72 1e b4 43 0d 25 18 34 e3 59 bf 85 81 d0 22 4c a3 18 10 47 82 4d 48 9c c0 87 1d 8d 84 10 43 5a 44 25 8a ad 0f 26 b5 a2 13 47 d2 07 26 f6 e1 a5 30 8d a9 4c 65 fa b5 90 a8 f4 a6 2b 3d db ff 23 de 04 a7 a1 74 d1 8b 43 59 c3 9e 82 42 83 28 a4 c1 4e 75 bb 93 50 28 25 97 38 c6 f1 6f 71 5c 54 5d 06 77 16 b2 54 ea 8f 97 9a 5c 25 03 b3 43 44 66 4e 74 94 79 55 57 0f 59 3b d2 81 0e ac 93 14 d5 23 75 28 ab d4 a1 15 35 a8 09 8d 5c e7 4a d7 ba Data Ascii: M0gL@CM=%Iv3}o_&Mu:3[h^n0-4A k;3`o@`f"2#A3rC%4Y"LGMHCZD%&G&0Le+=#tCYB(NuP(%8oq\T]wT\%CDfNtyUWY;#u(5\J
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 02 1b d8 80 0c 5b db 42 07 94 e0 cc 6a 92 2d 99 cd 64 e6 33 85 c9 cd 60 ce 0d 3c e7 c1 1b 7a 26 b0 80 22 41 90 72 92 b4 8c f3 70 90 38 02 ec 87 71 91 93 a5 ff 2d 2a b0 1f d0 dd 0d 3d e7 41 81 e8 78 a7 21 7e be c8 44 5d 04 68 40 05 7a 0b 7f ce e1 a0 39 a0 40 53 4a 30 87 0d e4 e0 a1 0a ed 22 05 72 70 d0 39 18 f4 a2 1a 8a d1 96 66 44 c0 f4 31 69 02 93 94 e7 2d 42 20 c0 24 8d 4f 4b 4c a2 dc 2d 06 80 52 49 84 94 5f 55 ea e8 49 89 74 1f 58 70 89 26 5f 62 1f fe 76 ca 09 f7 f9 e1 4c e4 fb 68 22 00 88 82 8e 72 42 47 28 f5 53 22 46 41 80 15 7c 02 15 35 e0 d3 53 25 a0 d4 a3 d2 6f 13 06 24 94 a1 0e c8 c0 b0 c0 87 ab c1 38 de a2 b6 02 42 71 58 50 1d 7d 2b 80 20 d5 01 42 b6 0e 20 17 05 62 6b 59 1f 99 aa 58 d9 d5 00 3b 64 d5 09 2b 40 c3 0c b8 47 1e b5 7a 95 b2 3c d8 91 Data Ascii: [Bj-d3`<z&"Arp8q-*=Ax!~D]h@z9@SJ0"rp9fD1i-B $OKL-RI_UItXp&_bvLh"rBG(S"FA\|5S%o$8BqXP}+ B bkYX;d+@Gz<
2025-01-02 05:12:43 UTC	12576	IN	Data Raw: c0 30 47 aa f7 6c 81 5c 3d ba fb cd 13 e4 8d df 08 68 e5 08 cb ba c5 0e 66 bf ee b8 05 50 03 fb 1d 01 4b 10 02 cb de ba 62 b2 43 3c de ff ed de fe ed 79 1b e7 b1 92 08 0e 5e ca 6e e0 0b e5 ee 01 dd 03 b4 9e 6c d1 15 c0 c9 24 99 1b 1a ce b4 1c be 6d 87 8e 0e 32 dd 21 c2 08 6e a4 3d ae 89 34 a5 4f d8 e2 eb a1 3b 9c 0e d4 0c 90 9e 0c 50 f0 72 ba 0d ee 2a ea f2 0b 94 9b de 09 7a 2b 26 82 5d f1 49 60 f1 18 7f 3c 97 fe 09 9d 75 3c 18 cf 0c 38 75 98 ab 7b c6 08 77 eb 5f ed 2b 93 7b a9 cf 5e 01 d1 5e ed 98 6b 64 23 8a de f2 a7 06 2a 1f c1 c9 ee f2 68 3e 26 07 1a 05 6a a0 80 5b 40 ec 89 c8 70 bc 8e f3 fc 29 91 75 5c b2 79 1a 26 ea aa f0 4c cf ea 4e df f4 50 cf 42 43 2d ee f0 93 08 6c e0 d8 5b d6 d1 bc 80 e7 3d 1b bc 66 55 9b 5b 16 27 8a 13 ef 98 3d ef 19 2e 9b a3 Data Ascii: 0Gl\=hfPKbC<y^nl$m2!n=4O;Prz+&]I`<u<8u{w_+{^^kd#h>&j[@p)u\y&LNPBC-l[=fU['=.
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 2b 64 2c 4b ed ca cb f2 3b f0 01 6f 68 ff 7c 39 c4 43 6f fd c3 f0 c4 23 31 c4 b5 c8 6a 41 ab 16 60 42 4d 80 0c ae 32 31 07 31 9b 13 ea 77 ec b7 ef be fb 66 36 e3 c2 cb ef d7 6f 7f fa 22 d1 6f ff fe ec 87 de 4c e7 fc 0b 20 fb 54 96 92 eb 19 70 62 3d 8b c9 cf a8 16 34 a2 d4 82 2a 4b 18 80 04 07 20 26 a9 80 25 27 35 80 5a 5e be 51 c1 a4 99 0d 13 4e a3 ca 25 c2 86 b5 a4 5d 66 4d 77 02 d4 12 be 36 b6 ad 91 0d 50 5f 13 03 03 19 c8 a8 1a f4 20 2b 54 7b 4b a2 20 f5 97 2f bd cd 30 16 b0 40 63 bc b0 11 02 7e 01 4b 79 c3 cd de e0 b2 ba bf 01 2e 34 b6 8a 22 69 d6 f0 44 c3 89 26 71 58 14 40 e3 1c 37 9b e0 1c 61 38 00 a8 db 2c a2 30 b7 92 18 20 39 b4 a8 c0 64 0e 21 2a 30 02 80 80 33 18 c0 0c e2 38 47 39 d2 f1 8e 76 cc 63 1d f7 88 47 3e ea d1 21 7a 98 d2 b5 66 d6 ac d6 Data Ascii: +d,K;oh\|9Co#1jA`BM211wf6o"oL Tpb=4K &%'5Z^QN%]fMw6P_ +T{K /0@c~Ky.4"iD&qX@7a8,0 9d!038G9vcG>!zf
2025-01-02 05:12:43 UTC	8232	IN	Data Raw: 9e 04 b8 61 86 aa b2 f2 aa e7 75 c0 28 ff 78 08 05 17 6e d2 41 79 62 7d 67 6f 78 af 2a 50 08 77 01 8f 55 02 21 bb ec 50 c9 26 f9 1d b2 86 7f 17 0e b8 89 81 f9 d2 f7 2f 21 0c 36 08 4b 84 b3 1c 63 0b 85 34 54 7c ca 31 bf 28 43 e2 33 b8 b0 a8 e1 87 43 84 f5 cb c9 7a ac cc f2 30 2a 73 63 cd 0b 46 d2 f8 23 9a 3d be e4 48 41 39 9e 29 74 3d f7 38 29 e5 11 63 2a c4 24 9a 68 6a c3 a5 4b ed 38 e4 12 96 13 3d 49 51 4c 44 1a 80 6c d0 28 d5 e8 f5 39 98 56 04 12 d7 4c 7f 6d f6 47 34 26 3d d2 49 3d 4d 07 14 5e 8d 1d 08 77 52 ae 12 75 14 ae 85 92 70 89 16 03 b0 aa d3 23 f4 86 19 d5 26 5e 2d e0 41 08 0b 2c a7 38 56 5a b0 14 9d a4 27 44 2e f9 e4 94 47 1e 82 aa 95 57 7e 79 51 0f 64 3e 39 a3 05 0f e6 f6 4e 24 d4 fd ea 0c a3 f3 14 59 5b 6f 29 a7 96 de 97 10 20 f2 ec 24 48 06 Data Ascii: au(xnAyb}goxPwU!P&/!6Kc4T\|1(C3Cz0scF#=HA9)t=8)c*$hjK8=IQLDl(9VLmG4&=I=M^wRup#&^-A,8VZ'D.GW~yQd>9N$Y[o) $H

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49898	111.174.12.113	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:41 UTC	361	OUT	GET /img/uu-rt150x150.gif HTTP/1.1 Host: monkey.p2ld58.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:42 UTC	612	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 200936 Connection: close Accept-Ranges: bytes Age: 4 Cache-Control: max-age=7200 Etag: "67700a17-310e8" Expires: Sat, 01 Feb 2025 05:12:38 GMT Last-Modified: Sat, 28 Dec 2024 14:24:23 GMT Vary: Accept-Encoding Via: cache75.jnmp,cache02.hsct02 X-Bdcdn-Cache-Status: TCP_MISS,TCP_HIT X-Request-Id: c0bb13cbeec059ee1a7d6938b1f35169 X-Request-Ip: 8.46.123.189 X-Response-Cache: parent_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:42 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:42 UTC	15772	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 ff 00 e3 ae 95 d5 9d 83 fb 63 51 ba 7d 61 65 18 a9 db aa 95 8b 51 37 db a4 8a c8 8d 72 f9 d9 c6 fe 95 2f f5 21 72 f4 a8 cc ed ca b7 e3 48 bd e7 b2 9a fb 96 52 ff 19 46 47 93 bb fb e8 d8 fb 6b 90 db b6 a6 f3 ba a6 ce 96 79 ad 71 56 a7 6c 52 fd c4 2d 9b 62 49 94 5a 41 96 2a db ff ba 52 ff c7 4d 18 28 52 eb b6 9e e7 3b a6 f3 ce ba bd 82 65 5f 70 90 ff d5 dc fe 76 68 f5 77 a7 c6 d0 da 5c 2a 1a d3 9a 7d e7 c3 ad fe a8 58 b3 75 5a 9b 5c a2 c4 8a 6d ff 24 45 eb 35 99 f9 ac 6d a4 66 4c ae b7 c8 fb 18 57 fa d0 93 fb ec e6 ff 37 45 ff c9 17 c9 9c 87 fe 87 62 f8 d4 bf c3 86 69 fd fd fd fc d8 e6 fc f5 eb ff 56 4d f7 1c 66 f3 c3 ae b6 c6 d1 da b1 9d fc ce 6d fe ea b0 fe 6b 6b fd 98 60 ff 47 48 fc 5d 51 f0 2a 85 e6 b2 96 f1 56 8c e4 be Data Ascii: GIF89acQ}aeQ7r/!rHRFGkyqVlR-bIZARM(R;e_pvhw\}XuZ\m$E5mfLW7EbiVMfmkk`GH]Q*V
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 0c 01 b5 4b b5 7b aa b1 3f a0 b5 1d 3b 03 33 70 06 70 3c 01 37 e0 bb c9 80 cb 77 0c a8 f0 1a ad ff 70 04 7d ec c7 04 51 0b 81 ec c2 ce 8b c8 14 71 cd 31 9c b7 cf e4 c8 84 b0 d2 fe 00 07 36 7b ce 27 90 ce 48 7a 02 4a 4a 05 88 10 b1 88 90 05 54 10 04 74 f0 09 38 80 08 3c d0 03 88 10 d4 3f 30 02 97 8a 07 7d ad b9 fc 9c d1 e3 f5 ba 4a 80 09 38 30 01 98 8d d9 3b ad 08 13 c0 d0 6e 8c bb d9 80 d5 f0 f6 03 c4 7b c7 06 3c b2 09 ac d1 04 71 03 67 2d 10 1e ed c2 2a 91 b7 a9 c0 c8 d2 6b b0 71 1d c9 fe f0 03 04 02 a6 e8 4c d0 31 0d 04 32 0d d8 77 20 b1 9b 30 be 70 70 7b 94 90 00 9d 8d d0 3d 90 a7 4a 50 d4 47 dd 7e ff ec ba 56 6c ac ca da 02 33 d0 bb b7 ab bb 8a 70 03 1e ff 00 c7 83 20 d1 96 65 0d 1c dc c1 02 81 07 aa 3d 10 1c 4d 10 af 5d 11 1f ad d6 1e ed 84 28 dd 06 Data Ascii: K{?;3pp<7wp}Qq16{'HzJJTt8<?0}J80;n{<qg-*kqL12w 0pp{=JPG~Vl3p e=M](
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 01 48 f0 83 fe 90 c2 17 4b b4 1f 5b 10 1b fb c2 1b 9b a7 ba 29 aa 0d 56 10 5d a0 06 49 70 aa db 6a 02 38 00 07 40 dc 0c 03 91 05 9e 9b a6 27 30 02 70 c0 03 d3 20 b4 13 b0 b4 ff 10 bb 09 d0 9d 70 40 ba 3c d0 b7 41 70 b4 3f b0 af 98 c0 ba 2d 10 ac 3d 50 b5 09 30 01 d6 f0 0f 85 d0 03 13 50 c1 5b 3b 08 d6 70 03 d9 10 04 3d 50 1c 37 e0 01 83 70 06 d6 70 04 20 fa b0 1f 90 0d 24 3c 10 1b e5 b4 17 9b 0d 1b 4b 97 73 0b 97 0e 80 bd 72 5b c3 7a 2a 10 d0 ff d5 10 9f 60 be 04 8a b7 09 e0 0a 77 70 07 05 11 0e 26 90 a0 54 01 07 44 70 02 9b 10 0a 44 f0 03 3d fb 03 23 00 c0 3c 3a 02 3d c0 3a 3f 30 a4 a5 8b 03 b7 0a 0d 54 40 9e 10 d0 03 09 70 bc b3 3c c6 44 3c cb 5e bb a6 85 70 69 1e 30 01 bf 4b c7 71 7c 04 41 e0 b6 98 ba c7 3f 88 07 76 7c b1 85 ac b1 cc 0c c3 a0 a9 b1 dc Data Ascii: HK[)V]Ipj8@'0p p@<Ap?-=P0P[;p=P7pp $<Ksr[z*`wp&TDpD=#<:=:?0T@p<D<^pi0Kq\|A?v\|
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 53 3b 03 77 2a aa 13 30 03 ff 80 57 0a 90 05 33 60 59 22 6b aa 85 90 0c a5 aa 08 d9 f0 ae 7f 9a 80 25 7b 06 b2 b5 98 a9 aa 01 57 e0 af ff 90 0a ba 49 b7 28 91 0a 0e e0 00 69 70 9c 7c 27 b0 06 9b 04 bf f0 0b 0d c3 04 df 7a ab 0b fb 0b 09 60 02 89 0b 07 54 40 05 09 f0 b8 8a 0b 07 12 db 07 ff 90 00 7d 30 02 94 30 01 38 b0 b9 59 30 01 3d 00 a7 ff 80 03 a8 10 ba 04 11 04 a8 10 04 d0 d0 b1 37 f0 0f 85 f0 0f 59 50 08 a6 f0 03 ad 9b 00 59 70 03 ee da 02 41 90 0d 83 50 08 8a 30 08 be 3b 10 67 eb 10 6b 78 04 37 50 08 47 e0 98 ad ba af 7a bb bc 69 a0 b7 29 d1 bc c5 29 12 01 1b 08 1d f2 03 84 10 04 71 21 00 d9 8a b3 27 10 0e 70 d0 0c e0 ff db 0c 38 30 0d e1 db 0c 70 40 04 95 8a 08 70 00 b5 e1 10 04 a1 80 08 84 10 0a 4a 30 0d a1 40 b1 9c aa 08 33 10 0a f9 ab bf a6 10 Data Ascii: S;w*0W3`Y"k%{WI(ip\|'z`T@}008Y0=7YPYpAP0;gkx7PGzi))q!'p80p@pJ0@3
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: ae f7 9e ef 3d f7 ef c8 ff 3b 42 f0 8e 2f ec 3f f0 95 06 66 8f 56 74 47 c7 06 3e c0 12 22 53 60 8e 27 47 1c 40 67 c1 04 11 58 b1 43 56 85 55 6d 34 10 d8 07 42 dd 32 39 dc 57 39 a1 f1 14 d7 03 0a f8 d0 00 76 00 07 e7 a7 05 9f d0 05 73 e0 72 6f 06 03 b8 40 4c f2 a5 46 55 c6 68 c3 c6 62 71 f0 05 35 78 7f fe e7 7f fa b7 83 fa 17 0f 80 07 7c 5e 06 0e c7 95 70 be 15 53 d7 47 14 34 d0 2f 05 75 56 d4 e2 7c ba e2 03 08 c1 06 89 85 55 cc 54 7d 5e a0 44 dc 25 52 d2 d3 2c 4f 01 0a 3b 70 0e 70 60 07 a7 97 0e 38 80 0a 54 f0 03 97 80 0c 3e a1 6e f1 06 77 a7 c0 40 f6 86 06 05 30 83 71 50 87 ba b7 7f b8 d7 7f f1 c0 83 7c f8 05 3e c8 73 c6 e6 04 42 88 70 c4 77 74 d7 87 12 af f3 74 11 87 1a 07 42 03 96 ff 90 12 92 f7 86 28 15 00 c6 40 0a 2e d5 52 9d c4 06 ae 83 01 5d b7 7d Data Ascii: =;B/?fVtG>"S`'G@gXCVUm4B29W9vsro@LFUhbq5x\|^pSG4/uV\|UT}^D%R,O;pp`8T>nw@0qP\|>sBpwttB(@.R]}
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 6e 6a 2d cc 79 6f 50 b0 c8 90 10 b8 ce 5f 75 82 4c 50 ed fa 19 79 d8 c4 68 16 a8 6f 64 9e c9 d3 b7 f2 e1 94 02 1e 30 1c 93 05 55 05 2f 58 bc 89 a5 58 c5 c2 eb 38 04 93 f3 78 4b f9 65 7f fa d3 d2 df 00 d4 bd 86 ff db 60 66 37 5b 57 7f 8d f8 5f 95 a1 89 19 9e 2c 18 61 b9 98 a7 ee 01 4d a0 54 3b e0 e8 c4 11 0d 55 4d 2c 59 12 fb e3 1e 57 4c cd 6b 06 ce 6d f1 48 40 74 92 00 89 cb 18 80 3d fa b3 28 d7 80 0e 0d 19 5a db 70 95 89 e2 c8 60 13 bf fb 62 4f 4e b8 9c 62 2c cf 0f c6 5b fe 8c a0 be 70 51 30 27 6c 92 d8 4d d4 77 79 5c 5b 36 67 1a cd 10 ae f4 6d 75 58 00 50 9c 77 19 61 d0 46 3f 85 89 67 0a b5 b7 14 6a 4b 26 66 1f b0 1d 7a d4 77 b9 b3 8e 9f 3c fc e4 1e 5b 63 39 27 7c 7b c7 4d 72 a4 54 e0 bd f1 af c7 0a 0a 2b 11 6b e6 4c a7 79 cd 9b ee ee 29 0e 50 81 04 4c Data Ascii: nj-yoP_uLPyhod0U/XX8xKe`f7[W_,aMT;UM,YWLkmH@t=(Zp`bONb,[pQ0'lMwy\[6gmuXPwaF?gjK&fzw<[c9'\|{MrT+kLy)PL
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 7e 20 63 53 7a 1c 80 f8 da 5d 3a b9 d7 d7 4a ac e4 56 d3 4b da 2d 95 14 5a 30 42 f5 5b 7f 13 0e 57 dc 1e 8f ad a2 d0 62 8b 09 54 e0 44 5f 21 18 1d 8c 29 a9 74 d4 69 2e f8 e2 43 8f 02 21 c0 08 23 17 c0 e0 4b 78 3f 21 e3 07 06 37 81 a8 1e 89 36 b1 e6 1e 76 b3 e5 46 c3 4b 1c b4 88 81 25 bc e5 17 23 49 d1 d5 58 d6 1e d2 49 b7 0a 71 7b d4 39 15 85 04 52 f6 e3 9d 0c 75 66 5d 5f b7 91 c0 c6 0a 1c 01 38 10 0c 6c 30 b2 02 1b 24 28 35 5b 18 c8 b0 02 a2 96 64 72 69 13 5f 26 ce 16 58 4e b8 05 95 9f 9f 32 da 03 e7 2a ab ec 41 aa a9 73 32 a4 aa aa 92 51 e6 aa 8f 64 ed ff 37 12 7e 18 38 18 da 4b 3b 00 f0 80 20 8c 70 e4 43 a9 ff 61 74 ca 05 2b 30 e2 05 95 82 15 95 de b2 75 6d b9 13 a6 5f 0a 35 26 4c b8 15 85 66 62 51 a9 c9 e6 2a 13 92 6a 4f a9 a7 92 4a 42 a9 8f 39 c4 e3 Data Ascii: ~ cSz]:JVK-Z0B[WbTD_!)ti.C!#Kx?!76vFK%#IXIq{9Ruf]_8l0$(5[dri_&XN2As2Qd7~8K; pCat+0um_5&LfbQjOJB9
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 85 1b b1 3f 6d de 79 dd da 3e fd e1 7f 1d d8 76 6c bc 03 3c d8 95 7a a9 03 48 dd e2 69 c4 60 86 4b 95 38 15 82 63 12 93 34 59 2a c5 93 1d 11 15 ad b5 c1 81 cc 61 82 77 78 0a 8e 8b c6 07 00 5b fc a9 cd 17 7b 97 30 bf ee e8 bb 16 0a bc 49 bb e1 1c 6e 01 ac 4d 0f e5 dd cd 23 0e c0 ca 9b d4 3c 3c ce dc e9 8b b1 da 5e 43 19 5e 4e e5 78 e5 68 14 a3 b2 6a b9 5c 61 03 61 83 42 37 55 ea 45 78 3f de 87 05 28 69 8c a7 4e a9 f3 76 13 60 04 22 89 ac d3 89 05 71 00 d1 74 0d 0f e5 0d d4 1d 6e de 66 c0 d3 38 7c bc 73 ff 6c c3 f4 50 a5 16 9d ad 29 1e 9e e6 b5 61 ff e8 ae 94 78 01 9f bd 12 65 9e 5d d0 84 3a 7a b7 02 84 95 b5 1c 2c dd b1 3c 84 0d 6e 5b 0a 38 15 f8 76 09 ef 58 00 2e 8c 05 f2 20 0f c4 3b de 80 be e1 75 0d e5 20 3e de 43 5d e5 76 2c c7 c6 4b b1 18 4a d8 8e 1e Data Ascii: ?my>vl<zHi`K8c4Y*awx[{0InM#<<^C^Nxhj\aaB7UEx?(iNv`"qtnf8\|slP)axe]:z,<n[8vX. ;u >C]v,KJ
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 53 c3 b9 5a 5d c6 da 56 79 b8 52 40 03 a8 d4 33 21 52 b5 bd 38 85 6d 20 03 0e 60 05 64 a8 e2 49 08 86 28 28 5f 23 b8 04 d1 ad 59 4c ae 66 2f 66 db 7e 7d 5b 11 6d df 83 4d 00 63 90 87 2c 98 80 1e 50 07 75 b0 00 1b 6c 00 1c 60 c5 cb 05 9b ea 21 0c a7 4d 1c 94 18 62 1f 0d d9 62 a3 3d c8 b5 3d 45 21 81 02 12 a2 72 0a 19 62 b6 88 6d 60 08 56 c0 80 65 9e 83 28 08 86 60 f8 de 0a 20 df 7c ed 62 28 c0 e4 87 1e 61 30 16 03 ff d4 b5 c6 62 25 e3 37 dc 8a 2c 08 67 78 50 07 41 b0 03 16 0d 82 09 c0 4f cb dd b9 1e 34 a2 3c 3e 8c d4 52 5e d5 22 d7 58 ad bd 06 cd ae 65 b9 00 8f 51 86 65 c8 83 95 ba 39 3b 24 05 85 50 81 64 a6 05 58 80 85 83 4e e8 ef bd 04 2c c8 d7 f3 8d 68 6b be e6 9b 35 5d 9d 65 df d5 35 e3 37 0c e7 09 98 00 6d a4 84 fa 0c 02 23 70 45 90 c2 33 58 44 1b b5 Data Ascii: SZ]VyR@3!R8m `dI((_#YLf/f~}[mMc,Pul`!Mbb==E!rbm`Ve(` \|b(a0b%7,gxPAO4<>R^"XeQe9;$PdXN,hk5]e57m#pE3XD
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 09 e8 20 33 39 c9 17 8e 85 0b 87 21 87 17 f0 7d 01 b0 03 76 f8 77 43 49 94 7f 08 00 4e 70 94 4d 99 94 84 49 98 4c 49 8e e5 38 88 e8 68 95 41 41 53 5a 39 4c 26 49 13 75 53 11 46 d1 17 3d e1 02 a4 21 4f 64 60 89 96 10 93 de a2 89 00 29 7a 1c 15 0c d2 78 90 3f 28 15 c9 85 18 41 d7 70 77 08 94 7f f8 97 46 00 98 15 59 98 b4 a9 94 e2 f8 8a 19 79 8e a4 b0 69 52 28 96 cc e5 59 8e e8 6a 77 f6 08 18 20 2a 16 41 59 06 81 80 63 f9 9b 6a c6 33 67 09 93 32 09 9a 6b 89 03 15 30 09 a0 60 90 07 79 10 41 88 69 d8 b6 97 7c f9 87 46 e0 04 84 ff d9 94 80 29 9e 4e 10 07 e7 59 9b 87 49 8e 1c e8 70 f7 72 50 1e d1 55 6f c2 01 6e 80 82 1b 40 79 3d a2 12 a1 12 16 91 55 10 06 91 9c 1c 71 1d c3 44 4f 6f a1 0c 31 11 93 25 b7 96 1e 74 09 3b 90 5c d9 b7 5f ac d7 80 99 26 7e 68 f0 90 42 Data Ascii: 39!}vwCINpMILI8hAASZ9L&IuSF=!Od`)zx?(ApwFYyiR(Yjw *AYcj3g2k0`yAi\|F)NYIprPUon@y=UqDOo1%t;\_&~hB

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49904	120.233.179.91	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:41 UTC	365	OUT	GET /jsgif/yf150-150.js HTTP/1.1 Host: 2024hwus1.heibanwa.mobi Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:42 UTC	575	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:42 GMT Content-Type: application/javascript Content-Length: 10355 Connection: close Server: openresty Last-Modified: Sat, 14 Dec 2024 17:08:22 GMT ETag: "2873-6293dfea22d2b" via: CHN-GDdongguan-CMCC5-CACHE39[11],CHN-GDdongguan-CMCC5-CACHE43[0,TCP_HIT,10],CHN-GDdongguan-GLOBAL1-CACHE46[26],CHN-GDdongguan-GLOBAL1-CACHE110[0,TCP_HIT,19] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 807dba8e6e4f83e4e776f1870cce162c nginx-hit: 1 Age: 1598557 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:42 UTC	10355	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 03 00 00 00 0b df 81 d0 00 00 00 09 70 48 59 73 00 00 2e 23 00 00 2e 23 01 78 a5 3f 76 00 00 01 29 50 4c 54 45 47 70 4c f1 cf 9f 65 3d 1d 4a 2c 15 f7 e9 dd fc f6 ef f5 dd c4 01 01 01 fc f7 f6 05 05 04 f7 de c4 8b 5a 2d 37 23 12 12 0b 07 f7 df bf 2e 1e 10 d3 b8 9a 64 49 2b f6 de c2 c3 99 60 00 00 00 09 0a 09 02 02 02 05 06 05 ff ed bf 0f 0d 0a ff ff ff f2 d1 a4 11 11 13 0a 05 02 ff ff d9 19 13 0a f5 e1 cc f5 de c6 22 19 0d ff ff ce 2a 20 14 fa ee e1 f2 d7 b0 37 28 16 19 19 1a ff ff e2 fb f2 ea f8 e7 d4 43 34 1f ff ff eb ff f6 c9 02 04 14 ff ff f5 8d 60 2e 72 47 1e f6 de bb 75 57 31 51 30 11 60 38 16 52 3f 22 60 4b 2c 46 24 0b fd e5 ac 35 16 05 fb e0 99 d3 b6 7e a4 73 39 8a 7b 5e 16 Data Ascii: PNGIHDRpHYs.#.#x?v)PLTEGpLe=J,Z-7#.dI+`"* 7(C4`.rGuW1Q0`8R?"`K,F$5~s9{^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49902	120.233.179.91	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:41 UTC	366	OUT	GET /jsgif/yf1300-200.js HTTP/1.1 Host: 2024hwus1.heibanwa.mobi Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:42 UTC	573	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:42 GMT Content-Type: application/javascript Content-Length: 535999 Connection: close Server: openresty Last-Modified: Sat, 14 Dec 2024 17:08:23 GMT ETag: "82dbf-6293dfeb2c32a" via: CHN-GDdongguan-CMCC5-CACHE11[8],CHN-GDdongguan-CMCC5-CACHE36[0,TCP_HIT,5],CHN-GDdongguan-GLOBAL1-CACHE20[13],CHN-GDdongguan-GLOBAL1-CACHE79[0,TCP_HIT,1] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: be478423985d0d3fa4ad3f23d3da9101 nginx-hit: 1 Age: 1598590 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:42 UTC	15811	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ca 00 9d 62 fa 96 70 5a 04 be ca ff 01 26 ff ee ac d8 d5 d3 af 8b 66 e7 64 a1 93 6e 9a d6 bb b2 6b 59 55 54 9c 49 da cc fc e3 dd 79 e8 99 1b f9 b2 b5 53 2c 1a dd ba 53 92 5a 29 cf 0c 54 d3 af 97 9e 05 06 fe 01 45 06 4b ae c8 36 85 01 66 01 fb af 95 63 46 2e 6d 8d de d9 cc b9 e7 dd fa 9e eb f8 e8 99 00 ea ff c3 af b2 97 ff aa 10 fd 96 a8 fe 68 70 b8 b2 b3 ee dd 4b ff dd 5e 68 50 91 f5 b5 6a b4 96 8a 01 00 01 d2 b5 fe 95 1e 8e b9 ae fb fb 4d 4c ee ee c7 f9 b6 cf b1 95 fe 65 1d ab fd 81 90 60 db f5 ee cc a6 9c 25 5c d3 02 09 ce 21 22 ff 4e 6e ff ef 98 f5 b3 51 fe 25 49 d0 ae 70 ee 88 1c ee ee dd ff ee ff d1 96 8d 8d 88 80 d0 93 70 ff ee 00 fa 8f 4c 5f 8b 9f 35 2b 2e 77 4b fd f6 4a 2f 17 6a 8d 56 2c 55 a1 95 2b 6c 69 f8 d2 f2 Data Ascii: GIF89abpZ&fdnkYUTIyS,SZ)TEK6fcF.mhpK^hPjMLe`%\!"NnQ%IppL_5+.wKJ/jV,U+li
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: c4 44 5e 1a 1c b2 df d1 b1 d6 60 79 62 6e 24 96 a6 6d 24 b2 b9 21 1f 12 08 ae d1 d0 77 dc 4e d7 09 22 43 b9 a2 69 a4 5c 43 3e da e0 18 e4 20 52 87 4b 7a 9f 6e c9 d1 4c a2 14 3d da a4 d6 f5 8d e8 5d a4 91 71 db 69 66 a6 d9 ad d1 76 52 a2 50 3e 5c 51 b6 0b 56 a6 07 71 3e 8c 8c 1c 4f 8d 80 81 53 66 08 86 bc a7 c3 a0 48 85 f0 cb 85 c4 67 22 f1 1d 28 62 09 11 1c 83 0a 8e 84 04 10 61 32 e8 c2 72 41 80 02 ee 1b 1f 18 80 13 bc 20 bd b1 80 08 34 23 00 29 40 07 7c 0c 84 4e d2 2e dc 00 47 64 c4 0a 98 52 bb d1 65 bb 3d 17 00 39 17 87 f2 60 0a fe 00 89 f2 41 20 28 dc 9a bd 12 77 c2 e4 50 9a e6 4a 46 59 1c 9e 9e 41 32 07 ee 29 e7 8a 26 5d 6a 3e 22 44 ed e6 a4 54 e4 6d 65 da 1c 42 e1 d9 6d 85 3b 60 24 4b 0a d1 aa f4 8d 40 b2 ff 4d 64 34 1f 1b b9 50 65 f5 9a 43 dd 9e a7 Data Ascii: D^`ybn$m$!wN"Ci\C> RKznL=]qifvRP>\QVq>OSfHg"(ba2rA 4#)@\|N.GdRe=9`A (wPJFYA2)&]j>"DTmeBm;`$K@Md4PeC
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: cc 80 05 38 05 d0 00 04 7b 6b c8 96 ec a6 26 48 04 2a 50 49 93 3c 4e 97 aa 82 26 e8 47 ed a1 c9 24 a0 49 27 d2 c7 0d 90 80 88 bb a3 97 00 c3 49 98 84 a8 9a 82 49 f0 b3 39 1a cd 9d 14 ca 29 8c c0 df eb 31 10 dd 98 a4 7c b1 87 9a b1 94 83 cb 7e fa 45 5a 6b a9 a0 2b b6 b0 23 2d 3b bb ca ff 9a 3a ee eb 30 48 4c d1 8b 22 4b 43 02 ad 0e d4 be d3 2a b1 f4 53 bf e4 91 a5 b5 24 d1 fd cb a8 a8 54 c4 9e 63 52 26 8d 3c 3b 1b 88 0e eb b9 cb a2 4b 9f dc a4 cf e9 a6 2c 08 21 18 e2 d2 47 6b 81 47 f3 d2 3a f8 82 39 f8 82 ca 02 d3 2f 45 d3 33 45 d3 2f 15 a1 ba b4 52 c3 3c 84 38 cd cd bf 94 53 3a ad 53 db 64 b4 82 9a 81 2d 55 d3 34 85 a1 47 13 d3 2e e8 53 3f 55 53 30 25 a0 01 a5 c3 74 88 c5 43 18 cc d5 84 04 4e 89 a0 3d 25 54 33 ff 6d 81 3a 78 81 3a c0 54 4c 2d d3 4c ad 83 Data Ascii: 8{k&HPI<N&G$I'II9)1\|~EZk+#-;:0HL"KCS$TcR&<;K,!GkG:9/E3E/R<8S:Sd-U4G.S?US0%tCN=%T3m:x:TL-L
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 0e b8 5c 2c 9a 37 aa e9 9f 03 24 0c 84 40 39 1c 66 49 34 98 a2 d6 35 83 0d 46 60 4a 5a 09 89 46 3b 05 10 0f 88 53 a4 04 16 4c 78 b3 80 f8 17 36 70 10 00 33 27 0a 4b b0 04 35 b0 04 43 80 02 84 b9 75 3b 61 7c f7 c2 07 9a e6 07 38 36 2f 5e b0 00 67 e0 04 5e 40 33 9b 05 11 c7 a0 2c 79 9a 2c 70 53 17 30 74 87 d8 d4 68 56 f0 19 57 e4 1b 83 50 6b 24 60 01 36 04 03 84 fa 00 27 d7 1f 5d 66 0b 14 90 0b be 60 08 45 d0 7b ad c0 3e 1a 70 09 5d 89 03 26 20 07 a9 38 06 3f 80 3e 67 50 06 7c 60 00 3d c0 05 0e 50 aa 65 40 01 66 90 00 72 b0 15 29 14 01 86 21 06 ab d4 04 2c 79 1c 5d c0 9b 0e 26 31 29 a2 6c 31 09 72 85 78 11 c4 f8 14 d4 81 85 c6 e0 00 a5 00 22 fb 31 17 98 e1 19 3b 70 00 55 74 45 c8 a0 1d 44 a9 07 c9 00 6b 2c 21 02 ff 89 b0 8d 87 20 9b cf a1 05 57 30 73 be 16 Data Ascii: \,7$@9fI45F`JZF;SLx6p3'K5Cu;a\|86/^g^@3,y,pS0thVWPk$`6']f`E{>p]& 8?>gP\|`=Pe@fr)!,y]&1)l1rx"1;pUtEDk,! W0s
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 82 ac 47 0a cf ac 7a 38 67 2a 98 84 3a ca 27 00 de 4b 01 ee e0 0f 48 d2 74 1c c4 41 58 c0 ce ec 2c 84 a6 82 d1 00 0d 48 74 a8 52 2d 35 54 35 a4 36 ea 0e c2 cc 20 0f 02 c0 0d ae 60 5b fe ef 3f 17 20 09 89 00 09 40 4d 08 c4 41 34 6e d1 16 6f 35 17 29 05 35 3c a3 2e cb a9 8c 70 e3 37 12 e0 db 90 31 df 6c 6d 19 29 c2 04 e2 43 02 12 29 94 58 12 00 88 60 36 12 21 00 3e ab 7a aa 07 1b 33 ee a3 92 a1 00 28 e4 90 44 60 0e 30 f2 26 16 09 3e d0 4d 3e 5c ac 00 70 86 92 8c 02 7a 44 a0 42 8e f1 06 aa 07 77 7a 4a 19 ef 90 2c ef 35 bd 5e 40 1b a1 27 f0 1c e2 1f 97 e5 dd 2c f5 95 de 43 5c d3 6b 0e 92 51 38 16 b2 03 10 f5 5f e0 88 2a 07 a9 75 e6 a0 22 11 c0 22 b3 ac 0f a6 b5 09 a6 40 63 8f b5 c5 36 0b 3a e4 43 28 b4 40 63 a7 a0 ff 0e 86 60 0a aa c4 20 53 56 8c b4 6c c1 c2 Data Ascii: Gz8g:'KHtAX,HtR-5T56 `[? @MA4no5)5<.p71lm)C)X`6!>z3(D`0&>M>\pzDBwzJ,5^@',C\kQ8_u""@c6:C(@c` SVl
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 7c 54 85 89 3e 58 8c a0 43 1d 29 31 4c 7a 14 44 2e 04 1a c2 48 a2 13 ad 7a 55 ac 1e 8d 0d 79 39 a5 4c b2 ca a2 61 80 91 68 53 eb a2 89 ae a6 a2 2b 36 b1 70 22 98 24 28 f7 f6 b8 c5 51 09 0b 87 34 49 98 18 e7 10 b7 3a 64 86 09 19 9b 4b 08 a2 46 24 b4 71 8d 82 a4 d3 db 04 3b d8 39 b2 f1 b0 8b cd 43 4b a8 14 d5 18 72 a4 ff 91 9f 14 a5 23 43 49 ca 2a 99 24 02 95 3b 6a 4f 6f 56 85 36 80 56 63 f5 ec 65 36 db b9 06 63 78 2a 3f a1 6d 83 cf da d0 b2 87 66 d4 b4 d9 c4 d0 0f b7 e2 3a 95 25 24 80 b3 55 01 53 b4 43 38 0f a5 65 b6 be 0b 5f 56 96 30 5c da b2 50 41 6d 70 94 a9 42 83 4d da 91 e7 a6 de 41 2e 36 a1 6b 5d 4f 95 af 29 77 d1 d8 60 ac 05 3c ae 54 6b 9a 4f 9d 26 54 dc 75 cf 5d 29 45 33 cd c4 4a 5b 88 c9 52 9c 62 4a 67 f3 a5 6f 7d 41 d3 b1 06 e5 97 2b c8 7c 86 be Data Ascii: \|T>XC)1LzD.HzUy9LahS+6p"$(Q4I:dKF$q;9CKr#CI$;jOoV6Vce6cx?mf:%$USC8e_V0\PAmpBMA.6k]O)w`<TkO&Tu])E3J[RbJgo}A+\|
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 0a bd 28 a3 0e 43 13 b9 22 51 25 3b 04 d3 9a f6 d9 12 cb 6a ce 59 2d f1 4a 97 62 63 d0 4f b9 24 b5 c0 08 e2 a5 58 8b 92 da 89 14 2f 90 73 d7 52 d4 45 1c 80 d9 45 b4 bc c5 4a df b0 23 4f 88 30 56 24 bc 22 e8 00 c8 86 50 96 65 c4 a4 b0 6d df 52 1d 74 98 43 58 c7 92 d1 18 da 50 e5 4a c0 3d 3e a3 5f 9b 54 15 6b de 74 08 ff 83 cd d4 90 b8 db 12 0c 73 38 1f 6b ad e4 a1 4e 1d 8d 4d cb 9b 11 32 a1 d1 74 cc 5b aa 5c 36 08 0f 68 88 6c 20 66 ed af 7f 5d b4 32 44 96 ef bf 04 9e 91 72 2b b4 5f b7 2a 78 c1 6e 65 40 04 85 6a 5d 20 91 a6 23 71 8c a1 4d f2 3a d8 67 46 64 1a 87 c5 4d 5d a6 86 61 bc 8a b8 99 6d a4 4e bf e0 a1 11 7e b9 8d b0 7a 75 cd 48 f0 44 11 17 0c 6c 00 6e 0b b1 36 55 70 17 1b b3 f8 24 6e c8 0f f9 3e 12 d0 36 d9 a4 6d 0d 75 0a 51 44 a5 02 ae f4 b6 4f 5b Data Ascii: (C"Q%;jY-JbcO$X/sREEJ#O0V$"PemRtCXPJ=>_Tkts8kNM2t[\6hl f]2Dr+_*xne@j] #qM:gFdM]amN~zuHDln6Up$n>6muQDO[
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 01 22 8c 49 1c 5d 2d 98 45 89 b5 12 27 01 09 88 0e 2b dc 33 5d da c6 96 01 d9 ed df fe 7a 79 3f f9 0d 2f 94 f5 80 68 3e 73 c7 bf c0 cc 20 56 f3 35 f0 81 6d c1 8a e1 24 20 40 19 1c a3 0b 15 32 3c e3 16 77 94 15 9e f0 70 71 07 89 e8 71 b7 9a e5 55 90 7f c8 40 84 3c e4 41 ba f2 9d ad 7f 88 b0 98 2d 41 57 82 18 b9 85 44 ff 8d 8b 61 75 4c 58 94 35 ae 71 70 2b 2c 60 8f f2 53 7a e0 d3 a9 0a 5e e1 ab 8b 4c 82 12 3f 28 42 00 8a b4 16 0a 98 40 01 01 d0 c2 0a f8 40 81 00 14 50 0c 55 c0 ab 99 2a 94 30 aa e2 28 05 1b c8 d9 70 12 e1 1f 50 28 c6 3f 01 90 c0 0a 1a 8a a5 a5 a8 42 01 6d 2e 6b 9a 1d 26 91 14 00 82 ce 80 98 73 0a 2e 61 e5 2b 0b 93 2c 0d 8b f3 d7 ba 6a d3 09 0e fa cf 6d 02 2b c8 c6 3a 37 40 6e f1 90 fe b4 d4 3b 5f d5 c5 f7 78 07 27 c4 79 d6 1b 83 d8 91 56 ed Data Ascii: "I]-E'+3]zy?/h>s V5m$ @2<wpqqU@<A-AWDauLX5qp+,`Sz^L?(B@@PU*0(pP(?Bm.k&s.a+,jm+:7@n;_x'yV
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: 92 10 45 4e 20 97 da b9 8e 2f 77 19 1a 61 22 6e 0a 54 51 c1 2b 90 b6 8c de 26 4d 03 5a 00 4a 1e c8 09 9b bc b1 a4 0f 7b eb 03 24 02 5a 16 25 2c e4 2b 2d a0 c7 e1 56 3b 99 02 44 b4 35 0b 38 05 50 76 d0 8a d0 7c 4b 22 6d 8b 07 42 6c d1 19 de b8 23 c7 2d 40 f3 ce ea 16 d1 25 b9 85 04 94 d0 43 42 5c a3 37 f0 90 06 28 7f ff 83 5b 1c c0 83 38 81 d8 e5 a1 5d 3e ca 44 e3 a9 b9 d0 00 80 6a 53 c9 09 dd 16 ad cd ce 5d 98 ad 65 52 c5 0f 44 b0 80 05 90 4b 02 ec 61 cf 7a 54 a7 03 3c a8 a8 0a 7f 90 c5 08 64 d1 d3 33 fc e1 0c 3f 0d d0 0f 12 c0 3b 02 19 80 0b c1 1b ac 8b be 10 55 ff 59 2f 11 69 a8 89 5c b7 0a 8a 2c 25 21 0f 6f d8 9e 8b 10 10 80 10 95 76 74 66 30 6f 5a a3 5d 15 40 d8 d6 d2 78 ba 76 0c 93 37 3d 3e bd cf 2d 7b b8 01 52 3a 0b 3e 89 34 e1 42 6f 48 c2 95 12 81 Data Ascii: EN /wa"nTQ+&MZJ{$Z%,+-V;D58Pv\|K"mBl#-@%CB\7([8]>DjS]eRDKazT<d3?;UY/i\,%!ovtf0oZ]@xv7=>-{R:>4BoH
2025-01-02 05:12:42 UTC	16384	IN	Data Raw: fd 14 f5 cc d8 8d cd 38 ac 56 92 9d b6 69 2e 6e 25 ac 81 29 81 4a 10 0c 7d b2 2f 35 94 6c 91 d9 0f 1d e4 c1 b6 29 34 6a 6c a0 7d e4 e0 9a c6 c8 76 ba c0 bc 6e 47 23 de db 2a 66 64 0d 7c 4c 85 d3 a0 cc 7b 19 44 a2 51 e3 95 ed b7 0c 07 d8 7c 24 d3 be 1a 8c c0 1b 38 07 f8 6b 15 24 63 e5 d1 6d 4b 3e 63 c1 ef bd 71 ba 14 c9 17 e3 d3 21 e7 c9 fc c7 59 fb 97 ca ef 77 e6 ed 93 8e ec f8 e7 7e 1e e8 80 3e e8 82 5e e8 84 7e e8 86 ff 9e e8 80 1e 71 94 0a 15 a0 c8 a2 a7 f4 6d db 1b 6e 73 0c 6e a6 48 76 5a 90 7c c7 27 6e d2 87 23 28 93 66 07 7e d2 bc c7 cb a2 fe 7b 02 4e 58 31 9c 47 24 63 de 43 8b 32 3b 6b 41 62 ad 64 c3 f4 4a 53 91 e7 72 6d 42 74 4d 42 8b 56 84 a5 eb ae 35 4c e2 36 fc 76 29 de 85 65 d1 d8 01 1b 3a 0b d2 d8 5b b0 05 1b 80 4f 89 d7 1f 4d 5c b0 1e 04 22 Data Ascii: 8Vi.n%)J}/5l)4jl}vnG#*fd\|L{DQ\|$8k$cmK>cq!Yw~>^~qmnsnHvZ\|'n#(f~{NX1G$cC2;kAbdJSrmBtMBV5L6v)e:[OM\"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49891	36.99.2.62	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:42 UTC	387	OUT	GET /video/m3u8/202401/30/a2146fa33ff3/cy1300.js HTTP/1.1 Host: x-hweu2.hccoeutg.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:42 UTC	584	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:42 GMT Content-Type: application/javascript Content-Length: 117813 Connection: close Server: openresty Last-Modified: Mon, 08 Apr 2024 14:28:27 GMT ETag: "1cc35-615969e681fad" via: CHN-HAluoyang-AREACT3-CACHE32[9],CHN-HAluoyang-AREACT3-CACHE6[0,TCP_HIT,3],CHN-HEshijiazhuang-GLOBAL1-CACHE41[20],CHN-HEshijiazhuang-GLOBAL1-CACHE102[0,TCP_HIT,17] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 364619e4fe017c4842acbbc17367793a nginx-hit: 1 Age: 2181572 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:42 UTC	15800	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 d7 04 41 cd a7 96 d3 4e 4f c7 9b 87 6f 55 90 c9 95 75 d8 d8 d9 9c 88 ac b2 9a ca ec 48 30 fb bb 85 62 46 32 aa 79 67 ea 55 69 d8 ac 95 b4 2d 51 bb 96 86 a6 73 59 d8 a7 8c b9 8a 75 f4 7c 00 db 02 3a 16 11 0f 4e 34 28 5c 58 a8 e7 1b 00 ec 4f 08 ff ec e8 90 45 70 ef 67 54 b1 6d 3b f6 97 89 f7 ba 82 20 30 5b ef 79 00 31 24 25 98 73 68 ff c4 8a b9 84 69 87 75 9c 75 56 43 f3 88 77 c9 66 75 d2 57 60 e8 38 22 73 2a 2b 4b 27 19 2c 20 1a b7 ac ac be 79 95 fb c5 bb f3 77 65 e7 24 0a 20 18 14 fd de d8 f7 a3 96 cb c8 c8 e8 2a 12 eb 20 03 cc a2 8d b7 85 aa d4 b4 a7 f7 b4 aa e9 31 1a 51 4d 69 8b 54 3f dd b2 9a a3 8e c3 ac 86 75 e7 ad 7b 95 6a 55 df 3a 2d ad a3 d6 c4 70 87 f9 62 03 b0 2e 12 8e 25 2a ff e4 de b2 45 54 eb 24 08 c7 b9 Data Ascii: GIF89aANOoUuH0bF2ygUi-QsYu\|:N4(\XOEpgTm; 0[y1$%shiuuVCwfuW`8"s+K', ywe$ 1QMiT?u{jU:-pb.%*ET$
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: db 3a a5 20 5b cc 80 45 76 d1 59 d0 c6 3a ed 51 1f 49 6e 25 c7 45 d8 64 6e 0e 48 41 7a 01 26 5b 90 85 8d 44 9c bc bc db 43 c0 e1 72 38 2a e8 9a 53 6f 29 ea a3 c2 2e 78 84 cd e6 b4 c7 23 22 c8 ed 42 cd f8 e6 40 f9 76 04 cc ae 93 c5 25 d2 0c ac e9 11 52 d3 40 19 6f 5d 06 d4 88 41 dd 1e ba 6a 50 8a e9 70 e0 72 e6 00 91 0a 4c 9c e0 a8 26 25 fa 2a 5d aa d3 f1 bc 66 b1 be ff 1d 73 2a c2 30 98 27 fa 28 c1 12 58 70 2e fe 54 00 6b 94 08 68 80 19 fc 08 75 02 1e 9e c5 af 6f 2a 81 19 d8 f3 dc cd 09 de 09 5a bb 72 70 26 ae 14 7a 72 70 07 4f eb 73 16 03 e4 6d f4 46 cb eb 9c 19 55 bb 76 b0 27 2a 70 28 16 2c a6 e8 02 9d 5d 6b 16 e4 ab 28 1a 5a 0a d7 40 f9 cc 09 23 98 c1 c1 56 89 0b 9b 01 0c b3 d4 55 59 f4 ea d1 67 15 b7 8a 2a a8 c3 0d c7 9e a7 d9 ca 0b 04 a4 39 3e 6c af Data Ascii: : [EvY:QIn%EdnHAz&[DCr8So).x#"B@v%R@o]AjPprL&%]fs0'(Xp.TkhuoZrp&zrpOsmFUv'p(,]k(Z@#VUYg9>l
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 56 e7 75 66 e7 76 76 e7 77 86 e7 78 96 e7 79 a6 e7 7a b6 e7 7b c6 e7 7c d6 e7 7d e6 e7 7e f6 e7 7f 06 e8 80 16 e8 81 46 67 53 02 e6 61 46 e8 84 c6 d8 62 ee ba 28 d4 04 65 e6 c2 c4 08 63 5e 35 00 1c 88 06 f6 9d e6 80 c5 e0 08 c8 e6 09 80 80 e4 9d df 5b 3e 8d 2e b0 e4 d2 3d 05 04 40 80 53 80 87 6c 18 82 96 76 e9 97 86 e9 98 96 e9 99 a6 e9 9a b6 e9 9b c6 e9 9c d6 e9 9d ff e6 e9 9e f6 e9 9f 06 ea a0 16 ea a1 26 ea a2 36 ea a3 46 ea a4 56 ea a5 66 ea a6 76 6a 98 ce 86 7b 40 69 04 00 52 4f 56 e8 ab 86 b9 2f d5 4e ac 66 68 17 8d 06 28 d0 84 c1 6d 5c 89 ce 61 c4 20 85 68 88 66 a8 cb e8 a7 f4 66 38 20 de cb 4d 56 90 4e 54 b7 c6 3a 06 18 e9 92 16 5d 94 86 87 03 48 85 7e 08 86 60 38 87 c0 16 ec c1 26 ec c2 36 ec c3 46 ec c4 56 ec c5 66 ec c6 76 ec c7 86 ec c8 96 ec Data Ascii: Vufvvwxyz{\|}~FgSaFb(ec^5[>.=@Slv&6FVfvj{@iROV/Nfh(m\a hff8 MVNT:]H~`8&6FVfv
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 0e 42 c7 67 8c 37 26 fa 65 7d bc af 5f 16 0f 01 8a 33 84 1c 13 87 9c c8 91 c4 28 b9 f0 05 78 30 78 9b 00 05 a0 d5 a3 8a 97 bd 98 9c c9 88 97 a4 97 d7 c9 e0 8b 12 a0 5c 4a a5 34 4a 30 f0 09 a8 0c 09 ed bb 4a 29 6b 04 f3 c0 b2 b1 5c d6 31 31 cb b8 74 bf 90 a1 15 67 0b ab 6e 8d b6 b6 72 8a 57 20 a9 09 55 01 db c3 9d be fc 2b 95 11 cc c8 93 1e 84 e1 62 16 58 cc 43 cb 9b ff 3f 21 9a ca 8c b4 08 18 c1 e0 fc 8a 2b f5 8f 94 fa 1b e8 a7 c1 c2 a3 52 fb eb b5 df 4c 6f 59 a1 c4 9a ad d9 8f 7d b4 fa 17 b8 b5 99 1f c6 99 4f f2 7c 4f b7 57 43 81 aa 7b a7 2d 1d d2 f9 cf d5 f9 99 e7 31 d0 f9 43 6e df e5 72 09 9d ce ad c1 d0 2f e1 d0 d4 4a 36 5d 50 47 18 e9 0f f5 ca 36 17 20 9f 4c 44 35 3a b7 ae 25 5d 46 f1 30 86 44 23 22 ab f0 c7 0d 12 0f fe 60 04 60 d4 b8 e3 5a 65 e5 4a Data Ascii: Bg7&e}_3(x0x\J4J0J)k\11tgnrW U+bXC?!+RLoY}O\|OWC{-1Cnr/J6]PG6 LD5:%]F0D#"``ZeJ
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 95 b0 a4 06 77 64 c8 89 b0 44 53 9b 8c 29 78 4c c8 8c 4c c9 9c cc c7 5c 45 0a a0 4c cc cc 4c cc 6c 17 54 94 8b 78 99 97 31 12 23 d1 22 2d cd 6a 3d ca 22 45 56 2c ac 53 e4 35 9b 50 c5 d4 2c 2c 57 4c 23 58 94 46 eb 50 07 43 38 81 0b 60 0d 40 ba 45 43 22 3e df f4 99 5e 54 a4 ff 09 a0 be 01 28 2e 08 e0 ad 09 28 4e 6f 63 c6 1d 90 80 01 30 01 66 6c 46 06 f0 03 75 a0 4d 63 2b 20 1a ca 4e ed dc ce ec fc 3c 70 dc 42 f7 23 47 6a a8 0f 3c 44 2f 75 3c 3a 8f d0 c3 11 6c 8f 18 b8 10 10 d9 82 ac 0c 8f f0 d9 bf ab ec 0e 5b 28 b0 83 f0 81 12 0a 12 01 28 09 98 61 3b 82 13 31 14 f3 21 73 7a a6 01 63 13 02 f5 a1 b5 64 9c 32 b4 b2 0b 72 a6 93 3b c9 89 c4 38 b0 c1 bf 8b cc cf 58 5a 3f 6c 29 07 0e 2d 07 24 88 01 33 6c 93 91 ac 2f 4c 01 c2 16 54 b9 0e 4d 51 0e ad c8 24 d0 81 79 Data Ascii: wdDS)xLL\ELLlTx1#"-j="EV,S5P,,WL#XFPC8`@EC">^T(.(Noc0flFuMc+ N<pB#Gj<D/u<:l[((a;1!szcd2r;8XZ?l)-$3l/LTMQ$y
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 93 03 52 e0 05 b5 28 7b 1d 92 03 3f 30 1a 16 75 51 e7 f3 04 3f 40 4b 83 f3 8b 4b 11 8c c1 e7 74 82 c9 3c 2b a0 03 69 a3 8c 34 c5 7a 89 73 67 77 96 67 38 45 8d e6 21 77 f6 41 1c e1 81 0e 7d 59 68 a4 a4 5f 9c c7 39 46 75 8e f9 d4 68 ed b3 8e 8d 80 2b bd 72 06 54 10 07 c4 d6 ff 2a 03 d9 92 78 42 01 64 c0 57 21 00 04 1e 90 2b f7 53 80 3c 94 90 b8 16 7d 98 32 2c d0 e0 08 7a d2 05 12 49 2b ab 32 8f d2 72 29 bd 12 0a 1e 70 56 69 25 90 e7 67 04 ea 37 91 28 c4 8e 0f c9 a1 bd e2 a1 60 d0 07 f7 97 7f fc 77 6c ca 47 05 d0 c0 a0 22 50 69 7d 10 07 3b 14 a3 2a 39 7d 49 4a 8f 53 a5 a4 4d 9a 29 2f 79 44 31 29 93 f3 30 81 c6 00 45 28 e0 02 17 d8 09 24 30 46 58 64 5a 5c 54 0d f9 90 0f 58 d4 6e 1c c8 05 04 61 94 fc e6 00 92 00 0c 26 20 10 b1 75 11 48 59 0b 70 f4 30 52 e9 07 Data Ascii: R({?0uQ?@KKt<+i4zsgwg8E!wA}Yh_9Fuh+rTxBdW!+S<}2,zI+2r)pVi%g7(`wlG"Pi};9}IJSM)/yD1)0E($0FXdZ\TXna& uHYp0R
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: d9 32 53 46 ab 18 6d 91 e4 de 27 01 9f 11 02 25 30 92 76 c0 1a 33 27 31 a3 05 e7 0a d3 44 7f 8b ce be 11 9a 2c c2 3c 92 e5 5b 26 c0 ce 2a 13 3f be 0c 28 32 d3 10 ac 8b 1d 8d a1 33 39 cd d1 88 13 f1 44 93 ed f0 d0 37 29 e1 f4 d4 e2 3a 83 f4 f0 64 73 d4 8a d4 0b 45 8f d4 f0 ff ca 02 f6 b0 39 bf a1 d4 c2 0d f4 96 94 1e 27 32 f0 98 13 d2 ae 30 4c a3 b0 f0 ae 80 10 de f1 49 8d 53 24 49 f3 d3 c4 10 37 7f 01 d8 cc 70 3f e5 eb 49 27 cf 48 5c e0 23 99 ad 4d 7f c1 0d e9 50 20 bb 13 10 bf b3 f9 fa 2d 11 47 4d 3c 69 8f 3c 09 35 78 de 13 3f d3 13 d9 3e c3 50 5b 8f b2 9a cf 05 47 ed 05 00 95 51 31 35 53 8b ef f8 66 d3 e0 fa 13 ae ae f2 78 02 54 40 51 84 2b 1b e4 9b 94 11 33 6e 31 51 d7 72 41 11 f4 35 70 51 88 c6 00 12 68 15 12 50 60 2e 13 6e 0c 50 a0 56 21 41 18 e9 6f Data Ascii: 2SFm'%0v3'1D,<[&*?(239D7):dsE9'20LIS$I7p?I'H\#MP -GM<i<5x?>P[GQ15SfxT@Q+3n1QrA5pQhP`.nPV!Ao
2025-01-02 05:12:43 UTC	3709	IN	Data Raw: f1 c1 e2 65 c9 e2 54 e4 c4 2a 10 d2 2d 5e 66 17 dc 82 10 bd da 73 a1 40 f2 fd c7 e2 74 81 ba c4 8c 05 e0 5e 24 79 12 24 5c 47 6a 0a 5a 7c 74 81 2b d4 62 30 0a 67 f3 d1 a6 35 2e db 6f 76 92 36 56 df 6e 72 5f 6f 2a d7 9b ba d6 38 ee 07 71 ae a7 8c 90 43 20 e0 02 33 85 9b 72 ff 3e 42 fa a1 4e 73 9e 9b 91 60 81 bb 8d 82 f4 68 42 2e 04 80 03 9c 57 36 ad aa bd ed 23 93 88 09 be 15 c0 04 e8 1b 40 f2 1f 3b 65 4d 26 7c 53 34 70 02 27 10 20 a5 ca 08 02 0c 0a 60 02 dd 43 ba 62 42 ad a8 81 95 d5 7e ae 28 b3 06 1d a5 54 a8 41 f5 27 41 39 24 0b 5d 1c 6b 38 c5 44 9c 0a 4c fa dc 51 b1 01 8e c6 96 83 16 1d 70 ad 84 4f 48 ab 55 1a d0 4d a8 e8 88 b2 a9 ba 22 dd 15 98 1e 04 e5 c4 0a 21 4a 0e 11 18 0b 22 dd 50 d1 45 4d 01 e8 b7 c6 d6 57 3a 26 a3 f8 65 22 c2 9d 8f 9e 25 51 d0 Data Ascii: eT-^fs@t^$y$\GjZ\|t+b0g5.ov6Vnr_o8qC 3r>BNs`hB.W6#@;eM&\|S4p' `CbB~(TA'A9$]k8DLQpOHUM"!J"PEMW:&e"%Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49905	123.6.18.47	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:42 UTC	376	OUT	GET /b38048b5589bcfb538c627481211202f.gif HTTP/1.1 Host: ylg1.duyunfk.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:44 UTC	414	IN	HTTP/1.1 200 OK Server: NgxFence Date: Thu, 02 Jan 2025 05:12:43 GMT Content-Type: image/gif Content-Length: 47056 Connection: close Last-Modified: Sat, 19 Oct 2024 09:07:13 GMT Vary: Accept-Encoding ETag: "671376c1-b7d0" Expires: Wed, 11 Dec 2024 13:50:56 GMT Cache-Control: max-age=2592000 X-Cache: HIT Strict-Transport-Security: max-age=31536000; includeSubdomains; preload Accept-Ranges: bytes
2025-01-02 05:12:44 UTC	15970	IN	Data Raw: 47 49 46 38 39 61 96 00 96 00 f7 85 00 d7 15 27 b6 b3 ad 6c 6d 2c 96 18 13 42 42 43 b3 a8 92 06 09 0e 94 90 8a 75 73 69 8d 86 75 f0 af 0e 6f 6c 4f 62 27 24 dd 72 38 8c 8c 4e db 45 29 48 4c 13 08 25 26 cd bb af b3 8b 37 dd 31 24 2b 2e 0b a9 9b 8a 33 33 24 fd ed d9 32 46 16 55 56 22 45 45 36 0d 13 25 45 45 23 54 54 54 ea 13 28 dc db d7 56 56 35 e6 6b 19 dc 36 33 55 53 47 5e 64 2a dc 8d 16 d7 02 32 df 74 19 eb 31 26 ce 00 32 76 4c 2d a2 96 75 47 54 21 28 32 25 13 23 12 5e 5a 51 dc 12 2f 24 32 33 4b 4a 48 a0 a2 9a e3 59 1f 39 42 42 49 52 36 ce 01 23 21 16 12 de 52 21 54 48 24 d6 63 5a 78 77 7f df a2 13 eb 21 2a 62 63 50 4a 52 46 53 4a 36 9b 9b 9e e7 bf 0b b5 3c 34 18 18 1d 63 61 67 29 29 29 31 31 31 20 21 20 d6 21 29 de 29 29 39 39 3a d6 29 29 3a 39 2f 29 29 Data Ascii: GIF89a'lm,BBCusiuolOb'$r8NE)HL%&71$+.33$2FUV"EE6%EE#TTT(VV5k63USG^d2t1&2vL-uGT!(2%#^ZQ/$23KJHY9BBIR6#!R!TH$cZxw!bcPJRFSJ6<4cag)))111 ! !)))99:)):9/))
2025-01-02 05:12:44 UTC	68	IN	Data Raw: af 3c 84 14 f7 55 b0 b7 fd f2 89 47 1a d4 35 a7 88 4f 6e 9e 73 85 4c 24 98 33 ef f9 45 92 22 74 d0 04 bd e8 c1 ed 10 d2 87 9e c8 a5 27 c4 95 4e 07 1d 41 2a 1d 75 d2 0e 04 ea 55 cf ba d6 b7 ce f5 ae 7b fd Data Ascii: <UG5OnsL$3E"t'NA*uU{
2025-01-02 05:12:44 UTC	16384	IN	Data Raw: eb 02 67 00 d8 13 a2 87 9c 11 49 a5 4c 48 7b 0a 52 80 3a 29 b8 fd ed a5 a2 80 da df 3e f7 ba db 3d 06 78 cf fb dd ef 9e 77 f1 cc 5d ef 69 ff 92 dc a5 70 02 bd 03 60 f0 76 1f 7c e1 d5 fe 80 07 d0 1d f1 8a c7 7b e3 1f 20 10 2d 48 5e ed 02 d9 7b e2 1f 9f 78 05 10 c2 f3 9f 0f fc 88 e4 5e 78 11 1c e2 f4 87 80 3c df 45 a0 00 43 b8 1e 11 ae 57 00 0a 38 5f 7a 22 bc 3e f6 b3 5f bc e6 77 bf f9 b4 e3 bd 10 c0 0f be ef 09 e4 fb 13 50 40 01 c1 07 fe 03 74 9f 78 43 24 1f f6 88 10 fe e5 8d ef fc e7 27 bf 06 cc e7 bd f6 eb 7e fb 42 24 02 ee 7e 67 42 ff e9 81 df 7d 0a 64 df f7 26 20 ff ed 5d 9f 08 d8 ff 9d 02 ea 5f ff eb 0b 21 82 f3 6f 5f fb d1 bf fd f0 c7 73 f8 f6 43 5f ff 96 97 78 f1 37 7f ea e7 04 06 98 76 03 18 7c dd 57 08 e6 a7 7a f7 e7 80 be 67 7d e2 47 01 04 a2 05 Data Ascii: gILH{R:)>=xw]ip`v\|{ -H^{x^x<ECW8_z">_wP@txC$'~B$~gB}d& ]_!o_sC_x7v\|Wzg}G
2025-01-02 05:12:44 UTC	14634	IN	Data Raw: 57 20 6d 00 bf 9f bc cb 40 3a bd b7 ea 31 bd 07 53 b5 d3 50 2d 15 55 d4 13 5d 84 96 40 e6 18 61 85 c3 00 0c 10 9d 0c 0b ca 0d ab 7c df 14 3d 6c 05 55 01 27 51 4e fb 65 f0 15 99 a5 c9 32 7a 50 04 ce 6c 07 25 bb 1d 10 36 99 b3 53 42 d7 6c 78 2e e5 3e 4b c7 cd 59 90 1d 4c 94 02 03 31 08 05 31 00 0c b0 9b 31 35 64 16 1b 4d d1 a4 74 83 9b c7 59 32 53 16 1c 3a 29 70 d0 0a b1 02 72 c4 52 a4 17 aa c3 16 d0 bb c2 44 19 71 07 14 7d d0 4e 30 02 6d 50 04 45 c0 08 1c cd 08 48 97 cd 2b 16 32 c7 7a a6 3a 54 d0 12 cd 10 00 f0 03 2a bd d2 2c 9d 1c 19 fd d2 1a 5d 04 2b 30 d3 34 ff bd 02 3b f0 04 0c 10 99 72 57 12 c6 70 d2 4a d4 42 ca 91 1c 2d 3d d4 2d fd d3 7a 34 02 34 71 0a 4a bd d4 c0 01 d4 4b 0d 1e 50 0d d5 41 2d 0c 54 5d d5 47 7d d5 17 ad 47 7e b0 d5 5c cd 14 c9 61 d5 Data Ascii: W m@:1SP-U]@a\|=lU'QNe2zPl%6SBlx.>KYL1115dMtY2S:)prRDq}N0mPEH+2z:T*,]+04;rWpJB-=-z44qJKPA-T]G}G~\a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49893	175.6.201.25	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:43 UTC	377	OUT	GET /jiamigif/168sc/168-200x200-2.gif HTTP/1.1 Host: www12.pengxunfei.site Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:43 UTC	581	IN	HTTP/1.1 200 OK Server: Byte-nginx Content-Type: image/gif Content-Length: 308156 Connection: close Accept-Ranges: bytes Age: 147 Cache-Control: max-age=2592000 Etag: "67555191-4b3bc" Expires: Sat, 01 Feb 2025 05:10:16 GMT Last-Modified: Sun, 08 Dec 2024 07:58:09 GMT Via: cache40.yzmp,cache07.hyct X-Bdcdn-Cache-Status: TCP_HIT X-Request-Id: 3ffc77ef13ed0dd2f8b5ab1cdaf4e4f9 X-Request-Ip: 8.46.123.189 X-Response-Cache: edge_hit X-Response-Cinfo: 8.46.123.189 X-Tt-Trace-Tag: id=5 Date: Thu, 02 Jan 2025 05:12:43 GMT Strict-Transport-Security: max-age=66666
2025-01-02 05:12:43 UTC	15803	IN	Data Raw: 47 49 46 38 39 61 c8 00 c8 00 f7 ff 00 53 2a 07 95 12 12 99 00 ff fe f4 b7 f6 d9 6e dc a1 fd 56 b2 f4 f8 b4 90 a3 da f6 fc b2 b1 68 66 54 54 53 46 fb d3 aa f8 d4 4e fd fb d1 f8 b2 06 fd 93 92 ef 8b 77 d4 b5 4c fe d5 01 16 5f a0 61 9b a0 dd 01 5a 8c 8a 70 f6 d6 91 f9 8e 06 14 55 db fa 29 2a fe ef 70 76 76 65 64 8f 71 d2 d6 d5 5c 67 a8 21 54 5c 6e 4c 04 67 d3 ef b3 b3 b2 fb b3 2d b8 4d f7 d5 91 6f d5 b2 2d f2 d5 ff b3 b0 90 90 6d 04 b2 91 6d a5 dc ae 8d 70 4b b1 92 4c d6 d1 91 46 44 38 b4 8e 05 d3 b5 6d b4 ae 70 90 6e 2c f3 67 50 b9 01 b1 d5 d3 b2 d3 b4 8f dc 44 45 b3 91 2c 95 95 8c f7 d0 2d f9 6f 06 05 21 63 fb b6 4a da cf 6e d6 ad 07 da 11 24 f5 b3 6e 8c 53 9c b2 70 4d ff f7 4a ca 76 f7 ad 2a fb 6d 4e 28 93 8c 4e 03 aa ff d3 69 a7 29 ac fb 29 22 0b cf ee Data Ascii: GIF89aSnVhfTTSFNwL_aZpU)pvvedq\g!T\nLg-Mo-mmpKLFD8mpn,gPDE,-o!cJn$nSpMJv*mN(Ni))"
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: dd d7 31 44 ff f6 53 f4 12 b2 fd ca ea fe d8 9d 35 78 32 43 64 6f 00 a7 f0 00 53 71 14 5b 32 2e 57 b2 2e e7 72 f8 62 32 e3 16 ae 3c 3c f2 ef 3e ae 19 c8 ca ff aa 71 b6 76 ae 08 8b 5a 21 07 86 22 8b 32 fa 0a a0 2c b8 6c 00 ff 2e b5 06 f3 1b db 32 2f ef f2 25 6f b3 37 eb b2 2f 2b f0 1d 07 33 b5 fe 6e 2a 08 83 30 a4 c2 15 bb 2c 3a d7 c6 2e 08 49 34 5b 6e e8 fe ff ed 2e d4 b3 2c cf 32 0a ab b3 35 3f 32 24 73 af 2d df 32 37 7f 33 14 07 34 41 0b b4 01 63 f2 06 1c ee 02 df 31 f9 ce 2c 39 f3 33 44 47 34 44 33 34 43 f7 72 38 17 34 46 1b 74 46 6f b4 41 0f f4 0a 5f 34 48 87 b4 2f 2b 6e 47 73 b4 49 97 34 4a 9f b4 4a a7 34 4b af f4 1c bb 74 4b c7 34 4c cf b4 4c f3 72 4d d3 34 4e df b4 4e e3 74 4e f7 f4 4e ff b4 4f 07 34 50 0f 75 50 13 b5 51 77 73 51 27 f5 51 2f 75 4e Data Ascii: 1DS5x2CdoSq[2.W.rb2<<>qvZ!"2,l.2/%o7/+3n*0,:.I4[n.,25?2$s-2734Ac1,93DG4D34Cr84FtFoA_4H/+nGsI4JJ4KtK4LLrM4NNtNNO4PuPQwsQ'Q/uN
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: b2 d5 c7 7f 74 df 72 24 20 90 5c ff 4f eb 84 de 01 d2 45 80 99 9d 86 c4 60 f5 bd cd 1e 31 60 05 8e d4 9b 61 a0 fd 74 61 9b bd 19 10 c2 9f 10 5e 05 7f 08 43 7f b8 14 ce ac e1 09 ea 86 08 0a 9b d3 b8 4c 16 fa 20 1c b6 a0 0d 2e 8e 15 d2 c5 7b 3d e1 db 65 88 16 d2 a1 17 ae 10 18 0a a2 9f 00 e1 f5 e1 4c 0c d9 d9 fc a1 43 11 16 a1 26 b1 d3 9b 6c e1 e1 6c 08 cb 9c 9d f7 f9 a1 9d 05 c7 db 58 cf 3e a5 1d 0d be 1d 89 35 21 26 be 0c 75 79 21 87 00 a2 04 fa 60 06 5e 94 4b 81 dc f6 64 17 1a 36 22 ce 2c 58 80 ad 60 f5 61 62 15 5a 22 0f f2 a0 9d a1 9d 4f 68 8b 0b e6 21 28 32 60 b5 10 63 29 fe 60 9e 1c 23 32 1e 23 05 b2 62 2b de d9 6d 68 52 7a 38 e2 12 c2 0c ae fd a0 25 56 53 33 06 e3 31 36 1f 4f d8 d8 17 8e a1 f4 8d 14 2f 8a c8 41 f1 09 6c 5c 23 75 8d 61 2a 32 e3 0e c2 Data Ascii: tr$ \OE`1`ata^CL .{=eLC&llX>5!&uy!`^Kd6",X`abZ"Oh!(2`c)`#2#b+mhRz8%VS316O/Al\#ua*2
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 12 96 61 c0 2b 35 bf 5c ee 4b f3 7e 3a 30 11 00 73 3d 30 bc 30 6e 44 1f 65 24 eb fa 68 19 c1 4e 3b 47 cc 9b 34 98 4b 8b 2d 07 7d f4 29 4f 6f bd f5 d8 f3 32 ff fc bf d8 5f c7 1e dd 2b 61 ff 6d 84 df 91 bf e1 ed da 27 c0 98 bc 2f 7e d7 a3 5f fd ec a7 c0 5f f4 a2 17 a1 c8 5f 1f f6 a7 39 59 18 82 76 37 79 05 b8 c4 56 9e 01 1e 8e 77 d5 c3 5e f6 10 b8 40 fb 35 b0 84 0d d4 01 0a 75 10 85 28 fc 03 00 c2 38 cd 29 50 b3 21 9a a4 8f 83 b9 9b 1e 08 11 c8 8b 11 92 d0 84 bd 48 21 10 8f 81 42 71 c8 23 0a f2 90 c3 3f 84 61 06 0b 59 a3 89 1a ec 90 0d 49 47 3d 03 86 90 7e 3c 64 a0 0f 81 a8 45 14 de a2 8b 5e ec 22 11 57 92 8a e4 50 70 7d 51 94 22 f5 e4 a7 43 1e fa f0 87 5b 4c e1 2d 74 f0 c5 39 7a 71 03 5d 5c 89 34 ce 68 c3 de 51 71 8d 6c cc e2 1b e1 48 c7 41 de e2 1f c8 d0 Data Ascii: a+5\K~:0s=00nDe$hN;G4K-})Oo2_+am'/~___9Yv7yVw^@5u(8)P!H!Bq#?aYIG=~<dE^"WPp}Q"C[L-t9zq]\4hQqlHA
2025-01-02 05:12:43 UTC	16384	IN	Data Raw: 7a d1 85 aa fc e1 07 8c 04 0c 90 40 3c c1 d5 cc 2d 48 f6 e1 55 a9 5c 40 4e 68 48 cf 45 03 24 d9 84 52 74 03 0c 70 81 cd 60 de da f1 c0 5d c5 94 2d f0 47 37 4c 03 f3 e0 06 f2 bd 82 2e a4 c8 2e bc c3 2e 80 62 34 dd 02 36 8a 83 3c 00 00 00 c4 97 21 54 57 9a e5 61 7a 7d 46 41 c4 0d b9 40 05 b9 70 c1 6f 90 90 02 a8 23 0f 78 17 b9 7c 81 7f 98 de c1 a1 20 99 b1 ff 97 68 c4 1e 51 c8 84 aa 40 21 ae cc 44 74 0d ce 7e 90 e3 71 b0 09 42 b8 59 4d 58 e3 e2 60 23 43 66 a3 3c 44 01 00 e8 82 75 55 99 b0 11 64 88 f0 98 82 95 d4 b9 81 8d aa 7d c9 ba 91 19 a2 5d c6 d6 25 07 86 1d c4 cd 68 d0 71 78 22 c7 d9 9b 42 32 4e 43 be e4 2d e8 80 0e 88 83 1f c8 81 12 bc da 38 72 4c 7a 95 5b 8e 49 58 69 fd 9b b3 f1 1d a2 a1 12 fd 95 99 fc 09 4b 4a 4a 11 4b da c5 52 b6 24 76 c0 64 4c ca Data Ascii: z@<-HU\@NhHE$Rtp`]-G7L...b46<!TWaz}FA@po#x\| hQ@!Dt~qBYMX`#Cf<DuUd}]%hqx"B2NC-8rLz[IXiKJJKR$vdL
2025-01-02 05:12:44 UTC	16384	IN	Data Raw: b8 f8 cd ef ff 7e 53 ac 83 63 f4 42 07 bd 08 c5 1e 60 bc 07 23 d8 ab 0c 21 9a 4d 1d 8b 4a ce 55 c2 04 9d 1d 85 f0 73 6a 89 cb ce c8 82 a0 04 65 e2 3f 8c 86 56 63 82 58 7c 22 0e 6e 7d 81 78 e2 29 ab b8 ca bd b8 32 96 db f2 8b 5f f0 82 17 6b f8 32 98 59 e0 06 17 7c a1 cc 66 fe 02 1b bf d0 81 fb 18 98 a3 10 66 9e 9c 6c 61 c5 39 0b 23 06 68 6d 26 00 e0 22 8f 7f 88 03 b3 1f 5e c9 2d d4 f2 e1 27 13 7a be 86 2e b4 3e a3 4c 5c 13 23 77 ca 97 ad b2 8a b1 2c 69 2d 77 b9 d2 c0 b8 74 04 32 ad e9 4d 6f 1a cc 9e 5e 83 1b d6 60 84 51 8f 7a 0f a6 3e 35 aa fd b0 07 3f f4 97 bf e2 d8 af a3 fd 6c 5c e3 fe 63 d0 b5 86 69 ad 73 dd 64 24 21 7a d1 52 8e 75 72 21 9d 62 49 5f 19 2e 5c b6 f4 a5 81 c1 e9 65 33 3b 02 c9 ae 74 97 b7 2c ed 5f 10 bb 17 c7 38 c6 8a 53 fc 68 60 07 3a d0 Data Ascii: ~ScB`#!MJUsje?VcX\|"n}x)2_k2Y\|ffla9#hm&"^-'z.>L\#w,i-wt2Mo^`Qz>5?l\cisd$!zRur!bI_.\e3;t,_8Sh`:
2025-01-02 05:12:44 UTC	16384	IN	Data Raw: 71 ca 0e 70 d0 19 1c 0e c2 29 71 c0 b6 cf 99 f1 03 1c 50 20 68 1c 93 e9 83 2d 59 83 04 c0 70 82 fd b2 c4 83 1f 14 c9 15 24 20 81 2b ec 21 93 bd 08 85 45 fc ff 20 20 38 94 40 67 88 d0 01 53 34 0d b6 aa fc c3 0f 88 d0 59 ad 11 91 dc b8 71 e5 1a d7 38 cb bd cd a2 87 b2 74 c5 de d4 11 c7 35 c4 e5 5d 8f d4 2b 3b b3 46 c8 a9 4e cc 47 85 24 3c 81 a7 22 f6 d0 8c 1d a0 28 44 c1 c6 78 05 89 5e 79 31 49 97 a0 46 d1 ba 95 4d 1d 74 22 72 6f 07 c5 22 72 a0 b8 65 28 fe 0f 79 24 18 7d 03 7f 39 cc 61 4d 29 97 26 fc 54 73 5e 38 94 6a ee 10 3e 4b bc e4 8d bb 38 c6 73 eb ec 97 74 7c 4d 3e 6e 26 6d 42 be 87 50 68 51 37 98 f1 83 45 e4 21 07 fa 89 a3 e5 17 2d 9d 0d 9f f3 ea 98 73 3d 2d b1 a6 f3 61 0e b3 eb 27 81 ad ea 55 c7 8f b1 33 23 94 50 28 0b e8 06 d3 78 f5 d2 54 c5 8f 53 Data Ascii: qp)qP h-Yp$ +!E 8@gS4Yq8t5]+;FNG$<"(Dx^y1IFMt"ro"re(y$}9aM)&Ts^8j>K8st\|M>n&mBPhQ7E!-s=-a'U3#P(xTS
2025-01-02 05:12:44 UTC	16384	IN	Data Raw: 9e 34 46 81 4c 26 6f d8 f1 a6 07 14 fc 88 c2 8f 1a 6d 68 80 5a 6a 1b e0 85 97 35 c0 38 c2 b3 20 bf 0d 8a be 08 fa 20 17 3f 3a a4 c8 40 8a 78 df 85 23 83 0c e0 30 90 52 a7 64 18 55 41 7a 7b 4e 08 ba 30 5a cd f7 22 0e ed d0 d9 8e 09 31 da 30 4d 5b e1 80 43 0a 38 10 39 38 80 60 13 56 ff 38 4d 79 fc 78 ba 04 ae a5 40 c4 e2 8b 05 85 29 a9 d2 8c a8 e3 e3 8f d7 b8 e2 47 a3 d6 70 fb ed 35 46 53 79 65 ba c9 4d ab 6e a6 1a 1c cb 4b 8b dc 75 70 68 bb fe 65 5a 4c ea 90 11 7c f0 c1 a5 b1 7a 31 71 e4 59 58 1c c8 c5 89 62 72 3f a0 ad 31 b3 9a f6 d0 bc 8e 35 78 f9 6c 0d 23 e2 8e 00 6e d2 dd 26 12 6f d4 53 af 1b 55 d6 eb 4a ab 5f 57 0d 4f fc 22 bb 64 47 9c 6a c5 17 d7 d3 a4 c6 a3 90 e7 62 3f 82 77 69 d0 a4 42 a9 e3 f8 e3 dd f6 1c 18 b7 89 2a 9d f4 08 8a 54 7d 7a ea f3 0e Data Ascii: 4FL&omhZj58 ?:@x#0RdUAz{N0Z"10M[C898`V8Myx@)Gp5FSyeMnKupheZL\|z1qYXbr?15xl#n&oSUJ_WO"dGjb?wiB*T}z
2025-01-02 05:12:44 UTC	16384	IN	Data Raw: 89 00 a3 36 4c 0e 74 80 f6 5c c0 39 20 b9 0a 28 c0 01 2c 00 0d b8 80 0a e4 c0 1a f4 42 14 98 dc 2d c8 83 1c 18 01 0f 68 cd d6 1c 85 d7 d4 76 33 b9 81 eb 82 39 7e 3f b6 4a 8f f9 4a 9f c1 3a e7 40 02 24 80 18 70 64 1f 5c 51 9b ef 41 1d 7c 81 12 ab 84 3a 2c 40 21 dc d7 ae 88 42 19 2c 8e 2d 48 85 50 4b ff 85 34 fa 39 bd bb 89 3c 30 80 48 18 81 7b c9 03 00 cc 01 0d 1c 00 06 7c d1 35 33 c0 5b 32 c0 0b 84 6f e5 7c 43 0e 44 46 10 f4 33 ac 2b 81 a7 b8 c1 1c 30 62 ae 88 80 1e 58 fc a5 4b 65 55 56 41 10 a0 00 10 ec 80 1c 34 40 09 54 03 07 58 82 08 9c bc 08 b8 c0 6d 0f 80 92 2f 3c 03 2c c1 01 c0 00 d2 c1 4a 0e 5c 00 00 dc 02 ce 1b 03 06 c8 01 37 86 c3 14 90 0e 53 84 8f 13 38 41 22 58 b4 1b b8 81 0b 74 b9 97 4f bb 2c 7b 9c 46 bf 72 87 25 40 32 94 c3 8b 18 41 b8 5b fd Data Ascii: 6Lt\9 (,B-hv39~?JJ:@$pd\QA\|:,@!B,-HPK49<0H{\|53[2o\|CDF3+0bXKeUVA4@TXm/<,J\7S8A"XtO,{Fr%@2A[
2025-01-02 05:12:44 UTC	16384	IN	Data Raw: 10 08 0a 50 36 10 58 50 c0 0b e6 00 00 43 24 42 10 1a fd 44 ca d0 61 36 42 6c 34 2a 9b 98 d2 15 58 a3 1a 29 9e a0 0e 57 c8 01 19 72 09 0b 5c f4 22 01 c8 09 89 18 48 01 53 0c c2 23 1a bc 05 44 2e 5a 19 92 9d 4e a1 00 36 9d 60 34 7e e9 cb 86 e5 62 24 fc b1 69 39 02 05 da 70 84 40 03 4f d5 0a 24 78 90 11 5b 7c 00 52 20 1b 19 39 45 76 a0 71 9c cc 16 e1 60 44 54 bc b0 51 45 10 02 00 00 a8 c1 15 22 30 af 63 f4 e6 04 2c f0 40 38 32 73 81 bb aa 41 02 34 c0 c3 25 2a 20 e0 0a cc 2d 11 64 1c 01 24 54 e0 d0 19 d0 b1 1a 03 a8 06 06 68 55 8c c6 e2 61 8c 81 98 2c 66 1c 11 82 1d c8 2f 06 e1 58 80 0b 08 41 08 17 74 20 1c c2 70 81 ff 11 8a b0 d1 15 0b e0 13 23 b6 1f 45 fa 67 04 37 48 e2 b6 b0 48 d7 32 6c cc 83 33 68 c3 1d a8 44 e5 62 78 bb 0c 2e 1c 87 19 f3 30 b2 e7 7c 9a Data Ascii: P6XPC$BDa6Bl4X)Wr\"HS#D.ZN6`4~b$i9p@O$x[\|R 9Evq`DTQE"0c,@82sA4% -d$ThUa,f/XAt p#Eg7HH2l3hDbx.0\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49903	120.233.179.91	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:44 UTC	358	OUT	GET /jsgif/ny.js HTTP/1.1 Host: 2024hwus1.heibanwa.mobi Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:45 UTC	583	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:45 GMT Content-Type: application/javascript Content-Length: 1186304 Connection: close Server: openresty Last-Modified: Fri, 08 Nov 2024 08:31:26 GMT ETag: "121a00-6266293ae6576" via: CHN-GDdongguan-CMCC5-CACHE26[16],CHN-GDdongguan-CMCC5-CACHE29[0,TCP_HIT,11],CHN-GDdongguan-GLOBAL1-CACHE91[503],CHN-GDdongguan-GLOBAL1-CACHE67[343,TCP_MISS,500] x-hcs-proxy-type: 1 X-CCDN-CacheTTL: 2592000 X-CCDN-REQ-ID-46B1: 535d1dd41cf278cad101e255023f379d nginx-hit: 1 Age: 2147822 Accept-Ranges: bytes Access-Control-Allow-Origin: *
2025-01-02 05:12:45 UTC	15801	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 b8 97 8f d2 aa 97 fe 49 06 ff fd b2 d3 44 d6 fe d0 8d 9d 2d 22 ff f9 94 dd 22 fe ff b2 ff b5 33 da 94 22 ce 53 6b 96 ff ff 11 ac 89 79 ff 6e ff f7 bb b1 d7 44 ee ff 92 ff 22 a5 d8 ff 8b 68 55 2b 1e 92 30 93 12 29 55 dd cc b8 b4 b8 d2 70 10 b7 ba db f3 d7 dd ef ad 62 e3 ff 77 67 91 73 6d f7 b8 90 b7 cc d8 ff ff 28 cf 97 93 a7 2d 50 90 8d 91 f7 54 b3 72 0d da 2a 0c 2a ff ff 4d 71 22 6f ff fe 6e cd bb d1 db 27 64 90 11 fd fd b1 78 b1 95 d4 74 24 b7 4b 11 4b d3 92 6d b2 24 ff 55 00 aa ac 33 ac 2b 25 2a 6f 6d 71 32 11 10 ab 76 6d fc d8 00 8c 95 aa b4 93 af ff 2b 01 10 01 09 70 53 4c ae 11 ff 4d 48 4d 95 66 57 b7 aa 97 68 43 30 88 22 bb 52 25 51 ff 88 00 fa d8 6e db 2f 9c bb 44 bb ff 66 5a fe 09 01 fb b6 4a 2e 43 6c 8f 48 Data Ascii: GIF89aID-""3"SkynD"hU+0)Upbwgsm(-PTr*Mq"on'dxt$KKm$U3+%omq2vm+pSLMHMfWhC0"R%Qn/DfZJ.ClH
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: 76 a6 69 96 5c 6e c5 50 3f 30 40 19 be 48 91 d0 88 8e 9c a6 2c 70 80 10 14 43 3f c4 43 8e 60 10 05 69 dc 67 8a e1 05 55 90 04 79 89 30 b0 d0 91 f8 8a 0d fc 9c 9c 14 91 9d d8 c9 d0 15 84 2d ec 01 9f 0c 22 14 bd d7 12 4c d1 34 d4 e2 0f 12 c4 2c 30 4a 2d 62 a7 0e 06 80 b2 78 27 41 88 e7 78 d2 5d 8d 8d a7 73 16 04 19 30 1e e3 6d 22 79 fe e0 08 fc 51 32 06 12 7d ce a7 7d d6 a7 2f 04 80 19 04 c0 7b ca 42 7a 44 92 78 fa e7 2e 8a 62 76 a2 27 41 78 98 90 c9 51 77 a6 67 3f 1c 0a 1c 90 8a 2f 30 68 81 f6 03 31 fe ca 83 86 92 27 1a 68 3f a0 a2 28 71 d8 7b 26 e8 2e aa 07 2d 4a a8 2d fc a2 af 4c dd 7b a6 28 89 ae a8 86 aa a8 86 56 a8 af 30 de 84 62 27 a9 b0 92 8b ce 28 8b e2 68 8b e6 28 76 ba 09 0b ec a8 81 a6 07 1c b4 81 0a c0 41 91 aa 00 91 c2 01 90 9e ff c3 91 1a 69 Data Ascii: vi\nP?0@H,pC?C`igUy0-"L4,0J-bx'Ax]s0m"yQ2}}/{BzDx.bv'AxQwg?/0h1'h?(q{&.-J-L{(V0b'(h(vAi
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: 21 24 27 4f 2b 80 51 93 4f 80 31 18 26 8c 42 59 f2 02 2f 20 96 2f 3c 08 6b b0 42 82 38 36 86 7a 19 82 00 19 9a 59 88 30 4c 88 2f 54 19 9b 49 88 88 b2 99 2a 4c a8 5b 13 19 8f 19 08 8a aa c3 8a 28 0c 39 94 c3 0c 95 36 18 e8 87 2b 50 05 92 fa 02 3e dc 04 2d 28 c2 72 d8 06 44 58 83 64 19 8a 99 a2 a9 29 c8 9a 92 c8 84 4c b0 00 af b1 03 3b 38 03 3b b8 50 a8 a0 02 0e 8d 43 0e cd 50 7e b3 c6 50 1c ab c5 30 9c 34 90 1d 24 2d c5 e5 40 45 b8 81 8c 51 70 8b d0 21 0d b6 88 45 b5 90 06 5a 2c 45 c3 21 d2 5b ec 38 5d b4 c6 eb f9 38 be d9 2a c7 c9 ab 80 13 8b be 62 b8 10 58 0d d9 11 0b 6e 68 06 63 c4 ab d2 b9 b9 27 78 9e b7 a8 2a 1e a8 b9 d7 79 88 b0 d0 0d 3d 29 0e e2 f0 d3 5c 50 1d 6d f8 d3 42 f5 d3 d9 08 01 d5 89 87 bb 51 9d 12 18 84 be ea 07 61 28 0e 48 ff a5 8c 41 10 Data Ascii: !$'O+QO1&BY/ /<kB86zY0L/TIL[(96+P>-(rDXd)L;8;PCP~P04$-@EQp!EZ,E![8]8bXnhc'x*y=)\PmBQa(HA
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: 7a 30 6a a2 35 ca a2 31 9a 7a 89 57 8f f3 f8 8d 33 a6 30 87 57 30 7a 70 7b b7 c7 7b ff 28 90 4e f7 2d f3 19 8a 24 21 8a 6a 86 4e e8 94 90 22 71 93 61 c1 17 d6 57 93 9f 66 01 e2 57 7d 7a 53 7f 28 65 00 2e 89 1b 3c 29 92 27 55 95 1e b9 6a 5a aa a5 50 e3 50 6b fa a6 70 1a a7 5a 6a 01 24 20 7e a9 e3 a6 72 9a a7 3d 69 67 34 49 69 ea 07 51 24 45 02 21 a1 16 60 7a 17 7d d6 06 90 d1 50 78 a1 14 31 30 38 23 06 07 6d f0 95 04 e3 80 5c b9 95 63 10 96 98 3a 06 9a fa 05 5f d0 08 97 80 09 65 f9 18 c4 13 1e 57 80 81 51 45 0a 54 25 1f 6f 19 97 54 82 26 d3 73 20 37 d0 9b 31 f4 9b 42 f0 01 25 f0 23 db 93 05 53 90 05 23 10 3f 17 52 21 ee 13 ac df 80 21 77 d5 03 c5 60 ac 0e c0 98 ab 35 08 42 20 1f 6f f0 22 ef 76 07 8f 89 99 9a e9 08 09 84 0b 18 b2 23 3c b2 3e ff 9c 65 59 44 Data Ascii: z0j51zW30W0zp{{(N-$!jN"qaWfW}zS(e.<)'UjZPPkpZj$ ~r=ig4IiQ$E!`z}Px108#m\c:_eWQET%oT&s 71B%#S#?R!!w`5B o"v#<>eYD
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: a8 08 cc 31 bf 8a 0b 05 2a 00 07 2a 80 54 ee 64 10 b2 8b 19 5f e1 1a 86 81 91 f6 a5 84 6e 6f c4 94 81 08 7a c0 51 10 e9 52 d6 eb 19 9e 68 20 e1 0e be 2a 80 ba e8 04 55 82 91 55 e0 92 55 80 91 01 00 72 03 42 40 1a 84 81 16 72 25 1d 98 65 03 84 41 8f a4 a1 55 f7 b1 19 9e 41 c2 56 f5 1d bf 31 04 78 20 54 72 60 1c 7f 80 07 36 60 21 01 a0 1e c8 2e f5 12 29 51 62 41 19 00 65 94 46 6f 5e 72 ec 5d 70 6c 59 31 09 1c 70 cc f4 de 25 f4 06 45 f6 4a f2 c7 4e a9 5a 00 26 f7 58 12 96 80 8f 61 82 6f c9 68 f2 c9 0c c0 50 73 12 98 86 00 0b f4 e0 27 47 c6 64 a0 0f 65 08 e0 05 9a d3 29 8f 32 29 3e ed 29 fb 21 60 9f 12 16 94 b2 60 fb 95 d6 12 56 60 93 72 60 fb d5 16 be 12 2e 3f 60 61 27 b6 61 0f d6 62 fd 15 63 01 96 61 37 f6 62 11 b6 1f b4 cf 2b 73 80 60 0d 36 ff 63 ff 95 62 Data Ascii: 1*Td_nozQRh UUUrB@r%eAUAV1x Tr`6`!.)QbAeFo^r]plY1p%EJNZ&XaohPs'Gde)2)>)!``V`r`.?`a'abca7b+s`6cb
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: dc 4b cc 9d 9c c1 58 15 41 22 24 56 71 55 26 ee c9 21 a0 01 12 d0 23 66 ed 43 15 94 d5 a3 84 41 0b b8 81 1b 70 eb b7 7a 6b b7 82 eb 59 3d 93 98 18 81 32 cd 8c cd 38 53 5c 79 e4 d3 45 5d 0c 14 6b bf 10 15 48 16 4d 49 1a cd 60 a9 64 bd 7a 5d d9 69 00 d8 99 9d 4c 0a c0 26 cc 9d c3 20 41 13 84 cc cf 9d 02 09 f0 24 bd 08 40 20 58 c0 c2 de ea 25 b4 1d 66 6d 82 21 dc dd 2a c0 40 23 90 c2 14 f4 c0 15 94 c0 14 a8 16 37 14 1e 0f 70 c3 46 c0 96 e1 c4 d6 e2 40 40 32 b8 42 56 e2 16 e4 bd c2 01 66 01 00 8c c0 c9 82 43 2c 64 8e e6 e4 c4 e7 65 c0 2c 38 c0 57 16 81 5c b6 5e 33 c0 42 33 ac cf d1 02 d8 7f 09 83 39 7c 0e 4a 08 c5 d3 16 45 3a 60 00 3d 2c e6 78 ad 84 34 44 66 4d 8c d7 f1 dd 04 d3 86 4f f8 5c cf 7d 35 df 4e f8 c4 06 48 43 5e 52 cf 50 30 ed 66 02 ff 45 7f 61 1f Data Ascii: KXA"$VqU&!#fCApzkY=28S\yE]kHMI`dz]iL& A$@ X%fm!*@#7pF@@2BVfC,de,8W\^3B39\|JE:`=,x4DfMO\}5NHC^RP0fEa
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: c5 14 a2 24 62 0f 70 08 bf 59 20 82 fb 12 3f 59 b2 0f fc b0 22 ca c4 a2 ff 68 31 02 31 90 04 91 bf 03 19 a3 19 b3 3f 94 25 4d 95 3d cd 0a 60 05 ff fb b1 00 34 00 21 13 c0 13 21 03 2f 58 91 d7 94 91 16 49 c0 d9 a4 81 28 f0 03 42 2a a4 30 c8 4d 68 58 ce df 34 83 41 43 5a df 54 5a 0f 50 5a a7 cd b3 a7 3d 5a a8 05 c2 a8 ad da a9 6d da ab b5 5a ac dd 5a e2 64 5a ae bd da 22 f4 5a b0 15 5b b0 fd 41 b2 65 ce b2 8d ce e1 b4 4e df 94 ce e7 cc 34 0a b0 82 75 58 86 2a 24 01 bb f5 03 6a 20 00 6a 40 00 49 c8 c2 37 d0 86 6c 5a cf f6 1c 5c 60 81 84 29 40 43 19 18 83 73 4a 27 fb 7c d2 51 54 03 34 70 03 37 68 01 37 40 83 4b 98 dc 4b 40 03 ca d5 dc cb 6d 81 cc f5 03 c9 a5 dc c9 95 5c 12 90 dc d0 ad 5c 37 50 83 a0 b2 18 01 f0 03 c4 02 c4 c8 59 44 78 99 97 be ff 6a 28 09 fd Data Ascii: $bpY ?Y"h11?%M=`4!!/XI(B0MhX4ACZTZPZ=ZmZZdZ"Z[AeN4uX$j j@I7lZ\`)@CsJ'\|QT4p7h7@KK@m\\7PYDxj(
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: 69 3f 6c 79 97 f0 8c e5 7d 26 1d 51 31 4c f9 8f 94 d6 14 2c a9 a4 0b 2d 3a 78 d3 58 9a 84 33 4d 29 46 09 8e 14 8b 9b 82 45 16 10 7d 88 10 48 ca d3 94 ee b2 20 b8 f0 63 4a 6d 21 ca bd 09 30 97 ff 90 c5 21 db 28 10 6f c5 04 4c 8b 09 dc 9a 00 50 ac 58 24 23 16 da f8 87 2d 6c d1 0c b3 34 a3 1e cd 34 10 75 72 d8 94 1e 69 67 0a 10 c2 c7 0f b3 52 a7 af 3c 83 3c ff a8 d3 68 08 f6 cd c2 a2 a7 21 63 60 54 0c d2 f9 0f 23 48 8d 2c 0c d3 94 86 96 b7 4e 05 d4 d3 6a 65 1b de 19 f5 d9 b0 7d 6e f5 23 35 f1 67 05 fe 11 07 3a d2 d1 04 71 3c 83 09 e6 40 da b3 a8 a0 2e 1b 74 9f 6c df 57 55 86 ff a0 f4 7d ee 03 a4 41 ea 31 db d9 f6 63 37 e1 c9 a5 6f 13 12 dc 9a 0a 70 a3 2b 79 a4 47 99 2a 0b bd e0 f2 a6 29 75 1f 06 4b 14 db b0 d8 f4 1f 4f 95 4b 00 db 27 16 58 a4 a1 20 42 c0 9b Data Ascii: i?ly}&Q1L,-:xX3M)FE}H cJm!0!(oLPX$#-l44urigR<<h!c`T#H,Nje}n#5g:q<@.tlWU}A1c7op+yG*)uKOK'X B
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: 3b 86 12 1b e6 f4 64 c9 bd 2c b0 92 a3 9b a4 32 2d 80 bc f4 79 a6 9c b1 c3 c8 5f 93 49 0a f6 71 33 36 17 49 d5 ec 6a 73 95 6a 06 e7 33 65 30 40 65 63 79 1b c8 c0 46 9e c3 c4 48 fb e0 89 59 ca e8 83 b3 a1 ea 25 72 30 9b 21 be 98 40 30 a9 ed 2c 75 30 2b 1c 64 86 b3 b4 db d4 2d 63 b5 19 a0 d3 b5 cf 41 d7 e4 66 6f 73 fb 57 e3 2e 13 b3 d8 e1 2d 86 04 84 ce 6e 02 f0 42 57 c9 42 6d 39 54 d8 94 59 20 98 0f f0 8c 02 f3 10 9f 7a 36 64 92 cd a4 4c 11 f6 69 a2 12 09 e1 9f ff 14 a8 8b 4a 70 83 84 a2 25 07 46 ab d1 08 19 1a d1 85 70 01 07 0a 71 c9 07 70 30 04 8d 72 63 21 00 68 48 0f 92 ff a8 c3 27 19 84 05 e8 f8 07 06 5c 31 0c 96 36 04 a6 32 95 b0 d8 b6 34 11 a5 e2 29 22 30 80 c3 42 8a 6a 90 a1 76 b8 0d 31 08 f1 3f ca 20 15 b6 d9 c9 4e 12 91 6d df 1a 39 e1 85 d0 31 54 Data Ascii: ;d,2-y_Iq36Ijsj3e0@ecyFHY%r0!@0,u0+d-cAfosW.-nBWBm9TY z6dLiJp%Fpqp0rc!hH'\1624)"0Bjv1? Nm91T
2025-01-02 05:12:45 UTC	16384	IN	Data Raw: cb a5 d1 96 b8 a9 42 20 0a 17 4f 22 41 b7 49 46 4a d2 91 54 41 8a 21 61 37 bb bc e1 84 26 71 83 04 12 54 0c 63 8a f4 4d 23 ba 0b c9 f3 3e f2 3c 08 2a 19 80 ba 80 ca 36 4a 0c be f6 e9 8e 00 90 60 df fb e2 f7 bd d3 39 4f 7d f1 eb df 7f f4 e1 1f bc 48 8f 7e be e3 b3 9f 15 78 95 b3 9c 25 2d 95 eb 5d a5 31 ed 69 13 02 66 7b 0a 64 4c 0c 21 f3 98 c7 64 5b 19 fc d0 61 3f 78 18 c4 22 1e 31 1f 42 07 4d 11 5f 02 c5 23 5e 31 8b 45 4c 02 10 bf d8 0f 2f 3e 45 db e0 c6 a2 e2 b4 08 c7 c5 d1 66 87 98 01 81 d6 95 12 ae 25 d2 67 46 14 86 b0 3e f1 29 61 0d fb c7 3a 4c 04 0c 01 2c 69 48 d2 75 ff e7 74 9d c4 89 2b 63 39 cb 5a de 32 27 2a 80 65 7d 3c 73 44 cc 60 c2 3f ae ec e5 2e 9b b9 cb ac 10 62 97 bd cc 66 37 93 69 73 15 f0 80 de 3a f4 0f c6 b0 c2 4a 61 ee 10 34 f4 21 44 56 Data Ascii: B O"AIFJTA!a7&qTcM#><6J`9O}H~x%-]1if{dL!d[a?x"1BM_#^1EL/>Ef%gF>)a:L,iHut+c9Z2'e}<sD`?.bf7is:Ja4!DV

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49907	106.225.241.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:44 UTC	534	OUT	GET /c.js?web_id=1281318611&t=z HTTP/1.1 Host: c.cnzz.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:46 UTC	544	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/javascript Content-Length: 906 Connection: close Date: Thu, 02 Jan 2025 05:08:50 GMT cache-control: public, max-age=321 Via: cache47.l2cn1802[0,0,304-0,H], cache2.l2cn1802[0,0], cache5.cn3693[0,0,200-0,H], cache2.cn3693[0,0] etag: W/"7396302432673235262" Age: 235 Ali-Swift-Global-Savetime: 1735794530 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Thu, 02 Jan 2025 05:11:11 GMT X-Swift-CacheTime: 180 Timing-Allow-Origin: * EagleId: 6ae1f19617357947659881891e
2025-01-02 05:12:46 UTC	906	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 3d 22 68 74 74 70 3a 22 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 5f 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 2c 74 3d 30 2c 65 3d 5f 2e 6c 65 6e 67 74 68 3b 74 3c 65 3b 74 2b 2b 29 7b 76 61 72 20 6e 2c 69 3d 5f 5b 74 5d 3b 69 66 28 69 2e 73 72 63 26 26 28 6e 3d 2f 5e 28 68 74 74 70 73 3f 3a 29 5c 2f 5c 2f 5b 5c 77 5c 2e 5c 2d 5d 2b 5c 2e 63 6e 7a 7a 5c 2e 63 6f 6d 5c 2f 2f 69 2e 65 78 65 63 28 69 2e 73 72 63 29 29 29 72 65 74 75 72 6e 20 6e 5b 31 5d 7d 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 7d 28 29 3f 22 68 74 74 70 3a 22 3a 22 68 74 74 70 73 3a 22 2c Data Ascii: !function(){var _="http:"==function(){for(var _=document.getElementsByTagName("script"),t=0,e=_.length;t<e;t++){var n,i=_[t];if(i.src&&(n=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(i.src)))return n[1]}return window.location.protocol}()?"http:":"https:",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49908	223.109.148.174	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:46 UTC	1117	OUT	POST /stat.htm?id=1281318611&r=&lg=en-us&ntime=none&cnzz_eid=1014212052-1735794755-&showp=1280x1024&p=https%3A%2F%2Fwww.rr8844.com%2F&t=%E6%9C%80%E6%96%B0%E7%83%AD%E9%97%A8%E7%94%B5%E5%BD%B1%E5%9C%A8%E7%BA%BF%E8%A7%82%E7%9C%8B%EF%BD%9C%E5%85%8D%E8%B4%B9%E9%AB%98%E6%B8%85%E7%94%B5%E5%BD%B1%E8%B5%84%E6%BA%90%EF%BD%9C%E7%94%B5%E5%BD%B1%E7%BD%91%E7%AB%99-%E5%85%8D%E8%B4%B9%E5%9C%A8%E7%BA%BF%E8%A7%82%E7%9C%8B%E7%83%AD%E9%97%A8%E7%94%B5%E5%BD%B1%EF%BD%9C%E9%AB%98%E6%B8%85%E7%94%BB%E8%B4%A8...&umuuid=194256e0475528-0a57ea5506af81-26031e51-140000-194256e0476637&h=1 HTTP/1.1 Host: z6.cnzz.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.rr8844.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:46 UTC	183	IN	HTTP/1.1 200 OK Server: Tengine Date: Thu, 02 Jan 2025 05:12:46 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding
2025-01-02 05:12:46 UTC	12	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a 30 0d 0a 0d 0a Data Ascii: 2ok0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49909	123.6.18.89	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:46 UTC	374	OUT	GET /cdbcb1b08e2d9dc97758d1ca7b53357b.gif HTTP/1.1 Host: vns3.ezrent.hk Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:46 UTC	416	IN	HTTP/1.1 200 OK Server: NgxFence Date: Thu, 02 Jan 2025 05:12:46 GMT Content-Type: image/gif Content-Length: 309347 Connection: close Last-Modified: Mon, 06 May 2024 15:21:00 GMT Vary: Accept-Encoding ETag: "6638f55c-4b863" Expires: Sat, 01 Feb 2025 05:12:41 GMT Cache-Control: max-age=2592000 X-Cache: HIT Strict-Transport-Security: max-age=31536000; includeSubdomains; preload Accept-Ranges: bytes
2025-01-02 05:12:46 UTC	15968	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f6 7f 00 ca 0c 12 31 5b ac 96 95 93 ec 67 5f fe 4f 0e eb 8e 91 b8 0b 10 ef dc b4 b3 da fa fd 8f 0f fd fb f8 f3 a3 67 9d ac de fc 6e 0a ff f9 eb f8 d5 d2 00 b5 fc f6 00 00 fe ad 18 fd 71 21 6f 9c e7 f7 b0 ad f5 cf 58 44 99 10 00 6a ee d9 8c 8c fd fb da 00 91 f6 ff ee bc cf cf d4 f7 ef db f1 a4 eb 55 cc fc f7 e9 cb 0f 0f 10 9f 6a 15 fe 33 00 d6 ea fd fe c7 23 fb d0 95 fd 85 27 e3 2a d9 49 0b 96 fd bc 21 01 02 fd d0 d9 ee d4 27 29 69 68 65 fb 42 f3 2a 8a c6 ae 90 6d bc 60 55 cc b2 ab f7 4e 29 0a 21 ab d6 ad 8f f5 2e 2a 07 95 d0 1b 68 04 6d 8f aa ec eb ec fd db ec b6 0a a6 f3 b3 8b 51 1b 14 d1 16 bc 5e 60 aa fc ed ec 01 73 cd 5d 67 e9 d5 52 02 d8 16 1c ff ea f6 03 81 b0 36 50 f1 f4 35 56 da 6b 06 6c 1f cb 9e 05 07 b0 87 1b d6 90 Data Ascii: GIF89a1[g_Ognq!oXDjUj3#'I!')iheBm`UN)!.*hmQ^`s]gR6P5Vkl
2025-01-02 05:12:46 UTC	68	IN	Data Raw: 0a 0a 97 b9 9a 9a 48 87 75 07 20 d7 22 43 5e fa a5 7d 77 78 39 91 21 5f ea a5 1d 95 8a 05 d5 91 9f 88 50 60 50 13 91 77 78 6e 87 2b c5 59 79 75 47 04 d0 d9 15 04 18 79 19 68 2d ce 99 88 3b f0 37 d9 20 9d Data Ascii: Hu "C^}wx9!_P`Pwxn+YyuGyh-;7
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: 9a 29 78 38 c2 65 cb 29 39 3b 80 5a 7f 18 39 d3 59 81 97 33 a7 10 38 06 01 10 a7 ce d0 01 8c ba 9c f4 88 0d b1 f5 a6 e0 b6 9d f7 a6 ff a6 96 18 16 df 19 10 ea 59 a0 d8 d0 92 fe c9 94 32 d9 93 14 ba 9e 12 da aa b0 5a aa f7 a9 aa b3 ca 94 68 11 a1 47 01 a1 b1 4a a1 49 59 5e 11 8a 92 43 69 9e e7 b9 aa 3c 99 92 b9 20 ac 4b 89 a0 09 4a ab 0f 8a ab 7a 80 ac bb 6a a1 58 89 a1 52 09 31 3c d8 a1 20 9a ad 30 58 7b 23 7a 72 60 99 7b c2 78 00 e2 2a ae 29 5a 4b e3 7a ae a6 80 ae be 48 03 4a 38 ae 78 85 0a ea ca 06 4b a7 a2 00 14 af 7c 99 8d f1 4a 03 41 27 08 ea aa a4 b0 71 72 ab 61 af 02 2b b0 86 19 af ba 66 b0 54 ea 0a c5 81 b0 54 b8 08 f0 6a af 1b 44 99 e2 d4 0a 57 8a a5 21 79 9b cd 02 12 1a bb b1 1c cb b1 83 4a 78 1d 1b b2 1c bb 9a bb 19 79 08 95 91 10 c8 8f e0 80 Data Ascii: )x8e)9;Z9Y38Y2ZhGJIY^Ci< KJzjXR1< 0X{#zr`{x*)ZKzHJ8xK\|JA'qra+fTTjDW!yJxy
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: e9 48 8e 40 d6 18 f1 e8 63 0f e8 56 0b 90 9c 9f e3 64 4d f9 63 86 d4 48 8d e4 2b 8e d4 9d 41 56 7f 79 45 3b 26 f8 0d 68 57 9e d5 64 ff 9e e8 79 9e ea 99 9e ec b9 9e ee 59 9e 8e e2 0e 43 38 91 39 99 73 95 b0 89 3f 69 85 66 39 02 0a b0 90 70 59 9f e9 02 0e be e6 93 8b 88 20 f5 92 77 3c f9 9f 44 79 4c 1c 09 a0 96 80 4c 3d f9 9f 66 f9 95 08 9a a0 16 9a 7a d1 b3 74 11 9a 97 f4 d9 a1 1a ba 94 12 6a 77 0b aa 00 9d 86 a0 4b 19 84 62 f1 34 f3 29 94 1d 19 2c 29 fa a2 2f 2a 0e 77 38 a1 40 a9 87 33 f8 75 17 f3 0d 33 ca a1 82 e8 78 2b 99 a3 da b0 68 52 69 a1 84 47 a3 84 05 a4 cf 90 31 34 2a 89 85 47 89 ea 90 01 f9 a9 a1 23 8a 9f 1e 6a 84 ed 70 98 58 9a a5 5a ba a5 5c 5a 7c aa a8 98 f8 c0 98 ad 18 11 51 83 5f b4 98 06 51 c0 01 b7 88 8b 06 41 03 65 da 0f 0a c4 99 44 34 Data Ascii: H@cVdMcH+AVyE;&hWdyYC89s?if9pY w<DyLL=fztjwKb4),)/w8@3u3x+hRiG14G#jpXZ\Z\|Q_QAeD4
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: c3 52 60 b4 46 0e 00 10 39 23 64 31 04 d8 56 06 38 42 f6 10 59 cd 16 92 ed a0 12 3d 14 81 c6 22 43 c8 96 6c e4 b6 58 8d 45 6d 21 81 ff 05 b5 82 2b 0c e1 06 26 38 6d 8f b5 12 20 79 10 a0 d5 43 06 90 82 54 04 19 56 c4 82 a6 45 5b fb 22 4f b2 85 6f fb 96 94 c8 c8 03 3e 08 5c fa 26 70 38 08 95 06 07 47 c7 e5 0d a0 42 0e 53 c8 85 60 00 5d cb 65 16 52 88 0f 50 a8 24 47 11 31 cf 55 31 8d 74 95 e3 80 96 0c 47 39 6d e8 86 92 f1 5e 67 d0 30 65 e8 03 67 18 22 33 f7 5e 75 d9 03 62 80 07 7c 19 39 1f 80 07 7b 29 5f f9 e5 96 6f 68 1b 08 a6 03 85 78 3a 7a 48 1a 4a c7 98 ac 85 4b 8d e9 87 7c 48 35 94 58 99 52 a7 00 3b 90 4d 36 f0 82 3f 41 01 8d 48 76 59 d3 1c 60 33 9a 0c b0 03 62 b3 03 45 80 9a 14 40 37 63 57 99 95 f9 4d 75 93 76 ef 94 8b fc a1 05 03 42 4f 87 37 00 6e e0 Data Ascii: R`F9#d1V8BY="ClXEm!+&8m yCTVE["Oo>\&p8GBS`]eRP$G1U1tG9m^g0eg"3^ub\|9{)_ohx:zHJK\|H5XR;M6?AHvY`3bE@7cWMuvBO7n
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: b2 b7 bf a0 ed 7d 01 fc 4b df b0 35 b8 ec 61 ef 81 ec 4a 97 ff 18 53 39 07 42 f0 82 31 9a c1 0c f4 85 41 08 ca ff 88 60 6c 81 97 8f 3a e8 c0 2f 6c d0 81 28 24 a1 13 2a c2 98 28 04 49 85 26 0c 58 0a 67 88 3d 21 75 80 2d 87 c8 a1 0e 77 48 85 02 0e a6 7f 3c dc 21 02 10 38 08 22 64 28 88 48 dc c7 e9 3a 36 07 0a 38 f1 89 50 8c a2 14 a7 48 c5 2a 5a f1 8a 58 cc a2 16 b7 c8 c5 2e 7a f1 8b 60 0c 63 15 e7 e0 b1 23 ce 8e 76 13 31 de 43 72 77 84 8a f4 2e 04 12 f9 c2 00 66 30 47 37 de 0e 60 19 18 88 79 7c c6 3c 52 09 6d 3c d1 13 c9 1f 53 82 9a 80 8c 4f 20 b6 9a 87 07 08 e2 84 a2 d0 87 7c 59 7b 24 f8 b4 e7 48 ee ad 8f 57 ed 1b 5b 02 cd 96 03 f9 71 85 88 8e 18 a0 e0 f6 d7 39 33 ce 4d 6d 9b 2c 97 28 d7 02 07 fe 91 a3 89 57 80 a5 2c 29 30 87 30 f9 26 96 14 c0 a5 2e 67 b9 Data Ascii: }K5aJS9B1A`l:/l($(I&Xg=!u-wH<!8"d(H:68PHZX.z`c#v1Crw.f0G7`y\|<Rm<SO \|Y{$HW[q93Mm,(W,)00&.g
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: c9 28 a7 ac 32 af 2d 36 64 e3 cb 30 c7 2c f3 cc 34 2b c4 d0 46 3a b6 d1 a3 8f 18 09 f9 91 14 44 8a 34 c2 1a 4b ff 76 b2 12 1f 4f 52 c6 47 94 34 dd db a4 19 82 68 c0 12 96 5c f6 94 93 96 3e 1d 30 54 01 00 64 e0 2f 52 11 80 2d 36 00 61 93 8d d4 c2 08 97 ad f6 d8 6b 03 30 c8 56 54 b5 2d 37 db 74 9b 6d f7 dc 66 47 c5 a6 9b 5c e1 e9 66 26 6f ed 19 42 9f 6e 11 da 57 5b 84 26 7e f8 a3 8a 25 7a 78 9f 8c 37 0a c6 5d 66 b1 95 d7 e5 72 71 62 00 26 94 5e 32 aa 24 a0 d3 13 ba 24 97 a0 7c 09 c9 26 93 de c7 e8 a2 7b 1e 8b 7e 2b 97 8c 1f 21 0f a0 ee 6c 7f 83 14 1b fb ed c9 a6 0c c5 03 cc cc 8b b2 2b bd 0f 3f 1d ca 2c fe 93 9d ef c5 9b fc 83 a5 d0 57 7a 80 ed ce 42 11 7d f4 0b 30 ff 8a b8 d4 cf e7 80 20 23 84 2a 7e f8 e4 33 f1 44 ae c8 97 3f 82 3b c8 11 22 4b 07 69 87 53 Data Ascii: (2-6d0,4+F:D4KvORG4h\>0Td/R-6ak0VT-7tmfG\f&oBnW[&~%zx7]frqb&^2$$\|&{~+!l+?,WzB}0 #*~3D?;"KiS
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: 00 4c 09 ad 74 a4 43 19 4c 14 d2 11 5f f5 f1 50 0f 8e 8c f3 24 43 4d f2 30 95 46 53 32 34 83 42 5b 3a f4 c9 96 ff 40 e9 21 14 4b 33 3c c0 9d 5c 35 65 70 91 93 47 a6 29 e7 47 33 b0 f7 e6 23 51 64 60 11 35 58 7c a1 01 8b bc b4 f0 56 5b 5c 30 80 87 a2 63 1d ea e8 a3 6d e1 41 49 0f 74 09 66 57 06 41 16 f0 57 5d 03 64 5a e9 5d 05 64 9a d7 a7 5f 0c 60 6a 5e 15 a4 5a 00 a9 96 5e 3a a9 64 8a 7d 20 ab 61 8e cd 4a 2b 0c b2 46 66 eb ad b0 ea 8a 89 68 a2 65 21 6c 1d c0 86 26 ac b0 84 b2 98 cb 2e 7a 14 31 9b 6a 45 e4 51 84 b3 ac 51 c0 c0 b5 d4 3e bb da b4 d6 32 a0 ad 6c 79 6c e1 48 08 12 0c 07 5c 03 c2 dd 66 ee ba ec e6 b6 c0 23 25 5c b7 dc 74 d4 4d 87 c0 bd 08 5c 47 af 74 7d 64 a7 1c be f7 1e e7 6f 72 03 1f 87 c0 9e b6 30 88 1f 21 f3 9d d7 ca 79 83 b4 c7 70 7e fa 7d Data Ascii: LtCL_P$CM0FS24B[:@!K3<\5epG)G3#Qd`5X\|V[\0cmAItfWAW]dZ]d_`j^Z^:d} aJ+Ffhe!l&.z1jEQQ>2lylH\f#%\tM\Gt}dor0!yp~}
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: ca 07 5d 2d b8 6a 95 a7 80 9f e8 89 a0 38 8a a2 58 8a a1 78 8a a4 48 52 25 80 7a ac a8 7a a8 27 7a f5 a3 0d a9 37 8b ad b8 52 b6 b2 11 a8 68 7f 94 f5 3a bc d8 8b 41 68 84 3f 86 84 dd 45 47 1c 34 05 46 66 3f 9f 93 8c 8b 73 7e c3 78 37 c5 f8 39 53 90 7d 1a a2 85 ca a8 84 b6 53 21 c0 f8 8c f6 b3 7f 44 a6 8d 4a b8 3a 89 a5 58 de f8 ff 8c 1f 75 80 0f 35 8e f6 c3 85 75 78 87 ec 58 15 79 e8 00 ef 08 74 89 02 14 b4 17 8f 21 00 00 16 e8 7b cc 60 88 fc 48 88 b2 65 88 bc 67 88 15 b0 2e 21 08 8f 06 39 6d e7 e6 04 0a 49 27 28 38 24 b4 90 87 69 87 23 9a 32 24 69 d3 20 d5 97 8b a6 36 40 e8 e8 84 d7 90 8a 9f 07 86 f9 c3 37 c5 32 92 ad b2 52 46 48 0b 4a 38 0b cf 38 0b d6 b8 6c e5 f7 56 10 70 05 f5 47 8d 2d 49 3b a0 c3 8c 12 02 38 30 b9 93 db c8 21 ae 66 93 2d 69 3f 91 64 Data Ascii: ]-j8XxHR%zz'z7Rh:Ah?EG4Ff?s~x79S}S!DJ:Xu5uxXyt!{`Heg.!9mI'(8$i#2$i 6@72RFHJ88lVpG-I;80!f-i?d
2025-01-02 05:12:47 UTC	16384	IN	Data Raw: db ef 10 e6 f5 45 4e fe 25 93 bc e6 b7 f3 07 25 23 9b 9c 4f 14 8c 95 c2 9a 65 28 c2 3d f3 2b e3 f5 b1 62 36 fa 62 13 fb 00 67 41 36 e8 90 94 4a a7 14 58 90 c5 08 ee 97 74 76 46 59 e2 52 20 97 45 0c ca 60 01 c4 d4 06 6b 80 4c eb b2 0b c8 64 3d 90 36 03 37 10 0b 05 a2 2f c6 a0 17 c8 50 06 f3 f2 0a 52 50 69 d9 90 4e e5 c7 0e 9b 96 ff 0d f1 23 3f 70 f7 69 bd 35 79 16 13 4e 91 90 41 d0 b5 6b e9 74 5d d8 45 42 1a 14 5d 05 90 5d 83 85 08 83 57 4f b0 b6 6b 2a d3 16 8f 87 03 19 84 84 78 17 01 b2 86 84 ac 82 3f f2 60 6a 95 e7 10 fc 85 0a 8c 93 06 d0 b6 79 f4 85 0a 45 73 19 48 c4 85 ee 20 64 e7 b6 00 5a 88 54 fd 96 7d 3c 04 05 ac a7 07 cc 96 45 25 45 25 2d 06 7c 8d 21 70 fd 36 7d e2 c5 7b 6c 60 6e 62 d8 7b b1 17 86 0e b6 71 ca 37 88 34 75 87 e5 a6 54 9b 97 7c 84 b8 Data Ascii: EN%%#Oe(=+b6bgA6JXtvFYR E`kLd=67/PRPiN#?pi5yNAkt]EB]]WOk*x?`jyEsH dZT}<E%E%-\|!p6}{l`nb{q74uT\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49910	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:46 UTC	732	OUT	GET /static/images/2.ico HTTP/1.1 Host: www.rr8844.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UM_distinctid=194256e0475528-0a57ea5506af81-26031e51-140000-194256e0476637; CNZZDATA1281318611=1014212052-1735794755-%7C1735794755
2025-01-02 05:12:47 UTC	314	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:46 GMT Content-Type: image/x-icon Content-Length: 1608 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 28 Nov 2023 11:07:18 GMT ETag: "648-60b346bf9c580" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:47 UTC	1608	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 32 00 32 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC22"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49906	123.6.18.47	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:46 UTC	376	OUT	GET /6d1a62e98f7abc0ea4a7ac9760cb2e97.gif HTTP/1.1 Host: ylg1.duyunfk.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:48 UTC	416	IN	HTTP/1.1 200 OK Server: NgxFence Date: Thu, 02 Jan 2025 05:12:47 GMT Content-Type: image/gif Content-Length: 705232 Connection: close Last-Modified: Thu, 29 Aug 2024 10:31:14 GMT Vary: Accept-Encoding ETag: "66d04df2-ac2d0" Expires: Sat, 01 Feb 2025 05:12:39 GMT Cache-Control: max-age=2592000 X-Cache: HIT Strict-Transport-Security: max-age=31536000; includeSubdomains; preload Accept-Ranges: bytes
2025-01-02 05:12:48 UTC	1188	IN	Data Raw: 47 49 46 38 39 61 14 05 c8 00 f7 ff 00 44 99 0e ad 01 00 f9 d8 d1 fe ee ad ff 89 72 00 32 ff fd d4 b0 b1 af aa d6 85 85 ff 69 58 ff fd 88 fe f2 73 94 87 84 58 44 ef b1 86 84 fb ab 8f fd 95 85 fe 53 46 fe 77 63 fc 6d 24 fc b8 a7 05 21 9a d0 ce b7 e2 29 d8 f2 b4 47 48 0c 96 fa ff 00 ad bb f0 ff 58 2a 28 7b cb f4 d3 97 ec eb eb d0 17 c2 ff 00 00 b4 5b 1a ac b6 cb 21 20 7f ff 2e 5d fb 40 f3 9b a1 63 55 6e a0 d5 0a 06 6a 64 5c ff 28 2e d9 30 30 f3 a2 dc af ae 97 6d 8a ad cf 97 31 18 4b 89 fb d9 69 22 52 94 d5 d4 f6 29 84 d5 92 00 00 2a 00 00 cf b3 ad f5 21 00 92 69 60 51 00 00 ff ec 56 dd db da fd ca 32 ee ed da 1d 6c 04 2c 2c 2e 21 63 a9 73 ef ff ce b0 8a 8d a9 d5 34 78 f7 47 cb fc ff 55 8f 68 00 00 ef b9 2f ed ed ca 84 f9 ff db ab 35 34 4f f1 af d4 f7 8a b3 Data Ascii: GIF89aDr2iXsXDSFwcm$!)GHX({[! .]@cUnjd\(.00m1Ki"R)!i`QV2l,,.!cs4xGUh/54O
2025-01-02 05:12:48 UTC	4608	IN	Data Raw: 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 52 65 66 23 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 31 2e 30 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 4d 4d 3a 49 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 33 35 42 33 46 36 37 45 36 35 45 45 31 31 45 46 41 35 35 36 39 45 44 32 46 30 34 37 41 34 38 35 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 33 35 42 33 46 36 37 46 36 35 45 45 31 31 45 46 41 35 35 36 39 45 44 32 46 30 34 37 41 34 38 35 22 3e 20 3c 78 6d 70 4d 4d 3a 44 65 72 69 76 65 64 46 72 6f 6d 20 73 74 52 65 66 3a 69 6e 73 74 61 6e 63 65 49 44 3d 22 78 6d 70 2e 69 69 64 3a 33 35 42 33 46 36 Data Ascii: e.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Windows)" xmpMM:InstanceID="xmp.iid:35B3F67E65EE11EFA5569ED2F047A485" xmpMM:DocumentID="xmp.did:35B3F67F65EE11EFA5569ED2F047A485"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:35B3F6
2025-01-02 05:12:48 UTC	1536	IN	Data Raw: 14 0c a4 eb b0 a7 0d 7b c1 18 fc c0 1f 7c c1 1e 3c 6b 23 30 00 1d 9c 6c 41 ba 0e 16 50 b5 2e ba a7 37 f5 a3 92 58 b7 67 d1 b4 4b 70 05 17 3b a2 cf 23 c3 de a3 c0 0d 0c c1 aa 57 c1 39 fa 0d 03 10 7a 15 9c c1 3e 7c c4 38 3b c3 af c1 05 b6 36 c2 46 cc 88 1d a0 b2 df 90 95 9c 27 c1 21 dc c4 9c 17 5e 13 9a a7 5c f0 07 a4 18 7a 72 29 2b 37 95 b4 ca 26 7b b2 22 0e eb 70 c3 1f 8c a3 a7 10 a7 12 ea 7d 5c 5b 8b 6e 20 b5 67 bc 4b b9 10 c7 b1 38 c7 76 fb c6 20 9b 0b 43 9b c7 5c f0 0d 20 fb a4 59 bb c5 67 71 c7 d6 a8 c7 e3 ff 44 c5 16 bc c6 79 99 c1 23 7c 98 1b 9c c3 82 1c b6 9c b9 6e ec 20 07 09 29 8e e3 78 b6 86 9a b6 a0 5c a8 6e 2b 9b e8 58 ca 71 1b 01 2b a0 09 7b 5c c8 95 6c 3b 86 bc c7 94 7c 3b 5d c2 05 35 78 0d 02 20 b8 0f 50 52 d8 b0 05 36 a8 49 2e 70 02 9d 7a Data Ascii: {\|<k#0lAP.7XgKp;#W9z>\|8;6F'!^\zr)+7&{"p}\[n gK8v C\ YgqDy#\|n )x\n+Xq+{\l;\|;]5x PR6I.pz
2025-01-02 05:12:48 UTC	7680	IN	Data Raw: c6 37 71 0d c5 85 14 c9 05 23 c7 8e 1c 23 1e 54 78 65 9d 38 51 19 31 6e 84 38 f3 24 46 97 0d 75 7e 1b 40 93 e5 cf 9b 32 65 52 2c b2 ee 1b 3d 3f 41 85 06 5d 99 10 e3 00 91 51 d7 89 1a 68 51 e3 92 90 23 a3 2e b1 00 05 4a 91 af 45 c0 7a 1d 6b 2c aa b8 2b 2a 2f 16 6c 33 42 94 d1 ac 51 e5 ce 15 94 34 e3 dd 95 1e f5 7a 8c d8 e6 e5 5c 90 72 7f ec 25 cc 77 6f 5e 82 c3 e0 06 66 4c b2 a1 20 c3 85 d5 4a 26 d8 46 9f 56 9d 24 35 3f f6 73 98 f2 e7 c4 8b b3 66 5d d2 c6 27 df 99 17 9b b2 4c ad 91 a2 d5 8a 36 11 e6 3c 2b 37 ae ff e3 cc 22 1d e3 6e bc 73 33 63 db 0d cf 7d f3 40 e1 41 02 02 04 1e 40 20 20 c1 79 02 09 09 a4 47 7f 4e 7d ba 74 ec d9 a1 5f d7 1e 1d 3a 12 eb db bd 27 88 50 3e c2 2a 0e ec d4 e5 ee cd fe b6 6f dc bf e5 8b 44 50 df 7e fd 01 08 14 61 eb 22 40 00 1e Data Ascii: 7q##Txe8Q1n8$Fu~@2eR,=?A]QhQ#.JEzk,+/l3BQ4z\r%wo^fL J&FV$5?sf]'L6<+7"ns3c}@A@ yGN}t_:'P>oDP~a"@
2025-01-02 05:12:48 UTC	16384	IN	Data Raw: c5 f5 69 75 fd 0e 43 53 f8 18 36 d5 f0 ad 0f c6 e1 9b 58 1c c6 70 be f7 19 dc 8f b6 c8 0d 68 3b db 19 17 b8 d0 8d f8 c3 5f fe 1e 10 85 07 82 0f 7e 58 85 df 54 7e 38 09 fe c5 df d4 d0 1f 01 0a 20 c1 44 1b 95 49 c4 f4 49 5f 07 38 99 28 68 98 37 89 51 bc 70 4c f5 85 51 bf 1c 02 f5 11 1f f1 c1 8a 18 15 58 02 6e 1f f6 3d 93 f1 49 9f f4 41 20 18 f1 d9 12 bc 00 f8 95 20 f5 bd 99 3a b8 41 f6 f1 ca f6 bd 8b b2 fd 0b f5 7d 1f f6 f1 ca 08 d8 cb 37 a8 82 b5 50 0b b6 5c cb 18 94 20 83 65 df 4d 58 cb b6 50 0b 10 5e 8b 12 1e ff a0 4a 75 92 17 15 14 a9 fc c1 91 61 db 2b 59 40 a2 41 19 ae a4 d9 83 41 21 db 34 4c 2c fc 01 4c 64 9b 51 e8 83 05 b8 01 a6 01 0b b0 b8 01 59 40 21 3c d9 0a 15 92 a1 ae f1 13 52 b4 4c 29 95 1f 16 2d 81 1d 41 d9 43 50 e1 97 91 e1 de a8 03 16 02 8c Data Ascii: iuCS6Xph;_~XT~8 DII_8(h7QpLQXn=IA :A}7P\ eMXP^Jua+Y@AA!4L,LdQY@!<RL)-ACP
2025-01-02 05:12:48 UTC	9728	IN	Data Raw: 01 a0 15 02 d8 15 09 18 80 47 42 16 19 58 a4 28 f8 c0 5f 09 07 78 08 07 3c c0 14 09 20 80 60 13 b6 61 db 96 08 78 15 70 68 07 39 d9 b5 66 91 03 3c 78 25 51 11 95 07 20 80 4f 63 ad a2 9b b9 5d c2 36 2e 60 00 5f e2 b6 46 e1 17 7f 21 a1 03 50 04 55 38 80 7d 19 81 1e 60 03 8a e9 81 11 a0 a6 76 53 04 36 f8 03 06 08 11 36 e8 a6 13 38 01 17 50 01 15 80 27 5e 08 83 03 08 83 30 70 01 1d 50 01 29 14 27 3b 74 80 48 d0 01 47 a1 83 30 68 04 1d 80 99 89 33 44 5e e0 27 2d 20 89 52 e8 86 8d 63 9b c1 7a 44 92 63 9b 48 f4 38 4a ff a4 c4 94 33 ac 4b 54 00 4d dc c4 c0 e2 c4 4c 84 c4 4e 0c c5 49 14 c5 90 fb 44 4f ec 38 52 24 ac 53 44 2c 4b c4 c4 c3 5a 00 0f 00 86 8b 43 8a bc 72 87 ca 4a be 43 bb 10 31 fa 3f 35 fb b1 ac 53 9e 1a 2b 1e 88 c9 ba 31 b3 10 ab 73 8a e8 53 bf da 2a Data Ascii: GBX(_x< `axph9f<x%Q Oc]6.`_F!PU8}`vS668P'^0pP)';tHG0h3D^'- RczDcH8J3KTMLNIDO8R$SD,KZCrJC1?5S+1sS*
2025-01-02 05:12:48 UTC	6144	IN	Data Raw: 0d 2e 40 ad 9b 02 41 01 17 6e 67 8e d8 74 f3 9f 86 31 de 66 4e 56 84 94 69 d3 99 05 79 81 49 3c b2 8d 8b 64 66 26 19 fb 4c 3f ff e2 96 2b 80 23 26 8d 9b 01 47 e8 26 bb 90 bc 81 0d 29 ab c8 1b 5a f2 33 72 ea 65 9c e8 cc e8 38 67 e7 19 dd fd a1 9a db 40 c7 0f 2c 00 15 ce c0 6e 9b 8b c3 88 e7 d8 20 37 8e e6 b4 08 a3 eb e9 d2 f4 e2 b7 2f 14 61 2e 42 fd 81 59 36 10 09 9f 96 0e a9 f3 fc 42 e7 46 f0 07 a1 0e 55 a7 53 e5 e9 e5 36 97 8c c9 6c b5 22 89 61 e9 5e 24 63 bb 0f be e6 ac 08 8d 27 cf 18 c2 ce 6a 6a 85 9a c8 14 ff 8a f3 f0 f0 03 01 4c ef 14 2e b0 84 32 9c 53 8a 04 28 08 02 9a 00 df 61 c5 47 d8 07 3c e0 7c 02 30 c0 78 c0 71 0e f4 b0 c3 00 ee c3 c0 00 c0 11 1f f8 6c 96 3e 2b d0 44 14 3c d0 9f fe fd 0f 03 1e a0 cf 7c c0 e1 01 0f 50 e0 80 dd f1 ce 7d 22 04 5b Data Ascii: .@Angt1fNViyI<df&L?+#&G&)Z3re8g@,n 7/a.BY6BFUS6l"a^$c'jjL.2S(aG<\|0xql>+D<\|P}"[
2025-01-02 05:12:48 UTC	16384	IN	Data Raw: c0 d9 ea 2f 59 83 95 b1 80 b6 b3 52 54 fa 07 b2 c6 ea e1 6c 88 f8 52 7c 45 aa b8 ce d9 52 3f 09 cd 52 58 66 4e 81 0b 1c 67 16 90 08 d7 04 a9 53 70 10 1b dc df de 40 bd 7e 59 49 a7 02 c5 1c d5 66 b6 d1 c2 1d 33 b7 16 72 af cc 95 98 57 57 c2 8f 5f 69 52 00 a7 08 47 3a 30 d2 8e ca c2 43 e8 e1 d0 cb 56 6a ab 16 08 24 c0 b3 9f 25 80 75 1f 30 da b3 3c 2e 0a 1e 40 ad 07 ba 41 98 d9 9e 23 2e 79 b1 9c 38 28 2b 8e be b0 c5 71 a5 2b dd e9 be f2 74 e1 b6 0e 76 bf 65 9d dc 87 bb 0a cd ac e2 2b 0f e0 02 1e 7e 20 80 74 a4 43 ff db 18 27 f9 45 5a 13 3c e8 5a 82 1e 0f b8 86 e2 6d 73 8d f1 f6 20 0f b5 81 3c 1b bc 8b 5e 41 7c 40 10 d7 20 c0 35 a4 20 05 fe 71 fe 0f aa 38 c0 23 52 70 80 5c 84 c2 01 df 49 c1 35 88 71 85 2b 10 c3 3b ee 39 c0 15 42 61 0d 4e d0 12 07 c4 10 c4 1f Data Ascii: /YRTlR\|ER?RXfNgSp@~YIf3rWW_iRG:0CVj$%u0<.@A#.y8(+q+tve+~ tC'EZ<Zms <^A\|@ 5 q8#Rp\I5q+;9BaN
2025-01-02 05:12:48 UTC	16384	IN	Data Raw: 51 bf 63 7a a3 a5 46 ef 3e 97 56 d7 c2 e3 d6 d7 3b 75 af f7 80 01 c0 fa d4 0d 42 bb 00 77 10 92 06 96 01 43 1a 3e 40 d1 a0 30 52 2b ff d2 c8 95 19 66 07 27 8c 43 0a ed 74 65 c5 b8 81 cb 11 7b 25 21 8e 84 08 86 7f 22 ca 80 1e e4 20 fa 2c c0 8f 13 12 e3 7e 4e b5 c6 3c 66 70 58 9e 20 18 8b 19 9e c7 61 61 d8 13 56 89 4a 63 66 6d 6b f5 34 89 5a 7e a6 95 fd 10 00 09 43 4e ca 91 bd d9 33 6e 44 20 04 10 20 64 60 dc 3e 8e 0d 40 a1 98 10 21 89 d5 26 6f 92 a4 39 84 f1 13 c6 72 bc 52 99 10 b4 08 26 6b 02 8d e6 95 7d fc 64 ff 42 5e 33 c9 0c c5 99 04 b8 b1 82 d8 0f cf 6d b3 7f 3b 18 48 fa 8c 4a 4f c2 fb 9e 71 ea 67 9e 21 fe a6 42 ba 36 9a e3 43 70 06 37 38 a4 6a e0 0e ed 7f 8d 2e 34 d7 b8 46 73 5a a6 2f dd 34 4b d1 5f 19 d2 90 26 a6 5c 23 a5 bc a3 70 5a 43 19 de 20 11 Data Ascii: QczF>V;uBwC>@0R+f'Cte{%!" ,~N<fpX aaVJcfmk4Z~CN3nD d`>@!&o9rR&k}dB^3m;HJOqg!B6Cp78j.4FsZ/4K_&\#pZC
2025-01-02 05:12:48 UTC	16384	IN	Data Raw: 17 c6 db fc 8d fc 85 0f c7 f9 6c bf 9b de 9d 9f 29 e9 f1 ed ee f9 7e bb a4 9a eb 54 b7 71 3a 7b cb db 7e dd cd 1e bd bd 03 3c b8 a0 ce db 70 9a 8b 22 b1 33 4a 79 da 77 78 8c b7 f7 3c eb b1 bd ec d2 e7 4d f8 01 af b7 b9 3d 07 ee 69 fb f4 a3 e6 76 d4 36 56 57 19 2e 0c f7 d3 08 30 40 1e 43 83 2c d2 9c 83 59 14 e0 80 00 7c b7 55 d8 c4 a6 5a c3 03 2b 8e 19 89 1c 20 bb 15 ae 45 36 b9 5c 8f ec 7f bb b2 1c 5e 79 92 cb 65 52 02 28 03 b0 40 99 89 4d d9 3b 8c 83 95 dd cb ce 69 99 2a 31 00 0a 8c 47 10 84 5d d7 d1 dd a9 65 ff 60 42 6d e0 05 86 81 0a 38 c2 09 04 82 29 2c 40 d5 21 9d d1 95 5d d5 c1 02 2c 38 80 23 84 01 d7 85 9d df 25 57 dd 5d 20 32 85 81 03 68 01 2c 14 c2 c3 2c 9d d1 f9 20 2c 04 82 16 38 82 0a b0 9d 99 c9 20 42 d5 60 12 82 16 a6 dd 5a 79 1d 1e 79 05 de Data Ascii: l)~Tq:{~<p"3Jywx<M=iv6VW.0@C,Y\|UZ+ E6\^yeR(@M;i*1G]e`Bm8),@!],8#%W] 2h,, ,8 B`Zyy

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49911	106.225.241.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:47 UTC	360	OUT	GET /c.js?web_id=1281318611&t=z HTTP/1.1 Host: c.cnzz.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:48 UTC	544	IN	HTTP/1.1 200 OK Server: Tengine Content-Type: application/javascript Content-Length: 906 Connection: close Date: Thu, 02 Jan 2025 05:08:50 GMT cache-control: public, max-age=321 Via: cache47.l2cn1802[0,0,304-0,H], cache2.l2cn1802[0,0], cache5.cn3693[0,0,200-0,H], cache8.cn3693[1,0] etag: W/"7396302432673235262" Age: 237 Ali-Swift-Global-Savetime: 1735794530 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Thu, 02 Jan 2025 05:11:11 GMT X-Swift-CacheTime: 180 Timing-Allow-Origin: * EagleId: 6ae1f19c17357947679211575e
2025-01-02 05:12:48 UTC	906	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 5f 3d 22 68 74 74 70 3a 22 3d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 6f 72 28 76 61 72 20 5f 3d 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 73 63 72 69 70 74 22 29 2c 74 3d 30 2c 65 3d 5f 2e 6c 65 6e 67 74 68 3b 74 3c 65 3b 74 2b 2b 29 7b 76 61 72 20 6e 2c 69 3d 5f 5b 74 5d 3b 69 66 28 69 2e 73 72 63 26 26 28 6e 3d 2f 5e 28 68 74 74 70 73 3f 3a 29 5c 2f 5c 2f 5b 5c 77 5c 2e 5c 2d 5d 2b 5c 2e 63 6e 7a 7a 5c 2e 63 6f 6d 5c 2f 2f 69 2e 65 78 65 63 28 69 2e 73 72 63 29 29 29 72 65 74 75 72 6e 20 6e 5b 31 5d 7d 72 65 74 75 72 6e 20 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 63 6f 6c 7d 28 29 3f 22 68 74 74 70 3a 22 3a 22 68 74 74 70 73 3a 22 2c Data Ascii: !function(){var _="http:"==function(){for(var _=document.getElementsByTagName("script"),t=0,e=_.length;t<e;t++){var n,i=_[t];if(i.src&&(n=/^(https?:)\/\/[\w\.\-]+\.cnzz\.com\//i.exec(i.src)))return n[1]}return window.location.protocol}()?"http:":"https:",

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49912	194.147.100.102	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:47 UTC	497	OUT	GET /static/images/2.ico HTTP/1.1 Host: www.rr8844.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: UM_distinctid=194256e0475528-0a57ea5506af81-26031e51-140000-194256e0476637; CNZZDATA1281318611=1014212052-1735794755-%7C1735794755
2025-01-02 05:12:47 UTC	314	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:47 GMT Content-Type: image/x-icon Content-Length: 1608 Connection: close Strict-Transport-Security: max-age=31536000 Upgrade: h2 Last-Modified: Tue, 28 Nov 2023 11:07:18 GMT ETag: "648-60b346bf9c580" Server: nginx X-Cache-Status: HIT Accept-Ranges: bytes
2025-01-02 05:12:47 UTC	1608	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 32 00 32 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIF``CC22"}!1AQa"q2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49761	23.145.136.94	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:50 UTC	508	OUT	OPTIONS /getDataInit HTTP/1.1 Host: data.7wzx9.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://www.rr8844.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:50 UTC	539	IN	HTTP/1.1 200 Date: Thu, 02 Jan 2025 05:12:50 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: https://www.rr8844.com Access-Control-Allow-Methods: GET,POST,DELETE,PUT,PATCH Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: true Access-Control-Max-Age: 3600 Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH Server: cdn Strict-Transport-Security: max-age=31536000; X-Cache-Status: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49913	23.145.136.94	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:51 UTC	504	OUT	OPTIONS /forward HTTP/1.1 Host: data.7wzx9.com Connection: keep-alive Accept: / Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type Origin: https://www.rr8844.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Sec-Fetch-Mode: cors Sec-Fetch-Site: cross-site Sec-Fetch-Dest: empty Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:52 UTC	539	IN	HTTP/1.1 200 Date: Thu, 02 Jan 2025 05:12:52 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: https://www.rr8844.com Access-Control-Allow-Methods: GET,POST,DELETE,PUT,PATCH Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: true Access-Control-Max-Age: 3600 Allow: GET, HEAD, POST, PUT, DELETE, OPTIONS, PATCH Server: cdn Strict-Transport-Security: max-age=31536000; X-Cache-Status: MISS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49914	23.145.136.94	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:53 UTC	604	OUT	POST /getDataInit HTTP/1.1 Host: data.7wzx9.com Connection: keep-alive Content-Length: 42 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-type: application/json Accept: / Origin: https://www.rr8844.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:53 UTC	42	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4a 6f 68 6e 22 2c 22 61 67 65 22 3a 33 31 2c 22 63 69 74 79 22 3a 22 4e 65 77 20 59 6f 72 6b 22 7d Data Ascii: {"name":"John","age":31,"city":"New York"}
2025-01-02 05:12:54 UTC	508	IN	HTTP/1.1 200 Date: Thu, 02 Jan 2025 05:12:53 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: https://www.rr8844.com Access-Control-Allow-Credentials: true Set-Cookie: JSESSIONID=DD539C52D34B6F0980545F723E54BB04; Path=/; HttpOnly Server: cdn Strict-Transport-Security: max-age=31536000; X-Cache-Status: MISS
2025-01-02 05:12:54 UTC	15876	IN	Data Raw: 39 30 65 61 0d 0a 7b 22 65 72 72 6f 72 43 6f 64 65 22 3a 22 30 22 2c 22 6d 65 73 73 61 67 65 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 49 6d 67 66 69 6c 65 4e 61 6d 65 22 3a 22 74 79 7a 63 22 2c 22 77 65 62 49 6e 66 6f 4d 61 74 69 6f 6e 50 6f 4d 61 70 22 3a 6e 75 6c 6c 2c 22 75 70 6c 6f 61 64 44 65 74 61 69 6c 50 6f 4d 61 70 22 3a 6e 75 6c 6c 2c 22 6d 65 6e 75 30 4c 69 73 74 4d 61 70 22 3a 5b 7b 22 6d 65 6e 75 32 4c 69 73 74 22 3a 5b 7b 22 74 79 70 65 4e 61 6d 65 32 22 3a 22 39 31 e4 bc a0 e5 aa 92 22 2c 22 74 79 70 65 4d 69 64 32 22 3a 31 2c 22 74 79 70 65 49 64 32 22 3a 36 2c 22 68 72 65 66 22 3a 22 76 69 64 65 6f 2e 68 74 6d 6c 22 2c 22 73 6f 72 74 32 22 3a 31 2c 22 74 79 70 65 5f 6a 75 6d 70 75 72 6c 32 22 3a 22 22 7d 2c 7b 22 74 79 70 65 4e 61 Data Ascii: 90ea{"errorCode":"0","message":null,"data":{"ImgfileName":"tyzc","webInfoMationPoMap":null,"uploadDetailPoMap":null,"menu0ListMap":[{"menu2List":[{"typeName2":"91","typeMid2":1,"typeId2":6,"href":"video.html","sort2":1,"type_jumpurl2":""},{"typeNa
2025-01-02 05:12:54 UTC	16384	IN	Data Raw: 33 2c 22 74 79 70 65 5f 6a 75 6d 70 75 72 6c 32 22 3a 22 22 7d 2c 7b 22 74 79 70 65 4e 61 6d 65 32 22 3a 22 e9 80 81 e7 8e b0 e9 87 91 22 2c 22 74 79 70 65 4d 69 64 32 22 3a 32 2c 22 74 79 70 65 49 64 32 22 3a 31 34 30 2c 22 68 72 65 66 22 3a 22 68 74 74 70 73 3a 2f 2f 37 38 37 39 32 38 2e 63 6f 6d 3a 37 38 38 38 22 2c 22 73 6f 72 74 32 22 3a 34 2c 22 74 79 70 65 5f 6a 75 6d 70 75 72 6c 32 22 3a 22 22 7d 2c 7b 22 74 79 70 65 4e 61 6d 65 32 22 3a 22 e7 88 86 e5 a4 a7 e5 a5 96 22 2c 22 74 79 70 65 4d 69 64 32 22 3a 32 2c 22 74 79 70 65 49 64 32 22 3a 31 34 31 2c 22 68 72 65 66 22 3a 22 68 74 74 70 73 3a 2f 2f 37 38 37 39 32 38 2e 63 6f 6d 3a 37 38 38 38 22 2c 22 73 6f 72 74 32 22 3a 35 2c 22 74 79 70 65 5f 6a 75 6d 70 75 72 6c 32 22 3a 22 22 7d 2c 7b 22 74 Data Ascii: 3,"type_jumpurl2":""},{"typeName2":"","typeMid2":2,"typeId2":140,"href":"https://787928.com:7888","sort2":4,"type_jumpurl2":""},{"typeName2":"","typeMid2":2,"typeId2":141,"href":"https://787928.com:7888","sort2":5,"type_jumpurl2":""},{"t
2025-01-02 05:12:54 UTC	4851	IN	Data Raw: 2e 31 3a 38 38 30 38 2f 6d 6f 76 69 65 44 61 74 61 43 65 6e 74 65 72 2f 61 70 70 2f 6d 6f 76 69 65 41 70 69 2e 64 6f 22 2c 22 57 45 42 5f 42 41 43 4b 5f 54 49 43 4b 45 54 22 3a 22 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 38 38 30 38 2f 6d 6f 76 69 65 44 61 74 61 43 65 6e 74 65 72 2f 61 70 70 2f 6d 6f 76 69 65 41 70 69 2e 64 6f 22 2c 22 57 45 42 5f 4c 4f 47 49 4e 5f 42 59 5f 50 48 4f 4e 45 22 3a 22 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 38 38 30 38 2f 6d 6f 76 69 65 44 61 74 61 43 65 6e 74 65 72 2f 61 70 70 2f 6d 6f 76 69 65 41 70 69 2e 64 6f 22 2c 22 57 45 42 5f 53 45 4e 44 5f 50 48 4f 4e 45 5f 43 4f 44 45 22 3a 22 68 74 74 70 3a 2f 2f 31 32 37 2e 30 2e 30 2e 31 3a 38 38 30 38 2f 6d 6f 76 69 65 44 61 74 61 43 65 6e 74 65 72 2f 61 70 Data Ascii: .1:8808/movieDataCenter/app/movieApi.do","WEB_BACK_TICKET":"http://127.0.0.1:8808/movieDataCenter/app/movieApi.do","WEB_LOGIN_BY_PHONE":"http://127.0.0.1:8808/movieDataCenter/app/movieApi.do","WEB_SEND_PHONE_CODE":"http://127.0.0.1:8808/movieDataCenter/ap

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49915	23.145.136.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:56 UTC	349	OUT	GET /getDataInit HTTP/1.1 Host: data.7wzx9.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:56 UTC	241	IN	HTTP/1.1 405 Date: Thu, 02 Jan 2025 05:12:56 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Allow: POST Server: cdn Strict-Transport-Security: max-age=31536000; X-Cache-Status: MISS
2025-01-02 05:12:56 UTC	149	IN	Data Raw: 38 61 0d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 33 35 37 39 34 37 37 36 36 34 39 2c 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 65 72 72 6f 72 22 3a 22 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 2c 22 70 61 74 68 22 3a 22 2f 67 65 74 44 61 74 61 49 6e 69 74 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 8a{"timestamp":1735794776649,"status":405,"error":"Method Not Allowed","message":"Request method 'GET' not supported","path":"/getDataInit"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49916	104.26.10.58	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:57 UTC	620	OUT	GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnnjgp.jpg HTTP/1.1 Host: mtu.slinpic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:57 UTC	940	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:57 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 Cf-Bgj: h2pri ETag: W/"66dfaeb7-c155" Expires: Wed, 29 Jan 2025 04:00:05 GMT Last-Modified: Tue, 10 Sep 2024 02:28:07 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Age: 263416 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dnvB5pK4x4JR4O7rXS1kh8G5ZLqK8hrQbmbnyfes%2F9KiUSO3pjLbuhCfiV2Px%2FLkR%2BGJGT0Uws4EE0AbLlX0OV%2B823%2FKngoUfE5BWF3PxLStu45bf1TgqgpwLnV9FrmCKg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841d03f8bde95-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1496&min_rtt=1493&rtt_var=567&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=1198&delivery_rate=1916010&cwnd=240&unsent_bytes=0&cid=8b238fb8b74027b0&ts=135&x=0"
2025-01-02 05:12:57 UTC	429	IN	Data Raw: 37 63 38 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 01 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 04 00 02 03 05 06 01 07 08 ff c4 00 45 10 00 01 03 03 03 02 04 05 02 04 04 04 04 06 02 03 01 02 03 11 00 04 21 05 12 31 41 51 06 13 61 71 14 22 81 91 a1 Data Ascii: 7c89JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222X"E!1AQaq"
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 22 9b 4c 8e 84 69 01 48 71 9a e8 fc 50 07 0d 28 ae c4 9a ec 66 49 a0 06 c5 2a 7c 08 a5 1e 94 58 50 80 33 52 04 cf 5a 60 c5 3d 27 35 2e fd 16 88 ef 2f 9a b0 b7 de ec 99 24 21 20 72 62 7e 94 0d bd b2 9e 5d be a7 70 f1 42 d7 20 36 b1 19 e0 04 8e a2 0c cd 1d 7b 6c 2e ec ca 02 42 96 14 14 99 31 9e 0f e0 d7 51 6c e8 6d 2d dc 3d e6 a4 10 42 63 02 04 0c f6 02 bc ec f0 cb 3c 8a ba 5b 3e 9b c0 cb e3 62 f1 1c 9b a9 bb 55 ee ab d0 96 90 14 40 cd 30 8a 98 a4 93 8e 4d 74 b0 b0 99 22 bd 0e 49 76 7c dc a2 df 40 d0 45 28 c8 a9 4a 33 5c db 8a ab 33 a3 ad 24 17 01 27 00 d5 cd b2 83 63 74 64 9a a8 48 81 eb 47 b4 ec a5 30 72 39 ae 7c e9 b4 76 78 cd 45 9a 66 17 0d 8c c1 a2 1a 25 62 49 91 54 4c be b5 ba 94 72 0f 35 74 c9 30 3a 01 d2 bc ac 90 a6 7b 98 a7 c9 68 2a 31 02 9c 81 03 Data Ascii: "LiHqP(fI\|XP3RZ`='5./$! rb~]pB 6{l.B1Qlm-=Bc<[>bU@0Mt"Iv\|@E(J3\3$'ctdHG0r9\|vxEf%bITLr5t0:{h1
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: c3 a3 c8 cb 9d fd 46 ef 41 6e 29 40 18 56 3a d4 1e 72 a4 92 49 35 c2 e1 23 35 15 68 a2 ab 66 13 c8 db b4 75 67 72 a4 d7 29 46 6b b1 56 b4 65 6d b3 80 49 88 a2 11 68 b5 91 82 73 c5 3e d1 82 eb 80 0f ea 91 cd 6a 6d ad 51 6e d8 26 0a b9 92 2b 9f 3e 7f a7 a5 d9 db e3 78 af 26 df 46 69 cd 35 f6 86 e2 9c 73 50 9b 67 46 4a 4f bd 6b 1c 4a 56 65 47 1d aa 25 b4 d2 c1 04 02 3d 6b 08 f9 4f da 3a a5 e0 c7 d3 32 85 04 1c d2 8e 6a ca f2 d9 08 59 29 14 09 11 5d 71 9a 92 b4 70 4e 0e 0e 98 35 2a ed 28 cd 6c 72 9c ae c5 76 29 50 07 00 ae d2 1c 52 a0 68 e8 35 d8 15 c1 5d 02 81 a3 a0 53 56 04 71 4f cc d7 08 a2 c1 90 c6 44 57 48 34 f2 20 c5 77 68 38 e6 9d 93 56 45 9a 50 28 80 81 11 51 96 e0 d2 b4 37 16 86 41 3c 52 83 d4 54 a1 04 47 ed 4e 23 a4 51 61 c7 44 3b 2a 28 0a d4 10 85 Data Ascii: FAn)@V:rI5#5hfugr)FkVemIhs>jmQn&+>x&Fi5sPgFJOkJVeG%=kO:2jY)]qpN5(lrv)PRh5]SVqODWH4 wh8VEP(Q7A<RTGN#QaD;(
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: f6 1d 5d 81 b7 2d ac 32 43 8d 99 49 27 90 40 10 31 15 70 ca e2 9c 52 4e fe c4 cb 0a 9b 52 b6 ab ee 6f dc b7 53 96 c9 68 12 ca 94 d1 4e e4 e4 82 44 4f b8 aa 9f 0f 68 97 1a 51 29 b9 75 4f 3e e3 9b dd 79 00 27 cc 50 80 09 8c 70 06 28 f5 ea e8 6a f5 8b 67 5b 08 53 80 90 50 b9 2a 00 64 81 e9 39 f7 ab 06 2e 11 70 1b 71 a5 85 24 98 ce 0e 3d 3a f1 50 9d 96 d3 45 5d f3 85 09 79 96 9d 65 2f 38 54 a6 d0 a2 09 99 39 03 ad 67 ef 6d 9f 73 4c 75 c7 14 85 be e0 0d 84 a5 30 46 e4 c6 4f 62 60 fa 45 77 59 b6 72 e3 c4 a4 a1 27 73 68 42 b7 80 49 1c 9e 3b 8f 48 f5 ab b7 ad c2 92 87 0a 88 fe 62 48 49 c4 98 24 71 ea 6a e0 ad ab 22 6f 8c 5b 45 9d a2 82 1a 43 73 25 29 09 9e f0 22 8e 42 f1 55 16 ca 81 27 06 73 56 08 5e 05 74 ce 14 f4 72 e3 9d ad 86 85 57 42 81 a1 bc ca e8 70 4f 39 Data Ascii: ]-2CI'@1pRNRoShNDOhQ)uO>y'Pp(jg[SP*d9.pq$=:PE]ye/8T9gmsLu0FOb`EwYr'shBI;HbHI$qj"o[ECs%)"BU'sV^trWBpO9
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 06 ab 16 7f 98 67 83 56 16 67 20 01 9a e9 9c 52 8e 8e 48 4d ca 7b 0f 4c 01 00 71 9c 57 4a d4 08 8e 29 ed 22 49 93 cd 4a 1a 09 35 cb 69 1d a9 68 eb 52 51 91 9a 78 11 22 31 49 18 11 52 01 3d 6a 2c d1 22 12 d0 27 b5 3c 20 01 11 4e db 9e 6b a0 45 16 14 42 a6 12 7a 7d 6a 01 63 f3 08 38 9e 68 fa 40 53 52 68 4e 29 f6 31 0d 25 00 00 05 3e 26 95 76 a4 ae 88 0d ba 0c c8 aa db db 30 14 54 3a f0 2a e0 d0 b7 24 14 e7 8e d5 70 93 4c 89 c1 35 b3 2c eb 45 0b 21 40 cf 53 4c 06 04 0a b1 d4 36 2f 8c 11 f9 a0 12 93 23 19 af 42 12 b5 67 91 92 1c 64 d2 10 41 26 62 a6 41 09 49 13 04 d5 a5 b6 90 a5 37 b9 e5 14 a8 f0 06 60 57 6e b4 ad a1 05 9d ca 12 77 4d 64 f3 45 ba b3 68 f8 f3 4a e8 ab 8c 49 c1 35 2b 4b 00 46 05 4e ed a3 80 00 a1 c7 6e 94 65 ae 98 d1 42 5c 72 66 41 14 a5 92 29 Data Ascii: gVg RHM{LqWJ)"IJ5ihRQx"1IR=j,"'< NkEBz}jc8h@SRhN)1%>&v0T:*$pL5,E!@SL6/#BgdA&bAI7`WnwMdEhJI5+KFNneB\rfA)
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 54 48 d2 40 14 23 f3 9c 13 45 41 23 35 1a c0 00 92 29 a2 5a b3 15 b0 81 34 e4 c1 19 19 a4 24 9e 66 9c 11 3e 95 ed b6 7c c2 5b 26 61 80 e9 f9 94 02 7b 1a 57 1a 7a d0 37 20 6e 1e 9c d7 5b 10 00 98 cc e6 8d 2e 7c a3 71 c0 ea 2b 17 36 9d a3 a6 10 84 a3 4d 14 a5 30 48 20 82 39 06 b9 18 ab 1b b4 25 d0 54 91 91 d7 bd 01 15 b4 65 68 e5 c9 0e 0e 86 c5 28 a7 46 6b b1 e9 54 45 0d 8a 51 9a 75 76 04 7a d0 34 86 c0 e2 95 3a 2b a0 52 b1 d3 1b 15 d0 29 d1 4a 33 c5 2b 1a 47 20 d1 5a 73 7b ef 9a 07 a1 27 ec 2a 00 33 35 3b 17 ac d8 3a 1e 70 12 40 21 29 1c a8 9e 95 8e 79 56 37 fb 1d 3e 34 6f 2c 7f 71 97 ec 0b 8b 3b 96 e0 9f 3b 52 38 ef b1 20 63 d2 45 1e eb 61 9b e4 24 a8 6d 0c 21 21 4b 22 04 4c 8a 11 91 70 e2 92 2e 14 59 69 4b 2a 0d 20 49 04 99 24 9e 94 47 95 66 d6 a0 dd b2 Data Ascii: TH@#EA#5)Z4$f>\|[&a{Wz7 n[.\|q+6M0H 9%Teh(FkTEQuvz4:+R)J3+G Zs{'35;:p@!)yV7>4o,q;;R8 cEa$m!!K"Lp.YiK I$Gf
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: ee 75 17 52 a5 2c 3a a2 82 78 04 93 91 5e 45 59 ee da 40 61 a1 77 e2 94 5f 5a 97 03 a9 3b 1d 12 40 22 22 41 e9 ed 4e b9 d2 7f 8b 5f 39 76 94 1f 31 85 6d 2a 57 f9 88 32 08 3d 4c 0a bf b3 b6 f8 6b 22 b0 00 52 ce e2 7a 8a 2e d9 af 2e d1 29 48 00 ab 24 c4 e4 9a 7c 10 73 66 7f 59 d1 8e b3 a8 6d 57 cc 58 40 04 af 20 12 26 05 0d 77 62 b7 3c 33 6b a5 b4 54 00 70 8d a9 04 11 b4 99 cf bd 6b 82 12 1e 71 40 7c ca 56 7e 80 0a 8d 0d 7f c4 15 6d fe 90 7e 84 9a 4e 28 39 3d 19 4d 05 17 3a 56 91 7e 16 4b 90 49 99 82 d9 88 18 3c 99 a9 7c 25 79 79 72 dd ca 2f 94 64 11 b0 ac f2 73 20 13 57 eb b2 68 9b 82 5a 48 4b ee 20 ac 01 92 40 eb 55 ae 58 3d 6c ad 41 08 20 b6 b6 bf 90 20 7c a4 98 22 95 55 35 e8 ae 49 a7 7e c7 69 9a 83 3a cb 17 05 4c a8 06 55 b4 85 10 48 f5 04 41 06 a0 bd Data Ascii: uR,:x^EY@aw_Z;@""AN_9v1m*W2=Lk"Rz..)H$\|sfYmWX@ &wb<3kTpkq@\|V~m~N(9=M:V~KI<\|%yyr/ds WhZHK @UX=lA \|"U5I~i:LUHA
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 08 de 8c d1 6d 2a 70 b0 f2 82 c9 24 a4 83 32 07 a8 9a d2 f9 ac dc b0 a2 85 85 82 67 15 9f ba 68 a3 57 b0 40 fe 96 ec 5e 3c 4c 12 40 14 9a 5d 94 9b e9 96 fa 5b 2c ad e5 5d 25 49 53 c1 01 2b da 08 12 4e e2 60 f7 c5 5b d0 7a 7b 7e 53 05 24 83 04 01 02 38 00 51 93 5a 47 48 cd f6 2a 54 a6 94 d5 08 54 ab 93 9a 53 e9 40 1d a5 5c 06 bb 40 0a 2b 84 57 69 50 07 22 ba 29 45 2a 00 51 5c ae cd 34 91 34 00 e9 ae 13 4c dd 4d 2e 0e f4 00 f2 40 a6 15 c5 70 af 15 19 20 d0 02 5b a7 bd 42 56 4f 5a 71 c9 a6 c0 eb 40 86 12 48 9a 8c 93 de a6 31 15 11 19 aa 42 64 66 41 19 c5 67 9c 3f c4 bc 62 94 f2 ce 9c d6 e2 3a 17 55 c7 d8 7e 95 a4 5f 03 1d 6b 29 6c e2 b4 5f 15 dc 5b 3c 7f e1 f5 03 e6 36 e1 e4 2f b1 3f 71 f6 af 23 cf 5f fa 6b ba 3b 3c 7f d0 5a 1b ab d7 42 64 35 6f ba 00 24 c9 Data Ascii: mp$2ghW@^<L@][,]%IS+N`[z{~S$8QZGHTTS@\@+WiP")E*Q\44LM.@p [BVOZq@H1BdfAg?b:U~_k)l_[<6/?q#_k;<ZBd5o$
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 81 9e b5 04 98 ae 87 23 ad 00 4f 4a a1 0e 83 ef 4e f3 40 14 01 24 d3 49 a8 8b bd 8d 46 5c a0 09 8a ea 15 2f 34 c5 2c f7 a8 ca 89 e9 4e 89 6e 89 0a e9 85 c1 4d c9 e9 4c 28 33 91 4d 21 39 0f 2e d7 3c c9 a7 0b 75 a9 32 06 2b aa b5 5e dc 11 3d a9 d2 15 ba ba 18 5c c5 34 b9 4e 5d ba 81 e6 47 7a 89 6d 10 44 11 ea 69 a8 a2 1c da 3b e6 4d 29 26 b8 5a 09 00 93 1e f4 b7 a4 4c 9a ae 3f 02 e7 f2 31 f7 10 c3 65 c7 15 b5 09 c9 26 4c 0a a9 ba f2 35 25 36 46 96 ed d1 68 ee 6d 6e 8f 29 00 f7 05 50 4f d8 d5 a9 58 dd 83 4d 2a 9f 53 58 65 f0 e1 96 4a 52 bd 17 0f 29 c1 34 80 5c b6 d4 2e 52 a4 ae ed ab 34 28 ca 85 aa 37 2c ff 00 eb 56 27 d4 0a 0d cd 33 c3 da 61 0f 5f a9 a5 b8 32 17 7c ef 98 7e 80 98 1f 41 57 0b 31 dc 9f 4a f3 8f 1b da 39 75 e2 ab 4b 70 21 4e b4 81 ec 24 c9 fb Data Ascii: #OJN@$IF\/4,NnML(3M!9.<u2+^=\4N]GzmDi;M)&ZL?1e&L5%6Fhmn)POXM*SXeJR)4\.R4(7,V'3a_2\|~AW1J9uKp!N$
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: ad 31 37 39 d3 75 69 9c fe 42 58 b1 72 4a e9 ad 7c ec 6a f4 44 e9 be 35 6d 95 82 ab 5b d9 28 51 e7 74 1e 4f 32 0c 7d 22 b4 4b 6a d2 c9 48 f2 94 cb 0e 38 87 12 87 16 40 21 69 00 72 7d 64 f3 de a9 35 3d 5c eb 7a 5b 0d 37 6e fa 35 24 42 d2 e2 3f c8 ae 09 11 26 08 f4 aa 76 7c 27 a8 5f 3b 37 25 f5 2a 64 97 08 40 93 ea 49 3f 8a d2 94 d2 73 95 56 be 6c e6 b9 e2 93 58 a1 c9 37 76 dd 55 d6 87 e8 e5 0f 78 de e4 2d f1 72 85 ee 25 c4 8d a1 c2 20 f0 31 13 d2 b5 5a 5e c6 df d5 92 da 42 50 9b 94 6d 4a 40 00 08 1c 01 42 69 7e 12 1a 6d c2 6e 02 9b 0a 00 8f 94 a9 44 83 c8 92 40 fc 51 7a 7b 61 1a 96 b0 d1 e3 7b 6a fb 81 51 9e 71 96 d7 d9 7f 83 6f 0b 0e 4c 51 71 9d 5b 6d eb ef fb 96 49 05 e5 9d b3 1d fb 51 4d da a5 10 66 4f ad 33 ce 6d bf e5 b6 85 28 8e 42 10 49 ae f9 ef f0 Data Ascii: 179uiBXrJ\|jD5m[(QtO2}"KjH8@!ir}d5=\z[7n5$B?&v\|'_;7%*d@I?sVlX7vUx-r% 1Z^BPmJ@Bi~mnD@Qz{a{jQqoLQq[mIQMfO3m(BI

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49917	104.26.10.58	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:57 UTC	620	OUT	GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnn7uf.jpg HTTP/1.1 Host: mtu.slinpic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:57 UTC	938	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:57 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 Cf-Bgj: h2pri ETag: W/"66dfaeb7-db9c" Expires: Wed, 29 Jan 2025 04:00:05 GMT Last-Modified: Tue, 10 Sep 2024 02:28:07 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Age: 263416 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1FdAClzhJvzvd7JEld0fOrFELGc6vWeUSEBRnQRyQbbeWU1j%2B0tfZkqf2JfV4AxngV%2FSXUKGCocWHDHWnbZiUmhQaW0pA8r7%2Fal73FYcpC7XBU7Qf%2BXWI7Nvd2t5EdsnqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841d03acf41c0-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1720&rtt_var=661&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1198&delivery_rate=1634023&cwnd=210&unsent_bytes=0&cid=6fa1d047c03fdd49&ts=134&x=0"
2025-01-02 05:12:57 UTC	431	IN	Data Raw: 37 63 38 62 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 01 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 05 00 03 04 06 07 02 01 08 ff c4 00 4c 10 00 02 01 03 02 05 02 03 05 06 03 05 06 04 05 05 01 02 03 00 04 11 05 21 06 12 31 41 51 13 61 22 71 81 07 14 91 Data Ascii: 7c8bJFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222X"L!1AQa"q
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 59 d9 44 70 a7 b5 32 e3 06 a5 ba 15 e9 4d 08 19 ce f5 76 04 29 a1 f5 e2 28 3a 1d a8 15 ce 92 79 b9 23 5c 0c 82 4f ca ae 2b 6c 10 64 d4 69 62 5c 92 31 45 d8 01 b4 eb 46 b6 b7 54 61 b8 1b d4 e2 03 60 1e d5 e9 1b d7 a0 53 03 d0 40 c7 b5 65 1c 7d 29 1a f2 e0 90 42 1e 9f 3a d5 c8 ac 9f 8e c8 1a e1 04 67 e1 fe b5 33 d1 51 dd 13 fe cf 1c 9d 52 46 27 72 06 f5 a9 87 eb 59 47 00 64 6a 4f 81 b6 07 eb 5a 92 d2 86 87 3d 8f 87 ae 83 ed 4c 57 40 d5 10 3d cd 5e 83 4d 67 de ba 07 cd 00 76 46 48 3e 29 ca 68 3d 7b cf 4c 47 44 67 af 6a c5 38 df 4b b9 d4 f8 b5 56 24 25 08 03 9b b0 eb 5b 44 8f 88 d8 e7 a0 35 54 7b 4f 56 f5 6e 08 c8 e7 c6 71 e2 a2 6a d5 0d 32 bf 69 c3 d1 e8 bc 3d 34 33 90 d2 38 24 3e 37 04 8c 8a 91 6f 3d 96 a9 6d 6b 6d 71 20 4b 85 1c a7 3b 1c e2 af 52 d8 45 3c Data Ascii: YDp2Mv)(:y#\O+ldib\1EFTa`S@e})B:g3QRF'rYGdjOZ=LW@=^MgvFH>)h={LGDgj8KV$%[D5T{OVnqj2i=438$>7o=mkmq K;RE<
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 0d b1 53 bd 74 5a 22 98 c6 32 6b ae 4c d3 c2 2c 03 5e a8 c7 5a 4d 8e 86 79 00 15 ee 29 d2 01 d8 52 f4 c8 a5 63 a1 b1 d2 9c 5a f3 18 ae 80 fc 29 0e a8 eb 00 8a 43 95 4f ca bd 14 d4 a4 83 b6 f4 01 cc f3 67 61 50 dc 93 da a5 88 f3 d4 57 26 2c 93 b6 d4 d3 a1 10 31 93 5e f2 1a 95 f7 66 27 20 53 ab 6a c4 6f b5 55 a0 22 a4 64 f4 15 92 f1 e4 5c 9a e9 cf 5e 4f eb 5b 48 88 20 ac 6b ed 11 d5 38 87 24 ff 00 27 f5 ac e6 ed 17 0d 8f 7d 9e 82 da 8c b9 18 c0 15 a7 e3 06 b3 6f b3 ac 3e a7 21 1b 8e 51 5a 74 a3 0d d3 14 e1 a0 9e c6 eb dc d7 39 de bd ad 08 67 a0 e2 bd cd 73 4a 81 1d 83 5d 03 5c 66 96 69 01 d9 c3 02 a7 bd 36 6d a3 f4 c2 80 36 39 cd 74 0e f5 d0 34 c0 70 1c 00 3a e2 ba cd 35 9a 59 a0 76 0e d7 74 a1 ab da ac 44 e0 82 09 23 ae 29 9b 7d 22 5d 26 30 74 f6 04 63 e2 Data Ascii: StZ"2kL,^ZMy)RcZ)COgaPW&,1^f' SjoU"d\^O[H k8$'}o>!QZt9gsJ]\fi6m69t4p:5YvtD#)}"]&0tc
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: b5 75 de 93 63 a2 3b c1 b6 45 34 63 61 d4 54 ea 44 03 d4 51 61 44 20 31 d6 97 20 27 7a 91 24 63 19 1b 53 15 57 62 aa 16 00 18 c5 78 13 27 a5 76 2b a1 b5 00 25 40 05 7a 40 02 bd cd 78 7a 52 02 3c af 83 58 bf da 17 29 e2 12 58 7f 26 df 8d 6d 32 26 4e 6b 15 fb 43 18 e2 20 0f 50 9f d6 9b d0 e3 b0 8f d9 a8 ff 00 88 4b b6 36 1d 2b 4c b9 eb 59 8f d9 c4 87 f6 9c a4 0d b9 46 f5 a6 4a c5 89 aa 86 82 7b 1a ed 5e 67 14 89 ed 5c e6 b4 21 9d 02 2b ac d3 59 ae 81 a0 47 79 a5 9a e3 3b d7 b9 a0 0e ab d0 71 5c 03 5e 83 40 87 01 15 e1 20 57 22 91 e9 40 1c bc c9 1a 96 76 00 0e a6 a3 c5 aa 59 ce e5 23 9d 19 87 50 0d 2b 8b 58 e7 8d 95 c1 c1 1b d5 06 7d 3e 3d 33 5e 59 60 b8 20 31 20 83 d3 07 de b3 9c dc 2b 18 19 a0 db 13 24 8d 33 79 c0 a9 39 a8 d6 e4 7d dd 31 d0 8c d4 7b ad 52 Data Ascii: uc;E4caTDQaD 1 'z$cSWbx'v+%@z@xzR<X)X&m2&NkC PK6+LYFJ{^g\!+YGy;q\^@ W"@vY#P+X}>=3^Y` 1 +$3y9}1{R
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 9c f4 c6 26 38 15 89 7d a2 9c f1 11 27 af 26 df 8d 6d 6c 41 1d 6b 14 fb 45 c7 fb 45 91 b9 e4 fe b4 3d 0d 6c 93 f6 72 cc ba 8c 83 1b 10 2b 4f 7c e4 9f 35 98 7d 9f 96 fd a4 f9 18 f8 45 69 8e c6 aa 1a 26 7b 39 26 b8 cd 22 72 6b cc d6 84 1e e6 96 6b 9c d7 42 80 3a 15 ed 70 33 5d 66 80 3a af 73 5c 83 5e e6 80 3d 06 99 b9 bb 8a da 26 79 1c 0c 0e 84 f5 a7 81 a1 1a ed 83 dd 5b 16 89 39 d8 0e 99 eb 49 b6 95 a0 21 df 5d dd 7d c5 af e4 25 61 1b aa 2f 53 50 22 bc b1 d6 6d 12 1b 94 10 c8 77 04 9d f3 f3 a1 76 fa a6 a1 13 be 95 a9 40 c9 1c 80 fa 4c 77 1f 2f 9d 4a d1 34 c0 f2 4d 73 76 07 24 19 e5 1d 8e 3b d6 0d c9 b4 92 b4 f6 01 7d 32 fe 4b 2b 7b 9b 79 e5 0e f1 e7 90 93 d4 76 a0 a6 c1 f5 3b b1 34 cc ee ee 71 ca a7 65 1e 28 15 ee ae f7 7a a3 cb 11 28 8a 48 1c a3 b7 bd 19 Data Ascii: &8}'&mlAkEE=lr+O\|5}Ei&{9&"rkkB:p3]f:s\^=&y[9I!]}%a/SP"mwv@Lw/J4Msv$;}2K+{yv;4qe(z(H
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 53 18 cb 13 5c 9b d5 55 38 39 34 24 fa 07 47 0e 08 c8 35 8e 71 fa 13 c4 1b 1e 89 fd 6b 5a 96 e4 b9 f1 59 17 1e c9 8d 74 13 d7 97 fa d5 49 52 08 ec 9b c0 6a 3f 68 b1 07 7e 51 b5 68 ef de b3 8e 02 20 df b9 03 f9 45 68 ac d9 3b d5 71 e8 53 d8 d9 07 35 e1 ae 8d 73 56 40 85 74 2b 9c 57 a0 d0 07 54 ab 90 7d eb ac d3 03 dc d7 b9 18 ae 33 54 ee 35 e3 68 74 08 1a d2 d5 95 b5 06 1d 76 22 20 7b 91 dc f8 1f 53 49 e3 20 95 e1 16 5d 57 5d d3 74 48 04 da 85 d2 42 0f f0 a7 57 6f 92 8d cf e9 59 f6 af f6 b2 cc 5a 3d 26 d0 22 8d bd 59 b0 cd f3 00 1c 0f a9 35 99 6a 3a 9d de a3 75 25 d5 dc af 2c 92 13 cc f2 be 01 f6 cf f4 15 03 d6 84 11 cc 4c 84 7f 84 1e 51 f2 a8 b6 cb 49 22 cf 7f c5 3a b6 ab 38 9a 7b bb 89 5d 7a 04 21 42 fc 80 00 52 8b 88 f5 b8 a0 78 56 fe 7f 4d b3 cc ac e8 Data Ascii: S\U894$G5qkZYtIRj?h~Qh Eh;qS5sV@t+WT}3T5htv" {SI ]W]tHBWoYZ=&"Y5j:u%,LQI":8{]z!BRxVM
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 02 81 8f fa 80 8c e7 14 cb cc 07 53 4d 90 42 f5 a6 1f 72 69 a4 85 63 df 7b 03 a1 fa 57 bf 7b 27 b5 44 e5 af 79 4e 33 da aa 90 87 5e 5e 63 9c ed 5d 45 72 63 6c f5 a8 dd 29 51 40 11 96 ed 65 8f 07 63 51 0b fb d3 59 a4 09 a1 2a 1e c7 72 4e dd eb 2b e3 a5 03 5d 01 bb ae df 8d 6a 40 ef 59 57 1c 92 da fe fb e1 7f ad 4c f4 38 ec 2f f6 78 8b fb 46 40 7f c2 2b 43 99 00 63 8a ce 7e cf 8f fc 4a 40 4e 3e 11 5a 34 ac 0b 1c 1d a9 43 41 2d 8c 1e b5 e5 7a 6b 93 5a 90 7b 9a f3 35 e6 6b cc d0 07 79 a6 2e 6e 56 d6 03 33 82 51 46 4e 06 48 a7 41 ae 24 e5 28 c1 f1 c8 41 ce 7a 63 bd 0d 63 00 57 b5 fe 2f b4 d2 f4 37 bb 82 54 7b 87 1c b0 a1 39 df c9 1e 07 5f 7d 85 60 d7 f7 f2 dd dd 49 3c 8e 5e 67 62 5a 47 dc e4 ee 71 9e fe 49 fc 28 a7 13 ea 49 7b aa 4f 35 b7 c3 6b ce 44 0a 7a 91 Data Ascii: SMBric{W{'DyN3^^c]Ercl)Q@ecQY*rN+]j@YWL8/xF@+Cc~J@N>Z4CA-zkZ{5ky.nV3QFNHA$(AzccW/7T{9_}`I<^gbZGqI(I{O5kDz
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 8c 32 97 25 c3 30 3b e3 15 94 3c ed be 86 95 33 4a d0 b4 c8 34 cd 2a de 18 63 55 21 06 48 1d 76 a9 97 64 ad b9 0a 70 cd b0 a9 91 42 12 35 5f 00 0a 83 a8 c0 b7 73 08 43 94 11 8e 62 c3 b1 ae b6 e9 60 49 5b 1e a5 4a 95 66 59 ee 69 66 bc af 08 cd 00 75 93 da b9 c6 4e 4d 7b b5 78 58 03 bd 03 3c 7f e1 35 0d 86 f5 22 47 c8 c0 a6 48 cd 34 26 34 dd 6b d0 f8 18 a4 56 b9 20 e3 a5 50 84 4e f5 e6 6b 92 08 a5 4c 0e b2 33 5d 0e b5 c8 04 9a ec 29 a0 0f 73 8a ca 78 db 7d 7c e0 ff 00 2f f5 ad 54 83 81 59 4f 19 9c 6b ed 91 fc a2 a2 7a 2a 21 0e 06 ca 6a 6d 83 fc b5 a3 e7 26 b3 5e 08 39 d4 8e 3f c3 5a 48 1b d1 0d 04 b6 79 de bc 34 e7 21 3d 2b c3 19 ab b2 1a 1a 35 c1 91 41 c1 20 7c e9 f3 19 03 a5 33 25 ba 4a 30 cb f5 1d 69 df a1 51 e8 20 8c 83 91 ed 59 ff 00 1a 71 2c b0 c7 77 Data Ascii: 2%0;<3J4cU!HvdpB5_sCb`I[JfYifuNM{xX<5"GH4&4kV PNkL3])sx}\|/TYOkz!jm&^9?ZHy4!=+5A \|3%J0iQ Yq,w
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: 70 1b 1d 05 2a 4a 92 1a f6 68 11 5d db ce 9c f1 cc 8c be 73 55 9d 5f 5b 5b 6d 3b 55 b9 ca e1 50 aa 10 46 49 ae af e0 d3 ae ef c5 a5 a1 64 7c e6 57 8d b0 00 f7 aa 67 13 c5 61 7b ac da 68 5a 74 72 b9 2f fb d7 52 70 3d cd 0d 82 46 9e 0d 7b 9a e0 6d 5d 51 40 23 5e 13 4a bc a0 0f 09 35 c9 dc d7 a6 bc a0 67 85 6b 82 29 c0 46 6b dd a8 b1 50 d6 29 72 ed 5d d2 c6 69 a6 14 32 50 13 b5 79 e9 54 8c 57 b8 a2 c2 86 04 78 ae 80 f6 a7 82 d2 e4 cf 6a 2c 43 44 0f 15 91 f1 c2 1f db ec 41 fe 51 5b 17 a4 4f b5 63 fc 76 4c 5c 44 c0 f4 e4 07 f3 a9 9b b4 54 51 3f 80 a2 cd fb 9e e1 45 69 6b 16 f5 9c fd 9e b1 97 50 93 03 a0 15 a8 24 44 9e 98 a2 2e 90 e4 b2 73 1c 04 f4 1b 53 a6 d8 81 90 2a 4c 49 c8 b4 e6 32 29 39 3b 04 80 3a af af 6f 64 f2 40 01 91 46 70 4f 5a 05 61 c4 6b 7b 13 47 Data Ascii: pJh]sU_[[m;UPFId\|Wga{hZtr/Rp=F{m]Q@#^J5gk)FkP)r]i2PyTWxj,CDAQ[OcvL\DTQ?EikP$D.sSLI2)9;:od@FpOZak{G
2025-01-02 05:12:57 UTC	1369	IN	Data Raw: db a0 54 03 18 03 14 1f 8b 3d 38 f8 72 ed dc 67 08 48 3d c6 d5 69 e2 d1 35 d1 4e fb 38 84 4f a9 5f 5d 63 ac ad be 3a ee 4d 69 b5 4b fb 33 b4 f4 38 71 25 2b 86 7c 9c 9f 7a bb e0 05 2c 4e c0 64 d2 4f 03 6a d9 9f 7d a5 cf 04 16 29 cc e4 48 4e 02 83 b1 f9 d5 77 81 ec cf a8 de ab cb 1c 6c 85 c0 04 80 4d 31 c5 d7 4d c4 1c 63 1d 94 4c 0c 71 b6 09 27 60 3b d1 dd 73 5a b7 d3 2c ad f4 9d 32 21 25 d6 02 e5 46 e2 a5 bb 76 86 96 28 1f 36 b7 f7 66 96 c7 4a 42 d7 97 0e 40 3d 48 ed 92 68 ad 85 aa 70 fd a2 c3 12 8b 8d 5e e7 72 dd 48 3e 49 ec 05 0e d2 ad d3 46 20 c8 a2 7d 5a e7 65 1d 97 3f a0 1e 7b d5 e7 45 d0 8d 96 6e ae cf ab 77 26 ec c7 b7 b0 f0 29 c5 03 26 21 c8 cd 77 5e 0f 15 ed 50 8f 6b c2 37 af 45 2a 40 73 8c 9a 5c 99 ae eb a4 19 34 9b a1 d0 d7 a7 5e 88 b2 7b d4 82 Data Ascii: T=8rgH=i5N8O_]c:MiK38q%+\|z,NdOj})HNwlM1McLq'`;sZ,2!%Fv(6fJB@=Hhp^rH>IF }Ze?{Enw&)&!w^Pk7E*@s\4^{

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49919	104.26.10.58	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:58 UTC	620	OUT	GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unc7yj.jpg HTTP/1.1 Host: mtu.slinpic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:58 UTC	940	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:58 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 Cf-Bgj: h2pri ETag: W/"66dfae07-8130" Expires: Wed, 29 Jan 2025 04:00:05 GMT Last-Modified: Tue, 10 Sep 2024 02:25:11 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Age: 263417 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jIEmVkrY8K6uTYeSCMUnbp0FP7yf3HMH4I%2FyTk9KiprsXuCJ3jaUzjj7y5sSiO%2FTBcoDs8P%2Ff2qlIsXn29r%2FHBUps30OPAHq0eiagM0O7dlpa8miFGEHUCgvaPgp%2BRuxxQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841d4fb1cef9f-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1949&min_rtt=1939&rtt_var=749&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2824&recv_bytes=1198&delivery_rate=1441263&cwnd=219&unsent_bytes=0&cid=732b58f496d4567e&ts=136&x=0"
2025-01-02 05:12:58 UTC	429	IN	Data Raw: 37 63 38 39 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 01 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 ff c4 00 3f 10 00 01 03 03 03 03 02 05 02 05 03 03 03 04 03 01 01 00 02 11 03 04 21 05 31 41 12 51 61 71 81 06 13 22 91 a1 b1 Data Ascii: 7c89JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222X"?!1AQaq"
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: c8 73 64 38 66 56 dd a5 c8 b9 a0 1c 63 a8 61 de bd d4 ed 17 ee 9f 13 b2 21 2f ea 82 88 34 88 e1 21 09 c4 84 87 f2 81 84 79 84 c2 3d d4 87 64 d2 10 54 78 87 6d 84 81 4b 50 4b 7d 14 43 d5 42 4e 42 41 d9 2c a1 b3 c1 4e 07 d9 46 0a 70 29 04 a0 fd 93 c1 51 03 d9 3c 1c 80 a6 a1 20 29 e0 e0 28 81 ca 78 2a 3c 1b 48 0a 70 3c 1d 94 60 a7 83 b2 90 f1 ba 50 71 09 92 9d 2a 43 c7 a7 d9 2c a6 04 a0 c4 20 70 f0 96 73 b2 40 8f c2 94 1c 12 a6 88 dd 2c a0 51 ba 54 d9 1b 22 51 07 25 4d dc 22 50 2c f2 8f 09 06 70 89 40 e9 ca 49 42 10 2c f8 44 fb a4 06 20 23 f4 40 b3 9f 29 0a 39 fd 92 04 0b b1 f2 82 8e 50 88 09 0f dd 2a 42 81 3f 08 27 12 8f ca 32 80 9e c9 3d d1 ec 93 9e e8 15 09 11 e5 02 fa a2 72 8e c9 3d 50 72 c7 b7 08 29 b3 ec 85 56 82 70 89 39 94 4e 50 0f fe 50 07 02 11 29 Data Ascii: sd8fVca!/4!y=dTxmKPK}CBNBA,NFp)Q< )(x<Hp<`PqC, ps@,QT"Q%M"P,p@IB,D #@)9P*B?'2=r=Pr)Vp9NPP)
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: db 84 e8 1d 93 80 1d 90 47 9c 42 20 ce 01 52 47 b2 22 3b a0 e1 4c 82 41 04 11 82 0e e0 a4 f4 5d 5f c4 7a 21 a8 1f 7f 6a cf ac 09 ad 4c 0f ea f2 3c f7 ee b9 39 98 8d bb a8 5a 5d 95 12 9a 78 ee 89 c2 24 e9 ca 25 36 72 89 e5 02 c8 de 51 b2 49 fc 20 6d ca 07 20 14 d0 51 3c 20 78 c2 50 70 9a 12 ce 14 00 80 41 04 4a bb a6 5c c1 36 ef 39 19 61 3f a2 a7 29 8e ea 6b 9b 51 86 1c d3 21 48 e8 a7 28 9c 64 28 2d eb b6 e2 83 6a 03 9d 88 ec 79 53 48 85 35 52 67 b2 43 99 4a 52 12 a0 34 e1 46 e0 23 21 48 7b a6 39 12 ac 64 12 3b 20 1f 64 b5 04 65 34 15 01 e9 41 1f e0 94 c0 70 94 b8 88 19 24 98 00 6e 50 3f ac 01 b8 1e b8 0a 2b 9b eb 6b 4a 45 f5 eb 31 ad 00 93 27 65 85 f1 0e b8 74 cb 47 b9 ae 68 79 c3 67 24 fa 70 bc ce f7 59 ad a9 be a0 ac f7 7c c1 30 64 80 7c 11 b7 f9 e1 69 Data Ascii: GB RG";LA]_z!jL<9Z]x$%6rQI m Q< xPpAJ\69a?)kQ!H(d(-jySH5RgCJR4F#!H{9d; de4Ap$nP?+kJE1'etGhyg$pY\|0d\|i
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 4b 4e cd 15 6a 5b 0e 87 83 5a 88 20 11 1f d2 3c 78 f0 9b 73 6e c2 49 00 16 10 08 20 98 23 b8 f0 a4 63 c1 77 ca aa 40 27 12 46 08 e6 7c a4 a6 0b 3a e9 c6 5a 4c b4 f1 de 0f 63 82 9e 3c 27 52 f4 ce 7d b0 0d 9a 78 33 ce 67 d1 40 65 ae 00 8e 92 4c c2 d5 e8 24 10 40 04 7e 7c a8 aa 53 06 a3 81 20 13 89 89 1e 9f a2 99 7e e5 c7 ec 65 b5 72 d1 0e 38 da 77 21 6f 68 ba dd c6 9d 76 ca d4 5c 7e 65 33 3b c0 70 ec 40 dc 1e 57 35 d1 d1 52 24 17 70 36 05 5a b5 ac 18 e7 f5 82 01 1b 03 91 e9 f8 55 cb 19 53 8d 7d 19 f0 be b3 43 54 b3 a7 5a 89 22 9d 4c 16 1d e9 bc 01 2d 3f 69 07 9c ad f6 8f a5 dc c1 20 79 5e 15 f0 47 c4 27 47 d4 85 27 bf f9 57 04 36 26 00 78 38 3f 7c 1f 05 7b 95 b5 46 d4 a0 d7 03 25 c0 9f 31 bc ae 5b 35 5a 6d 61 82 5b 31 8d 87 a2 7c 1c a1 82 1a 07 84 f0 aa 1a Data Ascii: KNj[Z <xsnI #cw@'F\|:ZLc<'R}x3g@eL$@~\|S ~er8w!ohv\~e3;p@W5R$p6ZUS}CTZ"L-?i y^G'G'W6&x8?\|{F%1[5Zma[1\|
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 13 01 de 52 ca 24 8e 9c 16 93 23 21 6b da 5c 0b 8a 21 d3 f5 0c 11 fb ac 83 f8 4e b7 ae 6d ab 87 7f b1 d8 21 27 48 b1 b9 29 a4 a4 90 40 20 c8 39 04 20 9d bb a9 40 3e 17 3d f1 25 db e9 d8 be 8d 11 35 2a ff 00 2c 13 b3 64 19 71 f0 06 7d d6 ed 5a 81 8c 2e 27 fe 56 05 ed 06 d5 b8 75 5a ae 02 98 11 1c bb 33 f6 9f bc 00 b4 e3 9b bb 57 3b a9 a6 0e 97 a0 53 b6 b6 69 a8 43 9c df a8 b9 e3 69 d8 c7 3f e7 95 53 58 b9 b7 b6 b8 2e ac ef 9d 52 a1 07 a4 92 1c 44 40 c0 d8 42 bd ac ea 8f b6 a0 18 c0 1a 4e 40 18 2e 24 e0 18 cf 73 8f d1 63 1b 4a 34 5c 2b d4 1f c4 5e 3a 1e f2 60 b6 9f 60 7c ed e0 44 65 6f 6e a2 92 5a cb ba ea b8 73 09 b5 a5 6e c3 99 00 92 71 b0 93 81 ed ee ab be dd f5 5a c2 d6 41 80 0c 08 d8 91 27 8d a1 6d 1b 7a f7 6e 7d 5a cf 71 2e cc 91 24 8e 3d 3c 05 76 df Data Ascii: R$#!k\!Nm!'H)@ 9 @>=%5*,dq}Z.'VuZ3W;SiCi?SX.RD@BN@.$scJ4\+^:``\|DeonZsnqZA'mzn}Zq.$=<v
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 46 e0 4f 2a 0e a6 98 20 92 36 82 64 ff 00 92 8a 44 b2 5b 07 a4 12 40 24 7b aa d8 bc bd a6 a8 c0 5d d6 d8 21 c2 4f 81 b2 eb ff 00 d3 4d 50 69 9f 16 db 17 13 d1 54 1a 27 9c 91 02 57 20 d3 fc a7 37 78 c8 e6 42 d7 f8 5f 1a f5 a3 5c 60 97 88 3b c1 e3 1c e7 0a 99 77 2a d3 cb ea 60 f0 48 e0 80 41 1b 67 65 2b 01 00 0f 00 85 42 da a9 ad a6 db 56 26 5d 51 8c 26 38 38 cf f9 dd 69 0f ea 88 e1 72 ac 48 c8 4e 8e e8 e7 d0 27 42 80 88 44 89 99 01 12 d0 3f a8 7d d0 2c 24 8c ec 8e b6 e2 09 9f 01 1d 53 b3 49 f6 40 10 88 44 b8 ec cf 72 51 f5 ce cd 1e ea 41 05 11 94 43 cf 20 78 01 27 43 bf ef 8f 40 a0 2c 18 c6 52 42 3e 5f 77 1f 64 9f 2c 4e 49 3e a5 01 81 ba 24 77 1f 74 a2 93 47 fb 7e e9 dd 02 30 d1 f6 41 19 7b 79 70 48 5e d9 81 27 d0 29 8b 46 00 00 4f 84 d2 00 e4 0f 74 11 f5 Data Ascii: FO* 6dD[@${]!OMPiT'W 7xB_\`;w*`HAge+BV&]Q&88irHN'BD?},$SI@DrQAC x'C@,RB>_wd,NI>$wtG~0A{ypH^')FOt
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: a8 d2 d4 69 17 37 e9 aa dc 3d 93 90 7b 8f 09 f9 5a 55 d2 60 ec 9a 49 1c 22 70 65 21 7f 07 ee aa b3 8f f8 97 42 34 9c 6f ad 19 f4 1c d5 63 46 c7 b8 5c b9 3e eb d5 5c 41 04 11 20 8d 8a e2 7e 21 d1 3f 82 79 bb b6 6f fe 9d c7 ea 68 ff 00 61 fe ca 65 4b 02 51 29 0a 49 ca 90 f9 44 a6 4a 59 e1 03 8a 49 3d e5 24 a2 4a 07 03 91 22 47 8c ad a6 54 14 34 87 b9 85 c0 3c 82 5c c0 41 30 30 24 88 f5 80 4f 65 8a c0 e7 d4 63 1a 09 73 88 00 0e 49 38 57 29 de 36 dd f5 ed 5e 03 8d 3a 8f 68 7b 01 92 01 22 76 fd 16 fc 13 79 31 e7 df b5 98 f3 f2 2b 8a e4 f5 5c 54 3f 2e 95 32 df a6 9c ee 40 e5 d3 3b ed ea bb fd 0b 4c 6d b5 9b 0b 84 d4 8c 93 be 77 f7 5c 8e 9b 69 4e fb 5f a2 f7 92 e2 d0 5c 1a 4e 00 1e 3f 18 f2 bd 1a 9b 43 18 d1 ef 3d d5 b9 2f 7a 4f 14 d4 da ad db eb 53 a7 14 da 0f Data Ascii: i7={ZU`I"pe!B4ocF\>\A ~!?yohaeKQ)IDJYI=$J"GT4<\A00$OecsI8W)6^:h{"vy1+\T?.2@;Lmw\iN_\N?C=/zOS
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 00 74 19 1b 65 53 3c 3d be 1b 71 e5 ef 9b ad 3b 3a 1f 24 91 fa 2b a2 00 24 94 ac 02 04 1d f2 92 a6 1b b6 eb 9a f7 5b ce 91 54 7c 78 2b 3a e7 50 65 29 93 9e 00 4f b9 af 92 01 d9 63 57 a6 6b 93 13 2a f8 e3 2f 95 72 ba f0 9a ae b7 49 b8 9f 19 30 a9 5c 6b b4 1c d2 1c c9 1c 10 42 8f fe 8f 52 b3 b7 6f a9 e1 27 ff 00 4c d4 32 43 c1 27 72 04 15 be 33 09 e6 b0 ca e7 5c e6 a9 5e 95 77 12 c6 90 49 d8 f0 b2 22 09 06 3f 65 d7 d5 f8 5e be 7a 5e d2 33 82 20 85 ce df e9 d5 ec aa 9f 9a c2 04 c4 85 d3 c7 67 89 5c 9c 98 65 3b b1 4b 12 0a 70 12 63 ba 70 6f 53 4e 01 81 25 2d 31 20 82 04 83 ca d7 4c 92 db 1f e6 01 00 8d bd d7 a7 ff 00 a6 14 1e cb cb 9b 86 80 44 06 03 b9 1b 9f d9 79 95 26 91 54 71 1e 17 b4 7f a6 56 85 ba 25 4a a5 a4 17 d5 2e 99 e0 00 07 e6 56 1c fd 62 d7 8f b7 Data Ascii: teS<=q;:$+$[T\|x+:Pe)OcWk*/rI0\kBRo'L2C'r3\^wI"?e^z^3 g\e;KpcpoSN%-1 LDy&TqV%J.Vb
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 30 78 1f 95 e8 f4 98 18 d9 dc 9c 93 e5 73 72 f2 7b ae 97 c2 6a 1d 09 43 7c a7 47 84 a0 65 62 b9 03 42 58 ca 50 30 94 05 09 24 08 44 04 ee c9 22 4a 06 c0 e1 2c 25 8c a5 8d c2 06 10 92 07 94 f3 d9 24 65 03 63 1b 22 33 29 d1 94 42 06 90 9a 46 13 c8 1e e9 23 3d 90 30 e2 70 a3 a8 3e 82 3b 82 3f 0a 53 1d d3 08 90 50 55 d1 cc da 3d b0 09 0e 3e ca fe 7f ed 0b 3b 48 10 6e 29 e7 0e e0 2d 3f a7 68 79 fb 2b 61 e2 23 3f aa a3 20 93 b8 1e fb a7 47 91 f7 4a 40 3f ff 00 17 b9 21 2c 71 d3 1e ea ca 3b 54 21 0b a9 80 42 10 80 42 10 82 3a c3 aa 99 0a ae a2 d0 34 fa 8d 1c 00 3d 55 e2 01 dd 53 d4 bf fc 27 f9 85 9e 73 ab 56 9e 5c d8 18 88 dd 64 dd d2 eb af 5e 9c 7f 5d bd 56 c7 ff 00 e4 ad a6 8f a8 88 d8 2c e7 b2 35 5a 60 e7 a8 39 bf 70 42 e3 ce 7e da e8 e2 ba ce 39 7f 83 af 7f Data Ascii: 0xsr{jC\|GebBXP0$D"J,%$ec"3)BF#=0p>;?SPU=>;Hn)-?hy+a#? GJ@?!,q;T!BB:4=US'sV\d^]V,5Z`9pB~9
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 20 63 95 ce dc d2 2d 26 41 05 76 57 c5 bf 2c 90 42 e6 2f 40 24 c4 49 95 9b 79 97 4c 57 ee 42 68 20 42 9d f4 1e 49 81 82 9f 6b 49 83 51 b6 15 fe 9a 66 ab 43 89 d8 09 e5 4a db 5d a1 4e a5 20 c6 fb 91 e5 6a 90 0d b9 71 5a 17 7a 33 99 5d ae a5 0f 69 38 82 13 75 2b 17 5a da b4 f4 90 37 98 54 b2 d4 6e 39 ea 84 00 42 a1 5c 82 0e 54 f5 ab 02 f2 06 4c aa e6 09 20 9c 2b c8 ae 55 0b 1e 0b a3 90 ad 34 02 32 b3 6a c5 2b d0 d0 60 38 4a bf 49 f8 04 e3 95 36 18 a7 0c 1d 90 1a 07 08 0e 10 97 a8 28 5f 50 a0 00 a5 a6 30 0a 84 1c ab 34 84 91 99 45 32 d4 5b b7 a4 6a 54 a6 c0 27 25 c7 d0 7f e5 75 54 a9 06 48 00 01 01 66 69 d6 61 94 db 58 ff 00 5b 80 03 c0 95 b0 07 d4 71 c6 14 b8 f3 bb a7 01 b7 a2 70 00 78 40 18 1e 89 e0 76 45 44 25 03 1d d2 80 94 04 48 03 84 00 65 38 0c a3 94 Data Ascii: c-&AvW,B/@$IyLWBh BIkIQfCJ]N jqZz3]i8u+Z7Tn9B\TL +U42j+`8JI6(_P04E2[jT'%uTHfiaX[qpx@vED%He8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49922	104.26.11.58	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:58 UTC	386	OUT	GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnnjgp.jpg HTTP/1.1 Host: mtu.slinpic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:58 UTC	945	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:58 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 Cf-Bgj: h2pri ETag: W/"66dfaeb7-c155" Expires: Wed, 29 Jan 2025 04:00:05 GMT Last-Modified: Tue, 10 Sep 2024 02:28:07 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Age: 263417 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Px0gYbzFruUzSmL5%2FOJiJzS3lDQ23Aq1PKNOpRmDg2drVJUZn8lNDo%2BQhrsC%2FkHX5O%2BcCclE96xua3Yg6JDzOzQwhx43m4usTMeXaUN%2BxyQ%2FPOtqyE%2B6Toh9G%2BLo63S8tQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841d52dd6426d-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1788&min_rtt=1776&rtt_var=691&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=964&delivery_rate=1556503&cwnd=230&unsent_bytes=0&cid=fe56332c9570d267&ts=151&x=0"
2025-01-02 05:12:58 UTC	424	IN	Data Raw: 37 63 38 33 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 01 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 04 00 02 03 05 06 01 07 08 ff c4 00 45 10 00 01 03 03 03 02 04 05 02 04 04 04 04 06 02 03 01 02 03 11 00 04 21 05 12 31 41 51 06 13 61 71 14 22 81 91 a1 Data Ascii: 7c83JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222X"E!1AQaq"
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: c6 0a ef a5 76 22 9b 4c 8e 84 69 01 48 71 9a e8 fc 50 07 0d 28 ae c4 9a ec 66 49 a0 06 c5 2a 7c 08 a5 1e 94 58 50 80 33 52 04 cf 5a 60 c5 3d 27 35 2e fd 16 88 ef 2f 9a b0 b7 de ec 99 24 21 20 72 62 7e 94 0d bd b2 9e 5d be a7 70 f1 42 d7 20 36 b1 19 e0 04 8e a2 0c cd 1d 7b 6c 2e ec ca 02 42 96 14 14 99 31 9e 0f e0 d7 51 6c e8 6d 2d dc 3d e6 a4 10 42 63 02 04 0c f6 02 bc ec f0 cb 3c 8a ba 5b 3e 9b c0 cb e3 62 f1 1c 9b a9 bb 55 ee ab d0 96 90 14 40 cd 30 8a 98 a4 93 8e 4d 74 b0 b0 99 22 bd 0e 49 76 7c dc a2 df 40 d0 45 28 c8 a9 4a 33 5c db 8a ab 33 a3 ad 24 17 01 27 00 d5 cd b2 83 63 74 64 9a a8 48 81 eb 47 b4 ec a5 30 72 39 ae 7c e9 b4 76 78 cd 45 9a 66 17 0d 8c c1 a2 1a 25 62 49 91 54 4c be b5 ba 94 72 0f 35 74 c9 30 3a 01 d2 bc ac 90 a6 7b 98 a7 c9 68 2a Data Ascii: v"LiHqP(fI\|XP3RZ`='5./$! rb~]pB 6{l.B1Qlm-=Bc<[>bU@0Mt"Iv\|@E(J3\3$'ctdHG0r9\|vxEf%bITLr5t0:{h
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 4e 2b d1 86 25 c3 a3 c8 cb 9d fd 46 ef 41 6e 29 40 18 56 3a d4 1e 72 a4 92 49 35 c2 e1 23 35 15 68 a2 ab 66 13 c8 db b4 75 67 72 a4 d7 29 46 6b b1 56 b4 65 6d b3 80 49 88 a2 11 68 b5 91 82 73 c5 3e d1 82 eb 80 0f ea 91 cd 6a 6d ad 51 6e d8 26 0a b9 92 2b 9f 3e 7f a7 a5 d9 db e3 78 af 26 df 46 69 cd 35 f6 86 e2 9c 73 50 9b 67 46 4a 4f bd 6b 1c 4a 56 65 47 1d aa 25 b4 d2 c1 04 02 3d 6b 08 f9 4f da 3a a5 e0 c7 d3 32 85 04 1c d2 8e 6a ca f2 d9 08 59 29 14 09 11 5d 71 9a 92 b4 70 4e 0e 0e 98 35 2a ed 28 cd 6c 72 9c ae c5 76 29 50 07 00 ae d2 1c 52 a0 68 e8 35 d8 15 c1 5d 02 81 a3 a0 53 56 04 71 4f cc d7 08 a2 c1 90 c6 44 57 48 34 f2 20 c5 77 68 38 e6 9d 93 56 45 9a 50 28 80 81 11 51 96 e0 d2 b4 37 16 86 41 3c 52 83 d4 54 a1 04 47 ed 4e 23 a4 51 61 c7 44 3b 2a Data Ascii: N+%FAn)@V:rI5#5hfugr)FkVemIhs>jmQn&+>x&Fi5sPgFJOkJVeG%=kO:2jY)]qpN5(lrv)PRh5]SVqODWH4 wh8VEP(Q7A<RTGN#QaD;
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: b6 95 ac ad cb f6 1d 5d 81 b7 2d ac 32 43 8d 99 49 27 90 40 10 31 15 70 ca e2 9c 52 4e fe c4 cb 0a 9b 52 b6 ab ee 6f dc b7 53 96 c9 68 12 ca 94 d1 4e e4 e4 82 44 4f b8 aa 9f 0f 68 97 1a 51 29 b9 75 4f 3e e3 9b dd 79 00 27 cc 50 80 09 8c 70 06 28 f5 ea e8 6a f5 8b 67 5b 08 53 80 90 50 b9 2a 00 64 81 e9 39 f7 ab 06 2e 11 70 1b 71 a5 85 24 98 ce 0e 3d 3a f1 50 9d 96 d3 45 5d f3 85 09 79 96 9d 65 2f 38 54 a6 d0 a2 09 99 39 03 ad 67 ef 6d 9f 73 4c 75 c7 14 85 be e0 0d 84 a5 30 46 e4 c6 4f 62 60 fa 45 77 59 b6 72 e3 c4 a4 a1 27 73 68 42 b7 80 49 1c 9e 3b 8f 48 f5 ab b7 ad c2 92 87 0a 88 fe 62 48 49 c4 98 24 71 ea 6a e0 ad ab 22 6f 8c 5b 45 9d a2 82 1a 43 73 25 29 09 9e f0 22 8e 42 f1 55 16 ca 81 27 06 73 56 08 5e 05 74 ce 14 f4 72 e3 9d ad 86 85 57 42 81 a1 bc Data Ascii: ]-2CI'@1pRNRoShNDOhQ)uO>y'Pp(jg[SP*d9.pq$=:PE]ye/8T9gmsLu0FOb`EwYr'shBI;HbHI$qj"o[ECs%)"BU'sV^trWB
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 7b 55 95 80 09 06 ab 16 7f 98 67 83 56 16 67 20 01 9a e9 9c 52 8e 8e 48 4d ca 7b 0f 4c 01 00 71 9c 57 4a d4 08 8e 29 ed 22 49 93 cd 4a 1a 09 35 cb 69 1d a9 68 eb 52 51 91 9a 78 11 22 31 49 18 11 52 01 3d 6a 2c d1 22 12 d0 27 b5 3c 20 01 11 4e db 9e 6b a0 45 16 14 42 a6 12 7a 7d 6a 01 63 f3 08 38 9e 68 fa 40 53 52 68 4e 29 f6 31 0d 25 00 00 05 3e 26 95 76 a4 ae 88 0d ba 0c c8 aa db db 30 14 54 3a f0 2a e0 d0 b7 24 14 e7 8e d5 70 93 4c 89 c1 35 b3 2c eb 45 0b 21 40 cf 53 4c 06 04 0a b1 d4 36 2f 8c 11 f9 a0 12 93 23 19 af 42 12 b5 67 91 92 1c 64 d2 10 41 26 62 a6 41 09 49 13 04 d5 a5 b6 90 a5 37 b9 e5 14 a8 f0 06 60 57 6e b4 ad a1 05 9d ca 12 77 4d 64 f3 45 ba b3 68 f8 f3 4a e8 ab 8c 49 c1 35 2b 4b 00 46 05 4e ed a3 80 00 a1 c7 6e 94 65 ae 98 d1 42 5c 72 66 Data Ascii: {UgVg RHM{LqWJ)"IJ5ihRQx"1IR=j,"'< NkEBz}jc8h@SRhN)1%>&v0T:*$pL5,E!@SL6/#BgdA&bAI7`WnwMdEhJI5+KFNneB\rf
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 53 e9 8a 07 91 54 48 d2 40 14 23 f3 9c 13 45 41 23 35 1a c0 00 92 29 a2 5a b3 15 b0 81 34 e4 c1 19 19 a4 24 9e 66 9c 11 3e 95 ed b6 7c c2 5b 26 61 80 e9 f9 94 02 7b 1a 57 1a 7a d0 37 20 6e 1e 9c d7 5b 10 00 98 cc e6 8d 2e 7c a3 71 c0 ea 2b 17 36 9d a3 a6 10 84 a3 4d 14 a5 30 48 20 82 39 06 b9 18 ab 1b b4 25 d0 54 91 91 d7 bd 01 15 b4 65 68 e5 c9 0e 0e 86 c5 28 a7 46 6b b1 e9 54 45 0d 8a 51 9a 75 76 04 7a d0 34 86 c0 e2 95 3a 2b a0 52 b1 d3 1b 15 d0 29 d1 4a 33 c5 2b 1a 47 20 d1 5a 73 7b ef 9a 07 a1 27 ec 2a 00 33 35 3b 17 ac d8 3a 1e 70 12 40 21 29 1c a8 9e 95 8e 79 56 37 fb 1d 3e 34 6f 2c 7f 71 97 ec 0b 8b 3b 96 e0 9f 3b 52 38 ef b1 20 63 d2 45 1e eb 61 9b e4 24 a8 6d 0c 21 21 4b 22 04 4c 8a 11 91 70 e2 92 2e 14 59 69 4b 2a 0d 20 49 04 99 24 9e 94 47 95 Data Ascii: STH@#EA#5)Z4$f>\|[&a{Wz7 n[.\|q+6M0H 9%Teh(FkTEQuvz4:+R)J3+G Zs{'35;:p@!)yV7>4o,q;;R8 cEa$m!!K"Lp.YiK I$G
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 7d b6 98 d0 d4 ee 75 17 52 a5 2c 3a a2 82 78 04 93 91 5e 45 59 ee da 40 61 a1 77 e2 94 5f 5a 97 03 a9 3b 1d 12 40 22 22 41 e9 ed 4e b9 d2 7f 8b 5f 39 76 94 1f 31 85 6d 2a 57 f9 88 32 08 3d 4c 0a bf b3 b6 f8 6b 22 b0 00 52 ce e2 7a 8a 2e d9 af 2e d1 29 48 00 ab 24 c4 e4 9a 7c 10 73 66 7f 59 d1 8e b3 a8 6d 57 cc 58 40 04 af 20 12 26 05 0d 77 62 b7 3c 33 6b a5 b4 54 00 70 8d a9 04 11 b4 99 cf bd 6b 82 12 1e 71 40 7c ca 56 7e 80 0a 8d 0d 7f c4 15 6d fe 90 7e 84 9a 4e 28 39 3d 19 4d 05 17 3a 56 91 7e 16 4b 90 49 99 82 d9 88 18 3c 99 a9 7c 25 79 79 72 dd ca 2f 94 64 11 b0 ac f2 73 20 13 57 eb b2 68 9b 82 5a 48 4b ee 20 ac 01 92 40 eb 55 ae 58 3d 6c ad 41 08 20 b6 b6 bf 90 20 7c a4 98 22 95 55 35 e8 ae 49 a7 7e c7 69 9a 83 3a cb 17 05 4c a8 06 55 b4 85 10 48 f5 Data Ascii: }uR,:x^EY@aw_Z;@""AN_9v1m*W2=Lk"Rz..)H$\|sfYmWX@ &wb<3kTpkq@\|V~m~N(9=M:V~KI<\|%yyr/ds WhZHK @UX=lA \|"U5I~i:LUH
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 46 6a a6 c1 7f 08 de 8c d1 6d 2a 70 b0 f2 82 c9 24 a4 83 32 07 a8 9a d2 f9 ac dc b0 a2 85 85 82 67 15 9f ba 68 a3 57 b0 40 fe 96 ec 5e 3c 4c 12 40 14 9a 5d 94 9b e9 96 fa 5b 2c ad e5 5d 25 49 53 c1 01 2b da 08 12 4e e2 60 f7 c5 5b d0 7a 7b 7e 53 05 24 83 04 01 02 38 00 51 93 5a 47 48 cd f6 2a 54 a6 94 d5 08 54 ab 93 9a 53 e9 40 1d a5 5c 06 bb 40 0a 2b 84 57 69 50 07 22 ba 29 45 2a 00 51 5c ae cd 34 91 34 00 e9 ae 13 4c dd 4d 2e 0e f4 00 f2 40 a6 15 c5 70 af 15 19 20 d0 02 5b a7 bd 42 56 4f 5a 71 c9 a6 c0 eb 40 86 12 48 9a 8c 93 de a6 31 15 11 19 aa 42 64 66 41 19 c5 67 9c 3f c4 bc 62 94 f2 ce 9c d6 e2 3a 17 55 c7 d8 7e 95 a4 5f 03 1d 6b 29 6c e2 b4 5f 15 dc 5b 3c 7f e1 f5 03 e6 36 e1 e4 2f b1 3f 71 f6 af 23 cf 5f fa 6b ba 3b 3c 7f d0 5a 1b ab d7 42 64 35 Data Ascii: Fjmp$2ghW@^<L@][,]%IS+N`[z{~S$8QZGHTTS@\@+WiP")E*Q\44LM.@p [BVOZq@H1BdfAg?b:U~_k)l_[<6/?q#_k;<ZBd5
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 50 07 42 bb d3 81 9e b5 04 98 ae 87 23 ad 00 4f 4a a1 0e 83 ef 4e f3 40 14 01 24 d3 49 a8 8b bd 8d 46 5c a0 09 8a ea 15 2f 34 c5 2c f7 a8 ca 89 e9 4e 89 6e 89 0a e9 85 c1 4d c9 e9 4c 28 33 91 4d 21 39 0f 2e d7 3c c9 a7 0b 75 a9 32 06 2b aa b5 5e dc 11 3d a9 d2 15 ba ba 18 5c c5 34 b9 4e 5d ba 81 e6 47 7a 89 6d 10 44 11 ea 69 a8 a2 1c da 3b e6 4d 29 26 b8 5a 09 00 93 1e f4 b7 a4 4c 9a ae 3f 02 e7 f2 31 f7 10 c3 65 c7 15 b5 09 c9 26 4c 0a a9 ba f2 35 25 36 46 96 ed d1 68 ee 6d 6e 8f 29 00 f7 05 50 4f d8 d5 a9 58 dd 83 4d 2a 9f 53 58 65 f0 e1 96 4a 52 bd 17 0f 29 c1 34 80 5c b6 d4 2e 52 a4 ae ed ab 34 28 ca 85 aa 37 2c ff 00 eb 56 27 d4 0a 0d cd 33 c3 da 61 0f 5f a9 a5 b8 32 17 7c ef 98 7e 80 98 1f 41 57 0b 31 dc 9f 4a f3 8f 1b da 39 75 e2 ab 4b 70 21 4e b4 Data Ascii: PB#OJN@$IF\/4,NnML(3M!9.<u2+^=\4N]GzmDi;M)&ZL?1e&L5%6Fhmn)POXM*SXeJR)4\.R4(7,V'3a_2\|~AW1J9uKp!N
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 28 12 41 06 41 ad 31 37 39 d3 75 69 9c fe 42 58 b1 72 4a e9 ad 7c ec 6a f4 44 e9 be 35 6d 95 82 ab 5b d9 28 51 e7 74 1e 4f 32 0c 7d 22 b4 4b 6a d2 c9 48 f2 94 cb 0e 38 87 12 87 16 40 21 69 00 72 7d 64 f3 de a9 35 3d 5c eb 7a 5b 0d 37 6e fa 35 24 42 d2 e2 3f c8 ae 09 11 26 08 f4 aa 76 7c 27 a8 5f 3b 37 25 f5 2a 64 97 08 40 93 ea 49 3f 8a d2 94 d2 73 95 56 be 6c e6 b9 e2 93 58 a1 c9 37 76 dd 55 d6 87 e8 e5 0f 78 de e4 2d f1 72 85 ee 25 c4 8d a1 c2 20 f0 31 13 d2 b5 5a 5e c6 df d5 92 da 42 50 9b 94 6d 4a 40 00 08 1c 01 42 69 7e 12 1a 6d c2 6e 02 9b 0a 00 8f 94 a9 44 83 c8 92 40 fc 51 7a 7b 61 1a 96 b0 d1 e3 7b 6a fb 81 51 9e 71 96 d7 d9 7f 83 6f 0b 0e 4c 51 71 9d 5b 6d eb ef fb 96 49 05 e5 9d b3 1d fb 51 4d da a5 10 66 4f ad 33 ce 6d bf e5 b6 85 28 8e 42 10 Data Ascii: (AA179uiBXrJ\|jD5m[(QtO2}"KjH8@!ir}d5=\z[7n5$B?&v\|'_;7%*d@I?sVlX7vUx-r% 1Z^BPmJ@Bi~mnD@Qz{a{jQqoLQq[mIQMfO3m(B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49921	104.26.11.58	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:58 UTC	386	OUT	GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/xnn7uf.jpg HTTP/1.1 Host: mtu.slinpic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:58 UTC	943	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:58 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 Cf-Bgj: h2pri ETag: W/"66dfaeb7-db9c" Expires: Wed, 29 Jan 2025 04:00:05 GMT Last-Modified: Tue, 10 Sep 2024 02:28:07 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Age: 263417 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WVX6ivHc9TNqjMBVm%2BedtYMu%2F0%2BoIOTdWvvEuE4C9c%2FkjgwRktsws571508wHQV8JX7bQnHiB64589ST4gfKfRUpCZ2G%2FXZqOChv1vzwyFJo2RNM92%2FHu%2Fs1oQjrbwZx2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841d52b910c7a-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1545&min_rtt=1449&rtt_var=735&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=964&delivery_rate=1316501&cwnd=200&unsent_bytes=0&cid=0de576980c74e84f&ts=157&x=0"
2025-01-02 05:12:58 UTC	426	IN	Data Raw: 33 39 63 65 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 01 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 05 00 03 04 06 07 02 01 08 ff c4 00 4c 10 00 02 01 03 02 05 02 03 05 06 03 05 06 04 05 05 01 02 03 00 04 11 05 21 06 12 31 41 51 13 61 22 71 81 07 14 91 Data Ascii: 39ceJFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222X"L!1AQa"q
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: d4 d9 42 e7 73 59 d9 44 70 a7 b5 32 e3 06 a5 ba 15 e9 4d 08 19 ce f5 76 04 29 a1 f5 e2 28 3a 1d a8 15 ce 92 79 b9 23 5c 0c 82 4f ca ae 2b 6c 10 64 d4 69 62 5c 92 31 45 d8 01 b4 eb 46 b6 b7 54 61 b8 1b d4 e2 03 60 1e d5 e9 1b d7 a0 53 03 d0 40 c7 b5 65 1c 7d 29 1a f2 e0 90 42 1e 9f 3a d5 c8 ac 9f 8e c8 1a e1 04 67 e1 fe b5 33 d1 51 dd 13 fe cf 1c 9d 52 46 27 72 06 f5 a9 87 eb 59 47 00 64 6a 4f 81 b6 07 eb 5a 92 d2 86 87 3d 8f 87 ae 83 ed 4c 57 40 d5 10 3d cd 5e 83 4d 67 de ba 07 cd 00 76 46 48 3e 29 ca 68 3d 7b cf 4c 47 44 67 af 6a c5 38 df 4b b9 d4 f8 b5 56 24 25 08 03 9b b0 eb 5b 44 8f 88 d8 e7 a0 35 54 7b 4f 56 f5 6e 08 c8 e7 c6 71 e2 a2 6a d5 0d 32 bf 69 c3 d1 e8 bc 3d 34 33 90 d2 38 24 3e 37 04 8c 8a 91 6f 3d 96 a9 6d 6b 6d 71 20 4b 85 1c a7 3b 1c e2 Data Ascii: BsYDp2Mv)(:y#\O+ldib\1EFTa`S@e})B:g3QRF'rYGdjOZ=LW@=^MgvFH>)h={LGDgj8KV$%[D5T{OVnqj2i=438$>7o=mkmq K;
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: cd 99 72 76 af 0d b1 53 bd 74 5a 22 98 c6 32 6b ae 4c d3 c2 2c 03 5e a8 c7 5a 4d 8e 86 79 00 15 ee 29 d2 01 d8 52 f4 c8 a5 63 a1 b1 d2 9c 5a f3 18 ae 80 fc 29 0e a8 eb 00 8a 43 95 4f ca bd 14 d4 a4 83 b6 f4 01 cc f3 67 61 50 dc 93 da a5 88 f3 d4 57 26 2c 93 b6 d4 d3 a1 10 31 93 5e f2 1a 95 f7 66 27 20 53 ab 6a c4 6f b5 55 a0 22 a4 64 f4 15 92 f1 e4 5c 9a e9 cf 5e 4f eb 5b 48 88 20 ac 6b ed 11 d5 38 87 24 ff 00 27 f5 ac e6 ed 17 0d 8f 7d 9e 82 da 8c b9 18 c0 15 a7 e3 06 b3 6f b3 ac 3e a7 21 1b 8e 51 5a 74 a3 0d d3 14 e1 a0 9e c6 eb dc d7 39 de bd ad 08 67 a0 e2 bd cd 73 4a 81 1d 83 5d 03 5c 66 96 69 01 d9 c3 02 a7 bd 36 6d a3 f4 c2 80 36 39 cd 74 0e f5 d0 34 c0 70 1c 00 3a e2 ba cd 35 9a 59 a0 76 0e d7 74 a1 ab da ac 44 e0 82 09 23 ae 29 9b 7d 22 5d 26 30 Data Ascii: rvStZ"2kL,^ZMy)RcZ)COgaPW&,1^f' SjoU"d\^O[H k8$'}o>!QZt9gsJ]\fi6m69t4p:5YvtD#)}"]&0
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: b6 f4 ea ae 31 b5 75 de 93 63 a2 3b c1 b6 45 34 63 61 d4 54 ea 44 03 d4 51 61 44 20 31 d6 97 20 27 7a 91 24 63 19 1b 53 15 57 62 aa 16 00 18 c5 78 13 27 a5 76 2b a1 b5 00 25 40 05 7a 40 02 bd cd 78 7a 52 02 3c af 83 58 bf da 17 29 e2 12 58 7f 26 df 8d 6d 32 26 4e 6b 15 fb 43 18 e2 20 0f 50 9f d6 9b d0 e3 b0 8f d9 a8 ff 00 88 4b b6 36 1d 2b 4c b9 eb 59 8f d9 c4 87 f6 9c a4 0d b9 46 f5 a6 4a c5 89 aa 86 82 7b 1a ed 5e 67 14 89 ed 5c e6 b4 21 9d 02 2b ac d3 59 ae 81 a0 47 79 a5 9a e3 3b d7 b9 a0 0e ab d0 71 5c 03 5e 83 40 87 01 15 e1 20 57 22 91 e9 40 1c bc c9 1a 96 76 00 0e a6 a3 c5 aa 59 ce e5 23 9d 19 87 50 0d 2b 8b 58 e7 8d 95 c1 c1 1b d5 06 7d 3e 3d 33 5e 59 60 b8 20 31 20 83 d3 07 de b3 9c dc 2b 18 19 a0 db 13 24 8d 33 79 c0 a9 39 a8 d6 e4 7d dd 31 d0 Data Ascii: 1uc;E4caTDQaD 1 'z$cSWbx'v+%@z@xzR<X)X&m2&NkC PK6+LYFJ{^g\!+YGy;q\^@ W"@vY#P+X}>=3^Y` 1 +$3y9}1
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 4d 72 72 3a d7 9c f4 c6 26 38 15 89 7d a2 9c f1 11 27 af 26 df 8d 6d 6c 41 1d 6b 14 fb 45 c7 fb 45 91 b9 e4 fe b4 3d 0d 6c 93 f6 72 cc ba 8c 83 1b 10 2b 4f 7c e4 9f 35 98 7d 9f 96 fd a4 f9 18 f8 45 69 8e c6 aa 1a 26 7b 39 26 b8 cd 22 72 6b cc d6 84 1e e6 96 6b 9c d7 42 80 3a 15 ed 70 33 5d 66 80 3a af 73 5c 83 5e e6 80 3d 06 99 b9 bb 8a da 26 79 1c 0c 0e 84 f5 a7 81 a1 1a ed 83 dd 5b 16 89 39 d8 0e 99 eb 49 b6 95 a0 21 df 5d dd 7d c5 af e4 25 61 1b aa 2f 53 50 22 bc b1 d6 6d 12 1b 94 10 c8 77 04 9d f3 f3 a1 76 fa a6 a1 13 be 95 a9 40 c9 1c 80 fa 4c 77 1f 2f 9d 4a d1 34 c0 f2 4d 73 76 07 24 19 e5 1d 8e 3b d6 0d c9 b4 92 b4 f6 01 7d 32 fe 4b 2b 7b 9b 79 e5 0e f1 e7 90 93 d4 76 a0 a6 c1 f5 3b b1 34 cc ee ee 71 ca a7 65 1e 28 15 ee ae f7 7a a3 cb 11 28 8a 48 Data Ascii: Mrr:&8}'&mlAkEE=lr+O\|5}Ei&{9&"rkkB:p3]f:s\^=&y[9I!]}%a/SP"mwv@Lw/J4Msv$;}2K+{yv;4qe(z(H
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 90 48 39 a6 9a 53 18 cb 13 5c 9b d5 55 38 39 34 24 fa 07 47 0e 08 c8 35 8e 71 fa 13 c4 1b 1e 89 fd 6b 5a 96 e4 b9 f1 59 17 1e c9 8d 74 13 d7 97 fa d5 49 52 08 ec 9b c0 6a 3f 68 b1 07 7e 51 b5 68 ef de b3 8e 02 20 df b9 03 f9 45 68 ac d9 3b d5 71 e8 53 d8 d9 07 35 e1 ae 8d 73 56 40 85 74 2b 9c 57 a0 d0 07 54 ab 90 7d eb ac d3 03 dc d7 b9 18 ae 33 54 ee 35 e3 68 74 08 1a d2 d5 95 b5 06 1d 76 22 20 7b 91 dc f8 1f 53 49 e3 20 95 e1 16 5d 57 5d d3 74 48 04 da 85 d2 42 0f f0 a7 57 6f 92 8d cf e9 59 f6 af f6 b2 cc 5a 3d 26 d0 22 8d bd 59 b0 cd f3 00 1c 0f a9 35 99 6a 3a 9d de a3 75 25 d5 dc af 2c 92 13 cc f2 be 01 f6 cf f4 15 03 d6 84 11 cc 4c 84 7f 84 1e 51 f2 a8 b6 cb 49 22 cf 7f c5 3a b6 ab 38 9a 7b bb 89 5d 7a 04 21 42 fc 80 00 52 8b 88 f5 b8 a0 78 56 fe 7f Data Ascii: H9S\U894$G5qkZYtIRj?h~Qh Eh;qS5sV@t+WT}3T5htv" {SI ]W]tHBWoYZ=&"Y5j:u%,LQI":8{]z!BRxV
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 00 8a 66 5c e7 02 81 8f fa 80 8c e7 14 cb cc 07 53 4d 90 42 f5 a6 1f 72 69 a4 85 63 df 7b 03 a1 fa 57 bf 7b 27 b5 44 e5 af 79 4e 33 da aa 90 87 5e 5e 63 9c ed 5d 45 72 63 6c f5 a8 dd 29 51 40 11 96 ed 65 8f 07 63 51 0b fb d3 59 a4 09 a1 2a 1e c7 72 4e dd eb 2b e3 a5 03 5d 01 bb ae df 8d 6a 40 ef 59 57 1c 92 da fe fb e1 7f ad 4c f4 38 ec 2f f6 78 8b fb 46 40 7f c2 2b 43 99 00 63 8a ce 7e cf 8f fc 4a 40 4e 3e 11 5a 34 ac 0b 1c 1d a9 43 41 2d 8c 1e b5 e5 7a 6b 93 5a 90 7b 9a f3 35 e6 6b cc d0 07 79 a6 2e 6e 56 d6 03 33 82 51 46 4e 06 48 a7 41 ae 24 e5 28 c1 f1 c8 41 ce 7a 63 bd 0d 63 00 57 b5 fe 2f b4 d2 f4 37 bb 82 54 7b 87 1c b0 a1 39 df c9 1e 07 5f 7d 85 60 d7 f7 f2 dd dd 49 3c 8e 5e 67 62 5a 47 dc e4 ee 71 9e fe 49 fc 28 a7 13 ea 49 7b aa 4f 35 b7 c3 6b Data Ascii: f\SMBric{W{'DyN3^^c]Ercl)Q@ecQY*rN+]j@YWL8/xF@+Cc~J@N>Z4CA-zkZ{5ky.nV3QFNHA$(AzccW/7T{9_}`I<^gbZGqI(I{O5k
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 0e 95 c5 ba 75 8c 32 97 25 c3 30 3b e3 15 94 3c ed be 86 95 33 4a d0 b4 c8 34 cd 2a de 18 63 55 21 06 48 1d 76 a9 97 64 ad b9 0a 70 cd b0 a9 91 42 12 35 5f 00 0a 83 a8 c0 b7 73 08 43 94 11 8e 62 c3 b1 ae b6 e9 60 49 5b 1e a5 4a 95 66 59 ee 69 66 bc af 08 cd 00 75 93 da b9 c6 4e 4d 7b b5 78 58 03 bd 03 3c 7f e1 35 0d 86 f5 22 47 c8 c0 a6 48 cd 34 26 34 dd 6b d0 f8 18 a4 56 b9 20 e3 a5 50 84 4e f5 e6 6b 92 08 a5 4c 0e b2 33 5d 0e b5 c8 04 9a ec 29 a0 0f 73 8a ca 78 db 7d 7c e0 ff 00 2f f5 ad 54 83 81 59 4f 19 9c 6b ed 91 fc a2 a2 7a 2a 21 0e 06 ca 6a 6d 83 fc b5 a3 e7 26 b3 5e 08 39 d4 8e 3f c3 5a 48 1b d1 0d 04 b6 79 de bc 34 e7 21 3d 2b c3 19 ab b2 1a 1a 35 c1 91 41 c1 20 7c e9 f3 19 03 a5 33 25 ba 4a 30 cb f5 1d 69 df a1 51 e8 20 8c 83 91 ed 59 ff 00 1a Data Ascii: u2%0;<3J4cU!HvdpB5_sCb`I[JfYifuNM{xX<5"GH4&4kV PNkL3])sx}\|/TYOkz!jm&^9?ZHy4!=+5A \|3%J0iQ Y
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 42 6e 46 12 c8 70 1b 1d 05 2a 4a 92 1a f6 68 11 5d db ce 9c f1 cc 8c be 73 55 9d 5f 5b 5b 6d 3b 55 b9 ca e1 50 aa 10 46 49 ae af e0 d3 ae ef c5 a5 a1 64 7c e6 57 8d b0 00 f7 aa 67 13 c5 61 7b ac da 68 5a 74 72 b9 2f fb d7 52 70 3d cd 0d 82 46 9e 0d 7b 9a e0 6d 5d 51 40 23 5e 13 4a bc a0 0f 09 35 c9 dc d7 a6 bc a0 67 85 6b 82 29 c0 46 6b dd a8 b1 50 d6 29 72 ed 5d d2 c6 69 a6 14 32 50 13 b5 79 e9 54 8c 57 b8 a2 c2 86 04 78 ae 80 f6 a7 82 d2 e4 cf 6a 2c 43 44 0f 15 91 f1 c2 1f db ec 41 fe 51 5b 17 a4 4f b5 63 fc 76 4c 5c 44 c0 f4 e4 07 f3 a9 9b b4 54 51 3f 80 a2 cd fb 9e e1 45 69 6b 16 f5 9c fd 9e b1 97 50 93 03 a0 15 a8 24 44 9e 98 a2 2e 90 e4 b2 73 1c 04 f4 1b 53 a6 d8 81 90 2a 4c 49 c8 b4 e6 32 29 39 3b 04 80 3a af af 6f 64 f2 40 01 91 46 70 4f 5a 05 61 Data Ascii: BnFpJh]sU_[[m;UPFId\|Wga{hZtr/Rp=F{m]Q@#^J5gk)FkP)r]i2PyTWxj,CDAQ[OcvL\DTQ?EikP$D.sSLI2)9;:od@FpOZa
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: b4 e8 6c a2 11 db a0 54 03 18 03 14 1f 8b 3d 38 f8 72 ed dc 67 08 48 3d c6 d5 69 e2 d1 35 d1 4e fb 38 84 4f a9 5f 5d 63 ac ad be 3a ee 4d 69 b5 4b fb 33 b4 f4 38 71 25 2b 86 7c 9c 9f 7a bb e0 05 2c 4e c0 64 d2 4f 03 6a d9 9f 7d a5 cf 04 16 29 cc e4 48 4e 02 83 b1 f9 d5 77 81 ec cf a8 de ab cb 1c 6c 85 c0 04 80 4d 31 c5 d7 4d c4 1c 63 1d 94 4c 0c 71 b6 09 27 60 3b d1 dd 73 5a b7 d3 2c ad f4 9d 32 21 25 d6 02 e5 46 e2 a5 bb 76 86 96 28 1f 36 b7 f7 66 96 c7 4a 42 d7 97 0e 40 3d 48 ed 92 68 ad 85 aa 70 fd a2 c3 12 8b 8d 5e e7 72 dd 48 3e 49 ec 05 0e d2 ad d3 46 20 c8 a2 7d 5a e7 65 1d 97 3f a0 1e 7b d5 e7 45 d0 8d 96 6e ae cf ab 77 26 ec c7 b7 b0 f0 29 c5 03 26 21 c8 cd 77 5e 0f 15 ed 50 8f 6b c2 37 af 45 2a 40 73 8c 9a 5c 99 ae eb a4 19 34 9b a1 d0 d7 a7 5e Data Ascii: lT=8rgH=i5N8O_]c:MiK38q%+\|z,NdOj})HNwlM1McLq'`;sZ,2!%Fv(6fJB@=Hhp^rH>IF }Ze?{Enw&)&!w^Pk7E*@s\4^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49920	104.26.10.58	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:58 UTC	620	OUT	GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unbndf.jpg HTTP/1.1 Host: mtu.slinpic.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.rr8844.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:58 UTC	941	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:58 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 Cf-Bgj: h2pri ETag: W/"66dfae06-829f" Expires: Thu, 09 Jan 2025 11:01:42 GMT Last-Modified: Tue, 10 Sep 2024 02:25:10 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Age: 1966158 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SqyzDVwbEehdSmjIiigyyeH%2FFoD%2FEy4oShDUybZoM5qLkUHyy57ML6SAkJ1A%2BTCNOvn04l%2BjEIqP9HlU2ThUPR96C68TAxcV4s39cHAAdyNDbXOYxlSvqs0FU%2BM9QRC7aQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841d52b668ca1-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1950&min_rtt=1784&rtt_var=1002&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2826&recv_bytes=1198&delivery_rate=936798&cwnd=168&unsent_bytes=0&cid=365ee555de2cc4ed&ts=155&x=0"
2025-01-02 05:12:58 UTC	428	IN	Data Raw: 37 63 38 38 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 01 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 ff c4 00 44 10 00 01 04 01 02 04 03 07 02 05 02 04 04 05 05 00 01 00 02 03 11 21 04 31 05 12 41 51 06 61 71 07 13 22 81 91 a1 Data Ascii: 7c88JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222X"D!1AQaq"
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 4a 93 73 e8 a1 b0 64 71 1e 96 91 b2 f8 b6 a4 41 19 63 6c b9 c0 35 a0 1d cf f9 67 d0 2f 38 f1 66 b8 30 fe 8e 3c ff 00 f5 0d d1 71 bc 8f 4b fb 0f 35 d4 71 ce 2f fa 21 aa d6 38 02 4b cc 3a 7b 16 0d 0f 89 df 2d 87 f7 5e 4b af d7 ba 47 39 c4 93 9d ce e7 fa 95 16 ee ea 36 c2 6b b5 6d 46 a4 3c 97 17 f2 80 4d 9d 8d 0f d9 65 bf 50 75 0e 00 5b 62 07 1d cf 9f f4 4c 9e 4f 7e f2 5e 43 63 1b 90 72 7c bd 12 49 2b 60 68 f7 a6 9c 45 86 55 90 3f 01 5c 9a 2b 6a 40 43 1b 66 c0 e8 4a 8e e6 d4 9b ba 60 15 44 d0 f5 27 aa ae 1c e9 24 05 e0 d5 d8 02 89 3d aa f0 14 c2 50 19 44 07 11 b0 b3 4d f5 ee 55 e9 1b 5a 63 34 f1 96 ba 59 4b df b8 68 14 07 a7 f7 52 3b 51 00 e6 68 64 af 07 20 17 50 f5 20 7f 55 45 ce 1c c5 c4 e6 ab 18 24 fe ca 66 c4 0b 1a f9 0f 23 09 c1 3b 93 e9 d4 a2 c0 7b 27 Data Ascii: JsdqAcl5g/8f0<qK5q/!8K:{-^KG96kmF<MePu[bLO~^Ccr\|I+`hEU?\+j@CfJ`D'$=PDMUZc4YKhR;Qhd P UE$f#;{'
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: c6 3a 05 6b 4f 20 8d 94 f7 bd 8f 0d a2 5a 6c 1a ea 3a 25 2a b2 9d 74 c7 e2 7a 87 cb 4f 31 08 5c e0 48 a2 49 b1 eb d6 ff 00 25 62 64 38 35 b2 90 ed e8 9c 9f af 55 ad c4 5c d7 ca 5a 26 20 b8 07 06 96 e4 bb be 2c 01 e5 6b 29 e5 8f 34 40 b1 8c 8a 0a b6 cf 49 98 f2 d7 01 a9 68 11 91 56 70 41 f2 3d 4f 91 b5 3f e8 22 d4 b4 fe 9e 6b 78 60 25 af f8 4b 87 a6 db e2 c6 14 71 4a 20 6f 2b da 44 4e 35 60 87 37 e4 7f b2 9e 7d 0b 65 60 7e 98 46 64 6e 43 19 b1 3d c0 27 07 ae 0f c9 5c a9 be 54 e4 74 dc 3e 2b 63 03 6f e0 73 32 40 ae 84 66 8f d8 8d 95 79 48 d6 b4 49 66 37 37 05 cc 34 01 f3 1d 3e 49 1f 2e a6 29 2a 58 e4 0e 06 ab a8 1e 57 b8 37 b2 86 dd a7 94 ca c1 51 90 41 0d 18 27 d3 a2 9b 57 84 11 b2 68 1e e8 e6 6b a8 8c 1b b0 e0 7a 8f 24 e8 e4 7e 8e 50 c7 38 fe 9d d4 58 ea Data Ascii: :kO Zl:%tzO1\HI%bd85U\Z& ,k)4@IhVpA=O?"kx`%KqJ o+DN5`7}e`~FdnC='\Tt>+cos2@fyHIf774>I.)XW7QA'Whkz$~P8X
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 67 5c 4c c5 3c dc 31 ce 25 ed 3e f6 30 4e f9 c8 1f 2f c2 99 75 47 2e 3b 9b 9f 0f 54 61 b6 e7 71 82 95 44 d7 87 b4 3d b9 07 2a 40 6c 5a a7 31 52 a4 42 01 52 a4 b4 02 80 75 a2 d3 6d 16 50 0e b4 89 10 81 a2 a1 22 12 34 a1 2a 02 17 45 60 10 84 24 02 10 84 00 84 21 30 10 84 24 02 10 84 03 49 49 d1 08 29 51 b2 1d 94 6e cf a2 7b b6 4c 77 64 a9 98 53 2f 24 f9 61 2b 8e 54 72 1a c9 d8 0b a4 1b 89 f6 8b c5 1b a4 e1 32 69 c3 88 32 8e 52 41 c5 03 67 f0 05 f9 f9 af 07 e2 0f e7 75 82 6e f2 7b 9e ab d1 fd a7 f1 46 4b c4 8e 91 af 0e 7c 4c e5 cd e0 9c 9f 2e df 45 e5 5a b7 97 96 b6 cd 66 c7 71 7b a5 8f 77 6d 3c 63 15 cd 17 19 2f 04 10 05 ec 3f ba 03 48 6d 9c 38 8c 57 40 90 10 5d 64 02 07 40 36 29 d6 6e b7 71 dc 76 ec 16 89 36 89 70 68 c1 38 1d 28 29 1d cb 1b 7d db 2d c4 55 Data Ascii: g\L<1%>0N/uG.;TaqD=@lZ1RBRumP"4E`$!0$II)Qn{LwdS/$a+Tr2i2RAgun{FK\|L.EZfq{wm<c/?Hm8W@]d@6)nqv6ph8()}-U
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 54 ed a3 16 68 70 45 2c e9 a2 c1 e8 b7 e7 8b 18 0b 3e 78 b0 71 f2 4e 53 60 cf 00 a2 6b d5 61 f1 3d 20 2c 24 01 dc d0 c8 3d 17 55 2c 7b 8a 59 fa 88 01 06 c6 7b 85 72 ed 36 7c b8 ed 1e ac c0 4e 9a 4a 2d 76 40 38 a1 e4 55 89 e0 24 96 b3 20 8f 87 e7 fd 7f 23 cd 33 8b e9 c3 4b 5c d1 ca e6 93 8d 8a 5d 16 a0 ea 60 f7 6e 03 9c 02 40 ea 47 50 9d 9a 44 55 d2 4a 22 93 dd ba 8b 4d b4 12 2f 07 a1 f9 a8 f5 91 00 e6 49 b0 06 89 fb 29 35 b1 72 4e 5c d7 5b 25 16 09 19 04 75 fc 27 3c 37 53 a1 73 4d 02 ec 0b e8 e0 3f aa 46 9e 37 99 34 e1 9b 48 d0 40 1e 63 6c f9 81 f6 57 b4 92 87 32 8e e0 0a ae df e5 ac 5d 1c 86 a8 fc 24 51 b3 8c 8d c7 d9 5e d3 3b 93 54 d1 78 71 ac 9f 98 fd d4 58 bc 6c 75 1c 23 8a 6a 38 63 a5 76 9a 67 c4 68 3b e1 35 75 7f d4 ad ad 27 b4 de 29 a4 71 13 b2 2d Data Ascii: ThpE,>xqNS`ka= ,$=U,{Y{r6\|NJ-v@8U$ #3K\]`n@GPDUJ"M/I)5rN\[%u'<7SsM?F74H@clW2]$Q^;TxqXlu#j8cvgh;5u')q-
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: f6 71 27 fb a5 07 cf 09 80 25 08 54 c9 61 8e e9 d7 f2 a5 0f 17 59 23 b2 a8 0d 61 4a 0d 90 6e d4 d7 4e 19 ed 38 93 1f 9a 4f 64 94 6a fe 4a b8 39 f3 29 e1 c2 c9 21 4b 59 76 fa 49 09 12 da b7 e6 81 08 45 a0 04 21 16 80 10 8b 48 91 95 22 10 80 13 4a 72 43 ba 28 35 22 10 77 52 21 87 65 19 dd 48 ec 28 92 a7 15 b5 ae 68 8a 89 ab c6 f5 43 62 7e 42 d7 cb fe 29 e2 07 5f e2 3d 74 e1 d6 24 95 ce 17 8c 59 03 ec be 8c f1 16 a0 c1 c2 38 86 a8 10 0c 30 b8 32 ce e4 8c 9f ba f9 76 79 04 fc 5b 52 45 96 87 86 82 7b 03 fd 93 c7 ba b9 e0 e2 c2 4b 23 68 a7 1c 92 76 03 fc c2 59 79 74 f1 f2 0c b8 e0 ba fa 77 56 cb 1b 10 7c a4 8e 77 d0 be 8d 1d 07 e5 66 ce 43 a4 21 84 92 0e 49 c1 0b 44 a3 90 b0 03 cd 91 be 37 25 55 96 43 23 86 69 a3 00 0d 82 91 e0 d9 04 6d b9 22 b2 98 d6 87 49 40 Data Ascii: q'%TaY#aJnN8OdjJ9)!KYvIE!H"JrC(5"wR!eH(hCb~B)_=t$Y802vy[RE{K#hvYytwV\|wfC!ID7%UC#im"I@
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 95 f6 06 6f d5 0e 9b 25 9b 6e c1 39 04 77 54 7c 59 e1 88 3c 59 c1 84 2e e5 8f 5d 01 32 69 27 23 2c 7d 64 13 ff 00 49 d8 8f 43 b8 53 c0 09 00 ab d1 ca 23 6e 4d 00 a6 ef cc 63 9c df 87 cd cf 83 51 a3 d6 3b 49 ab 85 d0 ea 20 7b a3 96 37 0a 2d 23 f3 e4 7a 8a 4f 91 e5 f0 b9 a4 d1 20 83 5d 57 b0 f8 f3 c1 43 c4 9a 41 c5 78 73 43 78 bc 0c a0 dc 01 a8 60 fe 53 ff 00 a8 74 3f 23 8d bc 73 9c 96 96 96 16 3c 12 d7 35 c2 8b 48 b0 41 1d 08 21 29 76 58 dd b0 9f 4c 91 ae 68 03 b8 f9 ff 00 df ea b4 22 9f 90 8b 35 75 ba a5 2b 48 90 5e c4 55 10 86 3f 97 94 d5 8b 20 fc 8a d3 5b 8e 8e 0e 5b 85 e9 d1 c0 39 c3 4d e0 f6 4f 92 23 66 b3 d3 3d d5 4d 33 c7 28 2c 71 a3 44 82 36 2b 51 af 25 a3 63 8a c8 44 8f a3 e2 ca 72 63 a5 3e 5a b0 45 11 b8 4e 06 8f 63 f9 4f 96 2c 5e 01 1b 79 79 28 Data Ascii: o%n9wT\|Y<Y.]2i'#,}dICS#nMcQ;I {7-#zO ]WCAxsCx`St?#s<5HA!)vXLh"5u+H^U? [[9MO#f=M3(,qD6+Q%cDrc>ZENcO,^yy(
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 24 3b 14 e3 ba 69 d8 a4 0c 25 34 ee 94 ec 90 a4 71 19 d9 57 75 81 25 64 df ec ac 3d 56 7f fc d0 dd b9 88 27 d0 15 26 f2 4f 68 cf 07 c6 9c 03 4e 72 c6 4b 19 38 c0 3c c3 fa 82 9b e2 19 e6 fd 41 22 57 b1 b1 44 5d 40 d0 27 cc 6d d2 96 37 b5 3d 71 8f c7 71 86 38 b7 91 8c 00 9c 0e 60 49 07 e4 42 bb e2 69 cf fa 4b b5 8c c8 96 30 0d 74 07 7f c9 4a cf 0e ce 1b a9 6f e1 e7 11 7e ae 7d 5e a2 59 49 2c 90 f3 9b 18 b3 b5 7e 11 3d 86 b5 a2 cb a4 90 f2 80 76 cd 03 f9 5a 11 44 7d c0 6b a2 25 c6 c0 20 5d d1 db ee a1 64 4e 1a 82 fa 24 c2 0b 80 27 63 90 07 6f 3f 92 d7 6c 34 ef 3c 3d 03 7f 41 19 1b 00 3e 63 a7 cd 74 91 33 0b 23 c3 cd 03 84 c3 e8 3e 6b 76 30 03 42 ca f9 69 3b 3c 37 09 d4 02 4b a0 a3 7b c0 4b 6d 24 4a 1c d1 d7 e4 a4 f7 ad 1b 6e b2 f5 9a f8 b4 70 b9 ee 1c dc a2 Data Ascii: $;i%4qWu%d=V'&OhNrK8<A"WD]@'m7=qq8`IBiK0tJo~}^YI,~=vZD}k% ]dN$'co?l4<=A>ct3#>kv0Bi;<7K{Km$Jnp
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 01 8b f2 5b 0d c3 40 59 fc 31 b5 a4 60 e8 00 03 cb 0b 44 0c 29 a2 43 1e fa 07 2b 3b 57 ab 11 34 b8 9a 03 73 d1 5d 96 f9 4d 2c 3d 7e 92 39 c1 2f 2f 07 6c 1a b4 35 c3 4e 47 c4 7c 66 5d 5d e9 74 ce 7b 64 26 80 66 4b 8f 6f 4f 24 c8 38 44 bc 0f 83 cf ae 9d a1 fc 40 d3 40 76 4c 64 d0 1e 57 9b 5a 52 e8 99 03 ab 4e 04 63 ad 02 4b ab b9 dd 2b f5 6e d4 e8 a7 8a 52 65 75 b6 46 73 64 db 47 f0 fd 05 05 a6 37 5d 27 39 6d db cf 75 b3 bd fa b9 1c 64 2e 73 48 b2 e3 65 c7 a9 b2 b4 34 9a 8a 64 53 b1 a1 b3 c6 79 81 04 11 8e 9f 3e c5 53 e2 1a 17 8d 4c b2 44 03 a2 73 b9 98 5a 47 5c d5 79 6c ba 6e 0d a5 81 be 0f 99 8d 6b 25 d7 6a b5 6d 63 58 63 05 ed 00 02 0b 4d d8 04 d8 22 a8 8a 57 f0 e5 9b de 9e a5 17 05 87 8b e8 74 9c 66 06 be 36 ea 34 9e f2 52 1e 40 0f c6 2b 6a 14 6f e4 ab Data Ascii: [@Y1`D)C+;W4s]M,=~9//l5NG\|f]]t{d&fKoO$8D@@vLdWZRNcK+nReuFsdG7]'9mud.sHe4dSy>SLDsZG\ylnk%jmcXcM"Wtf64R@+jo
2025-01-02 05:12:58 UTC	1369	IN	Data Raw: 41 bb 03 7d d6 88 18 59 7c 12 9f a1 60 dc 82 41 2b 60 0b 1b 21 9e fb 42 f6 58 55 27 d3 87 83 8b 5a 25 97 49 0c 40 f4 46 d7 1c ec fa 0c d8 0b 1b 57 c2 e5 92 42 e6 bc b6 b1 8d af cf b8 fe 8b b7 7c 02 f6 51 bb 46 d7 dd b4 7c 93 dd 5c bf 77 97 ea 3c 31 a8 2e e6 a6 b0 17 90 48 20 34 9a bb ad c0 5d 07 85 a0 8b 82 71 08 f5 53 e9 5d ac d5 07 0e 42 1e 00 68 1d 40 ad fd 57 62 ce 1c c2 41 2c 06 bb e5 6a e9 62 d0 40 09 7e 84 48 f2 2a cb c8 00 fa 00 ae 5b 7c 56 79 4c 2f 98 47 78 c6 77 02 62 e1 ff 00 1d 67 99 e2 be c1 63 eb b8 a7 1a d7 b5 e1 9a 68 98 c2 28 51 c8 3b fd 17 45 ef a2 c1 8b 45 a6 8e 88 20 06 5e 07 4c 9d ba a6 bb e3 90 bc b5 a0 9d e8 00 3e 81 5d b6 ce ea 30 c7 0c 2e e4 73 5c 0b 4b ae 8a 7d 44 ba d0 d0 c7 80 18 d6 9b 36 2e c9 fa 85 ae 30 7b d2 b2 f6 7c 57 b6 Data Ascii: A}Y\|`A+`!BXU'Z%I@FWB\|QF\|\w<1.H 4]qS]Bh@WbA,jb@~H*[\|VyL/Gxwbgch(Q;EE ^L>]0.s\K}D6.0{\|W

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49918	23.145.136.95	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:58 UTC	345	OUT	GET /forward HTTP/1.1 Host: data.7wzx9.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:58 UTC	241	IN	HTTP/1.1 405 Date: Thu, 02 Jan 2025 05:12:58 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Allow: POST Server: cdn Strict-Transport-Security: max-age=31536000; X-Cache-Status: MISS
2025-01-02 05:12:58 UTC	145	IN	Data Raw: 38 36 0d 0a 7b 22 74 69 6d 65 73 74 61 6d 70 22 3a 31 37 33 35 37 39 34 37 37 38 36 35 32 2c 22 73 74 61 74 75 73 22 3a 34 30 35 2c 22 65 72 72 6f 72 22 3a 22 4d 65 74 68 6f 64 20 4e 6f 74 20 41 6c 6c 6f 77 65 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 52 65 71 75 65 73 74 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 6e 6f 74 20 73 75 70 70 6f 72 74 65 64 22 2c 22 70 61 74 68 22 3a 22 2f 66 6f 72 77 61 72 64 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 86{"timestamp":1735794778652,"status":405,"error":"Method Not Allowed","message":"Request method 'GET' not supported","path":"/forward"}0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49924	104.26.11.58	443	3848	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-02 05:12:59 UTC	386	OUT	GET /%E8%A1%97%E6%8B%8D%E5%81%B7%E6%8B%8D/unc7yj.jpg HTTP/1.1 Host: mtu.slinpic.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-02 05:12:59 UTC	933	IN	HTTP/1.1 200 OK Date: Thu, 02 Jan 2025 05:12:59 GMT Content-Type: image/jpeg Transfer-Encoding: chunked Connection: close Cache-Control: max-age=2592000 Cf-Bgj: h2pri ETag: W/"66dfae07-8130" Expires: Wed, 29 Jan 2025 04:00:05 GMT Last-Modified: Tue, 10 Sep 2024 02:25:11 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Age: 263418 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1rb%2BIuJDD0XsgWpZP2QdvZ6m2GEL7vxxBUn84PFtg6u5NGOCSwg6QjV16W6s2DDnqqN7uBqMadQkwO4mRcz9OaWLGAKUQiyx2tsf3O1WnuCr3ohyeYn7L3G3wb%2FUoxlXBw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb841d96e25de95-EWR server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1670&rtt_var=636&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2825&recv_bytes=964&delivery_rate=1708601&cwnd=240&unsent_bytes=0&cid=d6884c9cf9cc5f51&ts=146&x=0"
2025-01-02 05:12:59 UTC	436	IN	Data Raw: 37 63 38 66 0d 0a ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d 38 32 3c 2e 33 34 32 ff db 00 43 01 09 09 09 0c 0b 0c 18 0d 0d 18 32 21 1c 21 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 32 ff c0 00 11 08 02 58 01 e0 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 00 01 05 01 01 01 00 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 ff c4 00 3f 10 00 01 03 03 03 03 02 05 02 05 03 03 03 04 03 01 01 00 02 11 03 04 21 05 31 41 12 51 61 71 81 06 13 22 91 a1 b1 Data Ascii: 7c8fJFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222X"?!1AQaq"
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: a5 c8 b9 a0 1c 63 a8 61 de bd d4 ed 17 ee 9f 13 b2 21 2f ea 82 88 34 88 e1 21 09 c4 84 87 f2 81 84 79 84 c2 3d d4 87 64 d2 10 54 78 87 6d 84 81 4b 50 4b 7d 14 43 d5 42 4e 42 41 d9 2c a1 b3 c1 4e 07 d9 46 0a 70 29 04 a0 fd 93 c1 51 03 d9 3c 1c 80 a6 a1 20 29 e0 e0 28 81 ca 78 2a 3c 1b 48 0a 70 3c 1d 94 60 a7 83 b2 90 f1 ba 50 71 09 92 9d 2a 43 c7 a7 d9 2c a6 04 a0 c4 20 70 f0 96 73 b2 40 8f c2 94 1c 12 a6 88 dd 2c a0 51 ba 54 d9 1b 22 51 07 25 4d dc 22 50 2c f2 8f 09 06 70 89 40 e9 ca 49 42 10 2c f8 44 fb a4 06 20 23 f4 40 b3 9f 29 0a 39 fd 92 04 0b b1 f2 82 8e 50 88 09 0f dd 2a 42 81 3f 08 27 12 8f ca 32 80 9e c9 3d d1 ec 93 9e e8 15 09 11 e5 02 fa a2 72 8e c9 3d 50 72 c7 b7 08 29 b3 ec 85 56 82 70 89 39 94 4e 50 0f fe 50 07 02 11 29 b3 f6 fc a2 79 4d 26 Data Ascii: ca!/4!y=dTxmKPK}CBNBA,NFp)Q< )(x<Hp<`PqC, ps@,QT"Q%M"P,p@IB,D #@)9P*B?'2=r=Pr)Vp9NPP)yM&
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: 90 47 9c 42 20 ce 01 52 47 b2 22 3b a0 e1 4c 82 41 04 11 82 0e e0 a4 f4 5d 5f c4 7a 21 a8 1f 7f 6a cf ac 09 ad 4c 0f ea f2 3c f7 ee b9 39 98 8d bb a8 5a 5d 95 12 9a 78 ee 89 c2 24 e9 ca 25 36 72 89 e5 02 c8 de 51 b2 49 fc 20 6d ca 07 20 14 d0 51 3c 20 78 c2 50 70 9a 12 ce 14 00 80 41 04 4a bb a6 5c c1 36 ef 39 19 61 3f a2 a7 29 8e ea 6b 9b 51 86 1c d3 21 48 e8 a7 28 9c 64 28 2d eb b6 e2 83 6a 03 9d 88 ec 79 53 48 85 35 52 67 b2 43 99 4a 52 12 a0 34 e1 46 e0 23 21 48 7b a6 39 12 ac 64 12 3b 20 1f 64 b5 04 65 34 15 01 e9 41 1f e0 94 c0 70 94 b8 88 19 24 98 00 6e 50 3f ac 01 b8 1e b8 0a 2b 9b eb 6b 4a 45 f5 eb 31 ad 00 93 27 65 85 f1 0e b8 74 cb 47 b9 ae 68 79 c3 67 24 fa 70 bc ce f7 59 ad a9 be a0 ac f7 7c c1 30 64 80 7c 11 b7 f9 e1 69 8f 1d aa dc a4 77 1a Data Ascii: GB RG";LA]_z!jL<9Z]x$%6rQI m Q< xPpAJ\69a?)kQ!H(d(-jySH5RgCJR4F#!H{9d; de4Ap$nP?+kJE1'etGhyg$pY\|0d\|iw
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: 87 83 5a 88 20 11 1f d2 3c 78 f0 9b 73 6e c2 49 00 16 10 08 20 98 23 b8 f0 a4 63 c1 77 ca aa 40 27 12 46 08 e6 7c a4 a6 0b 3a e9 c6 5a 4c b4 f1 de 0f 63 82 9e 3c 27 52 f4 ce 7d b0 0d 9a 78 33 ce 67 d1 40 65 ae 00 8e 92 4c c2 d5 e8 24 10 40 04 7e 7c a8 aa 53 06 a3 81 20 13 89 89 1e 9f a2 99 7e e5 c7 ec 65 b5 72 d1 0e 38 da 77 21 6f 68 ba dd c6 9d 76 ca d4 5c 7e 65 33 3b c0 70 ec 40 dc 1e 57 35 d1 d1 52 24 17 70 36 05 5a b5 ac 18 e7 f5 82 01 1b 03 91 e9 f8 55 cb 19 53 8d 7d 19 f0 be b3 43 54 b3 a7 5a 89 22 9d 4c 16 1d e9 bc 01 2d 3f 69 07 9c ad f6 8f a5 dc c1 20 79 5e 15 f0 47 c4 27 47 d4 85 27 bf f9 57 04 36 26 00 78 38 3f 7c 1f 05 7b 95 b5 46 d4 a0 d7 03 25 c0 9f 31 bc ae 5b 35 5a 6d 61 82 5b 31 8d 87 a2 7c 1c a1 82 1a 07 84 f0 aa 1a 01 51 ba a8 6b a2 64 Data Ascii: Z <xsnI #cw@'F\|:ZLc<'R}x3g@eL$@~\|S ~er8w!ohv\~e3;p@W5R$p6ZUS}CTZ"L-?i y^G'G'W6&x8?\|{F%1[5Zma[1\|Qkd
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: 9c 16 93 23 21 6b da 5c 0b 8a 21 d3 f5 0c 11 fb ac 83 f8 4e b7 ae 6d ab 87 7f b1 d8 21 27 48 b1 b9 29 a4 a4 90 40 20 c8 39 04 20 9d bb a9 40 3e 17 3d f1 25 db e9 d8 be 8d 11 35 2a ff 00 2c 13 b3 64 19 71 f0 06 7d d6 ed 5a 81 8c 2e 27 fe 56 05 ed 06 d5 b8 75 5a ae 02 98 11 1c bb 33 f6 9f bc 00 b4 e3 9b bb 57 3b a9 a6 0e 97 a0 53 b6 b6 69 a8 43 9c df a8 b9 e3 69 d8 c7 3f e7 95 53 58 b9 b7 b6 b8 2e ac ef 9d 52 a1 07 a4 92 1c 44 40 c0 d8 42 bd ac ea 8f b6 a0 18 c0 1a 4e 40 18 2e 24 e0 18 cf 73 8f d1 63 1b 4a 34 5c 2b d4 1f c4 5e 3a 1e f2 60 b6 9f 60 7c ed e0 44 65 6f 6e a2 92 5a cb ba ea b8 73 09 b5 a5 6e c3 99 00 92 71 b0 93 81 ed ee ab be dd f5 5a c2 d6 41 80 0c 08 d8 91 27 8d a1 6d 1b 7a f7 6e 7d 5a cf 71 2e cc 91 24 8e 3d 3c 05 76 df 4c 34 e9 90 5b d4 49 Data Ascii: #!k\!Nm!'H)@ 9 @>=%5*,dq}Z.'VuZ3W;SiCi?SX.RD@BN@.$scJ4\+^:``\|DeonZsnqZA'mzn}Zq.$=<vL4[I
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: 20 92 36 82 64 ff 00 92 8a 44 b2 5b 07 a4 12 40 24 7b aa d8 bc bd a6 a8 c0 5d d6 d8 21 c2 4f 81 b2 eb ff 00 d3 4d 50 69 9f 16 db 17 13 d1 54 1a 27 9c 91 02 57 20 d3 fc a7 37 78 c8 e6 42 d7 f8 5f 1a f5 a3 5c 60 97 88 3b c1 e3 1c e7 0a 99 77 2a d3 cb ea 60 f0 48 e0 80 41 1b 67 65 2b 01 00 0f 00 85 42 da a9 ad a6 db 56 26 5d 51 8c 26 38 38 cf f9 dd 69 0f ea 88 e1 72 ac 48 c8 4e 8e e8 e7 d0 27 42 80 88 44 89 99 01 12 d0 3f a8 7d d0 2c 24 8c ec 8e b6 e2 09 9f 01 1d 53 b3 49 f6 40 10 88 44 b8 ec cf 72 51 f5 ce cd 1e ea 41 05 11 94 43 cf 20 78 01 27 43 bf ef 8f 40 a0 2c 18 c6 52 42 3e 5f 77 1f 64 9f 2c 4e 49 3e a5 01 81 ba 24 77 1f 74 a2 93 47 fb 7e e9 dd 02 30 d1 f6 41 19 7b 79 70 48 5e d9 81 27 d0 29 8b 46 00 00 4f 84 d2 00 e4 0f 74 11 f5 76 6b 8f a0 4b 27 fe Data Ascii: 6dD[@${]!OMPiT'W 7xB_\`;w*`HAge+BV&]Q&88irHN'BD?},$SI@DrQAC x'C@,RB>_wd,NI>$wtG~0A{ypH^')FOtvkK'
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: aa dc 3d 93 90 7b 8f 09 f9 5a 55 d2 60 ec 9a 49 1c 22 70 65 21 7f 07 ee aa b3 8f f8 97 42 34 9c 6f ad 19 f4 1c d5 63 46 c7 b8 5c b9 3e eb d5 5c 41 04 11 20 8d 8a e2 7e 21 d1 3f 82 79 bb b6 6f fe 9d c7 ea 68 ff 00 61 fe ca 65 4b 02 51 29 0a 49 ca 90 f9 44 a6 4a 59 e1 03 8a 49 3d e5 24 a2 4a 07 03 91 22 47 8c ad a6 54 14 34 87 b9 85 c0 3c 82 5c c0 41 30 30 24 88 f5 80 4f 65 8a c0 e7 d4 63 1a 09 73 88 00 0e 49 38 57 29 de 36 dd f5 ed 5e 03 8d 3a 8f 68 7b 01 92 01 22 76 fd 16 fc 13 79 31 e7 df b5 98 f3 f2 2b 8a e4 f5 5c 54 3f 2e 95 32 df a6 9c ee 40 e5 d3 3b ed ea bb fd 0b 4c 6d b5 9b 0b 84 d4 8c 93 be 77 f7 5c 8e 9b 69 4e fb 5f a2 f7 92 e2 d0 5c 1a 4e 00 1e 3f 18 f2 bd 1a 9b 43 18 d1 ef 3d d5 b9 2f 7a 4f 14 d4 da ad db eb 53 a7 14 da 0f 9d f0 b8 ad 7a f6 f5 Data Ascii: ={ZU`I"pe!B4ocF\>\A ~!?yohaeKQ)IDJYI=$J"GT4<\A00$OecsI8W)6^:h{"vy1+\T?.2@;Lmw\iN_\N?C=/zOSz
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: 3d be 1b 71 e5 ef 9b ad 3b 3a 1f 24 91 fa 2b a2 00 24 94 ac 02 04 1d f2 92 a6 1b b6 eb 9a f7 5b ce 91 54 7c 78 2b 3a e7 50 65 29 93 9e 00 4f b9 af 92 01 d9 63 57 a6 6b 93 13 2a f8 e3 2f 95 72 ba f0 9a ae b7 49 b8 9f 19 30 a9 5c 6b b4 1c d2 1c c9 1c 10 42 8f fe 8f 52 b3 b7 6f a9 e1 27 ff 00 4c d4 32 43 c1 27 72 04 15 be 33 09 e6 b0 ca e7 5c e6 a9 5e 95 77 12 c6 90 49 d8 f0 b2 22 09 06 3f 65 d7 d5 f8 5e be 7a 5e d2 33 82 20 85 ce df e9 d5 ec aa 9f 9a c2 04 c4 85 d3 c7 67 89 5c 9c 98 65 3b b1 4b 12 0a 70 12 63 ba 70 6f 53 4e 01 81 25 2d 31 20 82 04 83 ca d7 4c 92 db 1f e6 01 00 8d bd d7 a7 ff 00 a6 14 1e cb cb 9b 86 80 44 06 03 b9 1b 9f d9 79 95 26 91 54 71 1e 17 b4 7f a6 56 85 ba 25 4a a5 a4 17 d5 2e 99 e0 00 07 e6 56 1c fd 62 d7 8f b7 6a 2a 56 39 98 f4 09 Data Ascii: =q;:$+$[T\|x+:Pe)OcWk/rI0\kBRo'L2C'r3\^wI"?e^z^3 g\e;KpcpoSN%-1 LDy&TqV%J.VbjV9
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: 18 d9 dc 9c 93 e5 73 72 f2 7b ae 97 c2 6a 1d 09 43 7c a7 47 84 a0 65 62 b9 03 42 58 ca 50 30 94 05 09 24 08 44 04 ee c9 22 4a 06 c0 e1 2c 25 8c a5 8d c2 06 10 92 07 94 f3 d9 24 65 03 63 1b 22 33 29 d1 94 42 06 90 9a 46 13 c8 1e e9 23 3d 90 30 e2 70 a3 a8 3e 82 3b 82 3f 0a 53 1d d3 08 90 50 55 d1 cc da 3d b0 09 0e 3e ca fe 7f ed 0b 3b 48 10 6e 29 e7 0e e0 2d 3f a7 68 79 fb 2b 61 e2 23 3f aa a3 20 93 b8 1e fb a7 47 91 f7 4a 40 3f ff 00 17 b9 21 2c 71 d3 1e ea ca 3b 54 21 0b a9 80 42 10 80 42 10 82 3a c3 aa 99 0a ae a2 d0 34 fa 8d 1c 00 3d 55 e2 01 dd 53 d4 bf fc 27 f9 85 9e 73 ab 56 9e 5c d8 18 88 dd 64 dd d2 eb af 5e 9c 7f 5d bd 56 c7 ff 00 e4 ad a6 8f a8 88 d8 2c e7 b2 35 5a 60 e7 a8 39 bf 70 42 e3 ce 7e da e8 e2 ba ce 39 7f 83 af 7f 84 6d b3 ea 7f 4d 37 Data Ascii: sr{jC\|GebBXP0$D"J,%$ec"3)BF#=0p>;?SPU=>;Hn)-?hy+a#? GJ@?!,q;T!BB:4=US'sV\d^]V,5Z`9pB~9mM7
2025-01-02 05:12:59 UTC	1369	IN	Data Raw: 26 41 05 76 57 c5 bf 2c 90 42 e6 2f 40 24 c4 49 95 9b 79 97 4c 57 ee 42 68 20 42 9d f4 1e 49 81 82 9f 6b 49 83 51 b6 15 fe 9a 66 ab 43 89 d8 09 e5 4a db 5d a1 4e a5 20 c6 fb 91 e5 6a 90 0d b9 71 5a 17 7a 33 99 5d ae a5 0f 69 38 82 13 75 2b 17 5a da b4 f4 90 37 98 54 b2 d4 6e 39 ea 84 00 42 a1 5c 82 0e 54 f5 ab 02 f2 06 4c aa e6 09 20 9c 2b c8 ae 55 0b 1e 0b a3 90 ad 34 02 32 b3 6a c5 2b d0 d0 60 38 4a bf 49 f8 04 e3 95 36 18 a7 0c 1d 90 1a 07 08 0e 10 97 a8 28 5f 50 a0 00 a5 a6 30 0a 84 1c ab 34 84 91 99 45 32 d4 5b b7 a4 6a 54 a6 c0 27 25 c7 d0 7f e5 75 54 a9 06 48 00 01 01 66 69 d6 61 94 db 58 ff 00 5b 80 03 c0 95 b0 07 d4 71 c6 14 b8 f3 bb a7 01 b7 a2 70 00 78 40 18 1e 89 e0 76 45 44 25 03 1d d2 80 94 04 48 03 84 00 65 38 0c a3 94 0d 8c ec 8f 44 f8 ce Data Ascii: &AvW,B/@$IyLWBh BIkIQfCJ]N jqZz3]i8u+Z7Tn9B\TL +U42j+`8JI6(_P04E2[jT'%uTHfiaX[qpx@vED%He8D

Target ID:	0
Start time:	00:12:16
Start date:	02/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	00:12:19
Start date:	02/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 --field-trial-handle=1996,i,11860038956780945597,535589302757175344,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	00:12:25
Start date:	02/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.rr8844.com"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.rr8844.com

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Software Vulnerabilities

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 205

Chrome Cache Entry: 206

Chrome Cache Entry: 207

Chrome Cache Entry: 208

Chrome Cache Entry: 209

Chrome Cache Entry: 210

Chrome Cache Entry: 211

Chrome Cache Entry: 212

Chrome Cache Entry: 213

Chrome Cache Entry: 214

Chrome Cache Entry: 215

Chrome Cache Entry: 216

Chrome Cache Entry: 217

Chrome Cache Entry: 218

Chrome Cache Entry: 219

Chrome Cache Entry: 220

Chrome Cache Entry: 221

Chrome Cache Entry: 222

Chrome Cache Entry: 223

Chrome Cache Entry: 225

Chrome Cache Entry: 226

Chrome Cache Entry: 227

Chrome Cache Entry: 228

Chrome Cache Entry: 229

Chrome Cache Entry: 230

Chrome Cache Entry: 231

Windows Analysis Report
http://www.rr8844.com