Edit tour

Windows Analysis Report
http://www.telegramai.org/

Overview

General Information

Sample URL:	http://www.telegramai.org/
Analysis ID:	1589332
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected ZipBomb

AI detected suspicious URL

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4436 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3364 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,2141554347047288,12388819619459372047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5736 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramai.org/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Downloads\42275caf-472a-4a81-b0f0-faa185fa9241.tmp	JoeSecurity_ZipBomb	Yara detected ZipBomb	Joe Security

HTTP traffic detected: POST /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveContent-Length: 487sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.telegramai.orgSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: chromecache_83.2.dr, chromecache_102.2.dr, chromecache_105.2.dr

String found in binary or memory: https://swiperjs.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56157
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: classification engine

Classification label: mal68.evad.win@20/68@22/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,2141554347047288,12388819619459372047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramai.org/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,2141554347047288,12388819619459372047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Malware Analysis System Evasion

Yara detected ZipBomb

Source: Yara match

File source: C:\Users\user\Downloads\42275caf-472a-4a81-b0f0-faa185fa9241.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
http://www.telegramai.org/	100%	Avira URL Cloud	phishing

Source	Detection	Scanner	Label
https://www.telegramai.org/static/image/gou.png	100%	Avira URL Cloud	phishing
https://www.telegramai.org/static/image/right.png	100%	Avira URL Cloud	phishing
https://image.sanxiang-sh.com/telegram-16/phone.png	0%	Avira URL Cloud	safe
https://www.telegramai.org/static/image/left.png	100%	Avira URL Cloud	phishing
https://image.sanxiang-sh.com/telegram-logo.png	0%	Avira URL Cloud	safe
https://00-25-1333705940.cos.ap-hongkong.myqcloud.com/shater.zip	0%	Avira URL Cloud	safe
https://image.sanxiang-sh.com/telegram-16/cropped-header-image-5.png	0%	Avira URL Cloud	safe
https://www.telegramai.org/static/js/public.js	100%	Avira URL Cloud	phishing
https://image.sanxiang-sh.com/telegram-16/777.jpeg	0%	Avira URL Cloud	safe
https://image.sanxiang-sh.com/telegram-16/555.jpeg	0%	Avira URL Cloud	safe
https://www.telegramai.org/static/css/swiper-bundle.min.css	100%	Avira URL Cloud	phishing
https://www.telegramai.org/static/js/jquery.js	100%	Avira URL Cloud	phishing
https://image.sanxiang-sh.com/telegram-16/td_laptop.png	0%	Avira URL Cloud	safe
https://image.sanxiang-sh.com/telegram-16/logo.png	0%	Avira URL Cloud	safe
https://image.sanxiang-sh.com/telegram-16/top.png	0%	Avira URL Cloud	safe
https://www.telegramai.org/static/js/swiper-bundle.min.js	100%	Avira URL Cloud	phishing
https://www.telegramai.org/static/image/icon_nav.png	100%	Avira URL Cloud	phishing
https://www.telegramai.org/static/css/style.min.css	100%	Avira URL Cloud	phishing
https://image.sanxiang-sh.com/telegram-16/333.jpg	0%	Avira URL Cloud	safe
https://image.sanxiang-sh.com/telegram-favicon.ico	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
hk.file.myqcloud.com	43.132.105.108	true	false	high
hcdnwsa120.v5.cdnhwczoy106.cn	90.84.161.20	true	false	high
www.telegramai.org	172.67.187.243	true	true	unknown
www.google.com	142.250.184.228	true	false	high
image.sanxiang-sh.com	172.67.193.48	true	false	high
00-25-1333705940.cos.ap-hongkong.myqcloud.com	unknown	unknown	false	unknown
collect-v6.51.la	unknown	unknown	false	high
sdk.51.la	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.telegramai.org/static/js/public.js	false	Avira URL Cloud: phishing	unknown
https://www.telegramai.org/static/image/gou.png	false	Avira URL Cloud: phishing	unknown
https://00-25-1333705940.cos.ap-hongkong.myqcloud.com/shater.zip	false	Avira URL Cloud: safe	unknown
https://www.telegramai.org/static/image/left.png	false	Avira URL Cloud: phishing	unknown
https://www.telegramai.org/	false		unknown
http://www.telegramai.org/	true		unknown
https://image.sanxiang-sh.com/telegram-16/phone.png	false	Avira URL Cloud: safe	unknown
https://image.sanxiang-sh.com/telegram-16/777.jpeg	false	Avira URL Cloud: safe	unknown
https://image.sanxiang-sh.com/telegram-16/555.jpeg	false	Avira URL Cloud: safe	unknown
https://image.sanxiang-sh.com/telegram-logo.png	false	Avira URL Cloud: safe	unknown
https://image.sanxiang-sh.com/telegram-16/cropped-header-image-5.png	false	Avira URL Cloud: safe	unknown
https://collect-v6.51.la/v6/collect?dt=4	false		high
https://www.telegramai.org/static/image/right.png	false	Avira URL Cloud: phishing	unknown
https://www.telegramai.org/static/js/jquery.js	false	Avira URL Cloud: phishing	unknown
https://www.telegramai.org/static/css/swiper-bundle.min.css	false	Avira URL Cloud: phishing	unknown
https://image.sanxiang-sh.com/telegram-16/top.png	false	Avira URL Cloud: safe	unknown
https://www.telegramai.org/static/js/swiper-bundle.min.js	false	Avira URL Cloud: phishing	unknown
https://image.sanxiang-sh.com/telegram-16/333.jpg	false	Avira URL Cloud: safe	unknown
https://image.sanxiang-sh.com/telegram-16/td_laptop.png	false	Avira URL Cloud: safe	unknown
https://www.telegramai.org/static/image/icon_nav.png	false	Avira URL Cloud: phishing	unknown
https://sdk.51.la/js-sdk-pro.min.js?id=3KK9Zot37TeXAqY2&ck=3KK9Zot37TeXAqY2	false		high
https://image.sanxiang-sh.com/telegram-favicon.ico	false	Avira URL Cloud: safe	unknown
https://image.sanxiang-sh.com/telegram-16/logo.png	false	Avira URL Cloud: safe	unknown
https://www.telegramai.org/static/css/style.min.css	false	Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://swiperjs.com	chromecache_83.2.dr, chromecache_102.2.dr, chromecache_105.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.187.243	www.telegramai.org	United States	13335	CLOUDFLARENETUS	true
172.67.193.48	image.sanxiang-sh.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
90.84.161.20	hcdnwsa120.v5.cdnhwczoy106.cn	France	5511	OPENTRANSITFR	false
142.250.184.228	www.google.com	United States	15169	GOOGLEUS	false
43.132.105.108	hk.file.myqcloud.com	Japan	4249	LILLY-ASUS	false
104.21.7.172	unknown	United States	13335	CLOUDFLARENETUS	false
90.84.161.21	unknown	France	5511	OPENTRANSITFR	false

Private

IP
192.168.2.6
192.168.2.5

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1589332
Start date and time:	2025-01-12 01:13:46 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.telegramai.org/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.evad.win@20/68@22/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.16.206, 142.250.186.163, 142.251.168.84, 142.250.184.238, 142.250.186.78, 142.250.185.142, 2.22.50.144, 2.23.77.188, 142.250.186.46, 142.250.184.206, 142.250.186.174, 216.58.206.46, 142.250.185.206, 216.58.206.67, 34.104.35.123, 217.20.57.39, 184.28.90.27, 52.149.20.212, 13.107.246.45
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://www.telegramai.org/

Input	Output
URL: http://www.telegramai.org Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": true, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: http://www.telegramai.org
URL: https://www.telegramai.org/static/js/public.js... Model: Joe Sandbox AI	{ "risk_score": 2, "reasoning": "The provided JavaScript code appears to be a benign script that handles basic user interface functionality, such as a 'back to top' button and device-specific download links. It does not exhibit any high-risk behaviors like dynamic code execution, data exfiltration, or suspicious redirects. The script uses common jQuery methods and browser APIs, which are considered low-risk. While it includes some moderate-risk indicators like aggressive DOM manipulation, the overall context suggests this is a legitimate implementation of common web development practices." }
$('#to-top').click(function() { $('body,html').animate({scrollTop:0},1); return false; }); $(window).scroll(function() { const scrollTop = $(window).scrollTop(); const windowHeight = $(window).height(); if (scrollTop > 200 ) { $('#to-top').fadeIn(1).css('display', 'flex'); } else { $('#to-top').fadeOut(1).css('display', 'none'); } }); // function getOperatingSystem() { var userAgent = navigator.userAgent \|\| navigator.vendor \|\| window.opera; if (/android/i.test(userAgent)) { return "android"; } if (/iPad\|iPhone\|iPod/.test(userAgent) && !window.MSStream) { return "ios"; } return "pc"; } if(getOperatingSystem()=="android"){ $(".down-link").css("display",'none') $(".down-link.android").css("display",'inline-block') } if(getOperatingSystem()=="ios"){ $(".down-link").css("display",'none') $(".down-link.ios").css("display",'inline-block') } // $("header .nav.open").on("touchmove",function(event){ event.preventDefault(); }) $('#nav-btn').click(function(){ if ($(this).hasClass('open')) { $(this).removeClass('open') $('header .nav').removeClass('open') } else { $(this).addClass('open') $('header .nav').addClass('open') } })
URL: https://www.telegramai.org/static/js/swiper-bundle... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "The provided JavaScript snippet appears to be the Swiper library, which is a popular and widely-used mobile touch slider framework. It does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or redirects to malicious domains. The code is well-structured and does not exhibit any suspicious behavior. Overall, this script is likely benign and used for legitimate purposes." }
/** * Swiper 7.4.1 * Most modern mobile touch slider and framework with hardware accelerated transitions * https://swiperjs.com * * Copyright 2014-2021 Vladimir Kharlampidi * * Released under the MIT License * * Released on: December 24, 2021 */ !function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).Swiper=t()}(this,(function(){"use strict";function e(e){return null!==e&&"object"==typeof e&&"constructor"in e&&e.constructor===Object}function t(s={},a={}){Object.keys(a).forEach((i=>{void 0===s[i]?s[i]=a[i]:e(a[i])&&e(s[i])&&Object.keys(a[i]).length>0&&t(s[i],a[i])}))}const s={body:{},addEventListener(){},removeEventListener(){},activeElement:{blur(){},nodeName:""},querySelector:()=>null,querySelectorAll:()=>[],getElementById:()=>null,createEvent:()=>({initEvent(){}}),createElement:()=>({children:[],childNodes:[],style:{},setAttribute(){},getElementsByTagName:()=>[]}),createElementNS:()=>({}),importNode:()=>null,location:{hash:"",host:"",hostname:"",href:"",origin:"",pathname:"",protocol:"",search:""}};function a(){const e="undefined"!=typeof document?document:{};return t(e,s),e}const i={document:s,navigator:{userAgent:""},location:{hash:"",host:"",hostname:"",href:"",origin:"",pathname:"",protocol:"",search:""},history:{replaceState(){},pushState(){},go(){},back(){}},CustomEvent:function(){return this},addEventListener(){},removeEventListener(){},getComputedStyle:()=>({getPropertyValue:()=>""}),Image(){},Date(){},screen:{},setTimeout(){},clearTimeout(){},matchMedia:()=>({}),requestAnimationFrame:e=>"undefined"==typeof setTimeout?(e(),null):setTimeout(e,0),cancelAnimationFrame(e){"undefined"!=typeof setTimeout&&clearTimeout(e)}};function r(){const e="undefined"!=typeof window?window:{};return t(e,i),e}class n extends Array{constructor(e){super(...e\|\|[]),function(e){const t=e.__proto__;Object.defineProperty(e,"__proto__",{get:()=>t,set(e){t.__proto__=e}})}(this)}}function l(e=[]){const t=[];return e.forEach((e=>{Array.isArray(e)?t.push(...l(e)):t.push(e)})),t}function o(e,t){return Array.prototype.filter.call(e,t)}function d(e,t){const s=r(),i=a();let l=[];if(!t&&e instanceof n)return e;if(!e)return new n(l);if("string"==typeof e){const s=e.trim();if(s.indexOf("<")>=0&&s.indexOf(">")>=0){let e="div";0===s.indexOf("<li")&&(e="ul"),0===s.indexOf("<tr")&&(e="tbody"),0!==s.indexOf("<td")&&0!==s.indexOf("<th")\|\|(e="tr"),0===s.indexOf("<tbody")&&(e="table"),0===s.indexOf("<option")&&(e="select");const t=i.createElement(e);t.innerHTML=s;for(let e=0;e<t.childNodes.length;e+=1)l.push(t.childNodes[e])}else l=function(e,t){if("string"!=typeof e)return[e];const s=[],a=t.querySelectorAll(e);for(let e=0;e<a.length;e+=1)s.push(a[e]);return s}(e.trim(),t\|\|i)}else if(e.nodeType\|\|e===s\|\|e===i)l.push(e);else if(Array.isArray(e)){if(e instanceof n)return e;l=e}return new n(function(e){const t=[];for(let s=0;s<e.length;s+=1)-1===t.indexOf(e[s])&&t.push(e[s]);return t}(l))}d.fn=n.prototype;const p={addClass:function(...e){const t=l(e.map((e=>e.split(" "))));return this.forEach((e=>{e.classList.add(...t)})),this},removeClass:function(...e){const t=l(e.map((e=>e.split(" "))));return this.forEach((e=>{e.classList.remove(...t)})),this},hasClass:function(...e){const t=l(e.map((e=>e.split(" "))));return o(this,(e=>t.filter((t=>e.classList.contains(t))).length>0)).length>0},toggleClass:function(...e){const t=l(e.map((e=>e.split(" "))));this.forEach((e=>{t.forEach((t=>{e.classList.toggle(t)}))}))},attr:function(e,t){if(1===arguments.length&&"string"==typeof e)return this[0]?this[0].getAttribute(e):void 0;for(let s=0;s<this.length;s+=1)if(2===arguments.length)this[s].setAttribute(e,t);else for(const t in e)this[s][t]=e[t],this[s].setAttribute(t,e[t]);return this},removeAttr:function(e){for(let t=0;t<this.length;t+=1)this[t].removeAttribute(e);return this},transform:function(e){for(let t=0;t<this.length;t+=1)this[t].style.t
URL: https://www.telegramai.org/static/js/jquery.js... Model: Joe Sandbox AI	{ "risk_score": 1, "reasoning": "This appears to be the minified version of the jQuery library, which is a widely-used and trusted JavaScript library. The code does not contain any high-risk indicators such as dynamic code execution, data exfiltration, or suspicious redirects. The behaviors observed are typical of a legitimate JavaScript library, including DOM manipulation, event handling, and utility functions. While the code is obfuscated, this is a common practice for minified libraries to improve performance. Overall, this script poses a low risk and is likely a benign, widely-used JavaScript library." }
/!jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license/!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},T=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g;w.fn=w.prototype={jquery:"3.3.1",constructor:w,length:0,toArray:function(){return o.call(this)},get:function(e){return null==e?o.call(this):e<0?this[e+this.length]:this[e]},pushStack:function(e){var t=w.merge(this.constructor(),e);return t.prevObject=this,t},each:function(e){return w.each(this,e)},map:function(e){return this.pushStack(w.map(this,function(t,n){return e.call(t,n,t)}))},slice:function(){return this.pushStack(o.apply(this,arguments))},first:function(){return this.eq(0)},last:function(){return this.eq(-1)},eq:function(e){var t=this.length,n=+e+(e<0?t:0);return this.pushStack(n>=0&&n<t?[this[n]]:[])},end:function(){return this.prevObject\|\|this.constructor()},push:s,sort:n.sort,splice:n.splice},w.extend=w.fn.extend=function(){var e,t,n,r,i,o,a=arguments[0]\|\|{},s=1,u=arguments.length,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|g(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)\|\|(i=Array.isArray(r)))?(i?(i=!1,o=n&&Array.isArray(n)?n:[]):o=n&&w.isPlainObject(n)?n:{},a[t]=w.extend(l,o,r)):void 0!==r&&(a[t]=r));return a},w.extend({expando:"jQuery"+("3.3.1"+Math.random()).replace(/\D/g,""),isReady:!0,error:function(e){throw new Error(e)},noop:function(){},isPlainObject:function(e){var t,n;return!(!e\|\|"[object Object]"!==c.call(e))&&(!(t=i(e))\|\|"function"==typeof(n=f.call(t,"constructor")&&t.constructor)&&p.call(n)===d)},isEmptyObject:function(e){var t;for(t in e)return!1;return!0},globalEval:function(e){m(e)},each:function(e,t){var n,r=0;if(C(e)){for(n=e.length;r<n;r++)if(!1===t.call(e[r],r,e[r]))break}else for(r in e)if(!1===t.call(e[r],r,e[r]))break;return e},trim:function(e){return null==e?"":(e+"").replace(T,"")},makeArray:function(e,t){var n=t\|\|[];return null!=e&&(C(Object(e))?w.merge(n,"string"==typeof e?[e]:e):s.call(n,e)),n},inArray:function(e,t,n){return null==t?-1:u.call(t,e,n)},merge:function(e,t){for(var n=+t.length,r=0,i=e.length;r<n;r++)e[i++]=t[r];return e.length=i,e},grep:function(e,t,n){for(var r,i=[],o=0,a=e.length,s=!n;o<a;o++)(r=!t(e[o],o))!==s&&i.push(e[o]);return i},map:function(e,t,n){var r,i,o=0,s=[];if(C(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(e,t){l["[object "+t+"]"]=t.toLowerCase()});function C(e){var t=!!e&&"length"in e&&e.length,n=x(e);return!g(e)&&!y(e)&&("array"===n\|\|0===t\|\|"number"==typeof t&&t>0&&t-1 in e)}var E=function(e){var t,n,r,i,o,a,s,u,l,c,f,p,d,h,g,y,v,m,x,b="sizzle"+1*new Date,w=e.document,T=0,C=0,E=ae(),k=ae(),S=ae(),D=function(e,t){return e===t&&(f=!0),0},N={}.hasOwnProperty,A=[],j=A.pop,q=A.push,L=A.push,H=A.slice,O=function(e,t){for(var n=0,r=e.length;n<r;n++)if(e[n]===t)return n;retur
URL: https://www.telegramai.org/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

URL: https://www.telegramai.org/ Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": true, "contains_fake_security_alerts": false }

URL: https://www.telegramai.org/ Model: Joe Sandbox AI	{ "brands": [ "Telegram" ] }
	{ "brands": [ "Telegram" ] }
URL: https://www.telegramai.org/ Model: Joe Sandbox AI	{ "brands": [ "Telegram" ] }
	{ "brands": [ "Telegram" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 23:14:44 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.978639685926183
Encrypted:	false
SSDEEP:	48:8td7TjbLHqidAKZdA19ehwiZUklqehTy+3:8brMsy
MD5:	B133B6355B06C983447FBBB5F8305CA9
SHA1:	7A4BA20C0C385824C67D9C785E7B7F034F65FECF
SHA-256:	6DEC8A56ABAB7D049FFE301EEDD584AB08A1A96E9425601C20C5A9107881445E
SHA-512:	77D171CA79942513E89F0FD60595926FADA6B553B955DA8309B5660BB6CC810F4A0177F053572E1F849007E16FF3A0054A1A038781DA9F803BE7E023B7B74F1A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........d..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 23:14:44 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.996601596916512
Encrypted:	false
SSDEEP:	48:8Wd7TjbLHqidAKZdA1weh/iZUkAQkqehcy+2:8Kr+9Qxy
MD5:	999B546E5E55A52227411C60F76AF212
SHA1:	E53EA5D5A84C07A8E92D0A211DDDAAC515867517
SHA-256:	741C08E4D3DF2BD16041EC095ACE5B9334744C5C925EE93568032C9844E84A78
SHA-512:	9A80F9441733A710849A69BB424B568A86B71C9ACD63A01018FA3BF0AA75A2439955BC69D571666A2D7D40D4FCF7B1898224D6F086CB573D097DD1452FD54963
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,........d..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	4.005523727733996
Encrypted:	false
SSDEEP:	48:8xsd7TjbsHqidAKZdA14tseh7sFiZUkmgqeh7s6y+BX:8x8rDnoy
MD5:	13AA14D1E99C8040781EC0EA6D08F140
SHA1:	731958B19D916C8C0D88FD7D3E1504B403AEAF3B
SHA-256:	5879B242FF10B37E68F6E55CA42ADACD27E55A082E69707C82552BE093EF1CF2
SHA-512:	FCFB21E19B32309B6E81CA145C7E658BE9E5B329DC4BA8D01686887960A2168E7D951C0B7C4BB2D63685BCDA27D49EC105222CA4390A1F7F9066FC7993BF24E5
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 23:14:44 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.994818086148719
Encrypted:	false
SSDEEP:	48:8Md7TjbLHqidAKZdA1vehDiZUkwqehQy+R:8crliy
MD5:	D8E58488287E46758E1F332E669E71C4
SHA1:	D140403BCFD23F33BC76697530F47C59ECA435B0
SHA-256:	698ED5AA58298692D8B3AD5A959C565BC051ED1DCC026C421C691CD61A468E42
SHA-512:	FEB326B33889AC2A6A1090F28AE8E761E94003E5F3ADC4E3D2CF9D21389235A10E3290F43BB695103CB19A0490957286B5C904619F74B591C41CE0C3E35EC5A0
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....;....d..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 23:14:44 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9836221788034507
Encrypted:	false
SSDEEP:	48:8kd7TjbLHqidAKZdA1hehBiZUk1W1qehWy+C:8Er192y
MD5:	5A0DA517CA263088BB359A0FC31B5D91
SHA1:	E21E2AF9BD62AA72BC27783FE20A7B097DF2A7F0
SHA-256:	4699F56E9194B730E1506CA895916BD93891CDE6A8C0A1B69644F37FF452B536
SHA-512:	B79747C25FE479A272256205D73641CEFEE12544D18700FF1930299218AFB7040624F15FB7E02133A37E56C6F6530CB545EF0FAD234BF04AFA79F2D9636E08E7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........d..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Sat Jan 11 23:14:44 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.9938660600496223
Encrypted:	false
SSDEEP:	48:8Ed7TjbLHqidAKZdA1duT+ehOuTbbiZUk5OjqehOuTboy+yT+:8krJT/TbxWOvTboy7T
MD5:	C16DE9C6BECE2AAE774782D0BF938F4E
SHA1:	4FAF98A3B79F1DA446EF59E2B0700893756786B2
SHA-256:	62A167EE68BB33F94A95AAAD55F58714C1756FC60794250998048BC34C6C7C03
SHA-512:	D12E671C795C62662B3816BDDA7538131FEBD2F538CABA26B1BD9FF3621659DCA54A835F6C6D39AEFBEC5265F1B3A7FC908F93718B82C701D4F39B82EA4790A6
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.........d..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I,Z......B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V,Z......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V,Z......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V,Z............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V,Z.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........#.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\Downloads\42275caf-472a-4a81-b0f0-faa185fa9241.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	7698
Entropy (8bit):	7.9682614377655145
Encrypted:	false
SSDEEP:	192:jgO1oQg2IwZUvN88/an37CGWVr54fs987YchD2f3CnXwn9:jgWa2pZ6u6GWVrJqYchD2fyXw9
MD5:	B5450D3A0106CAFD79BB0739EE068A0E
SHA1:	FA64376E8FF79B55703B1B0A071CF177F394DB2F
SHA-256:	B716B2CDD6B10700236D917056004CD783641F977779ABB3F83CA991401BD739
SHA-512:	8204E3B804B4D53FC40FBE1B9181B2F538F47F23A2573A590128D4DFB56CE6414781BE4F29240B7757843336551BAE5606CA86C3A79F127E828CE80234FCE02C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ZipBomb, Description: Yara detected ZipBomb, Source: C:\Users\user\Downloads\42275caf-472a-4a81-b0f0-faa185fa9241.tmp, Author: Joe Security
Reputation:	low
Preview:	PK.........&Z.<.~..........shater.exe.y<To.7<....2..f....f4...l....i.2.e.L....H.../1.d...!.%C...}.k\|..}.~........u.W.....\.:..y.sM.>q....`..@...a.=.1..#..-S.X.).j.(.qj...:vN...SG..:..p...S!...=.R..Iu..=.'N..1......2\m1.'.I...G.{...Q...i.&D........>....#...k'.E1.1...9..1q....vgA..k.RFa.........8(Hx..m.w>....5P.%.0k.0....P..&a..#..P..&..0.9r).......B..P.`......9..i/.?...yX..F.f.huN.b.V....n.+..........S.^...^h?....a[/u..tX/..[h.]..a.A.0...5...}.;...6.m......\.Zx.g.........=F.0R..............IiKO..W...H_....%~.x....3..'.<\.g)$.1.%/.O.[.F.....ce...~6^.o.R...}..R.W..........&..%..7..]&[xG..iE.t.I......8r.5...]Z.5..$K..2..$yXA.........V.Zh.f...6..h..........{.......w).Q.U .Kj.........@......1.:...e.0........@.6:.,G .....?.,.X.....2.Jb..\.a.....b.......bP.Q.......N..b.u.).........S..C.C...h....(Y..fl.5\.......H.qR..N.eX@..............s....XUtI.$".6..'..U..W.Y?....W..].1-.\.I.+.r9.n..........:.i....WrX#...H#L..`9.z.n....R...F7....7..,....p.v.....U.pn.9B%.-...

C:\Users\user\Downloads\shater (1).zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	17267770
Entropy (8bit):	7.958701723336937
Encrypted:	false
SSDEEP:	393216:tX56P6bzyzkIPDHAr8ToylFR6zVwMYkBIqcB6yv3eKYhsbQM93:t5zyzBk7zmMNMcyv3edyf
MD5:	BA91C627B9A98B81408776A32E30BABB
SHA1:	446753DD897D046DC1E637550FB986B36DB822AD
SHA-256:	FA53B0DBD42B6DB538EF569A2301CB2EE4BF86DABC890514F320A0731E2A10DF
SHA-512:	D0568705D81EEF1B09913A13BB5FD850377C73C7E711402C2554CEAF109D129196289E63372016BAA3B13E345DA80A0AA8749E0C55601116FD4CDF7B2A74063D
Malicious:	false
Reputation:	low
Preview:	PK.........&Z.<.~..........shater.exe.y<To.7<....2..f....f4...l....i.2.e.L....H.../1.d...!.%C...}.k\|..}.~........u.W.....\.:..y.sM.>q....`..@...a.=.1..#..-S.X.).j.(.qj...:vN...SG..:..p...S!...=.R..Iu..=.'N..1......2\m1.'.I...G.{...Q...i.&D........>....#...k'.E1.1...9..1q....vgA..k.RFa.........8(Hx..m.w>....5P.%.0k.0....P..&a..#..P..&..0.9r).......B..P.`......9..i/.?...yX..F.f.huN.b.V....n.+..........S.^...^h?....a[/u..tX/..[h.]..a.A.0...5...}.;...6.m......\.Zx.g.........=F.0R..............IiKO..W...H_....%~.x....3..'.<\.g)$.1.%/.O.[.F.....ce...~6^.o.R...}..R.W..........&..%..7..]&[xG..iE.t.I......8r.5...]Z.5..$K..2..$yXA.........V.Zh.f...6..h..........{.......w).Q.U .Kj.........@......1.:...e.0........@.6:.,G .....?.,.X.....2.Jb..\.a.....b.......bP.Q.......N..b.u.).........S..C.C...h....(Y..fl.5\.......H.qR..N.eX@..............s....XUtI.$".6..'..U..W.Y?....W..].1-.\.I.+.r9.n..........:.i....WrX#...H#L..`9.z.n....R...F7....7..,....p.v.....U.pn.9B%.-...

C:\Users\user\Downloads\shater.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	62506228
Entropy (8bit):	7.999978556244661
Encrypted:	true
SSDEEP:	786432:t5zyzBk7zmMNMcyv3edyfmkjrvCN/tmiFSqndoj+6BBUhT4rbYgVDICBPqc18pp0:fyzJWdkjrKNtdBo0TqYgmTPL/ebSwR
MD5:	115C3122F43560D183BF64DF477C0475
SHA1:	EA54DAC9BEBE5DCAC44D68AD09E792790BB5C20A
SHA-256:	B7441EDB597F80DDC54CC93A144BCA4D16F122CB197AD3D87D861DCD9D729351
SHA-512:	C97C124D85639B7BF43DFE25F7681EFDB52D568303548BA44BF564BA482AE508A31065A352303714C2D200FB33EF9E0615B2D5AC866C2CB15B374E2E811545A7
Malicious:	false
Reputation:	low
Preview:	PK.........&Z.<.~..........shater.exe.y<To.7<....2..f....f4...l....i.2.e.L....H.../1.d...!.%C...}.k\|..}.~........u.W.....\.:..y.sM.>q....`..@...a.=.1..#..-S.X.).j.(.qj...:vN...SG..:..p...S!...=.R..Iu..=.'N..1......2\m1.'.I...G.{...Q...i.&D........>....#...k'.E1.1...9..1q....vgA..k.RFa.........8(Hx..m.w>....5P.%.0k.0....P..&a..#..P..&..0.9r).......B..P.`......9..i/.?...yX..F.f.huN.b.V....n.+..........S.^...^h?....a[/u..tX/..[h.]..a.A.0...5...}.;...6.m......\.Zx.g.........=F.0R..............IiKO..W...H_....%~.x....3..'.<\.g)$.1.%/.O.[.F.....ce...~6^.o.R...}..R.W..........&..%..7..]&[xG..iE.t.I......8r.5...]Z.5..$K..2..$yXA.........V.Zh.f...6..h..........{.......w).Q.U .Kj.........@......1.:...e.0........@.6:.,G .....?.,.X.....2.Jb..\.a.....b.......bP.Q.......N..b.u.).........S..C.C...h....(Y..fl.5\.......H.qR..N.eX@..............s....XUtI.$".6..'..U..W.Y?....W..].1-.\.I.+.r9.n..........:.i....WrX#...H#L..`9.z.n....R...F7....7..,....p.v.....U.pn.9B%.-...

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82", baseline, precision 8, 1024x512, components 3
Category:	downloaded
Size (bytes):	41526
Entropy (8bit):	7.922647756349403
Encrypted:	false
SSDEEP:	768:lB6Aa5oA1M3RYxtDWmI4rpGkBQvirwvJeRVEfFlDswP2LhKfSF4Jia1b1B5s2lQZ:lBBYoASs64FFQmYJs+3AwPtfo4JioZgR
MD5:	880C2CB4FA191A2F538463D69AF44489
SHA1:	99880F87D0EEF71B71BC23F856B17020005C9E1C
SHA-256:	93F01172B36E69C8A324442FAE79AE9F6DD7C5C7345FF458A9374A1436D5FE8D
SHA-512:	25C2AFF1BD44EB633CE500673818002F24E667D583B0A8A5F0BD9EE35C1324C42D891EB3167F2B5A6E541069CBC7F19AB24B69D07970598792CA2BB6567FC620
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/777.jpeg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..../.....K...k2.a...U%....)A.M,8R.sK.@-....Z(...Zo4....{R.L.."G.)......h.@..)i..- ....&..A.I.3J..Q.J).a.<.W...m.!.8..syo....-..vS..lj.....QY..)i.)........-.QH..)...-'zu...(.0....B.E.R..(........QE..C..(...4... ..Q. .(...(.....)i)E .(...(.....E.w...;.&)h.P..Q..(...E..QE..S...\}..B.6.z/.>./.&.....s.......

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1083 x 499, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	66150
Entropy (8bit):	7.978775494536139
Encrypted:	false
SSDEEP:	1536:PhDoHbk8I/2QFdssM8dMC6CA2AhXUIzu9AoJvYDQMb4p4aBtBlxyZJse8:Pe7k8pQnxM8CvqAhkIzuSk3AA7lx2se8
MD5:	1BC64AF22B7C6F477D1635B174C3E599
SHA1:	2F4DF7BB8F8AF81F97FC3A34673FDBA21008CD09
SHA-256:	9341108FEB5C7FE032FC0BDE2DC768A406707E978E94CC15B6E61E9A7EE716CF
SHA-512:	28AF04614AD1830455654E665F2084CD49C6B6D96D409DA15896A9CD0DB1F5EBE131C515DD89A1C4BF8897CE1F67BA13A00F5FFC0666B297F04FC9F848F368F5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...;............n....PLTE...........................................((,-.2. ...56:.........................1"";($$.....D--.}....(.......%7".!.$/.........t....JLR..c.....P\|..}I25...ccer..j.....XW\p.....z....f...R68.........8?D.......~iimD)"..pqv......8&.Q2)...........Z=A.y......[....2fBC....~.zu...&wy{...r..`..........U....DBF.......x.......}...}..ym....D..[b.^=1M.....kKM.kz............q.qi...w.....5....l........O\.ps..v....ih...=]uzPM._iO..........m...cT..pc.....SM...j...t..._Vyl'.......dn.G................O\|.........s].@.............K{.wC9...M.....x............Gb..dc.f0,J\.Z.\|O...]..!...d..F...1L.y..W..._....tU]..v.....7.2....z..E../..V..y.i.m<:m..z.........K'}.....,.......rk..m..e<...X.Q1uv,x...6..g.L..#..7.H.]...............tRNS..V)i.D..\t......IDATx.........................................................................`..eEq ..h:ml.F!E.A.\..UC.B...A.....O.N...b.Z...o....D..........................

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65279)
Category:	downloaded
Size (bytes):	135912
Entropy (8bit):	5.251228461507653
Encrypted:	false
SSDEEP:	3072:nJlTI5AfBFkvgn475jraWImz6T0WBD1VD74w991gIb:nJVI6fBFkvgn49jraWIm+T0WBD1p191d
MD5:	1ED8A578DA9D411803B72FA1ED81B2A5
SHA1:	FBD23D0946E1635FC1A6B014727239A06610FDDD
SHA-256:	8954AE9654AEA5D46A68BC5D91C063A3896A0D8A5927822049E4E06A4252B4A6
SHA-512:	A58D6DFC00E04F06DF19BC34FA6446777DC4AE80396204545A140D1693C801D073CA849BDFC16C16B7F8C014DC4B71853DD4DF82DA51ADB18291D9760B639760
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/js/swiper-bundle.min.js
Preview:	/*. Swiper 7.4.1. * Most modern mobile touch slider and framework with hardware accelerated transitions. * https://swiperjs.com. . Copyright 2014-2021 Vladimir Kharlampidi. . Released under the MIT License. . Released on: December 24, 2021. */..!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).Swiper=t()}(this,(function(){"use strict";function e(e){return null!==e&&"object"==typeof e&&"constructor"in e&&e.constructor===Object}function t(s={},a={}){Object.keys(a).forEach((i=>{void 0===s[i]?s[i]=a[i]:e(a[i])&&e(s[i])&&Object.keys(a[i]).length>0&&t(s[i],a[i])}))}const s={body:{},addEventListener(){},removeEventListener(){},activeElement:{blur(){},nodeName:""},querySelector:()=>null,querySelectorAll:()=>[],getElementById:()=>null,createEvent:()=>({initEvent(){}}),createElement:()=>({children:[],childNodes:[],style:{},setAttribute(){},getElem

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3393
Entropy (8bit):	7.861381453330033
Encrypted:	false
SSDEEP:	96:k6V1NQz8ZW1B/+bs6/qHgzraL//qt9ahig7Fe4b:v1NQz//+bsYqHgzmLHqt8ig5e4b
MD5:	941D950538F7CA436158C908C7DEC967
SHA1:	69E4EB157989D26A2F71778BCD9EE78BE57C3290
SHA-256:	44E36F9777D5A9DAF22BAC2890247E92466C2842947B5F4AFAF65AD91BF3F94F
SHA-512:	BAA766C378592012B190AF6658A24578A8C8551EFDD0C82BB1DAC1FB9C70C19A8ACEA56E4270B9E401C35494519A286B4E57F85C2F400715C1134B1A204ED2C2
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....................PLTE...'..&..'..%.."..%..'..'....&..)..#..$..(..$..'..#..#.."..(..$..%..%.."..).."..%..(..#..#..)..$..(..%..#..(..#....'.."..#..)..(.."..'..$..)..#..&..&..)..%..$....'..).."..(..$..(..#..(..#..&.."...."..)..#..)..$..(.."..$..)..&..#..)..)..)..)..'....#..(..#..&..&..'..&..$..'..&..'..#..".."..$....'..&..#..(..%..)..#..#..$..(..#..).."..$....)..&..&..#..(..).."..(.."..'..)..%.."......)..%..).....#..(..#..$..(..(..%..)..&..'..%..#..'..&..(..$..).."..'..%..'....'............................P..1...........C..L..G....)..(..........................}..g..9..*..5..>..,.................k..]..U..1.............x..n..5..-..-..5..............c..<..@..9.......................p..U..G..e..8..............\|..t.._..Z..]..L..r.........tRNS.......,....1.K.....2#......\|oIBA............E)&...........\L<<7...................hda.............wrmh[SO..........wkT...c`....&.....IDATx...M..@...d.d..S... ...l=....H. .h$...^<........-..07.........y.}...?<.

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 1024x576, components 3
Category:	downloaded
Size (bytes):	59978
Entropy (8bit):	7.9538746092793104
Encrypted:	false
SSDEEP:	1536:6akejN8f+Sc6mLKUhp8ENRpNxzZFUpjgBziVCme/:OKN8f+ScZKUhp/R3xzZmpjgBeVCme/
MD5:	4116E064AC15FF520A5A123614CD9B32
SHA1:	AB15640EA6F27395EC4A25EE1E6A65EB7BF28D5E
SHA-256:	F9D52596F666FA46651E4F5A23463FCF0DD387C18071D9E3A568125338820F75
SHA-512:	D5D2123EE05966797E660D7109CEA28F8D60F4813C955A38F19AFA5526439245A6EFED1D679A2C38DFB2E605486D7E833D14006F1CB3676FE3ADB67BC9E00E67
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/555.jpeg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......@...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..W.1\..d..+.a..N..i...Tjg...=...-.x.......Z.Zn...R.I.\|...`U...NEL.r'..t..z.r.."....&L .+.J.)1Elt..&.Z....Z..E<I..SL.t..R.].5.7....M-.j.0.1.M..Z....E....JQI@..Q@.K.m/JV...R.sF}(.Xzu.(..UO5.i.....Ir.......zS.a8.Z..C.....^..Ng....s..=XG5,..10..y...k.F..W,....~q.V......r.J..R6e..`*.s......f.h.u..T.V...j

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (15306)
Category:	downloaded
Size (bytes):	15563
Entropy (8bit):	5.237704090318284
Encrypted:	false
SSDEEP:	192:D4mUJbiKneTTzbHZ+SKUP3p/a/AMQfHffxVeesedOJ9A5Pz+c3At2/6:DJUbeTXbHZ+GA/AVfHfS4XYz
MD5:	BC962E7A8C5D00F04681054250D7162C
SHA1:	E4AA1ED747C0087D6062A4738A8C297CE44FC1AB
SHA-256:	B4C36BD623E62BEA63B81DABB7CE6F9E3AE05C5D22F11D2C3A5802CED3C9C499
SHA-512:	91FB48846BFF93FA111E67C344311BD4CC65696956E2D8B3DB5AF1D32342DB35163369F89F146D5F5CF72239AEE7885EDD87FDB015F8B2425A09EDCB4C9575AD
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/css/swiper-bundle.min.css
Preview:	/*. Swiper 7.4.1. * Most modern mobile touch slider and framework with hardware accelerated transitions. * https://swiperjs.com. . Copyright 2014-2021 Vladimir Kharlampidi. . Released under the MIT License. . Released on: December 24, 2021. */..@font-face{font-family:swiper-icons;src:url('data:application/font-woff;charset=utf-8;base64, d09GRgABAAAAAAZgABAAAAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGRlRNAAAGRAAAABoAAAAci6qHkUdERUYAAAWgAAAAIwAAACQAYABXR1BPUwAABhQAAAAuAAAANuAY7+xHU1VCAAAFxAAAAFAAAABm2fPczU9TLzIAAAHcAAAASgAAAGBP9V5RY21hcAAAAkQAAACIAAABYt6F0cBjdnQgAAACzAAAAAQAAAAEABEBRGdhc3AAAAWYAAAACAAAAAj//wADZ2x5ZgAAAywAAADMAAAD2MHtryVoZWFkAAABbAAAADAAAAA2E2+eoWhoZWEAAAGcAAAAHwAAACQC9gDzaG10eAAAAigAAAAZAAAArgJkABFsb2NhAAAC0AAAAFoAAABaFQAUGG1heHAAAAG8AAAAHwAAACAAcABAbmFtZQAAA/gAAAE5AAACXvFdBwlwb3N0AAAFNAAAAGIAAACE5s74hXjaY2BkYGAAYpf5Hu/j+W2+MnAzMYDAzaX6QjD6/4//Bxj5GA8AuRwMYGkAPywL13jaY2BkYGA88P8Agx4j+/8fQDYfA1AEBWgDAIB2BOoAeNpjYGRgYNBh4GdgYgABEMnIABJzYNADCQAACWgAsQB42mNgYfzCOIGBl

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2664 x 2744, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	687893
Entropy (8bit):	7.959198303368434
Encrypted:	false
SSDEEP:	12288:J7CJd3qZC+boVMd/tYx7wmCIfHZPYsCr9CojmqJsH/b:gy7qq/tYpwxISYLYsfb
MD5:	7EA114F508DD0209331BFF9F4F8F2BBA
SHA1:	B04750E533DBCAAD563EAAA63226AD9007CEB16A
SHA-256:	5A211F1F5EEB5DEB8EDF132667BC3EC787CBA7F3850A7A0FA952BA4B167052F5
SHA-512:	CA55C04E6FCA4F9B6FF669984D707F5A35D62B4ACAAEFE885654D9A7482DA94F2CDD78AC817C21CC367D619501A3283A9062824CCBB1A10B43C5381F5395174B
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/phone.png
Preview:	.PNG........IHDR...h.........~#^v....PLTE...vvvqqqmmmggg^^^cccGGITST...mmm.........\|\|\|........................wwu...............................................................................%$$...........9.....c..........===...........].4..iij...s.......D..pqq...........................R...v.MNR.....<....xyyS......#......aab.............^q......B..*..+....YZ[...p...................Z..uj.............gVS.....kb]..Zdu.....\|TA...aKpG6...J..^LD..Y@1....nX...waW.}q....\|\..y....Mb.....e%j.G5(:..Yw;t....K..r.b..s..~h.^..p..9$.....\|.Z....a...mI..F^,y......3.Gw.X.HK.......wW.......du....m..7[.I..+<_..^L.i1.o......n.}#.}.S'.L..._/.9.3......tRNS..-?Ol]...b...S"........b.......IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.};H.....H....^T.A<9.....o.....6.).%.P-.:C)K.(..3....t..`.`:.j.....@.,...b1.F.......k..R.....?pwN.b......w.P

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 84 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	346
Entropy (8bit):	6.2067180216551385
Encrypted:	false
SSDEEP:	6:6v/lhPlWxbXA9BhotIPRFRQeQeQeQeQeQeQeQeQAAU85M9eQQQQQQQQqYBlVp:6v/7WbXAzEIPRzAUMM9eQQQQQQQQqS
MD5:	B19CED806F61654ED67F23EFB4F24336
SHA1:	37A635A71154C08A9E025B428B44AEDAA38DE008
SHA-256:	537AE07701C3DB98E222250F18C223FE1EB4203E763D7C65EF6B349C0BEC7D1B
SHA-512:	258AF04D727890F21742ABBB126835F9FB78C4789282417496D894CCD0F76233E3C569F5DD186DC21B1A39C20E7E5DF4141196B160F56F6491B13BBCFEAC6423
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/image/icon_nav.png
Preview:	.PNG........IHDR...T...H.....h..!....sBIT....\|.d.....IDATx^.....0.E.....".Cxg....A.......{....T...r.@.g..j...=..........5?.@q......\.....\.....\.....\.....\.....\.....\.....\.....\.....\.j........>4P-..4P,..4P,..T...s.)................................................................*.@.....@.....@.....k.R....v....IEND.B`.

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 220 x 100, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9739
Entropy (8bit):	7.914505260000532
Encrypted:	false
SSDEEP:	192:gknlyfTf5n4b3sRbK5KvEKczTlW/aoOr7ax+SJJUWocAU9Uo0nC:bnlOnq3ybwKvszREbPUWvvqnC
MD5:	E94E30D49B2C58C8CE7BF1A96BE1458A
SHA1:	79334D2865DDD486A79F97725363F56655C80BDE
SHA-256:	93BE4E2A9B593AC4D78B29C43D2B8E7CDA4BA12299EB1517853E19E5EA9057C2
SHA-512:	9D69371DBB0223AEBC2D49D7DAAF3DD0451F865C73A146D1AC202B808498588EB26B1377BB00DB26A2A41433D1BB90933AC161FC6906DE339F0655B851C7A667
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......d.......^.....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-06T15:09:15+08:00" xmp:ModifyDate="2024-12-17T14:20:57+08:00" xmp:MetadataDate="2024-12-17T14:20:57+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7d066497-e3d0-2541-8dac-189d725474c6" xmpMM:DocumentID="xmp.did:7d066497-e3d0-2541-8dac-189d725474c6" xmpMM:OriginalDocumentID="xmp.did:7d066497-e3d0-2541-8

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 840 x 487, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	53316
Entropy (8bit):	7.965265678054814
Encrypted:	false
SSDEEP:	1536:gMPwGz33wW/wM+s3LHPYyE1+kn09/BETBfRO7hZ3:gun7/wMTYy2Vn0zETfq1
MD5:	F4EBBD76B086C583A0271B487FE34B85
SHA1:	B94F134B67FDF52BA1DEE9A2F1708A9DFD325BA2
SHA-256:	8AC29ED4158743CCBBE2C0F179008198627BB0C053060C017F2264476837293D
SHA-512:	0083EFA30FDFAFA664E28042576BE0ACD2EEAB68AF2EEB70C6F9B507D63EAAE811695EBD22310BE9CA4B98924D9B29ABE811B8B6F83F7A2DD2984A13134A4B46
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...H................PLTE...............666.........AAA......AAA...0........ ..&.....,..)..:..///988.........'''....................................0..fff.......~.....~r.w.....k.uj.oq.\|......q.q..{............~.{.........y.v............_........b.p...y..[......}..........b.h..\|.......................\|.\|.ott.{7..Y.iF.._`a....................a.....{..YXZNMMn.....lllTSS...y.._..U..trp...yxy........z.ws~.GFF...........e{.q............~.....Vz....is\|l^VH}...........k......nj................\|.....wedi.l...^hu........x........~n...w.o<t.......s...ztD...........}....}n....xsZO.`......gSD.}....r.......}0Ci...#j.W>7KUo...7I.^R.I].....M.j.p,4....H$Y..V....~..tc..)..T........m.e.g...ez,.@.G....?V,.../..J.I~.7W.~..^V......T.].^..O.:c/.......tRNS.R.x.x3...H..G....IDATx....j.0....B....=.^O..\|.-..ZS........l.E......#b..s...c...G.. j.......@......"[#.O.9...I"G.A..s.x.\|.....rs..?t.$.$8..K.....T...... ...o..!.<..$%.....$@.

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 1024x591, components 3
Category:	downloaded
Size (bytes):	45082
Entropy (8bit):	7.835095956679689
Encrypted:	false
SSDEEP:	768:G1Hlj2n+TPZ2v2NpYFRor1xS/XuIGwk3ji3v1w4Y1Gg8ont3r4cFwuF+B:Ghly+TPZs2PZOuIGh3ONxY1f8ont0cF0
MD5:	48F819FABB18F36C8C078D2590C49D38
SHA1:	A3BD148D2FF85DEE76376C85E161551B33CC2495
SHA-256:	14F9EF2B8E5B4F58EAF3107578DB32D6FCFA4F23AC13A8A4619FAE79A7B5A468
SHA-512:	BD0A963D6D6D9140F5504421D6B35499119C2609DB7CF2D652AF2814ECB4E4E5D21704DD44DCB4F2C4BC1578C7F490277CCD2CCD67C3E5F0EE9DFEE24057D0F7
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/333.jpg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......O...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..bE7y...i.......<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P.

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1090
Entropy (8bit):	7.5234783441730935
Encrypted:	false
SSDEEP:	24:4K9iE82RcrZw0WMUCiYEUNbWyX/9c4fwEBMDqim5IOEqACPCoeD:48i9hZayiYzwi/9zwMszbqhP5eD
MD5:	6C3A3C53915E000BD300FE168A069E02
SHA1:	0AAE9F53B586E5EBF40CE684A5A0754F90FAD4C8
SHA-256:	E3461207F8A9B933F2E057C7D7ED594CF338E44AA4DC3A3B6F1D67650D17379A
SHA-512:	096183167AAFF56E8C763706FAD7FB721B84161292E511FA472AA47AD288EAC68859AB2472E7B80A7DACA98701DF9E26ADC4BF4DAE37B5B567D6879CAB0FD1E3
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/image/left.png
Preview:	.PNG........IHDR...x...x.............sRGB.........PLTE..................................................................................................................................................................................................................~J....1tRNS... 0000@@@PPP``pppp..........................V....IDATh....r.0..`%.64....Z5ij..vdH!P([{.......c..Y.f....7....V.M.6m..tN.."NV...$..x..G.g..$...S.....H.?..2...zz..2....Fw..1<.d..I.....Q......4:..9E?..HI...%.......st..#......^.u..0F. .?..5.u.!0g.ta9.X.....5;.3.>m.}.....;.w.<..5..=.....?.q7...oH..........M....{..H.o..?...mUrs!..}I..........]{_{...O.i.k]...]XP......]. ..]xX\|..w-..]..u).Z.....q!.......w-..........Fv...-....o.........U6..t..(.O....T9F?2..K."A.5aY$.......!i.C.-..LZN..c.l..N@X.m.......S&+.,.T.l..9.Q9._..rZr.....Q.;=#(.e.]..2.......5...w.;yCi.{.w.......oH.v..\~..V6X...{..W.?...9.1i..N..v._..tvy.u_.j^...g.1..w.?.RF.W..+0..u.$....#c>..1.G...R.._!].......L.).r.Z...Q.

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	dropped
Size (bytes):	86923
Entropy (8bit):	5.288942392211126
Encrypted:	false
SSDEEP:	1536:hLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6tv:nkn6x2xe9NK6nC6N
MD5:	B72AFE07A6F6F477120F3B0803D0A983
SHA1:	78EF8329A917D65F8BEDF5E1336724C6F5B80404
SHA-256:	F1A9C17B50D6278A694406D9E5DCE160F81AFD7A2683DFDF07F0651C38BDAA8E
SHA-512:	823B863FE8840923178A5CF7DA42AD9A99C019CA237C320C080338A0B96D95A4662405E91877372BF664E0B6947E70202958A6513727B450CF9D04D29F50DA26
Malicious:	false
Reputation:	low
Preview:	/!jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license/!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},T=/

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	downloaded
Size (bytes):	15172666
Entropy (8bit):	7.999970793273492
Encrypted:	true
SSDEEP:	393216:tX56P6bzyzkIPDHAr8ToylFR6zVwMYkBIqcB6yv3eKYhsbQM97:t5zyzBk7zmMNMcyv3edyfd
MD5:	2557FC98F827286D0E3525365D4A8DBD
SHA1:	DD4437CAA8358C325C31BAAFCAB21B139F0DD653
SHA-256:	B71D6829913A8F9DEE41E673AD518F59121DCF0DEE5A95F4ECCA70C8FB66E3F0
SHA-512:	AB44DAA6C06E0B9B29542DB64075475386F2388483CA3B4C3DE4C55E9C122003E946AF6F1CB29B025C358A793275C29C6FB5C8DDE1FA7C82E1CF5A4746FAF347
Malicious:	false
Reputation:	low
URL:	https://00-25-1333705940.cos.ap-hongkong.myqcloud.com/shater.zip
Preview:	PK.........&Z.<.~..........shater.exe.y<To.7<....2..f....f4...l....i.2.e.L....H.../1.d...!.%C...}.k\|..}.~........u.W.....\.:..y.sM.>q....`..@...a.=.1..#..-S.X.).j.(.qj...:vN...SG..:..p...S!...=.R..Iu..=.'N..1......2\m1.'.I...G.{...Q...i.&D........>....#...k'.E1.1...9..1q....vgA..k.RFa.........8(Hx..m.w>....5P.%.0k.0....P..&a..#..P..&..0.9r).......B..P.`......9..i/.?...yX..F.f.huN.b.V....n.+..........S.^...^h?....a[/u..tX/..[h.]..a.A.0...5...}.;...6.m......\.Zx.g.........=F.0R..............IiKO..W...H_....%~.x....3..'.<\.g)$.1.%/.O.[.F.....ce...~6^.o.R...}..R.W..........&..%..7..]&[xG..iE.t.I......8r.5...]Z.5..$K..2..$yXA.........V.Zh.f...6..h..........{.......w).Q.U .Kj.........@......1.:...e.0........@.6:.,G .....?.,.X.....2.Jb..\.a.....b.......bP.Q.......N..b.u.).........S..C.C...h....(Y..fl.5\.......H.qR..N.eX@..............s....XUtI.$".6..'..U..W.Y?....W..].1-.\.I.+.r9.n..........:.i....WrX#...H#L..`9.z.n....R...F7....7..,....p.v.....U.pn.9B%.-...

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1081
Entropy (8bit):	7.49924272574793
Encrypted:	false
SSDEEP:	24:EK9iE82R3r/I4N6bPeRq1hnFWCJPIu/Tesi4ri30bpr:E8i9ir/rNifj4CBIu/Tesi4rQ0bF
MD5:	B6F0A6472B7E779D6030A10E069B22A2
SHA1:	2744AF266F6AFA5C78C95439CEF2B1C992452E10
SHA-256:	A92EF1610D5A38D3604EC50BE49D473423B0E8E7DFE1F5342BEB8EE64A55FA24
SHA-512:	A4CF02CFC740C12A1D8825BEAAAF748C06965785C89ABC720302208A7531FC34213E527091A8D01F9F086D548F6F9DC325D09F11EC247D11C9D5ED4B6DDB623F
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/image/right.png
Preview:	.PNG........IHDR...x...x.............sRGB.........PLTE......................................................................................................................................................................................................&......1tRNS... 0000@@@PPP``pppp..........................V....IDATh...[..0.........o..l.j/.......P>xY..&.....gN.'..VD..]....]..,....<M....>.'9.$..>.S.q-..O.,..".c......P.A..!.{W...:..9...^~H:h...".VG.8...,..+9.........#.N.bd..]..\.9h....F..d....Hsi.N.8Q..X`).'.....;Cg.g.a...\|p.lse/M.....;.Wv`z.R(y......g.a..._..6H9.k0..#Nn,l...+....r.wG..@...U..........R..0.n...fyEs.s...n.....<.v.i.%....o....AQ....~..rV...../...e.DF..../....G.].p.......X...P.U..?P.)cw5..-..o.6.7Ws..].x.........%.[./.^..x.1.........T..5..6..9gu5..a.@.E.;.W.....\|..Zn[^[.....b*.#.....Dut...[c..8..`.Q.\S.-.{.UJm....`!....m..6.a.{2z.:./I......l.,l.\.i.k..02......<,..P8.....+.....Y......B...V.B.B~.t}W...g..h..^."..u(\|3+.o..F/[.]<M

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3393
Entropy (8bit):	7.861381453330033
Encrypted:	false
SSDEEP:	96:k6V1NQz8ZW1B/+bs6/qHgzraL//qt9ahig7Fe4b:v1NQz//+bsYqHgzmLHqt8ig5e4b
MD5:	941D950538F7CA436158C908C7DEC967
SHA1:	69E4EB157989D26A2F71778BCD9EE78BE57C3290
SHA-256:	44E36F9777D5A9DAF22BAC2890247E92466C2842947B5F4AFAF65AD91BF3F94F
SHA-512:	BAA766C378592012B190AF6658A24578A8C8551EFDD0C82BB1DAC1FB9C70C19A8ACEA56E4270B9E401C35494519A286B4E57F85C2F400715C1134B1A204ED2C2
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/logo.png
Preview:	.PNG........IHDR....................PLTE...'..&..'..%.."..%..'..'....&..)..#..$..(..$..'..#..#.."..(..$..%..%.."..).."..%..(..#..#..)..$..(..%..#..(..#....'.."..#..)..(.."..'..$..)..#..&..&..)..%..$....'..).."..(..$..(..#..(..#..&.."...."..)..#..)..$..(.."..$..)..&..#..)..)..)..)..'....#..(..#..&..&..'..&..$..'..&..'..#..".."..$....'..&..#..(..%..)..#..#..$..(..#..).."..$....)..&..&..#..(..).."..(.."..'..)..%.."......)..%..).....#..(..#..$..(..(..%..)..&..'..%..#..'..&..(..$..).."..'..%..'....'............................P..1...........C..L..G....)..(..........................}..g..9..*..5..>..,.................k..]..U..1.............x..n..5..-..-..5..............c..<..@..9.......................p..U..G..e..8..............\|..t.._..Z..]..L..r.........tRNS.......,....1.K.....2#......\|oIBA............E)&...........\L<<7...................hda.............wrmh[SO..........wkT...c`....&.....IDATx...M..@...d.d..S... ...l=....H. .h$...^<........-..07.........y.}...?<.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2321
Entropy (8bit):	6.87424231574094
Encrypted:	false
SSDEEP:	48:D/6jVd6V4knA9WIbDP4tdoC3VHSy3dQ+Hl0ASvWU1LxbyEQxSe1:DSTlknmWIbDP431HSMQ+HlpeTNA51
MD5:	F2D860D597217C84892C0D1ECF370A1E
SHA1:	ADA9DC39B78E704E98A1AB7093257D001251DEC3
SHA-256:	3E45C0B06494346B4E26B248E55D09584B0775ED45C24D8D43E0011176BE32BF
SHA-512:	9439ECB9E28350536A5C556B73F79B5CE76DF27BEE8CA79E1750CE1C31BB79DEC7F37ADA523866BDE6E3C4AA85686811E878875385AD6B3248440E8CB07B973C
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@......iq.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-04T10:16:32+08:00" xmp:ModifyDate="2024-12-05T17:59:24+08:00" xmp:MetadataDate="2024-12-05T17:59:24+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:d91d07dd-9c23-9f4a-b532-92e5f520b423" xmpMM:DocumentID="xmp.did:16b410e7-8af1-c84b-a594-f3752fc0d2e8" xmpMM:OriginalDocumentID="xmp.did:16b410e7-8af1-c84b-a

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1331
Entropy (8bit):	5.130415263980162
Encrypted:	false
SSDEEP:	24:sSaDlMfl2HgSE98vJ34apncroPi3i436P8oe6uPBoND7S:sSaDafoASE98vB5TP+JOCP+du
MD5:	EBB3C870BBCA875F5CEEDE01DFD5AC71
SHA1:	8CC3CDB83C7463D5F4610BE553B2CE9034DDB2A8
SHA-256:	5D980CE2F83A0AF6CECA8264539E0380FF235E8C621BCA2F22F1BC2DB9B4FA5F
SHA-512:	A7D4F42F3327F36392E306EB99199B8ABBE8AB64771D99C67D87F4650C051D9A780049C844F3DF4C03AD9F7E710DAC6FC367388CB1E4EE3B41B1DF5E0A7D2E1C
Malicious:	false
Reputation:	low
Preview:	$('#to-top').click(function() {.. $('body,html').animate({scrollTop:0},1);.. return false;..});....$(window).scroll(function() {.. const scrollTop = $(window).scrollTop();.. const windowHeight = $(window).height();.. if (scrollTop > 200 ) {.. $('#to-top').fadeIn(1).css('display', 'flex');.. } else {.. $('#to-top').fadeOut(1).css('display', 'none');.. }..});....// ........function getOperatingSystem() {.. var userAgent = navigator.userAgent \|\| navigator.vendor \|\| window.opera;.. if (/android/i.test(userAgent)) {.. return "android";.. }.. if (/iPad\|iPhone\|iPod/.test(userAgent) && !window.MSStream) {.. return "ios";.. }.. return "pc";..}....if(getOperatingSystem()=="android"){.. $(".down-link").css("display",'none').. $(".down-link.android").css("display",'inline-block')..}..if(getOperatingSystem()=="ios"){.. $(".down-link").css("display",'none').. $(".down-link.ios").css("display",'inline-block')..

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1081
Entropy (8bit):	7.49924272574793
Encrypted:	false
SSDEEP:	24:EK9iE82R3r/I4N6bPeRq1hnFWCJPIu/Tesi4ri30bpr:E8i9ir/rNifj4CBIu/Tesi4rQ0bF
MD5:	B6F0A6472B7E779D6030A10E069B22A2
SHA1:	2744AF266F6AFA5C78C95439CEF2B1C992452E10
SHA-256:	A92EF1610D5A38D3604EC50BE49D473423B0E8E7DFE1F5342BEB8EE64A55FA24
SHA-512:	A4CF02CFC740C12A1D8825BEAAAF748C06965785C89ABC720302208A7531FC34213E527091A8D01F9F086D548F6F9DC325D09F11EC247D11C9D5ED4B6DDB623F
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...x...x.............sRGB.........PLTE......................................................................................................................................................................................................&......1tRNS... 0000@@@PPP``pppp..........................V....IDATh...[..0.........o..l.j/.......P>xY..&.....gN.'..VD..]....]..,....<M....>.'9.$..>.S.q-..O.,..".c......P.A..!.{W...:..9...^~H:h...".VG.8...,..+9.........#.N.bd..]..\.9h....F..d....Hsi.N.8Q..X`).'.....;Cg.g.a...\|p.lse/M.....;.Wv`z.R(y......g.a..._..6H9.k0..#Nn,l...+....r.wG..@...U..........R..0.n...fyEs.s...n.....<.v.i.%....o....AQ....~..rV...../...e.DF..../....G.].p.......X...P.U..?P.)cw5..-..o.6.7Ws..].x.........%.[./.^..x.1.........T..5..6..9gu5..a.@.E.;.W.....\|..Zn[^[.....b*.#.....Dut...[c..8..`.Q.\S.-.{.UJm....`!....m..6.a.{2z.:./I......l.,l.\.i.k..02......<,..P8.....+.....Y......B...V.B.B~.t}W...g..h..^."..u(\|3+.o..F/[.]<M

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	4286
Entropy (8bit):	5.157520760822341
Encrypted:	false
SSDEEP:	48:er7z41Fi4mXEJyfetrETUzkPPgl0TzcHdCC8ZzsVhRItkhXj4FOKWXG8Q:u7z41c4mXEpHzk3gqzNCBKwKWWB
MD5:	975B4112A366CCA6B9BF2C84E268268C
SHA1:	97992BEA1D222B36E9B77B1E0E2C9F0CFDE0CCF5
SHA-256:	181349B08B8DA309823B3B6A670CE13581FF82AF7B03DB71BA60C705D0620261
SHA-512:	1440CD81F276F753DE3B6DFC7851D569689E998F14C55DCE698F68B4487D36E18B9D010DE66EC791FC97704CCC674AB65B26AC46F298A97B664FFE7BCCC90034
Malicious:	false
Reputation:	low
Preview:	...... .... .........(... ...@..... ..................................................................+..+G.'..(..)..(..)..(..(..'..(G.+..........................................................................+..)..(..(..(..(..(..(..(..(..(..(..(..(..)..+..........................................................I..)..)..)..)..(..)..(..(..(..(..(..(..(..(..(..(..)..)..I..............................................+..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..+......................................,..+....)....)..)....)......)....)..)..)..)..)..)..)..)..)....--.............................+..+..............................................+..+......................I....+..............+....+..+..+..+..+..+....+......+....+..+....,..I..................+..+..+..+..+..+..+..+..

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 220 x 100, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	9739
Entropy (8bit):	7.914505260000532
Encrypted:	false
SSDEEP:	192:gknlyfTf5n4b3sRbK5KvEKczTlW/aoOr7ax+SJJUWocAU9Uo0nC:bnlOnq3ybwKvszREbPUWvvqnC
MD5:	E94E30D49B2C58C8CE7BF1A96BE1458A
SHA1:	79334D2865DDD486A79F97725363F56655C80BDE
SHA-256:	93BE4E2A9B593AC4D78B29C43D2B8E7CDA4BA12299EB1517853E19E5EA9057C2
SHA-512:	9D69371DBB0223AEBC2D49D7DAAF3DD0451F865C73A146D1AC202B808498588EB26B1377BB00DB26A2A41433D1BB90933AC161FC6906DE339F0655B851C7A667
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-logo.png
Preview:	.PNG........IHDR.......d.......^.....pHYs..........+......iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-06T15:09:15+08:00" xmp:ModifyDate="2024-12-17T14:20:57+08:00" xmp:MetadataDate="2024-12-17T14:20:57+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:7d066497-e3d0-2541-8dac-189d725474c6" xmpMM:DocumentID="xmp.did:7d066497-e3d0-2541-8dac-189d725474c6" xmpMM:OriginalDocumentID="xmp.did:7d066497-e3d0-2541-8

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65279)
Category:	dropped
Size (bytes):	135912
Entropy (8bit):	5.251228461507653
Encrypted:	false
SSDEEP:	3072:nJlTI5AfBFkvgn475jraWImz6T0WBD1VD74w991gIb:nJVI6fBFkvgn49jraWIm+T0WBD1p191d
MD5:	1ED8A578DA9D411803B72FA1ED81B2A5
SHA1:	FBD23D0946E1635FC1A6B014727239A06610FDDD
SHA-256:	8954AE9654AEA5D46A68BC5D91C063A3896A0D8A5927822049E4E06A4252B4A6
SHA-512:	A58D6DFC00E04F06DF19BC34FA6446777DC4AE80396204545A140D1693C801D073CA849BDFC16C16B7F8C014DC4B71853DD4DF82DA51ADB18291D9760B639760
Malicious:	false
Reputation:	low
Preview:	/*. Swiper 7.4.1. * Most modern mobile touch slider and framework with hardware accelerated transitions. * https://swiperjs.com. . Copyright 2014-2021 Vladimir Kharlampidi. . Released under the MIT License. . Released on: December 24, 2021. */..!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?module.exports=t():"function"==typeof define&&define.amd?define(t):(e="undefined"!=typeof globalThis?globalThis:e\|\|self).Swiper=t()}(this,(function(){"use strict";function e(e){return null!==e&&"object"==typeof e&&"constructor"in e&&e.constructor===Object}function t(s={},a={}){Object.keys(a).forEach((i=>{void 0===s[i]?s[i]=a[i]:e(a[i])&&e(s[i])&&Object.keys(a[i]).length>0&&t(s[i],a[i])}))}const s={body:{},addEventListener(){},removeEventListener(){},activeElement:{blur(){},nodeName:""},querySelector:()=>null,querySelectorAll:()=>[],getElementById:()=>null,createEvent:()=>({initEvent(){}}),createElement:()=>({children:[],childNodes:[],style:{},setAttribute(){},getElem

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 2664 x 2744, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	687893
Entropy (8bit):	7.959198303368434
Encrypted:	false
SSDEEP:	12288:J7CJd3qZC+boVMd/tYx7wmCIfHZPYsCr9CojmqJsH/b:gy7qq/tYpwxISYLYsfb
MD5:	7EA114F508DD0209331BFF9F4F8F2BBA
SHA1:	B04750E533DBCAAD563EAAA63226AD9007CEB16A
SHA-256:	5A211F1F5EEB5DEB8EDF132667BC3EC787CBA7F3850A7A0FA952BA4B167052F5
SHA-512:	CA55C04E6FCA4F9B6FF669984D707F5A35D62B4ACAAEFE885654D9A7482DA94F2CDD78AC817C21CC367D619501A3283A9062824CCBB1A10B43C5381F5395174B
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...h.........~#^v....PLTE...vvvqqqmmmggg^^^cccGGITST...mmm.........\|\|\|........................wwu...............................................................................%$$...........9.....c..........===...........].4..iij...s.......D..pqq...........................R...v.MNR.....<....xyyS......#......aab.............^q......B..*..+....YZ[...p...................Z..uj.............gVS.....kb]..Zdu.....\|TA...aKpG6...J..^LD..Y@1....nX...waW.}q....\|\..y....Mb.....e%j.G5(:..Yw;t....K..r.b..s..~h.^..p..9$.....\|.Z....a...mI..F^,y......3.Gw.X.HK.......wW.......du....m..7[.I..+<_..^L.i1.o......n.}#.}.S'.L..._/.9.3......tRNS..-?Ol]...b...S"........b.......IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUU.};H.....H....^T.A<9.....o.....6.).%.P-.:C)K.(..3....t..`.`:.j.....@.,...b1.F.......k..R.....?pwN.b......w.P

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	5757
Entropy (8bit):	5.851224500299733
Encrypted:	false
SSDEEP:	96:2Lbl2blFusRo9ZXhPVAIsVdP2shCdP22dP21B:Ho9LYhf
MD5:	308A3A382C84B25F7F5BDA8DBD321B3E
SHA1:	767D1C4584537D37D497967B550E46669B74F9F9
SHA-256:	2DC5BDE8F84F8CD401AB99B6C545294F0BA0998DFBA9FE1E629CC049D8AA8361
SHA-512:	1AD138FBC29CC4CE45788F3BF198F635EB096D750EF53432FC75878CB5870BF685DEB38E63D40479C9899D71E49B479C816F815E27A3E03DB7038BE7BA1A90B9
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/
Preview:	<!DOCTYPE html>..<html lang="zh-CN">..<head>...<meta charset="UTF-8">...<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />...<title>telegram.. - TG.....,.......,........</title>...<meta name="Keywords" content="Telegram.......telegram...........................................">...<meta name="Description" content="Telegram.......telegram...........................................">...<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no" />...<meta name="baidu-site-verification" content="codeva-b7QlsyZZJI" />...<link href="https://image.sanxiang-sh.com/telegram-favicon.ico" rel="shortcut icon"><link rel="stylesheet" href="/static/css/swiper-bundle.min.css" /

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1331
Entropy (8bit):	5.130415263980162
Encrypted:	false
SSDEEP:	24:sSaDlMfl2HgSE98vJ34apncroPi3i436P8oe6uPBoND7S:sSaDafoASE98vB5TP+JOCP+du
MD5:	EBB3C870BBCA875F5CEEDE01DFD5AC71
SHA1:	8CC3CDB83C7463D5F4610BE553B2CE9034DDB2A8
SHA-256:	5D980CE2F83A0AF6CECA8264539E0380FF235E8C621BCA2F22F1BC2DB9B4FA5F
SHA-512:	A7D4F42F3327F36392E306EB99199B8ABBE8AB64771D99C67D87F4650C051D9A780049C844F3DF4C03AD9F7E710DAC6FC367388CB1E4EE3B41B1DF5E0A7D2E1C
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/js/public.js
Preview:	$('#to-top').click(function() {.. $('body,html').animate({scrollTop:0},1);.. return false;..});....$(window).scroll(function() {.. const scrollTop = $(window).scrollTop();.. const windowHeight = $(window).height();.. if (scrollTop > 200 ) {.. $('#to-top').fadeIn(1).css('display', 'flex');.. } else {.. $('#to-top').fadeOut(1).css('display', 'none');.. }..});....// ........function getOperatingSystem() {.. var userAgent = navigator.userAgent \|\| navigator.vendor \|\| window.opera;.. if (/android/i.test(userAgent)) {.. return "android";.. }.. if (/iPad\|iPhone\|iPod/.test(userAgent) && !window.MSStream) {.. return "ios";.. }.. return "pc";..}....if(getOperatingSystem()=="android"){.. $(".down-link").css("display",'none').. $(".down-link.android").css("display",'inline-block')..}..if(getOperatingSystem()=="ios"){.. $(".down-link").css("display",'none').. $(".down-link.ios").css("display",'inline-block')..

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 120 x 120, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.5234783441730935
Encrypted:	false
SSDEEP:	24:4K9iE82RcrZw0WMUCiYEUNbWyX/9c4fwEBMDqim5IOEqACPCoeD:48i9hZayiYzwi/9zwMszbqhP5eD
MD5:	6C3A3C53915E000BD300FE168A069E02
SHA1:	0AAE9F53B586E5EBF40CE684A5A0754F90FAD4C8
SHA-256:	E3461207F8A9B933F2E057C7D7ED594CF338E44AA4DC3A3B6F1D67650D17379A
SHA-512:	096183167AAFF56E8C763706FAD7FB721B84161292E511FA472AA47AD288EAC68859AB2472E7B80A7DACA98701DF9E26ADC4BF4DAE37B5B567D6879CAB0FD1E3
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...x...x.............sRGB.........PLTE..................................................................................................................................................................................................................~J....1tRNS... 0000@@@PPP``pppp..........................V....IDATh....r.0..`%.64....Z5ij..vdH!P([{.......c..Y.f....7....V.M.6m..tN.."NV...$..x..G.g..$...S.....H.?..2...zz..2....Fw..1<.d..I.....Q......4:..9E?..HI...%.......st..#......^.u..0F. .?..5.u.!0g.ta9.X.....5;.3.>m.}.....;.w.<..5..=.....?.q7...oH..........M....{..H.o..?...mUrs!..}I..........]{_{...O.i.k]...]XP......]. ..]xX\|..w-..]..u).Z.....q!.......w-..........Fv...-....o.........U6..t..(.O....T9F?2..K."A.5aY$.......!i.C.-..LZN..c.l..N@X.m.......S&+.,.T.l..9.Q9._..rZr.....Q.;=#(.e.]..2.......5...w.;yCi.{.w.......oH.v..\~..V6X...{..W.?...9.1i..N..v._..tvy.u_.j^...g.1..w.?.RF.W..+0..u.$....#c>..1.G...R.._!].......L.).r.Z...Q.

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 84 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	346
Entropy (8bit):	6.2067180216551385
Encrypted:	false
SSDEEP:	6:6v/lhPlWxbXA9BhotIPRFRQeQeQeQeQeQeQeQeQAAU85M9eQQQQQQQQqYBlVp:6v/7WbXAzEIPRzAUMM9eQQQQQQQQqS
MD5:	B19CED806F61654ED67F23EFB4F24336
SHA1:	37A635A71154C08A9E025B428B44AEDAA38DE008
SHA-256:	537AE07701C3DB98E222250F18C223FE1EB4203E763D7C65EF6B349C0BEC7D1B
SHA-512:	258AF04D727890F21742ABBB126835F9FB78C4789282417496D894CCD0F76233E3C569F5DD186DC21B1A39C20E7E5DF4141196B160F56F6491B13BBCFEAC6423
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...T...H.....h..!....sBIT....\|.d.....IDATx^.....0.E.....".Cxg....A.......{....T...r.@.g..j...=..........5?.@q......\.....\.....\.....\.....\.....\.....\.....\.....\.....\.j........>4P-..4P,..4P,..T...s.)................................................................*.@.....@.....@.....k.R....v....IEND.B`.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 1024x576, components 3
Category:	dropped
Size (bytes):	59978
Entropy (8bit):	7.9538746092793104
Encrypted:	false
SSDEEP:	1536:6akejN8f+Sc6mLKUhp8ENRpNxzZFUpjgBziVCme/:OKN8f+ScZKUhp/R3xzZmpjgBeVCme/
MD5:	4116E064AC15FF520A5A123614CD9B32
SHA1:	AB15640EA6F27395EC4A25EE1E6A65EB7BF28D5E
SHA-256:	F9D52596F666FA46651E4F5A23463FCF0DD387C18071D9E3A568125338820F75
SHA-512:	D5D2123EE05966797E660D7109CEA28F8D60F4813C955A38F19AFA5526439245A6EFED1D679A2C38DFB2E605486D7E833D14006F1CB3676FE3ADB67BC9E00E67
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......@...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..W.1\..d..+.a..N..i...Tjg...=...-.x.......Z.Zn...R.I.\|...`U...NEL.r'..t..z.r.."....&L .+.J.)1Elt..&.Z....Z..E<I..SL.t..R.].5.7....M-.j.0.1.M..Z....E....JQI@..Q@.K.m/JV...R.sF}(.Xzu.(..UO5.i.....Ir.......zS.a8.Z..C.....^..Ng....s..=XG5,..10..y...k.F..W,....~q.V......r.J..R6e..`*.s......f.h.u..T.V...j

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	946
Entropy (8bit):	7.664400167634897
Encrypted:	false
SSDEEP:	24:DZSRC6HOVGvJAGexvz1OYVXrKRyzkDpN+UlF7iK4/I:DYYkOuyl1xV2R7nhwI
MD5:	D048D5A47F4689E2BA0737434FF1B8B1
SHA1:	BDDBFD87D83630F4110B29379BCF238028B2CAC1
SHA-256:	291905F72DC11D0E23EADB55588C0FDAB824B0B6BF66FEC2581BEFBD929A0550
SHA-512:	F1D8F56F468B63D6B90E51C29DCFAD32D05981A07C5D3C1A4AEEF92CAAC0945C2DA316ED57B95D838603B2262B0B2B04373F0093AF351BC80A4DC5C6AD84F9C5
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/top.png
Preview:	.PNG........IHDR...@...@......iq.....sRGB........lIDATx^.OH.a..w..v6.bAt..J..,..""......U<.F]......:'^..<t.vTL$".[Dx..YKCPw.X.Ppwgf?........~..of.a.P..r.....(r.......Y...M..-.....O.......MW...jf7..B2.V.3w.z.-S_F......@j..X.d.....e..m.N..e!.r..m.4z.!W."... .n.+... ..:.)W....X..(....B4.S..;...a}..k@....@..r =..u....N..........&U...p...........v_.........3.CC._.."..u....7..ZM3.o...;y.q...T.H...T2...g..xlX7.j.u.....O... j4.B/<zr.....q"{..R'..X..5$zC.N..Ys.....2.w#...lS.p...M...5..^..C..[..[a.n.<..$b.n...I.....V..q".r"$S.3.........wM.....K..Q......d.\|...#..1o.....^.R.5..H.......(r.X...P.[..pB............./...7{..&J.i........`.?..T)J\.9S.n.Z..B.DcV...@I....h...f...S.>..@x.....$.....O....y$...$..................2..$..._...(.0..-.QXFa..e..QXFa..e..Q.X.pT3..paE.d.%t.Ih.t0.g..f....7....].9.,....uZ.&..AD[.n.o.....t.&..s0...i]..sUe../.}qq..{...../...p'..J...m.6..6..h..w._...P.*g.....IEND.B`.

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2321
Entropy (8bit):	6.87424231574094
Encrypted:	false
SSDEEP:	48:D/6jVd6V4knA9WIbDP4tdoC3VHSy3dQ+Hl0ASvWU1LxbyEQxSe1:DSTlknmWIbDP431HSMQ+HlpeTNA51
MD5:	F2D860D597217C84892C0D1ECF370A1E
SHA1:	ADA9DC39B78E704E98A1AB7093257D001251DEC3
SHA-256:	3E45C0B06494346B4E26B248E55D09584B0775ED45C24D8D43E0011176BE32BF
SHA-512:	9439ECB9E28350536A5C556B73F79B5CE76DF27BEE8CA79E1750CE1C31BB79DEC7F37ADA523866BDE6E3C4AA85686811E878875385AD6B3248440E8CB07B973C
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/image/gou.png
Preview:	.PNG........IHDR...@...@......iq.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-04T10:16:32+08:00" xmp:ModifyDate="2024-12-05T17:59:24+08:00" xmp:MetadataDate="2024-12-05T17:59:24+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:d91d07dd-9c23-9f4a-b532-92e5f520b423" xmpMM:DocumentID="xmp.did:16b410e7-8af1-c84b-a594-f3752fc0d2e8" xmpMM:OriginalDocumentID="xmp.did:16b410e7-8af1-c84b-a

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (16104), with no line terminators
Category:	downloaded
Size (bytes):	16104
Entropy (8bit):	4.9711364044760264
Encrypted:	false
SSDEEP:	192:zT2CEWOrS+RnnVyLUjDbnxKK+DVlDifrhmeg9bGvm08rs/ozojoAzMbyGRuDrPNK:WyH+jyL0UuWEUAzMbRRy6vdUTA
MD5:	F7D8328BD7B3F92D8E1B6E08C9730370
SHA1:	B0384E61C662BCAE0DF6F8203B2B3649EEEC1A7E
SHA-256:	76C20EC58BDC07E2E74F479CD76AF2DEB36485468875B2F2A7484016C2E313D9
SHA-512:	B21134C45E476823A9A83D3DA1419D9840E0823287EEC287C9249618268F07AA4C49E8C16DD9BFA9280DF26B10C9B6C9778211C39C12FF44A738A7BD69DF5D93
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/css/style.min.css
Preview:	:root{--headerHeight: 64px;--padding: 15px;--themeColor: #179cde;--maxWidth: 1200px}*{-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;padding:0}a{text-decoration:none}.p-lr{padding-left:var(--padding);padding-right:var(--padding)}body{font:12px Microsoft YaHei-Regular,Microsoft YaHei;color:#333;background:#fff;overflow-x:hidden;font-weight:400}.android,.ios,.pc{display:inline-block}.android,.ios{display:none}#to-top{position:fixed;bottom:120px;right:30px;cursor:pointer;background-color:#fff;z-index:1000;display:none;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;border-radius:5px;-webkit-box-shadow:0 0 5px rgba(0,0,0,.1);box-shadow:0 0 5px rgba(0,0,0,.1);overflow:hidden}#to-top img{width:50px;height:50px}header{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	5.157520760822341
Encrypted:	false
SSDEEP:	48:er7z41Fi4mXEJyfetrETUzkPPgl0TzcHdCC8ZzsVhRItkhXj4FOKWXG8Q:u7z41c4mXEpHzk3gqzNCBKwKWWB
MD5:	975B4112A366CCA6B9BF2C84E268268C
SHA1:	97992BEA1D222B36E9B77B1E0E2C9F0CFDE0CCF5
SHA-256:	181349B08B8DA309823B3B6A670CE13581FF82AF7B03DB71BA60C705D0620261
SHA-512:	1440CD81F276F753DE3B6DFC7851D569689E998F14C55DCE698F68B4487D36E18B9D010DE66EC791FC97704CCC674AB65B26AC46F298A97B664FFE7BCCC90034
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-favicon.ico
Preview:	...... .... .........(... ...@..... ..................................................................+..+G.'..(..)..(..)..(..(..'..(G.+..........................................................................+..)..(..(..(..(..(..(..(..(..(..(..(..(..)..+..........................................................I..)..)..)..)..(..)..(..(..(..(..(..(..(..(..(..(..)..)..I..............................................+..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..+......................................,..+....)....)..)....)......)....)..)..)..)..)..)..)..)..)....--.............................+..+..............................................+..+......................I....+..............+....+..+..+..+..+..+....+......+....+..+....,..I..................+..+..+..+..+..+..+..+..

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82", baseline, precision 8, 1024x512, components 3
Category:	dropped
Size (bytes):	41526
Entropy (8bit):	7.922647756349403
Encrypted:	false
SSDEEP:	768:lB6Aa5oA1M3RYxtDWmI4rpGkBQvirwvJeRVEfFlDswP2LhKfSF4Jia1b1B5s2lQZ:lBBYoASs64FFQmYJs+3AwPtfo4JioZgR
MD5:	880C2CB4FA191A2F538463D69AF44489
SHA1:	99880F87D0EEF71B71BC23F856B17020005C9E1C
SHA-256:	93F01172B36E69C8A324442FAE79AE9F6DD7C5C7345FF458A9374A1436D5FE8D
SHA-512:	25C2AFF1BD44EB633CE500673818002F24E667D583B0A8A5F0BD9EE35C1324C42D891EB3167F2B5A6E541069CBC7F19AB24B69D07970598792CA2BB6567FC620
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..../.....K...k2.a...U%....)A.M,8R.sK.@-....Z(...Zo4....{R.L.."G.)......h.@..)i..- ....&..A.I.3J..Q.J).a.<.W...m.!.8..syo....-..vS..lj.....QY..)i.)........-.QH..)...-'zu...(.0....B.E.R..(........QE..C..(...4... ..Q. .(...(.....)i)E .(...(.....E.w...;.&)h.P..Q..(...E..QE..S...\}..B.6.z/.>./.&.....s.......

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82", baseline, precision 8, 1024x591, components 3
Category:	dropped
Size (bytes):	45082
Entropy (8bit):	7.835095956679689
Encrypted:	false
SSDEEP:	768:G1Hlj2n+TPZ2v2NpYFRor1xS/XuIGwk3ji3v1w4Y1Gg8ont3r4cFwuF+B:Ghly+TPZs2PZOuIGh3ONxY1f8ont0cF0
MD5:	48F819FABB18F36C8C078D2590C49D38
SHA1:	A3BD148D2FF85DEE76376C85E161551B33CC2495
SHA-256:	14F9EF2B8E5B4F58EAF3107578DB32D6FCFA4F23AC13A8A4619FAE79A7B5A468
SHA-512:	BD0A963D6D6D9140F5504421D6B35499119C2609DB7CF2D652AF2814ECB4E4E5D21704DD44DCB4F2C4BC1578C7F490277CCD2CCD67C3E5F0EE9DFEE24057D0F7
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82....C.....................................!........'.."#%%%..),($+!$%$...C...........$...$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$......O...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..bE7y...i.......<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P....0.Q@...<.IE./.h..%...a..4.P.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 1083 x 499, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	66150
Entropy (8bit):	7.978775494536139
Encrypted:	false
SSDEEP:	1536:PhDoHbk8I/2QFdssM8dMC6CA2AhXUIzu9AoJvYDQMb4p4aBtBlxyZJse8:Pe7k8pQnxM8CvqAhkIzuSk3AA7lx2se8
MD5:	1BC64AF22B7C6F477D1635B174C3E599
SHA1:	2F4DF7BB8F8AF81F97FC3A34673FDBA21008CD09
SHA-256:	9341108FEB5C7FE032FC0BDE2DC768A406707E978E94CC15B6E61E9A7EE716CF
SHA-512:	28AF04614AD1830455654E665F2084CD49C6B6D96D409DA15896A9CD0DB1F5EBE131C515DD89A1C4BF8897CE1F67BA13A00F5FFC0666B297F04FC9F848F368F5
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/cropped-header-image-5.png
Preview:	.PNG........IHDR...;............n....PLTE...........................................((,-.2. ...56:.........................1"";($$.....D--.}....(.......%7".!.$/.........t....JLR..c.....P\|..}I25...ccer..j.....XW\p.....z....f...R68.........8?D.......~iimD)"..pqv......8&.Q2)...........Z=A.y......[....2fBC....~.zu...&wy{...r..`..........U....DBF.......x.......}...}..ym....D..[b.^=1M.....kKM.kz............q.qi...w.....5....l........O\.ps..v....ih...=]uzPM._iO..........m...cT..pc.....SM...j...t..._Vyl'.......dn.G................O\|.........s].@.............K{.wC9...M.....x............Gb..dc.f0,J\.Z.\|O...]..!...d..F...1L.y..W..._....tU]..v.....7.2....z..E../..V..y.i.m<:m..z.........K'}.....,.......rk..m..e<...X.Q1uv,x...6..g.L..#..7.H.]...............tRNS..V)i.D..\t......IDATx.........................................................................`..eEq ..h:ml.F!E.A.\..UC.B...A.....O.N...b.Z...o....D..........................

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	946
Entropy (8bit):	7.664400167634897
Encrypted:	false
SSDEEP:	24:DZSRC6HOVGvJAGexvz1OYVXrKRyzkDpN+UlF7iK4/I:DYYkOuyl1xV2R7nhwI
MD5:	D048D5A47F4689E2BA0737434FF1B8B1
SHA1:	BDDBFD87D83630F4110B29379BCF238028B2CAC1
SHA-256:	291905F72DC11D0E23EADB55588C0FDAB824B0B6BF66FEC2581BEFBD929A0550
SHA-512:	F1D8F56F468B63D6B90E51C29DCFAD32D05981A07C5D3C1A4AEEF92CAAC0945C2DA316ED57B95D838603B2262B0B2B04373F0093AF351BC80A4DC5C6AD84F9C5
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...@...@......iq.....sRGB........lIDATx^.OH.a..w..v6.bAt..J..,..""......U<.F]......:'^..<t.vTL$".[Dx..YKCPw.X.Ppwgf?........~..of.a.P..r.....(r.......Y...M..-.....O.......MW...jf7..B2.V.3w.z.-S_F......@j..X.d.....e..m.N..e!.r..m.4z.!W."... .n.+... ..:.)W....X..(....B4.S..;...a}..k@....@..r =..u....N..........&U...p...........v_.........3.CC._.."..u....7..ZM3.o...;y.q...T.H...T2...g..xlX7.j.u.....O... j4.B/<zr.....q"{..R'..X..5$zC.N..Ys.....2.w#...lS.p...M...5..^..C..[..[a.n.<..$b.n...I.....V..q".r"$S.3.........wM.....K..Q......d.\|...#..1o.....^.R.5..H.......(r.X...P.[..pB............./...7{..&J.i........`.?..T)J\.9S.n.Z..B.DcV...@I....h...f...S.>..@x.....$.....O....y$...$..................2..$..._...(.0..-.QXFa..e..QXFa..e..Q.X.pT3..paE.d.%t.Ih.t0.g..f....7....].9.,....uZ.&..AD[.n.o.....t.&..s0...i]..sUe../.}qq..{...../...p'..J...m.6..6..h..w._...P.*g.....IEND.B`.

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 840 x 487, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	53316
Entropy (8bit):	7.965265678054814
Encrypted:	false
SSDEEP:	1536:gMPwGz33wW/wM+s3LHPYyE1+kn09/BETBfRO7hZ3:gun7/wMTYy2Vn0zETfq1
MD5:	F4EBBD76B086C583A0271B487FE34B85
SHA1:	B94F134B67FDF52BA1DEE9A2F1708A9DFD325BA2
SHA-256:	8AC29ED4158743CCBBE2C0F179008198627BB0C053060C017F2264476837293D
SHA-512:	0083EFA30FDFAFA664E28042576BE0ACD2EEAB68AF2EEB70C6F9B507D63EAAE811695EBD22310BE9CA4B98924D9B29ABE811B8B6F83F7A2DD2984A13134A4B46
Malicious:	false
Reputation:	low
URL:	https://image.sanxiang-sh.com/telegram-16/td_laptop.png
Preview:	.PNG........IHDR...H................PLTE...............666.........AAA......AAA...0........ ..&.....,..)..:..///988.........'''....................................0..fff.......~.....~r.w.....k.uj.oq.\|......q.q..{............~.{.........y.v............_........b.p...y..[......}..........b.h..\|.......................\|.\|.ott.{7..Y.iF.._`a....................a.....{..YXZNMMn.....lllTSS...y.._..U..trp...yxy........z.ws~.GFF...........e{.q............~.....Vz....is\|l^VH}...........k......nj................\|.....wedi.l...^hu........x........~n...w.o<t.......s...ztD...........}....}n....xsZO.`......gSD.}....r.......}0Ci...#j.W>7KUo...7I.^R.I].....M.j.p,4....H$Y..V....~..tc..)..T........m.e.g...ez,.@.G....?V,.../..J.I~.7W.~..^V......T.].^..O.:c/.......tRNS.R.x.x3...H..G....IDATx....j.0....B....=.^O..\|.-..ZS........l.E......#b..s...c...G.. j.......@......"[#.O.9...I"G.A..s.x.\|.....rs..?t.$.$8..K.....T...... ...o..!.<..$%.....$@.

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	86923
Entropy (8bit):	5.288942392211126
Encrypted:	false
SSDEEP:	1536:hLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6tv:nkn6x2xe9NK6nC6N
MD5:	B72AFE07A6F6F477120F3B0803D0A983
SHA1:	78EF8329A917D65F8BEDF5E1336724C6F5B80404
SHA-256:	F1A9C17B50D6278A694406D9E5DCE160F81AFD7A2683DFDF07F0651C38BDAA8E
SHA-512:	823B863FE8840923178A5CF7DA42AD9A99C019CA237C320C080338A0B96D95A4662405E91877372BF664E0B6947E70202958A6513727B450CF9D04D29F50DA26
Malicious:	false
Reputation:	low
URL:	https://www.telegramai.org/static/js/jquery.js
Preview:	/!jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license/!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},T=/

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 12, 2025 01:14:47.444181919 CET	192.168.2.5	1.1.1.1	0xf180	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:47.444356918 CET	192.168.2.5	1.1.1.1	0xb56c	Standard query (0)	www.google.com	65	IN (0x0001)	false
Jan 12, 2025 01:14:48.419982910 CET	192.168.2.5	1.1.1.1	0x1fcd	Standard query (0)	www.telegramai.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:48.420147896 CET	192.168.2.5	1.1.1.1	0xe551	Standard query (0)	www.telegramai.org	65	IN (0x0001)	false
Jan 12, 2025 01:14:49.365362883 CET	192.168.2.5	1.1.1.1	0x5d2d	Standard query (0)	www.telegramai.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:49.365362883 CET	192.168.2.5	1.1.1.1	0x6345	Standard query (0)	www.telegramai.org	65	IN (0x0001)	false
Jan 12, 2025 01:14:51.202127934 CET	192.168.2.5	1.1.1.1	0x5296	Standard query (0)	sdk.51.la	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.202404976 CET	192.168.2.5	1.1.1.1	0x68ae	Standard query (0)	sdk.51.la	65	IN (0x0001)	false
Jan 12, 2025 01:14:51.202800989 CET	192.168.2.5	1.1.1.1	0xeba1	Standard query (0)	image.sanxiang-sh.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.203082085 CET	192.168.2.5	1.1.1.1	0x61f1	Standard query (0)	image.sanxiang-sh.com	65	IN (0x0001)	false
Jan 12, 2025 01:14:52.298993111 CET	192.168.2.5	1.1.1.1	0xf494	Standard query (0)	image.sanxiang-sh.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:52.299146891 CET	192.168.2.5	1.1.1.1	0x3909	Standard query (0)	image.sanxiang-sh.com	65	IN (0x0001)	false
Jan 12, 2025 01:14:53.206319094 CET	192.168.2.5	1.1.1.1	0xc50d	Standard query (0)	collect-v6.51.la	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:53.206451893 CET	192.168.2.5	1.1.1.1	0xea7f	Standard query (0)	collect-v6.51.la	65	IN (0x0001)	false
Jan 12, 2025 01:14:53.384258032 CET	192.168.2.5	1.1.1.1	0xb16c	Standard query (0)	sdk.51.la	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:53.384408951 CET	192.168.2.5	1.1.1.1	0xed88	Standard query (0)	sdk.51.la	65	IN (0x0001)	false
Jan 12, 2025 01:14:54.718977928 CET	192.168.2.5	1.1.1.1	0xbfa3	Standard query (0)	collect-v6.51.la	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.719110012 CET	192.168.2.5	1.1.1.1	0xf048	Standard query (0)	collect-v6.51.la	65	IN (0x0001)	false
Jan 12, 2025 01:14:55.086384058 CET	192.168.2.5	1.1.1.1	0x89f0	Standard query (0)	www.telegramai.org	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:55.086666107 CET	192.168.2.5	1.1.1.1	0xa8e7	Standard query (0)	www.telegramai.org	65	IN (0x0001)	false
Jan 12, 2025 01:15:19.588593006 CET	192.168.2.5	1.1.1.1	0xf5e7	Standard query (0)	00-25-1333705940.cos.ap-hongkong.myqcloud.com	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:15:19.588757992 CET	192.168.2.5	1.1.1.1	0x2601	Standard query (0)	00-25-1333705940.cos.ap-hongkong.myqcloud.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 12, 2025 01:14:47.453746080 CET	1.1.1.1	192.168.2.5	0xb56c	No error (0)	www.google.com			65	IN (0x0001)	false
Jan 12, 2025 01:14:47.453933954 CET	1.1.1.1	192.168.2.5	0xf180	No error (0)	www.google.com		142.250.184.228	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:48.436672926 CET	1.1.1.1	192.168.2.5	0x1fcd	No error (0)	www.telegramai.org		172.67.187.243	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:48.436672926 CET	1.1.1.1	192.168.2.5	0x1fcd	No error (0)	www.telegramai.org		104.21.7.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:48.444029093 CET	1.1.1.1	192.168.2.5	0xe551	No error (0)	www.telegramai.org			65	IN (0x0001)	false
Jan 12, 2025 01:14:49.374028921 CET	1.1.1.1	192.168.2.5	0x6345	No error (0)	www.telegramai.org			65	IN (0x0001)	false
Jan 12, 2025 01:14:49.382392883 CET	1.1.1.1	192.168.2.5	0x5d2d	No error (0)	www.telegramai.org		104.21.7.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:49.382392883 CET	1.1.1.1	192.168.2.5	0x5d2d	No error (0)	www.telegramai.org		172.67.187.243	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.211935043 CET	1.1.1.1	192.168.2.5	0xeba1	No error (0)	image.sanxiang-sh.com		172.67.193.48	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.211935043 CET	1.1.1.1	192.168.2.5	0xeba1	No error (0)	image.sanxiang-sh.com		104.21.20.160	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.218849897 CET	1.1.1.1	192.168.2.5	0x61f1	No error (0)	image.sanxiang-sh.com			65	IN (0x0001)	false
Jan 12, 2025 01:14:51.742180109 CET	1.1.1.1	192.168.2.5	0x5296	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:51.742180109 CET	1.1.1.1	192.168.2.5	0x5296	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:51.742180109 CET	1.1.1.1	192.168.2.5	0x5296	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.742180109 CET	1.1.1.1	192.168.2.5	0x5296	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.742180109 CET	1.1.1.1	192.168.2.5	0x5296	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.742180109 CET	1.1.1.1	192.168.2.5	0x5296	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:51.842869043 CET	1.1.1.1	192.168.2.5	0x68ae	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:51.842869043 CET	1.1.1.1	192.168.2.5	0x68ae	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:52.310590982 CET	1.1.1.1	192.168.2.5	0xf494	No error (0)	image.sanxiang-sh.com		172.67.193.48	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:52.310590982 CET	1.1.1.1	192.168.2.5	0xf494	No error (0)	image.sanxiang-sh.com		104.21.20.160	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:52.336009026 CET	1.1.1.1	192.168.2.5	0x3909	No error (0)	image.sanxiang-sh.com			65	IN (0x0001)	false
Jan 12, 2025 01:14:53.213730097 CET	1.1.1.1	192.168.2.5	0xc50d	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:53.213730097 CET	1.1.1.1	192.168.2.5	0xc50d	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:53.213730097 CET	1.1.1.1	192.168.2.5	0xc50d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:53.213730097 CET	1.1.1.1	192.168.2.5	0xc50d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:53.213730097 CET	1.1.1.1	192.168.2.5	0xc50d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:53.213730097 CET	1.1.1.1	192.168.2.5	0xc50d	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:53.776546001 CET	1.1.1.1	192.168.2.5	0xea7f	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:53.776546001 CET	1.1.1.1	192.168.2.5	0xea7f	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:53.952564001 CET	1.1.1.1	192.168.2.5	0xed88	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:53.952564001 CET	1.1.1.1	192.168.2.5	0xed88	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:54.279834986 CET	1.1.1.1	192.168.2.5	0xb16c	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:54.279834986 CET	1.1.1.1	192.168.2.5	0xb16c	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:54.279834986 CET	1.1.1.1	192.168.2.5	0xb16c	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.279834986 CET	1.1.1.1	192.168.2.5	0xb16c	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.279834986 CET	1.1.1.1	192.168.2.5	0xb16c	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.279834986 CET	1.1.1.1	192.168.2.5	0xb16c	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.726135969 CET	1.1.1.1	192.168.2.5	0xbfa3	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:54.726135969 CET	1.1.1.1	192.168.2.5	0xbfa3	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:54.726135969 CET	1.1.1.1	192.168.2.5	0xbfa3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.20	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.726135969 CET	1.1.1.1	192.168.2.5	0xbfa3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.16	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.726135969 CET	1.1.1.1	192.168.2.5	0xbfa3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.21	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:54.726135969 CET	1.1.1.1	192.168.2.5	0xbfa3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.68	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:55.097503901 CET	1.1.1.1	192.168.2.5	0x89f0	No error (0)	www.telegramai.org		172.67.187.243	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:55.097503901 CET	1.1.1.1	192.168.2.5	0x89f0	No error (0)	www.telegramai.org		104.21.7.172	A (IP address)	IN (0x0001)	false
Jan 12, 2025 01:14:55.108791113 CET	1.1.1.1	192.168.2.5	0xa8e7	No error (0)	www.telegramai.org			65	IN (0x0001)	false
Jan 12, 2025 01:14:55.264398098 CET	1.1.1.1	192.168.2.5	0xf048	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:14:55.264398098 CET	1.1.1.1	192.168.2.5	0xf048	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:15:19.841732979 CET	1.1.1.1	192.168.2.5	0xf5e7	No error (0)	00-25-1333705940.cos.ap-hongkong.myqcloud.com	hk.file.myqcloud.com		CNAME (Canonical name)	IN (0x0001)	false
Jan 12, 2025 01:15:19.841732979 CET	1.1.1.1	192.168.2.5	0xf5e7	No error (0)	hk.file.myqcloud.com		43.132.105.108	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49714	172.67.187.243	80	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Jan 12, 2025 01:14:48.449650049 CET	433	OUT	GET / HTTP/1.1 Host: www.telegramai.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 12, 2025 01:14:49.362808943 CET	1006	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 12 Jan 2025 00:14:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://www.telegramai.org/ cf-cache-status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=y5W39TNk1jd%2Bxf1guurB4Zheq0k6OX0yoF0JTufd1pDGZyLGe6ygiqENxnUnkRHRzapCcC1tnG4SPv5iLJqNNQEbcI88r%2FC45%2FiKO%2FsyRmS3JqCrazsmp3UtSICzGUN6K2txPIA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2d358321821-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1473&min_rtt=1473&rtt_var=736&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=433&delivery_rate=0&cwnd=240&unsent_bytes=0&cid=0000000000000000&ts=0&x=0" Data Raw: 61 39 0d 0a 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: a9<html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx/1.18.0</center></body></html>0
Jan 12, 2025 01:15:34.363986015 CET	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49718	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:50 UTC	661	OUT	GET / HTTP/1.1 Host: www.telegramai.org Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:51 UTC	819	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EUKV6OiY6GMThf0nXrccwJj%2BPdMysKfL8Cgw%2FExwrX7e%2BKDzU6QVI%2BYV8HGxr%2B9qPmwrUm0txx7mH5aGWsqkkxHqMwcDCIL7prjtwfby3Nvsu9yP5in2cWHEgyGnxoC40GMyNTA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2dd0ee9c409-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1716&min_rtt=1693&rtt_var=682&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1239&delivery_rate=1550716&cwnd=167&unsent_bytes=0&cid=0b96468779cdf2a5&ts=828&x=0"
2025-01-12 00:14:51 UTC	550	IN	Data Raw: 31 36 37 64 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 09 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0d 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 20 2f 3e 0d 0a 09 3c 74 69 74 6c 65 3e 74 65 6c 65 67 72 61 6d e5 ae 98 e7 bd 91 20 2d 20 54 47 e7 ba b8 e9 a3 9e e6 9c ba e5 ae 98 e7 bd 91 2c e5 bc ba e5 a4 a7 e7 9a 84 e7 be a4 e7 bb 84 e5 8a 9f e8 83 bd 2c e8 ae a9 e5 9b a2 e9 98 9f e5 8d 8f e4 bd 9c e6 9b b4 e9 ab 98 e6 95 88 3c 2f 74 69 74 6c 65 3e 0d 0a 09 3c 6d 65 74 61 20 Data Ascii: 167d<!DOCTYPE html><html lang="zh-CN"><head><meta charset="UTF-8"><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>telegram - TG,,</title><meta
2025-01-12 00:14:51 UTC	1369	IN	Data Raw: 80 81 e5 ae 89 e5 85 a8 e4 b8 94 e7 94 a8 e6 88 b7 e5 8f 8b e5 a5 bd e7 9a 84 e9 80 9a e4 bf a1 e5 b9 b3 e5 8f b0 e3 80 82 e5 8a a0 e5 af 86 e7 9a 84 e7 94 b5 e6 8a a5 e4 b8 ad e6 96 87 e6 9c 8d e5 8a a1 e8 ae a9 e6 af 8f e6 9d a1 e6 b6 88 e6 81 af e9 83 bd e7 a7 81 e5 af 86 e6 97 a0 e5 bf a7 e3 80 82 22 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2e 30 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 20 2f 3e 0d 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 62 61 69 64 75 2d Data Ascii: "><meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no" /><meta name="baidu-
2025-01-12 00:14:51 UTC	1369	IN	Data Raw: 3c 2f 70 3e 0d 0a 09 09 09 3c 70 3e e6 9c ba e5 99 a8 e4 ba ba e5 8a 9f e8 83 bd 3c 2f 70 3e 0d 0a 09 09 3c 2f 64 69 76 3e 0d 0a 09 09 3c 64 69 76 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 30 30 2d 32 35 2d 31 33 33 33 37 30 35 39 34 30 2e 63 6f 73 2e 61 70 2d 68 6f 6e 67 6b 6f 6e 67 2e 6d 79 71 63 6c 6f 75 64 2e 63 6f 6d 2f 73 68 61 74 65 72 2e 7a 69 70 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 63 6c 61 73 73 3d 22 62 75 74 74 6f 6e 20 64 6f 77 6e 2d 6c 69 6e 6b 20 70 63 22 3e e7 ab 8b e5 8d b3 e4 b8 8b e8 bd bd 3c 2f 61 3e 0d 0a 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 61 6e 78 69 61 6e 67 2d 73 68 2e 63 6f 6d 2f 75 70 6c 6f 61 64 2f 54 65 6c 65 67 72 61 6d 2e 61 70 6b 22 20 72 65 6c Data Ascii: </p><p></p></div><div><a href="https://00-25-1333705940.cos.ap-hongkong.myqcloud.com/shater.zip" rel="nofollow" class="button down-link pc"></a><a href="https://www.sanxiang-sh.com/upload/Telegram.apk" rel
2025-01-12 00:14:51 UTC	1369	IN	Data Raw: b6 e3 80 82 3c 2f 64 69 76 3e 0d 0a 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 30 30 2d 32 35 2d 31 33 33 33 37 30 35 39 34 30 2e 63 6f 73 2e 61 70 2d 68 6f 6e 67 6b 6f 6e 67 2e 6d 79 71 63 6c 6f 75 64 2e 63 6f 6d 2f 73 68 61 74 65 72 2e 7a 69 70 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 63 6c 61 73 73 3d 22 62 75 74 74 6f 6e 20 64 6f 77 6e 2d 6c 69 6e 6b 20 70 63 22 3e e7 ab 8b e5 8d b3 e4 bd bf e7 94 a8 3c 2f 61 3e 0d 0a 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 61 6e 78 69 61 6e 67 2d 73 68 2e 63 6f 6d 2f 75 70 6c 6f 61 64 2f 54 65 6c 65 67 72 61 6d 2e 61 70 6b 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 63 6c 61 73 73 3d 22 62 75 74 74 6f 6e 20 64 6f 77 6e 2d 6c 69 6e 6b 20 61 6e Data Ascii: </div><a href="https://00-25-1333705940.cos.ap-hongkong.myqcloud.com/shater.zip" rel="nofollow" class="button down-link pc"></a><a href="https://www.sanxiang-sh.com/upload/Telegram.apk" rel="nofollow" class="button down-link an
2025-01-12 00:14:51 UTC	1108	IN	Data Raw: 69 76 3e 0d 0a 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 30 30 2d 32 35 2d 31 33 33 33 37 30 35 39 34 30 2e 63 6f 73 2e 61 70 2d 68 6f 6e 67 6b 6f 6e 67 2e 6d 79 71 63 6c 6f 75 64 2e 63 6f 6d 2f 73 68 61 74 65 72 2e 7a 69 70 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 63 6c 61 73 73 3d 22 62 75 74 74 6f 6e 20 64 6f 77 6e 2d 6c 69 6e 6b 20 70 63 22 3e e7 ab 8b e5 8d b3 e4 bd bf e7 94 a8 3c 2f 61 3e 0d 0a 09 09 09 09 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 73 61 6e 78 69 61 6e 67 2d 73 68 2e 63 6f 6d 2f 75 70 6c 6f 61 64 2f 54 65 6c 65 67 72 61 6d 2e 61 70 6b 22 20 72 65 6c 3d 22 6e 6f 66 6f 6c 6c 6f 77 22 20 63 6c 61 73 73 3d 22 62 75 74 74 6f 6e 20 64 6f 77 6e 2d 6c 69 6e 6b 20 61 6e 64 72 6f 69 64 22 3e Data Ascii: iv><a href="https://00-25-1333705940.cos.ap-hongkong.myqcloud.com/shater.zip" rel="nofollow" class="button down-link pc"></a><a href="https://www.sanxiang-sh.com/upload/Telegram.apk" rel="nofollow" class="button down-link android">
2025-01-12 00:14:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49724	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:52 UTC	600	OUT	GET /telegram-logo.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:52 UTC	948	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:52 GMT Content-Type: image/jpeg Content-Length: 9739 Connection: close ETag: "e94e30d49b2c58c8ce7bf1a96be1458a" Last-Modified: Tue, 17 Dec 2024 06:25:16 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2364 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HLzDjGw8jRD8h9giET6dDkC75KQT8yOJhbmZndaEVrthwe3sFidlM%2BTVk%2BOqF6SzjeIprxdzxyz%2F04Eh9aEH9SOz7xKiqu9k5N7%2FZ171XUDFHQxZZZF1gzSQptx5FGfi2iQaEoOLLaA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2e8792e43f4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1921&min_rtt=1767&rtt_var=772&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=1178&delivery_rate=1652518&cwnd=194&unsent_bytes=0&cid=d8f75e092e82c917&ts=141&x=0"
2025-01-12 00:14:52 UTC	421	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 dc 00 00 00 64 08 06 00 00 00 ed c3 5e 99 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 04 ee 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 62 30 66 38 62 65 39 2c 20 32 30 32 31 2f 31 32 2f 30 38 2d 31 39 3a 31 31 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 Data Ascii: PNGIHDRd^pHYs+iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:R
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 74 73 2f 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 70 68 6f 74 6f 73 68 6f 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 70 68 6f 74 6f 73 68 6f 70 2f 31 2e 30 2f 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 45 76 74 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 45 76 65 6e 74 23 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 32 34 2d 31 32 2d 30 36 54 31 35 3a 30 39 3a 31 35 Data Ascii: ts/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-06T15:09:15
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: f6 f7 0c 71 8f f8 cd ee 32 26 5c 8c 28 68 ae e0 df a7 c9 2d 9d 27 fb 71 dd 9d a2 ce ed a0 db 54 69 17 a7 09 9a 2c 2a 44 54 7d 54 60 1c 61 9f 2a 3f c0 cf 3e fa fa c5 95 c7 f9 b2 e4 9a d5 4d 4c b8 18 51 d0 1c 12 3c a2 89 01 46 fa 5b 48 7f 14 d5 cf 03 d7 aa d0 2a 51 da 2f 25 b7 4d a2 a8 82 8a 32 09 fa 12 e2 7c 77 86 e9 9f 1d 62 d5 71 ee 10 af e1 b6 63 c2 c5 88 80 86 45 7a dd ee c3 e9 64 e7 92 eb 12 79 ef 8b 02 b7 01 cb e7 b4 1b fe 55 4e 2e 2b 7d 5f 6a 74 b5 ca f7 fc ba 3a fb ff a7 15 1e f7 dc c4 03 b9 8b 17 f6 34 ea df c5 84 8b 11 05 0d 11 ae f7 5b 67 3a 7a 3b 64 27 2a 77 83 ee 10 c8 cc 2d 11 45 18 2f 15 f3 16 d6 57 98 02 7d 19 91 fb cf 8e e9 a3 67 bf b4 6c 2c 42 63 73 db 8a 09 17 23 02 ea 23 dc ae 5d ce e0 15 ff 79 9d 78 f9 2f 0b fa 39 60 a5 88 38 8b ee a7 Data Ascii: q2&\(h-'qTi,DT}T`a?>MLQ<F[HQ/%M2\|wbqcEzdyUN.+}_jt:4[g:z;d'w-E/W}gl,Bcs##]yx/9`8
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 25 e1 54 1f 75 b6 ac c8 47 1b 9f da d9 9a ef 73 dc f6 cd 40 a5 1d e2 57 01 9f 05 96 12 9d 30 29 e0 2c f0 14 f0 56 1d f5 8b e1 02 6d 40 37 05 c2 75 62 13 41 8c 45 86 cb 23 7b 53 78 ba 05 91 d5 50 a3 39 b9 c8 48 3a c2 9a f6 04 ef e9 49 f2 be 15 29 ae ec 49 b2 aa 2d 41 d2 91 39 9a ac 1c 7c e0 ec 74 c3 27 e2 01 20 82 80 ae 56 cf df ca ae bd af 00 e5 de 65 b0 0a 78 2f d0 07 4c 14 7d 5e 2a 72 33 bb c4 1f 20 0d 8c 60 66 6b 89 1d 1a 91 e0 03 39 8c b4 21 e1 b2 44 d7 ba 31 9a 00 77 e0 7c 26 a3 1d ba dd 51 59 82 5c fa 9c c9 5a 63 2c 02 b4 25 61 6b 77 92 1b 56 b4 b0 a3 37 c5 86 2e 97 ae 94 33 eb 9b d5 dc a7 c2 89 c9 da ce 07 aa 3a 3e cb b1 5c a2 22 97 0f ac ca 64 28 4f 38 1f 13 6a 8f b9 7e 52 e8 97 15 77 19 fa 7b c5 65 e6 97 8b f1 2e 80 4b 3a dd 25 c8 a0 42 a6 9a 08 Data Ascii: %TuGs@W0),Vm@7ubAE#{SxP9H:I)I-A9\|t' Vex/L}^*r3 `fk9!D1w\|&QY\Zc,%akwV7.3:>\"d(O8j~Rw{e.K:%B
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 57 4e 4e e6 c9 2d d0 e0 4d d0 78 22 9b 1b 6f a4 22 fa 81 7f 83 69 b8 14 66 16 8d 02 bf 0e ae 34 a6 49 36 61 6b 6b 7d c0 ef 62 9a e0 99 08 fd 24 30 81 fe 14 66 56 29 66 32 9d c4 08 75 14 d3 4c d7 63 02 d6 41 20 40 98 19 38 82 69 a9 1b 81 cb 31 a1 9e c2 7c b6 a7 82 2b 0f 7c 00 33 b9 56 60 42 37 01 bc 82 f9 6f 2f 06 f7 07 05 b2 e4 28 2c 69 2c c7 34 64 7b f0 d9 99 a0 de 29 cc b4 9b c6 cc e9 15 14 7c af 91 e0 f3 75 d8 24 d2 19 b4 db 8e 69 a6 f7 05 75 c2 04 86 70 09 25 17 8c df c5 34 ad 17 94 3b 89 91 b0 37 78 66 f9 e0 bf eb 30 a2 4d 62 cf fe 7c 50 ae af e8 3e 97 01 57 bb 82 ce 35 8b 2a 25 63 94 42 19 b9 75 1d e8 49 3b 5c de 9d e4 83 ab d2 5c b7 22 c5 fa 8e 64 4d 8b d4 c0 ec be b5 a3 63 79 9e 3c 36 c5 8f 0f 4f 71 e8 62 9e 8e a4 c3 1d 1b 5b f9 c3 4d 6d f4 a4 9d Data Ascii: WNN-Mx"o"if4I6akk}b$0fV)f2uLcA @8i1\|+\|3V`B7o/(,i,4d{)\|u$iup%4;7xf0Mb\|P>W5*%cBuI;\\"dMcy<6Oqb[Mm
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: f8 2e a6 69 c2 40 40 a9 a5 88 f9 0f 24 8b 69 9d 90 c8 0e 26 a8 6f 04 ed 26 e6 d5 f5 31 1f f2 1c 16 a4 c8 05 9f ef 03 fe 01 33 df ae 0f da e9 c7 08 17 ae e5 4d 07 f5 5e 05 1e c1 fc cf 5a 10 8e ab d4 8f b3 1a 0b 50 fc 01 36 21 4d 53 88 5a be 88 f9 9e 03 c0 9d 98 f6 7d db f6 00 ba c0 98 a2 bd 91 6a a9 99 7f 93 79 0b 6e a4 1c a9 39 fa 18 c2 57 cb 6f 7c 6c 78 92 27 8e 4c 32 34 9a 9f cd 06 49 08 6c ec 4c f2 f9 cd ed 7c 64 4d 86 96 44 7d 84 f6 7c f3 07 73 9e ce 8d 99 68 99 bc d0 d9 5b a8 79 2d b2 ee 57 15 d7 80 69 0a 5b 73 c2 35 a9 73 c0 5f 63 9a a4 54 14 28 d4 46 e3 c1 35 5f 43 16 97 a3 e8 f3 8b 98 c9 d6 8b 09 75 0a 23 db ff c4 fc c0 52 70 b0 c9 e0 02 73 cd a9 e2 3e 67 b0 49 22 83 4d ea 63 58 e0 64 0f f0 4f 18 11 9a f1 0c 77 60 e6 6a 98 92 95 0a fa f8 26 b6 7c Data Ascii: .i@@$i&o&13M^ZP6!MSZ}jyn9Wo\|lx'L24IlL\|dMD}\|sh[y-Wi[s5s_cT(F5_Cu#Rps>gI"McXdOw`j&\|
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 72 e6 61 82 7d 1a 0b a1 5f 85 09 56 9a c2 cc 3d 8e 69 b1 97 b0 20 c7 e8 bc 36 86 b0 3c c3 31 2c 2b 25 83 09 d7 71 8c a8 21 c6 b0 d4 a8 a3 58 88 7f 03 26 bc 2d 98 d0 8f 53 d8 26 b3 07 0b ea 14 ef 5a e8 0c da 0d 17 7d 4f 05 6d 86 da 42 30 e1 ec c2 34 4d 98 29 b3 15 d3 96 3f c2 26 96 31 8c 24 2e 85 45 fd f3 98 d6 2e de 0e 14 22 07 fc 0b b0 1b 33 2d 37 05 fd e5 b0 c9 e7 e7 c1 b3 e9 c1 4c e3 fe 60 2c c7 83 7f 83 11 f4 35 e0 7b c1 f3 f5 82 be 5e 9b f7 8c c0 cc ef d0 74 d6 60 9c cf ce 2b 73 06 9b 7c de a4 90 62 76 d6 55 2f 7f 54 9d e4 10 aa 5b a0 10 af 6c 24 58 51 09 a5 de 94 33 32 e1 f1 ca d9 19 b6 2e 4d d1 1a 71 71 bb 5c 1f e3 39 9f 13 13 79 bc 72 36 6c 84 f1 c1 bc 50 8b aa 22 ce 90 7a d3 47 4b 16 2e 8f 3c 96 ec fb 68 c4 7a 60 82 f3 08 96 0c bc 14 f3 49 92 98 Data Ascii: ra}_V=i 6<1,+%q!X&-S&Z}OmB04M)?&1$.E."3-7L`,5{^t`+s\|bvU/T[l$XQ32.Mqq\9yr6lP"zGK.<hz`I
2025-01-12 00:14:52 UTC	1104	IN	Data Raw: 3a 46 a9 86 a5 42 a6 54 64 2e 96 d8 34 5a 6b db 8d 8c 4f 44 55 99 46 f5 61 84 af 1d fa c2 86 23 f3 8b c6 1a 2e 46 14 94 dc 87 75 28 33 70 5c 91 07 50 5e 56 d5 b9 ea a2 c6 58 49 45 39 ac 2d 4e 52 74 55 8a 8e 56 69 bb 81 f1 a9 af be a8 be ac c8 03 87 32 03 b1 76 8b d1 30 4a 6f 7c bc 43 bc c3 2a 7b 70 f4 7e 41 4f 36 27 c7 b2 d6 65 81 6a 65 a2 2f 2d d4 35 3e 41 05 3d 89 a3 f7 ab ca 1e ee 90 f8 c5 88 31 1a 46 f9 e3 b0 ee 5a 3f 3d 9a cb 3f aa c8 f7 54 99 2a 2f e4 f5 ad af 95 af 5f 0f 2a f5 5f df f8 54 99 52 e4 7b a3 b9 fc a3 c3 77 c5 cb 00 31 9a 83 8a e7 cf 9d fd d2 96 b1 bc ef de 07 fa 14 0b 52 6f 9a 64 db d5 84 46 88 5c 4b 9b 0b ca 65 41 9e ca fb ee 7d 67 bf b4 e5 5d 9f 50 1b 63 f1 50 f5 c0 c7 23 6f 7e 7b 18 e5 5e 45 9e 06 72 5a 4e 8a 1b 55 74 97 1a 35 8c 2f Data Ascii: :FBTd.4ZkODUFa#.Fu(3p\P^VXIE9-NRtUVi2v0Jo\|C{p~AO6'eje/-5>A=1FZ?=?T/_*_TR{w1RodF\KeA}g]PcP#o~{^ErZNUt5/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49723	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:52 UTC	567	OUT	GET /static/css/swiper-bundle.min.css HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:52 UTC	895	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:52 GMT Content-Type: text/css; charset=utf-8 Content-Length: 15563 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=q2mjgPu53rD4%2BNKz0aveBXVWxephC1yC3yVE%2Bf8b%2B3EgszcfgrODOsJRIR%2FZw9qbUOhYE2zlGeMnWmKY6O%2BtyX2qt5IqYUcxox%2FhHZhyutoD0gIs8NgvkC7jC15uBLVukHpDt5c%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2e8bcf7c360-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=5281&min_rtt=1586&rtt_var=2945&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1145&delivery_rate=1841109&cwnd=138&unsent_bytes=0&cid=ebe0647d459b47a3&ts=806&x=0"
2025-01-12 00:14:52 UTC	474	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 53 77 69 70 65 72 20 37 2e 34 2e 31 0a 20 2a 20 4d 6f 73 74 20 6d 6f 64 65 72 6e 20 6d 6f 62 69 6c 65 20 74 6f 75 63 68 20 73 6c 69 64 65 72 20 61 6e 64 20 66 72 61 6d 65 77 6f 72 6b 20 77 69 74 68 20 68 61 72 64 77 61 72 65 20 61 63 63 65 6c 65 72 61 74 65 64 20 74 72 61 6e 73 69 74 69 6f 6e 73 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 73 77 69 70 65 72 6a 73 2e 63 6f 6d 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 2d 32 30 32 31 20 56 6c 61 64 69 6d 69 72 20 4b 68 61 72 6c 61 6d 70 69 64 69 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 6f 6e 3a 20 44 65 63 65 6d 62 65 72 20 32 34 2c 20 32 30 32 31 0a 20 2a 2f Data Ascii: /** * Swiper 7.4.1 * Most modern mobile touch slider and framework with hardware accelerated transitions * https://swiperjs.com * * Copyright 2014-2021 Vladimir Kharlampidi * * Released under the MIT License * * Released on: December 24, 2021 */
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 41 41 41 41 75 41 41 41 41 4e 75 41 59 37 2b 78 48 55 31 56 43 41 41 41 46 78 41 41 41 41 46 41 41 41 41 42 6d 32 66 50 63 7a 55 39 54 4c 7a 49 41 41 41 48 63 41 41 41 41 53 67 41 41 41 47 42 50 39 56 35 52 59 32 31 68 63 41 41 41 41 6b 51 41 41 41 43 49 41 41 41 42 59 74 36 46 30 63 42 6a 64 6e 51 67 41 41 41 43 7a 41 41 41 41 41 51 41 41 41 41 45 41 42 45 42 52 47 64 68 63 33 41 41 41 41 57 59 41 41 41 41 43 41 41 41 41 41 6a 2f 2f 77 41 44 5a 32 78 35 5a 67 41 41 41 79 77 41 41 41 44 4d 41 41 41 44 32 4d 48 74 72 79 56 6f 5a 57 46 6b 41 41 41 42 62 41 41 41 41 44 41 41 41 41 41 32 45 32 2b 65 6f 57 68 6f 5a 57 45 41 41 41 47 63 41 41 41 41 48 77 41 41 41 43 51 43 39 67 44 7a 61 47 31 30 65 41 41 41 41 69 67 41 41 41 41 5a 41 41 41 41 72 67 4a 6b 41 42 Data Ascii: AAAAuAAAANuAY7+xHU1VCAAAFxAAAAFAAAABm2fPczU9TLzIAAAHcAAAASgAAAGBP9V5RY21hcAAAAkQAAACIAAABYt6F0cBjdnQgAAACzAAAAAQAAAAEABEBRGdhc3AAAAWYAAAACAAAAAj//wADZ2x5ZgAAAywAAADMAAAD2MHtryVoZWFkAAABbAAAADAAAAA2E2+eoWhoZWEAAAGcAAAAHwAAACQC9gDzaG10eAAAAigAAAAZAAAArgJkAB
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 72 4a 37 73 72 5a 34 46 5a 6e 68 31 50 4d 41 74 50 68 77 50 36 66 6c 32 50 4d 4a 4d 50 44 67 65 51 34 72 59 38 59 54 36 47 7a 61 6f 30 65 41 45 41 34 30 39 44 75 67 67 6d 54 6e 46 6e 4f 63 53 43 69 45 69 4c 4d 67 78 43 69 54 49 36 43 71 35 44 5a 55 64 33 51 6d 70 31 30 76 4f 30 4c 61 4c 54 64 32 63 6a 4e 34 66 4f 75 6d 6c 63 37 6c 55 59 62 53 51 63 5a 46 6b 75 74 52 47 37 67 36 4a 4b 5a 4b 79 30 52 6d 64 4c 59 36 38 30 43 44 6e 45 4a 2b 55 4d 6b 70 46 46 65 31 52 4e 37 6e 78 64 56 70 58 72 43 34 61 54 74 6e 61 75 72 4f 6e 59 65 72 63 5a 67 32 59 56 6d 4c 4e 2f 64 2f 67 63 7a 66 45 69 6d 72 45 2f 66 73 2f 62 4f 75 71 32 39 5a 6d 6e 38 74 6c 6f 4f 52 61 58 67 5a 67 47 61 37 38 79 4f 39 2f 63 6e 58 6d 32 42 70 61 47 76 71 32 35 44 76 39 53 34 45 39 2b 35 53 Data Ascii: rJ7srZ4FZnh1PMAtPhwP6fl2PMJMPDgeQ4rY8YT6Gzao0eAEA409DuggmTnFnOcSCiEiLMgxCiTI6Cq5DZUd3Qmp10vO0LaLTd2cjN4fOumlc7lUYbSQcZFkutRG7g6JKZKy0RmdLY680CDnEJ+UMkpFFe1RN7nxdVpXrC4aTtnaurOnYercZg2YVmLN/d/gczfEimrE/fs/bOuq29Zmn8tloORaXgZgGa78yO9/cnXm2BpaGvq25Dv9S4E9+5S
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 6c 69 74 79 3a 68 69 64 64 65 6e 7d 2e 73 77 69 70 65 72 2d 61 75 74 6f 68 65 69 67 68 74 2c 2e 73 77 69 70 65 72 2d 61 75 74 6f 68 65 69 67 68 74 20 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 7b 68 65 69 67 68 74 3a 61 75 74 6f 7d 2e 73 77 69 70 65 72 2d 61 75 74 6f 68 65 69 67 68 74 20 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 66 6c 65 78 2d 73 74 61 72 74 3b 74 72 61 6e 73 69 74 69 6f 6e 2d 70 72 6f 70 65 72 74 79 3a 74 72 61 6e 73 66 6f 72 6d 2c 68 65 69 67 68 74 7d 2e 73 77 69 70 65 72 2d 33 64 2c 2e 73 77 69 70 65 72 2d 33 64 2e 73 77 69 70 65 72 2d 63 73 73 2d 6d 6f 64 65 20 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 70 65 72 73 70 65 63 74 69 76 65 3a 31 32 30 30 70 78 7d 2e 73 77 69 70 65 72 2d 33 64 20 Data Ascii: lity:hidden}.swiper-autoheight,.swiper-autoheight .swiper-slide{height:auto}.swiper-autoheight .swiper-wrapper{align-items:flex-start;transition-property:transform,height}.swiper-3d,.swiper-3d.swiper-css-mode .swiper-wrapper{perspective:1200px}.swiper-3d
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 73 2d 6f 76 65 72 66 6c 6f 77 2d 73 74 79 6c 65 3a 6e 6f 6e 65 7d 2e 73 77 69 70 65 72 2d 63 73 73 2d 6d 6f 64 65 3e 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 3a 3a 2d 77 65 62 6b 69 74 2d 73 63 72 6f 6c 6c 62 61 72 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 77 69 70 65 72 2d 63 73 73 2d 6d 6f 64 65 3e 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 3e 2e 73 77 69 70 65 72 2d 73 6c 69 64 65 7b 73 63 72 6f 6c 6c 2d 73 6e 61 70 2d 61 6c 69 67 6e 3a 73 74 61 72 74 20 73 74 61 72 74 7d 2e 73 77 69 70 65 72 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 73 77 69 70 65 72 2d 63 73 73 2d 6d 6f 64 65 3e 2e 73 77 69 70 65 72 2d 77 72 61 70 70 65 72 7b 73 63 72 6f 6c 6c 2d 73 6e 61 70 2d 74 79 70 65 3a 78 20 6d 61 6e 64 61 74 6f 72 79 7d 2e 73 77 69 70 65 72 2d 76 65 72 Data Ascii: s-overflow-style:none}.swiper-css-mode>.swiper-wrapper::-webkit-scrollbar{display:none}.swiper-css-mode>.swiper-wrapper>.swiper-slide{scroll-snap-align:start start}.swiper-horizontal.swiper-css-mode>.swiper-wrapper{scroll-snap-type:x mandatory}.swiper-ver
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 6e 2d 73 69 7a 65 3a 34 34 70 78 7d 2e 73 77 69 70 65 72 2d 62 75 74 74 6f 6e 2d 6e 65 78 74 2c 2e 73 77 69 70 65 72 2d 62 75 74 74 6f 6e 2d 70 72 65 76 7b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 74 6f 70 3a 35 30 25 3b 77 69 64 74 68 3a 63 61 6c 63 28 76 61 72 28 2d 2d 73 77 69 70 65 72 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 73 69 7a 65 29 2f 20 34 34 20 2a 20 32 37 29 3b 68 65 69 67 68 74 3a 76 61 72 28 2d 2d 73 77 69 70 65 72 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 73 69 7a 65 29 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 63 61 6c 63 28 30 70 78 20 2d 20 28 76 61 72 28 2d 2d 73 77 69 70 65 72 2d 6e 61 76 69 67 61 74 69 6f 6e 2d 73 69 7a 65 29 2f 20 32 29 29 3b 7a 2d 69 6e 64 65 78 3a 31 30 3b 63 75 72 73 6f 72 3a 70 6f 69 6e 74 65 72 3b 64 69 73 70 6c Data Ascii: n-size:44px}.swiper-button-next,.swiper-button-prev{position:absolute;top:50%;width:calc(var(--swiper-navigation-size)/ 44 * 27);height:var(--swiper-navigation-size);margin-top:calc(0px - (var(--swiper-navigation-size)/ 2));z-index:10;cursor:pointer;displ
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 69 6f 6e 2d 66 72 61 63 74 69 6f 6e 7b 62 6f 74 74 6f 6d 3a 31 30 70 78 3b 6c 65 66 74 3a 30 3b 77 69 64 74 68 3a 31 30 30 25 7d 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2d 64 79 6e 61 6d 69 63 7b 6f 76 65 72 66 6c 6f 77 3a 68 69 64 64 65 6e 3b 66 6f 6e 74 2d 73 69 7a 65 3a 30 7d 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2d 64 79 6e 61 6d 69 63 20 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 7b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 33 33 29 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2d 64 79 6e 61 6d 69 63 20 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 Data Ascii: ion-fraction{bottom:10px;left:0;width:100%}.swiper-pagination-bullets-dynamic{overflow:hidden;font-size:0}.swiper-pagination-bullets-dynamic .swiper-pagination-bullet{transform:scale(.33);position:relative}.swiper-pagination-bullets-dynamic .swiper-pagina
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 65 21 69 6d 70 6f 72 74 61 6e 74 7d 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 2d 61 63 74 69 76 65 7b 6f 70 61 63 69 74 79 3a 76 61 72 28 2d 2d 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 2d 6f 70 61 63 69 74 79 2c 20 31 29 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 63 6f 6c 6f 72 2c 76 61 72 28 2d 2d 73 77 69 70 65 72 2d 74 68 65 6d 65 2d 63 6f 6c 6f 72 29 29 7d 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 76 65 72 74 69 63 61 6c 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2c 2e 73 77 69 70 65 72 2d 76 65 72 74 69 63 61 6c 3e 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 Data Ascii: e!important}.swiper-pagination-bullet-active{opacity:var(--swiper-pagination-bullet-opacity, 1);background:var(--swiper-pagination-color,var(--swiper-theme-color))}.swiper-pagination-vertical.swiper-pagination-bullets,.swiper-vertical>.swiper-pagination-b
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2d 64 79 6e 61 6d 69 63 7b 6c 65 66 74 3a 35 30 25 3b 74 72 61 6e 73 66 6f 72 6d 3a 74 72 61 6e 73 6c 61 74 65 58 28 2d 35 30 25 29 3b 77 68 69 74 65 2d 73 70 61 63 65 3a 6e 6f 77 72 61 70 7d 2e 73 77 69 70 65 72 2d 68 6f 72 69 7a 6f 6e 74 61 6c 3e 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2d 64 79 6e 61 6d 69 63 20 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 2c 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 68 6f 72 69 7a 6f 6e 74 61 6c 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 62 75 6c 6c 65 74 73 2e 73 77 69 Data Ascii: .swiper-pagination-bullets-dynamic{left:50%;transform:translateX(-50%);white-space:nowrap}.swiper-horizontal>.swiper-pagination-bullets.swiper-pagination-bullets-dynamic .swiper-pagination-bullet,.swiper-pagination-horizontal.swiper-pagination-bullets.swi
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 70 72 6f 67 72 65 73 73 62 61 72 2d 6f 70 70 6f 73 69 74 65 2c 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 70 72 6f 67 72 65 73 73 62 61 72 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 76 65 72 74 69 63 61 6c 2c 2e 73 77 69 70 65 72 2d 76 65 72 74 69 63 61 6c 3e 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 70 72 6f 67 72 65 73 73 62 61 72 7b 77 69 64 74 68 3a 34 70 78 3b 68 65 69 67 68 74 3a 31 30 30 25 3b 6c 65 66 74 3a 30 3b 74 6f 70 3a 30 7d 2e 73 77 69 70 65 72 2d 70 61 67 69 6e 61 74 69 6f 6e 2d 6c 6f 63 6b 7b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 7d 2e 73 77 69 70 65 72 2d 73 63 72 6f 6c 6c 62 61 72 7b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 31 30 70 78 3b 70 6f 73 69 Data Ascii: per-pagination-progressbar-opposite,.swiper-pagination-progressbar.swiper-pagination-vertical,.swiper-vertical>.swiper-pagination-progressbar{width:4px;height:100%;left:0;top:0}.swiper-pagination-lock{display:none}.swiper-scrollbar{border-radius:10px;posi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49725	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:52 UTC	559	OUT	GET /static/css/style.min.css HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:52 UTC	884	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:52 GMT Content-Type: text/css; charset=utf-8 Content-Length: 16104 Connection: close Last-Modified: Wed, 18 Dec 2024 08:47:30 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dCo6zGXns079ZNsG9qmTU1C26CLwTm8x33eb322dH4olCB2eiRv3vBNoxyam3tEmngm4apzCHruuikxEH5RuKRfbz%2FsNY6q3ae27ztSf5FUl5ZwYWkse1LsIp4jEh2GVlDAGn7o%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2e8cd934343-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2337&min_rtt=2323&rtt_var=899&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1137&delivery_rate=1199178&cwnd=244&unsent_bytes=0&cid=1655684510f03d4a&ts=799&x=0"
2025-01-12 00:14:52 UTC	485	IN	Data Raw: 3a 72 6f 6f 74 7b 2d 2d 68 65 61 64 65 72 48 65 69 67 68 74 3a 20 36 34 70 78 3b 2d 2d 70 61 64 64 69 6e 67 3a 20 31 35 70 78 3b 2d 2d 74 68 65 6d 65 43 6f 6c 6f 72 3a 20 23 31 37 39 63 64 65 3b 2d 2d 6d 61 78 57 69 64 74 68 3a 20 31 32 30 30 70 78 7d 2a 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 61 7b 74 65 78 74 2d 64 65 63 6f 72 61 74 69 6f 6e 3a 6e 6f 6e 65 7d 2e 70 2d 6c 72 7b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 76 61 72 28 2d 2d 70 61 64 64 69 6e 67 29 3b 70 61 64 64 69 6e 67 2d 72 69 67 68 74 3a 76 61 72 28 2d 2d 70 61 64 64 69 6e 67 29 7d 62 6f 64 79 7b 66 6f 6e 74 3a 31 32 Data Ascii: :root{--headerHeight: 64px;--padding: 15px;--themeColor: #179cde;--maxWidth: 1200px}*{-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;padding:0}a{text-decoration:none}.p-lr{padding-left:var(--padding);padding-right:var(--padding)}body{font:12
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 72 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 66 66 66 3b 7a 2d 69 6e 64 65 78 3a 31 30 30 30 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 70 61 63 6b 3a 63 65 6e 74 65 72 3b 6a 75 73 74 69 66 79 2d 63 6f 6e 74 65 6e 74 3a 63 65 6e 74 65 72 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 35 70 78 3b Data Ascii: r;background-color:#fff;z-index:1000;display:none;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;-webkit-box-pack:center;-ms-flex-pack:center;justify-content:center;border-radius:5px;
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 72 69 67 68 74 3a 30 7d 68 65 61 64 65 72 20 23 6e 61 76 2d 62 74 6e 7b 68 65 69 67 68 74 3a 31 30 30 25 3b 64 69 73 70 6c 61 79 3a 6e 6f 6e 65 3b 77 69 64 74 68 3a 31 2e 32 35 72 65 6d 3b 68 65 69 67 68 74 3a 31 2e 30 36 32 35 72 65 6d 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 75 72 6c 28 2e 2e 2f 69 6d 61 67 65 2f 69 63 6f 6e 5f 6e 61 76 2e 70 6e 67 29 20 6e 6f 2d 72 65 70 65 61 74 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 73 69 7a 65 3a 31 30 30 25 20 31 30 30 25 7d 2e 63 72 75 6d 62 73 7b 63 6f 6c 6f 72 3a 23 36 36 36 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d Data Ascii: right:0}header #nav-btn{height:100%;display:none;width:1.25rem;height:1.0625rem;background:url(../image/icon_nav.png) no-repeat;background-size:100% 100%}.crumbs{color:#666;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 74 69 6d 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 63 6f 6c 6f 72 3a 23 39 39 39 3b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 7d 2e 6c 69 73 74 20 2e 6c 69 20 2e 69 6e 66 6f 20 2e 74 69 6d 65 3a 3a 62 65 66 6f 72 65 7b 63 6f 6e 74 65 6e 74 3a 22 22 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 77 69 64 74 68 3a 31 32 70 78 3b 68 65 69 67 68 74 3a 31 32 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a Data Ascii: time{font-size:12px;font-weight:400;color:#999;display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center}.list .li .info .time::before{content:"";display:block;width:12px;height:12px;background:
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 65 72 72 6f 72 2d 34 30 34 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 6c 65 72 74 20 70 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 72 65 6d 3b 63 6f 6c 6f 72 3a 23 38 39 38 35 38 35 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 33 34 70 78 7d 2e 65 72 72 6f 72 2d 34 30 34 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 61 6c 65 72 74 20 2e 62 74 6e 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 43 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 2e 33 31 32 35 72 65 6d 3b 77 69 64 74 68 3a 35 72 65 6d 3b 68 65 69 67 68 74 3a 31 2e 38 37 35 72 65 6d 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 2e 38 37 35 72 65 6d 3b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 6d Data Ascii: error-404-container .alert p{font-size:1rem;color:#898585;line-height:34px}.error-404-container .alert .btn{font-size:12px;color:#fff;background-color:var(--themeColor);border-radius:.3125rem;width:5rem;height:1.875rem;line-height:1.875rem;display:block;m
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 3b 68 65 69 67 68 74 3a 33 30 70 78 7d 2e 69 6e 64 65 78 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 70 61 72 74 31 20 2e 62 75 74 74 6f 6e 7b 68 65 69 67 68 74 3a 34 36 70 78 3b 70 61 64 64 69 6e 67 3a 30 20 33 30 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 76 61 72 28 2d 2d 74 68 65 6d 65 43 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 38 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 63 6f 6c 6f 72 3a 23 66 66 66 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 36 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 70 61 64 64 69 6e 67 2d 6c 65 66 74 3a 33 30 70 78 7d 2e 69 6e Data Ascii: ;height:30px}.index-container .part1 .button{height:46px;padding:0 30px;background:var(--themeColor);border-radius:30px;font-size:18px;font-weight:400;color:#fff;line-height:46px;text-align:center;margin-bottom:20px;position:relative;padding-left:30px}.in
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 29 3b 6d 61 72 67 69 6e 3a 30 20 32 30 70 78 7d 2e 69 6e 64 65 78 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 70 61 72 74 32 20 2e 69 74 65 6d 20 2e 74 69 74 6c 65 7b 66 6f 6e 74 2d 73 69 7a 65 3a 33 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 63 6f 6c 6f 72 3a 23 33 33 33 3b 6c 69 6e 65 2d 68 65 69 67 68 74 3a 34 35 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 31 30 70 78 7d 2e 69 6e 64 65 78 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 70 61 72 74 32 20 2e 69 74 65 6d 20 2e 64 65 73 63 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 36 70 78 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 63 6f 6c 6f 72 3a 23 36 36 36 7d 2e 69 6e 64 65 78 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 70 61 72 74 32 20 2e 69 74 65 6d 20 2e 62 75 74 74 6f 6e 7b 77 69 64 74 68 3a 31 32 Data Ascii: );margin:0 20px}.index-container .part2 .item .title{font-size:36px;font-weight:400;color:#333;line-height:45px;margin-bottom:10px}.index-container .part2 .item .desc{font-size:16px;font-weight:400;color:#666}.index-container .part2 .item .button{width:12
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 70 61 63 69 74 79 3a 2e 38 7d 2e 61 72 74 69 63 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 63 68 61 6e 6e 65 6c 2d 6c 69 73 74 20 2e 63 68 61 6e 6e 65 6c 2d 74 69 74 6c 65 20 61 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 63 6f 6c 6f 72 3a 23 39 39 39 7d 2e 61 72 74 69 63 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 63 68 61 6e 6e 65 6c 2d 6c 69 73 74 20 2e 63 68 61 6e 6e 65 6c 2d 74 69 74 6c 65 20 61 3a 68 6f 76 65 72 7b 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 43 6f 6c 6f 72 29 7d 2e 61 72 74 69 63 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 70 61 67 69 6e 61 74 69 6f 6e 7b 6d 61 72 67 69 6e 2d 74 6f 70 3a 33 30 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 35 30 70 78 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 63 6f 6c 6f 72 Data Ascii: pacity:.8}.article-container .channel-list .channel-title a{font-size:14px;color:#999}.article-container .channel-list .channel-title a:hover{color:var(--themeColor)}.article-container .pagination{margin-top:30px;margin-bottom:50px;text-align:center;color
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 6f 6e 74 61 69 6e 65 72 20 2e 63 6f 6e 74 61 69 6e 65 72 20 68 32 7b 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 32 32 70 78 3b 6d 61 72 67 69 6e 2d 62 6f 74 74 6f 6d 3a 32 35 70 78 7d 2e 61 72 74 69 63 6c 65 2d 63 6f 6e 74 61 69 6e 65 72 20 2e 63 6f 6e 74 61 69 6e 65 72 20 2e 69 6e 66 6f 73 7b 64 69 73 70 6c 61 79 3a 2d 77 65 62 6b 69 74 2d 62 6f 78 3b 64 69 73 70 6c 61 79 3a 2d 6d 73 2d 66 6c 65 78 62 6f 78 3b 64 69 73 70 6c 61 79 3a 66 6c 65 78 3b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 2d 6d 73 2d 66 6c 65 78 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 61 6c 69 67 6e 2d 69 74 65 6d 73 3a 63 65 6e 74 65 72 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 6c 69 6e 65 2d 68 65 69 67 Data Ascii: ontainer .container h2{text-align:center;font-size:22px;margin-bottom:25px}.article-container .container .infos{display:-webkit-box;display:-ms-flexbox;display:flex;-webkit-box-align:center;-ms-flex-align:center;align-items:center;font-size:14px;line-heig
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 69 6e 65 72 20 2e 72 65 63 6f 6d 6d 65 6e 64 20 2e 6d 6f 64 75 6c 65 2d 74 69 74 6c 65 3a 3a 61 66 74 65 72 7b 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 3b 63 6f 6e 74 65 6e 74 3a 22 22 3b 77 69 64 74 68 3a 31 30 30 25 3b 68 65 69 67 68 74 3a 34 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 76 61 72 28 2d 2d 74 68 65 6d 65 43 6f 6c 6f 72 29 3b 62 6f 72 64 65 72 2d 72 61 64 69 75 73 3a 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 6c 65 66 74 3a 30 3b 62 6f 74 74 6f 6d 3a 2d 33 70 78 3b 6f 70 61 63 69 74 79 3a 2e 38 7d 40 6d 65 64 69 61 20 73 63 72 65 65 6e 20 61 6e 64 20 28 6d 61 78 2d 77 69 64 74 68 3a 20 31 32 30 30 70 78 29 7b 2e 77 72 61 70 70 65 72 7b 6d 61 78 2d 77 69 64 74 68 3a 39 37 30 70 78 7d 7d 40 6d 65 64 69 Data Ascii: iner .recommend .module-title::after{display:block;content:"";width:100%;height:4px;background-color:var(--themeColor);border-radius:30px;position:absolute;left:0;bottom:-3px;opacity:.8}@media screen and (max-width: 1200px){.wrapper{max-width:970px}}@medi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49726	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:52 UTC	603	OUT	GET /telegram-16/logo.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:52 UTC	948	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:52 GMT Content-Type: image/jpeg Content-Length: 3393 Connection: close ETag: "941d950538f7ca436158c908c7dec967" Last-Modified: Fri, 06 Dec 2024 01:36:06 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2920 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RfIx7VxvCMOYHm5UWMfdiJ11f80HJWInfJf4pvxkpThw6fmBC6E%2BA3KIzEt%2B9gjDYya1pNMSX7NHmFUumdRTXPEgBsF4hXlWYUgmZFGq88gCgE3IZKgKFZJ5A7Fr%2F%2FL2zzZeegeRNRQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2e8ac6c1821-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1550&min_rtt=1549&rtt_var=584&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2873&recv_bytes=1181&delivery_rate=1867007&cwnd=242&unsent_bytes=0&cid=fa4e37a5b4127040&ts=159&x=0"
2025-01-12 00:14:52 UTC	421	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 03 00 00 00 0b df 81 d0 00 00 02 d9 50 4c 54 45 00 00 00 27 a5 e6 26 a6 e5 27 a6 e6 25 a4 e3 22 9f db 25 a2 e0 27 a6 e6 27 a5 e6 2a ab ee 26 a5 e5 29 aa ed 23 a1 de 24 a2 e0 28 a9 eb 24 a2 e0 27 a7 e8 23 a0 dc 23 a2 de 22 9f db 28 a8 ea 24 a3 e1 25 a4 e3 25 a3 e3 22 9e da 29 a9 eb 22 9f da 25 a4 e4 28 a9 eb 23 a0 dc 23 a1 dd 29 ab ee 24 a2 de 28 a8 e9 25 a3 e1 23 a1 de 28 a9 ea 23 a0 dc 2a ab ee 27 a6 e6 22 a0 db 23 a0 dc 29 aa ed 28 a9 ea 22 a0 dc 27 a6 e7 24 a2 e0 29 aa ec 23 a1 dd 26 a6 e6 26 a4 e3 29 aa ed 25 a4 e3 24 a2 e0 2a ab ee 27 a6 e7 29 ab ed 22 9f db 28 a9 eb 24 a1 df 28 a9 eb 23 9f db 28 a8 ea 23 a0 dc 26 a5 e5 22 a0 dc 2a ab ee 22 9f da 29 aa ec 23 a0 dc 29 aa ec 24 Data Ascii: PNGIHDRPLTE'&'%"%''&)#$($'##"($%%")"%(##)$(%#(#'"#)("'$)#&&)%$')"($(#(#&"")#)$
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: e3 22 9f db 2a ab ef 2a ab ef 29 a9 ea 25 a4 e2 29 aa ed ff ff ff 23 a1 de 28 a9 ea 23 a0 dc 24 a1 df 28 a8 e9 28 a7 e8 25 a3 e1 29 aa ec 26 a5 e5 27 a6 e6 25 a4 e2 23 9f db 27 a7 e7 26 a4 e3 28 a8 ea 24 a2 e0 29 aa ed 22 9f da 27 a6 e5 25 a3 e0 27 a6 e7 2a ab ee 27 a5 e5 2a ab ed fc fe ff fe fe ff d5 ee fa f9 fd fe f7 fc fe e9 f6 fc f2 fa fe e3 f3 fc 50 b7 eb 31 a9 e5 f0 f9 fd af de f5 94 d2 f1 43 b1 e9 4c b4 e7 47 b2 e7 2a a7 e5 29 a6 e3 28 a4 e1 f4 fb fe eb f7 fd c7 e8 f8 c3 e6 f8 c0 e5 f7 b9 e3 f7 a7 db f5 a1 d8 f4 7d c9 ee 67 c1 ed 39 ae e9 2a a8 e8 35 ab e6 3e ae e5 2c a6 e1 fb fd ff e6 f5 fc cc ea f9 b5 e1 f6 9b d6 f3 6b c1 ec 5d ba e8 55 b8 e8 31 ab e8 dd f1 fb ab dc f5 97 d5 f3 81 ca ef 78 c7 ef 6e c3 ed 35 ac e8 2d a8 e6 2d a7 e4 35 aa e3 d0 ec Data Ascii: "*)%)#(#$((%)&'%#'&($)"'%''P1CLG)(}g9*5>,k]U1xn5--5
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 70 9b 41 18 d4 0e 12 0b 3d f2 00 1a 24 55 16 f5 2d f3 9b 63 61 56 49 3c 93 cd d0 34 4c 56 ce 7b be 70 54 bc 31 86 45 43 61 59 7b 24 9e a9 36 78 28 26 2b e4 b3 ed bb 2c 1c ff e6 da 5e 7a 06 e5 0b ec 93 78 c6 3b e1 69 3f 5d 11 bb e9 a7 c3 c0 f5 3f 45 4c 71 da 83 f2 69 4d 34 1e d1 23 78 42 57 c2 9e 76 ef cc 22 0e 6b 1e 3f 4d fb 97 0a 7b e8 a7 31 b5 c3 28 5d 36 7b 2c 19 d4 07 b8 ce ed 28 c4 da 69 fa f0 a4 f0 0e b6 69 5c ef e0 a3 aa 4c 66 db d9 12 f7 e9 cd 3a 92 f6 ab d0 86 75 13 15 d8 55 e1 9a 04 99 aa 2c e1 df 33 1a 06 71 32 46 52 99 d4 86 bb d8 84 43 2a 5c c3 30 45 94 21 ec b1 ae 68 11 a7 4d c7 72 3c 13 4b 59 8b ee dd 57 02 57 17 08 09 6c fe a8 73 91 41 dc 0c 11 d6 9e c9 99 4f 74 a8 98 73 02 97 18 c6 f1 82 b4 d9 76 ba bd a9 46 dc 74 9a b4 fd 5f 72 c3 15 28 Data Ascii: pA=$U-caVI<4LV{pT1ECaY{$6x(&+,^zx;i?]?ELqiM4#xBWv"k?M{1(]6{,(ii\Lf:uU,3q2FRC*\0E!hMr<KYWWlsAOtsvFt_r(
2025-01-12 00:14:52 UTC	234	IN	Data Raw: fb cc 92 e1 66 e2 2e ac a9 5a 6e 31 b4 11 fb a8 a6 66 ef 4d a1 a5 d9 70 f0 4c 49 52 a8 d0 da d8 ca 9e a9 48 37 12 74 d1 f3 29 04 33 bc 18 3a 1a 07 26 22 3b 0a b9 ba 06 9d 09 f6 8a 68 b0 c1 6a 27 00 09 5f 4a 93 dc 2a d7 52 44 20 03 2b 77 29 22 f2 7e 87 62 84 81 1c 51 1d 9a a8 fb 51 15 f7 22 90 85 e3 c2 44 3f 3b 40 66 61 0b 40 9e 3c 0d 96 a8 f5 a8 3c b0 27 40 87 3c 2b bd 76 c3 72 ab 27 03 45 42 fc 94 3f 1a 37 75 3a 98 c3 a9 2c 02 6d 93 e8 29 74 1b 2e 33 b2 70 bd 95 80 0d 51 89 36 eb 30 45 57 32 3d 86 eb c5 6e 86 81 25 49 b5 8f ba 6f 1a 67 2a 99 be 7e 8c 54 0d 38 c0 b2 36 52 23 4b 5f 79 79 6a bc ce 49 73 6f a5 5b 91 3a d2 26 5d 32 bd 00 eb 13 09 6b 92 46 df c2 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: f.Zn1fMpLIRH7t)3:&";hj'_JRD +w)"~bQQ"D?;@fa@<<'@<+vr'EB?7u:,m)t.3pQ60EW2=n%Iog~T86R#K_yyjIso[:&]2kFIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49727	90.84.161.20	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:52 UTC	568	OUT	GET /js-sdk-pro.min.js?id=3KK9Zot37TeXAqY2&ck=3KK9Zot37TeXAqY2 HTTP/1.1 Host: sdk.51.la Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:53 UTC	434	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:52 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: openresty Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE5-CACHE5[154],EU-GER-frankfurt-EDGE5-CACHE5[ovl,152],CHN-HElangfang-GLOBAL6-CACHE138[ovl,16] X-CCDN-REQ-ID-46B1: 5071673e8ae87c9bb55bb080f386bcfd
2025-01-12 00:14:53 UTC	15950	IN	Data Raw: 34 61 36 0d 0a 2f 2a 21 0a 2a 20 35 31 4c 41 20 41 6e 61 6c 79 73 69 73 20 4a 61 76 61 73 63 72 69 70 74 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 20 4b 69 74 0a 2a 20 6a 73 2d 73 64 6b 2d 70 72 6f 20 76 31 2e 35 38 2e 33 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 36 2d 32 30 32 32 20 35 31 2e 6c 61 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 67 3d 65 5b 27 64 6f 63 75 6d 65 6e 74 27 5d 2c 68 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 69 3d 41 28 27 4f 62 6a 65 63 74 27 29 2c 6a 3d 41 28 27 4e 75 6d 62 65 72 27 29 2c 6b 3d 41 28 27 53 74 72 69 6e 67 27 29 2c 6d Data Ascii: 4a6/! 51LA Analysis Javascript Software Development Kit* js-sdk-pro v1.58.3* Copyright 2016-2022 51.la All Rights Reserved*/(function(c){'use strict';var e=window,g=e['document'],h=encodeURIComponent,i=A('Object'),j=A('Number'),k=A('String'),m
2025-01-12 00:14:53 UTC	16384	IN	Data Raw: 3e 30 78 30 3f 28 66 68 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 72 76 3a 27 29 2c 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 68 2b 30 78 33 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 68 29 29 2c 30 78 61 29 29 3a 28 66 66 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 45 64 67 65 2f 27 29 29 3e 30 78 30 26 26 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 66 2b 30 78 35 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 66 29 29 2c 30 78 61 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 66 6a 28 66 6b 2c 66 6c 2c 66 6d 29 7b 76 61 72 20 66 6e 2c 66 6f 2c 66 70 2c 66 71 2c 66 72 2c 66 73 2c 66 74 2c 66 75 3d 5b 5d 2c 66 76 3d 5b 5d 2c 66 77 3d 30 78 30 2c 66 78 3d 66 Data Ascii: >0x0?(fh=fi['indexOf']('rv:'),parseInt(fi['substring'](fh+0x3,fi['indexOf']('.',fh)),0xa)):(ff=fi['indexOf']('Edge/'))>0x0&&parseInt(fi['substring'](ff+0x5,fi['indexOf']('.',ff)),0xa);}function fj(fk,fl,fm){var fn,fo,fp,fq,fr,fs,ft,fu=[],fv=[],fw=0x0,fx=f
2025-01-12 00:14:53 UTC	3712	IN	Data Raw: 75 73 27 29 2c 6a 6b 5b 27 73 65 74 41 74 74 72 69 62 75 74 65 27 5d 28 27 63 68 61 72 73 65 74 27 2c 27 55 54 46 2d 38 27 29 2c 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 27 5d 28 27 68 65 61 64 27 29 5b 30 78 30 5d 5b 27 61 70 70 65 6e 64 43 68 69 6c 64 27 5d 28 6a 6b 29 2c 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 3f 6a 6b 5b 27 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 28 27 63 6f 6d 70 6c 65 74 65 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 7c 7c 27 6c 6f 61 64 65 64 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 29 26 26 6a 69 26 26 6a 69 28 29 3b 7d 3a 6a 6b 5b 27 6f 6e 6c 6f 61 64 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 Data Ascii: us'),jk['setAttribute']('charset','UTF-8'),document['getElementsByTagName']('head')[0x0]['appendChild'](jk),jk['readyState']?jk['onreadystatechange']=function(){('complete'==jk['readyState']\|\|'loaded'==jk['readyState'])&&ji&&ji();}:jk['onload']=function()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49729	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:52 UTC	362	OUT	GET /telegram-logo.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:52 UTC	945	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:52 GMT Content-Type: image/jpeg Content-Length: 9739 Connection: close ETag: "e94e30d49b2c58c8ce7bf1a96be1458a" Last-Modified: Tue, 17 Dec 2024 06:25:16 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2364 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Sj1BA9ESD%2FyscXPcVboeFKzHVD1gleIkX11aDApgTf7woLZ13Ekq%2F1WREiL8y69XIVU7buisKeF8Zu3hLAXFhTUcjfHgVbjBO8cRZKK4OHluovJviTq6xXMBXsc%2F8JfoYSoN5H8ux1I%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2ec98544295-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1703&min_rtt=1643&rtt_var=659&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2873&recv_bytes=940&delivery_rate=1777236&cwnd=252&unsent_bytes=0&cid=53b937fcbc8331bd&ts=166&x=0"
2025-01-12 00:14:52 UTC	424	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 dc 00 00 00 64 08 06 00 00 00 ed c3 5e 99 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 04 ee 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 62 30 66 38 62 65 39 2c 20 32 30 32 31 2f 31 32 2f 30 38 2d 31 39 3a 31 31 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 Data Ascii: PNGIHDRd^pHYs+iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:R
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 31 2e 31 2f 22 20 78 6d 6c 6e 73 3a 70 68 6f 74 6f 73 68 6f 70 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 70 68 6f 74 6f 73 68 6f 70 2f 31 2e 30 2f 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 45 76 74 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 45 76 65 6e 74 23 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 32 34 2d 31 32 2d 30 36 54 31 35 3a 30 39 3a 31 35 2b 30 38 Data Ascii: 1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-06T15:09:15+08
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 71 8f f8 cd ee 32 26 5c 8c 28 68 ae e0 df a7 c9 2d 9d 27 fb 71 dd 9d a2 ce ed a0 db 54 69 17 a7 09 9a 2c 2a 44 54 7d 54 60 1c 61 9f 2a 3f c0 cf 3e fa fa c5 95 c7 f9 b2 e4 9a d5 4d 4c b8 18 51 d0 1c 12 3c a2 89 01 46 fa 5b 48 7f 14 d5 cf 03 d7 aa d0 2a 51 da 2f 25 b7 4d a2 a8 82 8a 32 09 fa 12 e2 7c 77 86 e9 9f 1d 62 d5 71 ee 10 af e1 b6 63 c2 c5 88 80 86 45 7a dd ee c3 e9 64 e7 92 eb 12 79 ef 8b 02 b7 01 cb e7 b4 1b fe 55 4e 2e 2b 7d 5f 6a 74 b5 ca f7 fc ba 3a fb ff a7 15 1e f7 dc c4 03 b9 8b 17 f6 34 ea df c5 84 8b 11 05 0d 11 ae f7 5b 67 3a 7a 3b 64 27 2a 77 83 ee 10 c8 cc 2d 11 45 18 2f 15 f3 16 d6 57 98 02 7d 19 91 fb cf 8e e9 a3 67 bf b4 6c 2c 42 63 73 db 8a 09 17 23 02 ea 23 dc ae 5d ce e0 15 ff 79 9d 78 f9 2f 0b fa 39 60 a5 88 38 8b ee a7 d5 0b 8b Data Ascii: q2&\(h-'qTi,DT}T`a?>MLQ<F[HQ/%M2\|wbqcEzdyUN.+}_jt:4[g:z;d'w-E/W}gl,Bcs##]yx/9`8
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 1f 75 b6 ac c8 47 1b 9f da d9 9a ef 73 dc f6 cd 40 a5 1d e2 57 01 9f 05 96 12 9d 30 29 e0 2c f0 14 f0 56 1d f5 8b e1 02 6d 40 37 05 c2 75 62 13 41 8c 45 86 cb 23 7b 53 78 ba 05 91 d5 50 a3 39 b9 c8 48 3a c2 9a f6 04 ef e9 49 f2 be 15 29 ae ec 49 b2 aa 2d 41 d2 91 39 9a ac 1c 7c e0 ec 74 c3 27 e2 01 20 82 80 ae 56 cf df ca ae bd af 00 e5 de 65 b0 0a 78 2f d0 07 4c 14 7d 5e 2a 72 33 bb c4 1f 20 0d 8c 60 66 6b 89 1d 1a 91 e0 03 39 8c b4 21 e1 b2 44 d7 ba 31 9a 00 77 e0 7c 26 a3 1d ba dd 51 59 82 5c fa 9c c9 5a 63 2c 02 b4 25 61 6b 77 92 1b 56 b4 b0 a3 37 c5 86 2e 97 ae 94 33 eb 9b d5 dc a7 c2 89 c9 da ce 07 aa 3a 3e cb b1 5c a2 22 97 0f ac ca 64 28 4f 38 1f 13 6a 8f b9 7e 52 e8 97 15 77 19 fa 7b c5 65 e6 97 8b f1 2e 80 4b 3a dd 25 c8 a0 42 a6 9a 08 97 cc d1 Data Ascii: uGs@W0),Vm@7ubAE#{SxP9H:I)I-A9\|t' Vex/L}^*r3 `fk9!D1w\|&QY\Zc,%akwV7.3:>\"d(O8j~Rw{e.K:%B
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: e6 c9 2d d0 e0 4d d0 78 22 9b 1b 6f a4 22 fa 81 7f 83 69 b8 14 66 16 8d 02 bf 0e ae 34 a6 49 36 61 6b 6b 7d c0 ef 62 9a e0 99 08 fd 24 30 81 fe 14 66 56 29 66 32 9d c4 08 75 14 d3 4c d7 63 02 d6 41 20 40 98 19 38 82 69 a9 1b 81 cb 31 a1 9e c2 7c b6 a7 82 2b 0f 7c 00 33 b9 56 60 42 37 01 bc 82 f9 6f 2f 06 f7 07 05 b2 e4 28 2c 69 2c c7 34 64 7b f0 d9 99 a0 de 29 cc b4 9b c6 cc e9 15 14 7c af 91 e0 f3 75 d8 24 d2 19 b4 db 8e 69 a6 f7 05 75 c2 04 86 70 09 25 17 8c df c5 34 ad 17 94 3b 89 91 b0 37 78 66 f9 e0 bf eb 30 a2 4d 62 cf fe 7c 50 ae af e8 3e 97 01 57 bb 82 ce 35 8b 2a 25 63 94 42 19 b9 75 1d e8 49 3b 5c de 9d e4 83 ab d2 5c b7 22 c5 fa 8e 64 4d 8b d4 c0 ec be b5 a3 63 79 9e 3c 36 c5 8f 0f 4f 71 e8 62 9e 8e a4 c3 1d 1b 5b f9 c3 4d 6d f4 a4 9d aa 9a 71 Data Ascii: -Mx"o"if4I6akk}b$0fV)f2uLcA @8i1\|+\|3V`B7o/(,i,4d{)\|u$iup%4;7xf0Mb\|P>W5*%cBuI;\\"dMcy<6Oqb[Mmq
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 69 c2 40 40 a9 a5 88 f9 0f 24 8b 69 9d 90 c8 0e 26 a8 6f 04 ed 26 e6 d5 f5 31 1f f2 1c 16 a4 c8 05 9f ef 03 fe 01 33 df ae 0f da e9 c7 08 17 ae e5 4d 07 f5 5e 05 1e c1 fc cf 5a 10 8e ab d4 8f b3 1a 0b 50 fc 01 36 21 4d 53 88 5a be 88 f9 9e 03 c0 9d 98 f6 7d db f6 00 ba c0 98 a2 bd 91 6a a9 99 7f 93 79 0b 6e a4 1c a9 39 fa 18 c2 57 cb 6f 7c 6c 78 92 27 8e 4c 32 34 9a 9f cd 06 49 08 6c ec 4c f2 f9 cd ed 7c 64 4d 86 96 44 7d 84 f6 7c f3 07 73 9e ce 8d 99 68 99 bc d0 d9 5b a8 79 2d b2 ee 57 15 d7 80 69 0a 5b 73 c2 35 a9 73 c0 5f 63 9a a4 54 14 28 d4 46 e3 c1 35 5f 43 16 97 a3 e8 f3 8b 98 c9 d6 8b 09 75 0a 23 db ff c4 fc c0 52 70 b0 c9 e0 02 73 cd a9 e2 3e 67 b0 49 22 83 4d ea 63 58 e0 64 0f f0 4f 18 11 9a f1 0c 77 60 e6 6a 98 92 95 0a fa f8 26 b6 7c 32 8e 05 Data Ascii: i@@$i&o&13M^ZP6!MSZ}jyn9Wo\|lx'L24IlL\|dMD}\|sh[y-Wi[s5s_cT(F5_Cu#Rps>gI"McXdOw`j&\|2
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 82 7d 1a 0b a1 5f 85 09 56 9a c2 cc 3d 8e 69 b1 97 b0 20 c7 e8 bc 36 86 b0 3c c3 31 2c 2b 25 83 09 d7 71 8c a8 21 c6 b0 d4 a8 a3 58 88 7f 03 26 bc 2d 98 d0 8f 53 d8 26 b3 07 0b ea 14 ef 5a e8 0c da 0d 17 7d 4f 05 6d 86 da 42 30 e1 ec c2 34 4d 98 29 b3 15 d3 96 3f c2 26 96 31 8c 24 2e 85 45 fd f3 98 d6 2e de 0e 14 22 07 fc 0b b0 1b 33 2d 37 05 fd e5 b0 c9 e7 e7 c1 b3 e9 c1 4c e3 fe 60 2c c7 83 7f 83 11 f4 35 e0 7b c1 f3 f5 82 be 5e 9b f7 8c c0 cc ef d0 74 d6 60 9c cf ce 2b 73 06 9b 7c de a4 90 62 76 d6 55 2f 7f 54 9d e4 10 aa 5b a0 10 af 6c 24 58 51 09 a5 de 94 33 32 e1 f1 ca d9 19 b6 2e 4d d1 1a 71 71 bb 5c 1f e3 39 9f 13 13 79 bc 72 36 6c 84 f1 c1 bc 50 8b aa 22 ce 90 7a d3 47 4b 16 2e 8f 3c 96 ec fb 68 c4 7a 60 82 f3 08 96 0c bc 14 f3 49 92 98 c0 9c a6 Data Ascii: }_V=i 6<1,+%q!X&-S&Z}OmB04M)?&1$.E."3-7L`,5{^t`+s\|bvU/T[l$XQ32.Mqq\9yr6lP"zGK.<hz`I
2025-01-12 00:14:52 UTC	1101	IN	Data Raw: 86 a5 42 a6 54 64 2e 96 d8 34 5a 6b db 8d 8c 4f 44 55 99 46 f5 61 84 af 1d fa c2 86 23 f3 8b c6 1a 2e 46 14 94 dc 87 75 28 33 70 5c 91 07 50 5e 56 d5 b9 ea a2 c6 58 49 45 39 ac 2d 4e 52 74 55 8a 8e 56 69 bb 81 f1 a9 af be a8 be ac c8 03 87 32 03 b1 76 8b d1 30 4a 6f 7c bc 43 bc c3 2a 7b 70 f4 7e 41 4f 36 27 c7 b2 d6 65 81 6a 65 a2 2f 2d d4 35 3e 41 05 3d 89 a3 f7 ab ca 1e ee 90 f8 c5 88 31 1a 46 f9 e3 b0 ee 5a 3f 3d 9a cb 3f aa c8 f7 54 99 2a 2f e4 f5 ad af 95 af 5f 0f 2a f5 5f df f8 54 99 52 e4 7b a3 b9 fc a3 c3 77 c5 cb 00 31 9a 83 8a e7 cf 9d fd d2 96 b1 bc ef de 07 fa 14 0b 52 6f 9a 64 db d5 84 46 88 5c 4b 9b 0b ca 65 41 9e ca fb ee 7d 67 bf b4 e5 5d 9f 50 1b 63 f1 50 f5 c0 c7 23 6f 7e 7b 18 e5 5e 45 9e 06 72 5a 4e 8a 1b 55 74 97 1a 35 8c 2f b8 b7 9c Data Ascii: BTd.4ZkODUFa#.Fu(3p\P^VXIE9-NRtUVi2v0Jo\|C{p~AO6'eje/-5>A=1FZ?=?T/_*_TR{w1RodF\KeA}g]PcP#o~{^ErZNUt5/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49731	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:52 UTC	365	OUT	GET /telegram-16/logo.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:52 UTC	955	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:52 GMT Content-Type: image/jpeg Content-Length: 3393 Connection: close ETag: "941d950538f7ca436158c908c7dec967" Last-Modified: Fri, 06 Dec 2024 01:36:06 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2920 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ig%2FC6tdvfWm4DQ%2FEXvUzeDt6xaN9rtZYK33nxVFqyyy140d9K%2B7KoAVCPDJy4WVArawoEttimH7kplLCZSrG4pdoDaQTl5Hg0ZmZA6gHPO%2FARf16tYyO%2B6ptw5An%2Fb%2BbY7qXRm%2FSndg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2ec9ce243a5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1816&min_rtt=1790&rtt_var=690&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=943&delivery_rate=1631284&cwnd=252&unsent_bytes=0&cid=6c14ef27199d228f&ts=150&x=0"
2025-01-12 00:14:52 UTC	414	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 96 00 00 00 96 08 03 00 00 00 0b df 81 d0 00 00 02 d9 50 4c 54 45 00 00 00 27 a5 e6 26 a6 e5 27 a6 e6 25 a4 e3 22 9f db 25 a2 e0 27 a6 e6 27 a5 e6 2a ab ee 26 a5 e5 29 aa ed 23 a1 de 24 a2 e0 28 a9 eb 24 a2 e0 27 a7 e8 23 a0 dc 23 a2 de 22 9f db 28 a8 ea 24 a3 e1 25 a4 e3 25 a3 e3 22 9e da 29 a9 eb 22 9f da 25 a4 e4 28 a9 eb 23 a0 dc 23 a1 dd 29 ab ee 24 a2 de 28 a8 e9 25 a3 e1 23 a1 de 28 a9 ea 23 a0 dc 2a ab ee 27 a6 e6 22 a0 db 23 a0 dc 29 aa ed 28 a9 ea 22 a0 dc 27 a6 e7 24 a2 e0 29 aa ec 23 a1 dd 26 a6 e6 26 a4 e3 29 aa ed 25 a4 e3 24 a2 e0 2a ab ee 27 a6 e7 29 ab ed 22 9f db 28 a9 eb 24 a1 df 28 a9 eb 23 9f db 28 a8 ea 23 a0 dc 26 a5 e5 22 a0 dc 2a ab ee 22 9f da 29 aa ec 23 a0 dc 29 aa ec 24 Data Ascii: PNGIHDRPLTE'&'%"%''&)#$($'##"($%%")"%(##)$(%#(#'"#)("'$)#&&)%$')"($(#(#&"")#)$
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: a6 e7 29 ab ee 25 a3 e3 22 9f db 2a ab ef 2a ab ef 29 a9 ea 25 a4 e2 29 aa ed ff ff ff 23 a1 de 28 a9 ea 23 a0 dc 24 a1 df 28 a8 e9 28 a7 e8 25 a3 e1 29 aa ec 26 a5 e5 27 a6 e6 25 a4 e2 23 9f db 27 a7 e7 26 a4 e3 28 a8 ea 24 a2 e0 29 aa ed 22 9f da 27 a6 e5 25 a3 e0 27 a6 e7 2a ab ee 27 a5 e5 2a ab ed fc fe ff fe fe ff d5 ee fa f9 fd fe f7 fc fe e9 f6 fc f2 fa fe e3 f3 fc 50 b7 eb 31 a9 e5 f0 f9 fd af de f5 94 d2 f1 43 b1 e9 4c b4 e7 47 b2 e7 2a a7 e5 29 a6 e3 28 a4 e1 f4 fb fe eb f7 fd c7 e8 f8 c3 e6 f8 c0 e5 f7 b9 e3 f7 a7 db f5 a1 d8 f4 7d c9 ee 67 c1 ed 39 ae e9 2a a8 e8 35 ab e6 3e ae e5 2c a6 e1 fb fd ff e6 f5 fc cc ea f9 b5 e1 f6 9b d6 f3 6b c1 ec 5d ba e8 55 b8 e8 31 ab e8 dd f1 fb ab dc f5 97 d5 f3 81 ca ef 78 c7 ef 6e c3 ed 35 ac e8 2d a8 e6 2d Data Ascii: )%"*)%)#(#$((%)&'%#'&($)"'%''P1CLG)(}g9*5>,k]U1xn5--
2025-01-12 00:14:52 UTC	1369	IN	Data Raw: 8d a3 02 b2 3a b1 68 70 9b 41 18 d4 0e 12 0b 3d f2 00 1a 24 55 16 f5 2d f3 9b 63 61 56 49 3c 93 cd d0 34 4c 56 ce 7b be 70 54 bc 31 86 45 43 61 59 7b 24 9e a9 36 78 28 26 2b e4 b3 ed bb 2c 1c ff e6 da 5e 7a 06 e5 0b ec 93 78 c6 3b e1 69 3f 5d 11 bb e9 a7 c3 c0 f5 3f 45 4c 71 da 83 f2 69 4d 34 1e d1 23 78 42 57 c2 9e 76 ef cc 22 0e 6b 1e 3f 4d fb 97 0a 7b e8 a7 31 b5 c3 28 5d 36 7b 2c 19 d4 07 b8 ce ed 28 c4 da 69 fa f0 a4 f0 0e b6 69 5c ef e0 a3 aa 4c 66 db d9 12 f7 e9 cd 3a 92 f6 ab d0 86 75 13 15 d8 55 e1 9a 04 99 aa 2c e1 df 33 1a 06 71 32 46 52 99 d4 86 bb d8 84 43 2a 5c c3 30 45 94 21 ec b1 ae 68 11 a7 4d c7 72 3c 13 4b 59 8b ee dd 57 02 57 17 08 09 6c fe a8 73 91 41 dc 0c 11 d6 9e c9 99 4f 74 a8 98 73 02 97 18 c6 f1 82 b4 d9 76 ba bd a9 46 dc 74 9a Data Ascii: :hpA=$U-caVI<4LV{pT1ECaY{$6x(&+,^zx;i?]?ELqiM4#xBWv"k?M{1(]6{,(ii\Lf:uU,3q2FRC*\0E!hMr<KYWWlsAOtsvFt
2025-01-12 00:14:52 UTC	241	IN	Data Raw: 70 23 a1 74 f7 35 55 fb cc 92 e1 66 e2 2e ac a9 5a 6e 31 b4 11 fb a8 a6 66 ef 4d a1 a5 d9 70 f0 4c 49 52 a8 d0 da d8 ca 9e a9 48 37 12 74 d1 f3 29 04 33 bc 18 3a 1a 07 26 22 3b 0a b9 ba 06 9d 09 f6 8a 68 b0 c1 6a 27 00 09 5f 4a 93 dc 2a d7 52 44 20 03 2b 77 29 22 f2 7e 87 62 84 81 1c 51 1d 9a a8 fb 51 15 f7 22 90 85 e3 c2 44 3f 3b 40 66 61 0b 40 9e 3c 0d 96 a8 f5 a8 3c b0 27 40 87 3c 2b bd 76 c3 72 ab 27 03 45 42 fc 94 3f 1a 37 75 3a 98 c3 a9 2c 02 6d 93 e8 29 74 1b 2e 33 b2 70 bd 95 80 0d 51 89 36 eb 30 45 57 32 3d 86 eb c5 6e 86 81 25 49 b5 8f ba 6f 1a 67 2a 99 be 7e 8c 54 0d 38 c0 b2 36 52 23 4b 5f 79 79 6a bc ce 49 73 6f a5 5b 91 3a d2 26 5d 32 bd 00 eb 13 09 6b 92 46 df c2 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: p#t5Uf.Zn1fMpLIRH7t)3:&";hj'_JRD +w)"~bQQ"D?;@fa@<<'@<+vr'EB?7u:,m)t.3pQ60EW2=n%Iog~T86R#K_yyjIso[:&]2kFIENDB`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49732	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:53 UTC	604	OUT	GET /telegram-16/phone.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:53 UTC	948	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:53 GMT Content-Type: image/jpeg Content-Length: 687893 Connection: close ETag: "7ea114f508dd0209331bff9f4f8f2bba" Last-Modified: Fri, 06 Dec 2024 01:40:29 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2920 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3PRX%2FDViW9pYXeiO83sK84gBDymefTVBNhKRtx%2BzrgWI8aSk7CKIVrAjkcD3nH2igHlYeLpIcqetu3WB40mRtmsWTgZOKkBMGY3XTFjcuPhVp8AlIl4sjL3LH8mXL7wYq7ZI9R%2FaMjw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2efe8c803d5-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1769&min_rtt=1763&rtt_var=675&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2873&recv_bytes=1182&delivery_rate=1606160&cwnd=228&unsent_bytes=0&cid=60338b0b37943c1c&ts=274&x=0"
2025-01-12 00:14:53 UTC	421	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0a 68 00 00 0a b8 08 03 00 00 00 7e 23 5e 76 00 00 02 8b 50 4c 54 45 00 00 00 76 76 76 71 71 71 6d 6d 6d 67 67 67 5e 5e 5e 63 63 63 47 47 49 54 53 54 ff ff ff 6d 6d 6d ff ff ff 84 84 83 ff ff ff 7c 7c 7c 87 87 87 ff ff ff ff ff ff ff ff ff 9a 9a 9a 92 91 91 ff ff ff ff ff ff 77 77 75 e4 e4 e4 c9 c9 c9 fe fe fe f2 f2 f2 e5 ee f7 18 18 18 bc d3 f7 c0 c7 f7 c0 da f5 c4 bc f6 b4 dc f8 d0 d0 d0 e6 e6 e6 cb d6 f0 f7 c0 db de de de f0 c6 e2 08 07 08 b5 d1 ee b4 b4 b4 dd d0 ea d5 d5 d5 c6 c5 c5 bd bd bd d4 d3 ed 99 9a 9a a6 c9 e6 e7 ca e5 a8 bc dc 25 24 24 ba c9 f0 be b6 ed a3 b7 d5 2e 2e 2e 90 91 90 39 84 f7 ad c4 e2 63 b0 e0 c0 d2 ea 00 7f db a9 aa ab 3d 3d 3d b3 ae e0 03 89 db a3 a4 a4 a7 a2 d3 5d cb 90 34 Data Ascii: PNGIHDRh~#^vPLTEvvvqqqmmmggg^^^cccGGITSTmmm\|\|\|wwu%$$...9c===]4
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: e5 d0 c1 b9 5a c4 d8 8b 75 6a b9 b3 c9 81 cc df e6 d5 d6 d0 d5 df b0 d1 dc 67 56 53 a4 cc d7 cd bf d6 81 6b 62 5d a0 f3 5a 64 75 c1 d4 de d4 ba a9 7c 54 41 a6 b4 c8 8c 61 4b 70 47 36 cc e3 f8 4a 91 e0 5e 4c 44 e2 c4 ac 59 40 31 ae 9c 90 99 6e 58 f3 d6 e7 77 61 57 9c 7d 71 98 a7 bc ae 7c 5c 91 83 79 bf ca d3 fb 4d 62 9a 94 87 bd 84 65 25 6a b9 47 35 28 3a 7f d0 59 77 3b 74 b2 cc bb ab a0 4b 91 f6 72 aa 62 c0 91 73 a6 8a 7e 68 8e 5e e4 d0 bf 70 ac f7 39 24 19 8f df fa cf 98 7c 16 5a a7 f8 7f 8f 61 9f ba aa 6d 49 d0 a7 8f 46 5e 2c 79 92 b0 8c 80 95 c7 33 06 47 77 b2 58 93 48 4b 8f 9c fd d7 b3 f9 a2 ad 77 57 c4 c6 e3 ce e8 b6 93 9f c5 9c 64 75 95 89 b9 7f 6d 9a 84 37 5b 89 49 c8 fb 2b 3c 5f b5 d4 b4 5e 4c 9e 69 31 18 6f d5 fb fa e4 cd f3 a7 6e f7 7d 23 94 7d Data Ascii: ZujgVSkb]Zdu\|TAaKpG6J^LDY@1nXwaW}q\|\yMbe%jG5(:Yw;tKrbs~h^p9$\|ZamIF^,y3GwXHKwWdum7[I+<_^Li1on}#}
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: 58 19 48 06 1e a4 03 c1 d2 44 93 33 4e 9f 30 39 19 09 2c 4a 56 4b b9 f3 d5 f7 68 c9 dc 4c e6 c6 f6 69 b9 27 17 9b fe 7a 50 b9 8b e2 b9 2b 2e b2 b7 af 6c 93 b6 09 02 33 82 1c 31 8a 49 73 4e 55 fa 27 e0 c7 4a a7 c1 bb 36 70 27 28 88 5e 05 ce aa aa aa ea 6d 24 d7 93 2e dc 1f 19 7e 87 0e b9 5e db d0 4b 01 56 ae 91 08 d3 0a a0 18 2e 05 88 c4 11 00 b9 84 8f c2 da 36 6f 2b d9 77 4d 2b 75 31 f5 4c b2 e3 ad 90 0a 0c 4f ca 04 de 85 30 64 70 06 72 db c8 d9 0b 60 48 fc 71 79 1a af 41 1b cb 0a 48 0b 62 0d 78 bb 1f fe ca 7f 84 a9 81 cc aa aa aa ea 3d a5 d9 86 a0 d8 cc 97 42 45 ea 8a 52 76 93 21 3d 58 06 24 ae 28 0f 8a 14 2b 9b ef 0e d0 12 38 e3 eb 7d 00 38 31 69 7d 70 62 7b f6 95 c2 5d e0 db 37 0c 3a b4 09 4b 82 b4 01 7f 00 af 4c b5 99 34 51 e1 79 98 3a 5b 6c be 68 8d Data Ascii: XHD3N09,JVKhLi'zP+.l31IsNU'J6p'(^m$.~^KV.6o+wM+u1LO0dpr`HqyAHbx=BERv!=X$(+8}81i}pb{]7:KL4Qy:[lh
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: 83 c3 ed 1c 61 cc 14 e6 21 a7 10 2e 37 0e 89 f6 2c 50 a4 cd 83 30 dc 86 61 da 25 33 bf 11 5e b3 5b 21 bd cf ff 25 f3 26 21 fe ad a8 06 35 ab aa aa aa ef 17 5e a9 bd da 6d c4 16 9f 08 8f cf 7f 6a 4e 0c 23 0e 2d 83 0b be d2 e6 17 82 a1 87 d3 e2 03 cc 47 50 09 77 20 c2 40 c0 f4 27 60 ca 33 37 40 e4 04 38 6e 33 66 62 bd 87 22 9a 6e 70 8e bf 20 5a 7d 02 0e a1 05 01 5c 3a af 8b 8b b2 83 6d 4c 61 03 53 84 4d 6e 68 c3 3d 2a ce 37 14 32 ab aa aa aa e7 2a fe f2 e1 9e 1f 6c c9 ce 65 64 40 94 4c 9b 76 06 60 c3 11 c2 7c 6c d9 1d f7 38 db cb 94 34 0d 5e 7c b3 f8 20 42 f1 8c b6 10 bc 56 83 65 df 3e 8e a7 22 24 4e c9 73 6a 46 bb cf b1 d8 bc d2 5b e8 26 9a c6 1f ad 5b 99 36 99 a1 50 ef d4 ac aa aa aa be 57 32 77 3a 09 4e e2 44 f3 c1 32 bf 68 85 59 dc 0d 1e a7 c0 65 70 0c Data Ascii: a!.7,P0a%3^[!%&!5^mjN#-GPw @'`37@8n3fb"np Z}\:mLaSMnh=72led@Lv`\|l84^\| BVe>"$NsjF[&[6PW2w:ND2hYep
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: 14 45 51 f4 4a e9 8c 13 7f 37 d3 0f 75 7c 35 5d d6 fb 98 bd 5b e4 e9 71 86 7e 69 e4 52 11 17 3a 6f 49 dd 2e 26 de 4c dd a3 e6 3c c7 f6 00 98 03 cc 14 e0 28 f6 d3 9c d8 64 59 f4 e8 89 ca 9c 68 64 a3 d5 3f 51 55 8c b9 a4 71 2f 69 ae c5 58 55 3b 19 33 fd c6 1d 1f 2d 65 d4 5c a0 b6 0e 4a 6b bb 7e 2f 56 cf df 27 cd 79 3b 50 a2 99 51 14 45 d1 0b 8f 67 37 65 16 a1 4c c5 46 ee 49 30 e9 90 22 6e 91 e5 e5 88 a6 3a 63 a8 a2 4c 87 fb 69 46 a1 02 26 9e ee 31 a9 93 ab 40 0b 05 4e 7b a9 b5 41 44 87 0a 45 b2 54 0e 53 f2 e2 3a 17 aa 0c 71 9c 43 83 34 52 ac ef c3 ef f6 b5 ba 3f 6b cd eb fe 85 2b 60 53 5f ea 2d f5 c0 d8 5f 5a 40 d7 d1 ed f9 aa 66 14 45 51 74 4b e3 18 cd 34 65 92 fc a8 c8 db 60 59 2c 63 e3 2f d1 ea 15 27 16 9a 8e aa 2f 0a 0a 56 ea 61 38 b8 6a 21 d8 3f d8 79 Data Ascii: EQJ7u\|5][q~iR:oI.&L<(dYhd?QUq/iXU;3-e\Jk~/V'y;PQEg7eLFI0"n:cLiF&1@N{ADETS:qC4R?k+`S_-_Z@fEQtK4e`Y,c/'/Va8j!?y
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: 8a a2 e8 e9 a3 26 07 a1 4d 18 b3 fd 5a 26 6c 09 5f 9a 31 af 32 a5 8f 15 14 69 c2 26 f7 f6 86 88 f2 a8 92 4c 68 73 93 e6 a0 ab 26 02 b8 ea f5 5e fc 02 c2 3a 3b 66 87 13 4b d8 56 bc 68 2d 48 48 dc 88 9f 91 4c e6 b9 d4 b9 20 3d 33 a1 67 f8 76 5a 50 f3 dd af 38 f4 1b c7 bc 19 0f da 34 65 f2 4f 81 76 a1 1f 29 73 24 a8 19 45 51 14 2d 1a 2b 70 72 d9 12 99 12 11 07 f1 c1 eb 67 8f 27 02 1d 79 bd 97 44 85 f2 19 f7 c8 42 3f 37 c8 3b 57 14 88 f3 da 2e 4e 7a 20 66 01 2d b5 6e da 61 a6 50 0c 47 83 99 00 ae 22 7e 48 1c 27 ec 73 2f fb ad 8f e2 61 f0 d2 6f 9f 8f 2d fa a4 24 e8 b4 b4 0f bd 40 4d 54 6c 0b 7a 3f a2 39 12 d3 fc c5 de 99 28 b7 0d c3 50 30 6a d3 fc ff 27 77 a8 a2 5d 8a 6b 14 b6 c7 cd a4 12 1e 29 12 3c 24 cb e9 b5 05 af 56 ab d5 6a 0d e9 34 f3 30 0d 99 c8 98 69 Data Ascii: &MZ&l_12i&Lhs&^:;fKVh-HHL =3gvZP84eOv)s$EQ-+prg'yDB?7;W.Nz f-naPG"~H's/ao-$@MTlz?9(P0j'w]k)<$Vj40i
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: fc 4f b6 59 b3 d5 6a b5 2e 24 86 b6 e4 ce 5c 3c 15 de 36 13 cc dc 0a ca 2c c7 c9 f3 75 b6 91 94 d0 06 03 ba 53 13 dd 95 f5 71 30 31 c6 85 4d 86 35 c2 ef 04 93 ec 5f 85 88 8f 29 7e fb 6b b6 08 be 4d cb fb 1e 31 90 2e d8 64 49 90 c7 cf 59 73 ae 41 74 c6 4b 9a 31 5b ad 56 eb ba 02 33 21 cd 7a d7 cc 88 82 4c af fb a9 01 b3 00 4b 8d 03 37 32 7e 82 32 de 31 a1 3d 1b c1 b6 97 11 1c 49 fe f0 a5 b7 5f 85 64 bd 7d c9 05 a8 4b 24 d1 3d 8e 74 78 1e 3d 41 cd db 9b 22 59 f6 6a da af c9 1f f8 79 5d 90 04 60 7a aa 66 ef da de 6a b5 5a 57 12 4e 4c e2 1c 46 cc 7c 99 70 66 be 53 66 84 3b 18 53 8b 71 76 85 79 42 9c fc 70 01 1a 21 da f3 e6 8a b8 6b 86 be 97 87 a2 e9 59 ce 34 5b e5 91 fc ae 40 52 77 74 9f c8 f6 17 23 9d da 22 1f e6 30 c8 b0 88 a3 97 6a b9 55 2d d5 cf 79 ae 2b Data Ascii: OYj.$\<6,uSq01M5_)~kM1.dIYsAtK1[V3!zLK72~21=I_d}K$=tx=A"Yjy]`zfjZWNLF\|pfSf;SqvyBp!kY4[@Rwt#"0jU-y+
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: c6 99 72 97 99 36 33 13 48 63 ea 96 a8 cc df 5b e8 8d 10 74 53 bb c9 06 57 28 d4 c3 bd 97 97 51 76 21 45 70 5d e2 8a 27 57 80 54 c8 c2 a9 4e d5 92 6b 3c 43 4c 44 18 4d 27 f3 72 49 19 71 bb 17 5e 9e fd 09 ea 8e 6b 4e ff 95 14 de bd a0 09 bd dd dd 9b f3 07 e9 c9 de cf 33 94 ba 4d d2 bb 8e ef 47 1f 06 93 c3 2a 7b 48 d7 06 a1 35 93 3d dc e5 ae 35 f1 89 be 1c 6a e9 79 51 14 c5 a3 64 08 b7 7c a6 2e 60 76 26 9b b3 0f 49 36 73 8c cf ca 04 db 95 72 31 71 19 50 4e 14 82 7a bc 69 85 b8 86 72 85 e3 4a 8f 2e 4a 14 4e f1 b9 e4 a2 47 15 53 3e 74 9e ee bc 28 73 8a 2e d9 64 e9 0b 04 6f f2 5f 48 9c 96 c5 04 ab f9 22 a7 a5 3e cd 17 ff 84 4c a6 53 38 cc d9 64 93 d9 31 93 53 2a 8f 4f d6 44 64 ce a5 26 86 ce 74 a9 e9 59 cd 52 98 45 51 14 8f 8c 5f 6c d2 4e 46 b3 07 f1 14 ad 99 Data Ascii: r63Hc[tSW(Qv!Ep]'WTNk<CLDM'rIq^kN3MG{H5=5jyQd\|.`v&I6sr1qPNzirJ.JNGS>t(s.do_H">LS8d1SODd&tYREQ_lNF
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: 0a d8 b3 b9 27 f8 c2 c7 9a d0 bc 0d 39 18 34 5d 78 8d dc 6d fe 7b ec bb d0 ec 32 13 50 9c c8 cd eb 3e 90 ae ad dd 7d 11 7a ba 8d bb 4b 4d 3f 29 48 7f 6b d8 7e 9a e0 cb cf e5 b5 08 bd 28 8a 62 f5 1c d1 98 0b 2a d3 27 67 fa b6 99 11 e7 27 ff 08 54 66 10 1a 73 df 35 66 28 cc 0f 23 ba d6 bc 93 99 ff 02 a4 d8 32 53 41 96 0b 36 1e 94 63 d4 a6 ad 14 0e 15 4c 61 ec 9e d1 9c 77 51 0d 93 f3 42 35 d2 4c a5 db 8a 52 a2 09 3b 6f 69 86 6a e4 52 b4 81 7d ba 5c 1c e6 aa 72 7e c3 70 a1 5a 0c 7b c3 f5 6e 9a 5d e5 63 39 87 94 a6 74 e6 17 f8 1a 16 7c ff 1a 72 f3 6e 2c fd cd 6b be 39 81 d9 9a 30 19 40 f7 2d 35 db 6d 8a 6b 4d 60 7f 0b 1b 30 af a3 81 8a a2 28 d6 cc 80 d4 1c 5b be da 5c 2e 10 99 be 6d 26 28 91 39 4b 66 46 e8 89 cc b7 bb a6 5d b6 68 4c 54 e6 4c 63 ae 5e e0 20 61 Data Ascii: '94]xm{2P>}zKM?)Hk~(b*'g'Tfs5f(#2SA6cLawQB5LR;oijR}\r~pZ{n]c9t\|rn,k90@-5mkM`0([\.m&(9KfF]hLTLc^ a
2025-01-12 00:14:53 UTC	1369	IN	Data Raw: 7b 5a 33 d9 c1 1d 7c 4f 4d d9 7c f5 79 5c a6 31 f3 11 f4 46 2d 07 2a 8a a2 58 21 83 ad 36 8f 9b 29 4d 4f 66 f6 80 ca 24 9b c9 ec 4c e8 67 ff ec 3e 6f 19 32 9f aa cc 6d a3 55 2a 89 99 73 a5 8b fa 3d 6a 30 97 5d de b1 3c 9b 92 d2 f9 0a ec c1 8f f7 ff 75 da e8 36 0b db ee 4f 68 92 0d 66 28 bd fd 50 d7 31 90 3e 39 3e 28 1c a9 e9 1b b9 3f 9f 66 35 e5 e9 a1 94 30 a4 9b 1d 91 d1 f4 39 9a 43 0d 9e ff 60 ef fc 79 d3 08 82 28 9e 23 7f a0 b0 92 22 69 53 25 52 84 10 20 8a 2b 4c 05 92 0b 24 17 d7 50 a7 a1 f3 07 f0 e7 cf bc e5 45 ef f6 86 cd 25 98 d8 47 32 bf 99 dd bd db 23 0e ce 1f f1 3c 3b 3b 1b 04 41 30 78 94 96 e9 95 a6 af d1 ae 53 8a 13 5c 06 eb ae 9a 1b e8 bc ca e4 36 f3 9f c1 cc af 5f bf 5a 67 32 53 2b e6 10 99 2a a3 99 6f cc 48 1d 99 5f 4f f6 61 30 a4 3f f7 b9 Data Ascii: {Z3\|OM\|y\1F-X!6)MOf$Lg>o2mUs=j0]<u6Ohf(P1>9>(?f509C`y(#"iS%R +L$PE%G2#<;;A0xS\6_Zg2S+*oH_Oa0?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49733	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:53 UTC	608	OUT	GET /telegram-16/td_laptop.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:54 UTC	942	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:54 GMT Content-Type: image/jpeg Content-Length: 53316 Connection: close ETag: "f4ebbd76b086c583a0271b487fe34b85" Last-Modified: Fri, 06 Dec 2024 01:36:06 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tn1KT%2Bha78aEEadKfLn%2FUAscKYgzq6Fk%2BT3etB8S697lW10lacj%2BSBP1QbvkCU8MOsyav%2F1NSxjXc4yMW2kxREA1aidm%2FsWxR9lJn96tZ8klRu9Imwjehcdzvjx9ji9m0UiAuia1VdQ%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2efefe0c44a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1517&min_rtt=1489&rtt_var=615&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2872&recv_bytes=1186&delivery_rate=1700640&cwnd=228&unsent_bytes=0&cid=bc8100aece891a98&ts=884&x=0"
2025-01-12 00:14:54 UTC	427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 48 00 00 01 e7 08 03 00 00 00 b5 ec 8d fb 00 00 02 fd 50 4c 54 45 00 00 00 00 00 00 cd cd cd 12 12 12 a6 a4 a3 36 36 36 d6 d6 d6 15 15 15 8b 8b 8b 41 41 41 ff ff ff d6 d6 d6 41 41 41 02 02 02 30 99 da 1e 87 c7 f0 ff de 20 8a ca 26 8e ce f2 f2 f2 2c 95 d6 29 92 d2 3a 9e db 2f 2f 2f 39 38 38 0e 0e 0d 17 16 17 f7 f8 f8 27 27 27 1f 1f 1f ed ed ed df dc b3 f4 ff e2 e4 e0 b7 dc d8 af 98 98 98 d8 d6 ad ed fa d8 9c af 85 18 80 c0 99 ab 81 bb c5 97 95 a8 80 30 8a bd 66 66 66 92 ac 80 bf c8 9a 90 a6 7e b1 bc 8f 8d ab 7e 72 9d 77 b5 bd 97 b8 c2 96 6b 9b 75 6a 97 6f 71 a0 7c b6 c0 92 89 ac 83 71 9c 71 8b a5 7b 8c a1 80 f8 f0 dd dc e5 eb e2 e1 df 7e a5 7b fa ff e7 83 a9 82 d2 d3 a8 ac bb 8f 79 a2 76 a4 af 88 ed Data Ascii: PNGIHDRHPLTE666AAAAAA0 &,):///988'''0fff~~rwkujoq\|qq{~{yv
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 79 e2 f7 d7 97 a7 b5 b4 bb c6 7a 98 77 73 7e 86 47 46 46 b3 c5 b4 87 9d b0 94 92 92 da f0 ce 65 7b 8e 71 b8 e4 91 a9 c1 c2 ea bc dc d8 c2 c6 e2 f4 88 84 84 7e a5 89 d8 ea f7 56 7a 94 8d 8c 8c 69 73 7c 6c 5e 56 48 7d a4 b0 d7 f0 80 7f 7f 9b cd eb 8b 95 9f 6b 8d a8 9c a0 a0 88 6e 6a cb c2 bb bd d1 b1 ea f3 cd cc d1 b1 fe fd f2 a9 d7 a3 ac b9 a2 7c 92 a7 8c ac 92 77 65 64 69 a6 6c 9e b5 a3 5e 68 75 9c 88 80 da e6 c5 ee dc a4 78 84 95 bd e4 ac fb ba 97 87 7e 6e cc db c3 77 ad 6f 3c 74 9a d9 be b3 c3 d0 dc c3 87 73 de ab 99 97 7a 74 44 99 cc c6 b5 ab aa 96 8e 94 d6 89 b0 8a 7d b1 a8 8c ad 7d 6e ea bc ab 80 90 90 78 73 5a 4f 8a 60 fb ca a6 e5 9b 85 fa a9 82 67 53 44 d2 93 7d e9 d3 c7 92 8e 72 bc a7 9f fc db b9 a2 9a 7d 30 43 69 bd d4 c4 23 6a 9e 57 3e 37 4b 55 Data Ascii: yzws~GFFe{q~Vzis\|l^VH}knj\|wedil^hux~nwo<tsztD}}nxsZO`gSD}r}0Ci#jW>7KU
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 06 a4 bb bb 3e 88 1a 3f 6f 3c 8f a2 8b 9f ba dd 27 61 37 ec 45 03 7f 10 75 fb 9d bb 40 cb 3c fd a3 0b 0a 69 96 25 8d 3a 81 89 7b a4 82 bc 47 c2 1f 35 c7 81 95 e2 48 f8 32 5a ce d9 99 e3 3d d2 d5 83 98 ef 40 af 9c 9f 10 d2 ef fd 98 0f 65 7f 28 af 75 77 df 7f fd fc 7a 3b ac 85 ef a3 ae ff e9 51 ff 49 7d c5 6d b9 b5 8b cf 6e 7d ba 57 f6 d9 cf e5 48 ab b3 be 13 83 3d aa 4a 09 cc 5c 2f ed a4 1b 45 21 c9 86 34 e1 40 f2 b9 10 92 e4 48 eb aa 23 39 94 53 e6 9d d2 5a d7 e8 7e 3d d5 db 7e da 7a ba b2 fd 08 1e de db de bd 1d 85 9d 66 1f 76 76 1f 7e 85 b2 4f 7f 5e 21 a5 6d 8a a4 3e a1 6a 15 ea 77 36 58 69 5a ea a4 18 12 3a 92 74 3e 76 a4 f5 03 c1 17 e0 c3 2b bf 84 8e f6 2e 51 8e bd 2f 78 09 62 5c d6 c5 8d a8 6b af 76 7f dc eb 3d d9 b9 b1 f3 a4 7f a3 d7 ef 72 21 3d 6c Data Ascii: >?o<'a7Eu@<i%:{G5H2Z=@e(uwz;QI}mn}WH=J\/E!4@H#9SZ~=~zfvv~O^!m>jw6XiZ:t>v+.Q/xb\kv=r!=l
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 29 27 9e 3b d0 17 71 a6 81 20 2e 2c e3 ab 8c 34 fe 95 dc de ab 76 9d 3e 71 5c 69 24 96 a4 1d 52 0c 8d d4 22 32 01 85 86 8c 9f 33 c1 79 a3 a9 ac 19 b6 5b d9 dd 33 92 d2 85 26 9e d9 3c 0a 27 1f fa 94 ab 8d 84 9c f6 bd b4 73 e8 13 a9 f9 4c 58 d0 43 03 96 54 ed 38 c4 9c 19 36 02 9e d8 35 52 ad 2c d1 56 19 12 69 93 1b ab 6a a2 e1 1e 8f 0b 93 21 99 82 cb ec 27 23 2d 3a ab a0 8d 16 76 bb bf 46 c2 2f 61 d1 4a ad 91 20 ba 6e 7e fe 0f 77 36 e8 4b 1d 99 a2 ac 2f b9 d2 91 2e 95 29 f3 d2 94 86 78 56 80 46 5a 74 6e e1 a6 d5 26 8e f0 0b 59 4c 77 00 8b 0d 83 54 1a 4d dd f9 32 23 cd fb 68 cb 9a 9d 6b 24 a3 20 ac 05 1f a9 db 41 a2 fa b5 88 bc 92 1e 93 48 ce 39 e4 ce 81 f1 d2 ee 00 46 ea 39 75 0d 77 36 b4 0d ba 99 b7 0c c3 e2 4d ab 0d dc 8d ed ff 38 d2 31 52 5d e6 ca 16 96 Data Ascii: )';q .,4v>q\i$R"23y[3&<'sLXCT865R,Vij!'#-:vF/aJ n~w6K/.)xVFZtn&YLwTM2#hk$ AH9F9uw6M81R]
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 31 72 a7 2e 84 f9 bf 4d fc 84 38 e2 a3 95 99 12 49 f2 43 04 a1 13 92 19 9c 04 89 7a ec b5 d1 8a 41 bb 5d a4 7a b8 37 b9 9d cf db 96 c5 11 0b 40 12 ef b5 78 f3 63 5e 6d 7c ec b9 39 2d e5 ba 94 ce 55 3f 39 9d 9e 9e 9e b6 2e cb 77 e5 3b f2 a7 61 ab c0 49 fa 0e 28 09 9e c8 86 7a 77 d2 a2 dc b5 0c e9 cd a0 7f 71 a4 d7 4f ed 88 b7 55 47 52 12 9b 9b 04 52 a7 d2 29 a4 52 e3 d4 58 53 9f 87 42 20 35 7c b9 b6 e5 7a de 68 bc 91 9a 4d 74 1b dc b8 af c2 3a 86 2b 49 1d f1 26 24 ba ec cf ad b6 3f 23 02 30 10 27 c9 ef ad 5c 11 ad 98 3c e1 2c a8 6d 98 45 a6 14 2d 22 88 9f 25 38 22 80 68 88 bd 8b 77 86 2c fd b6 df ef 3b d5 66 b5 f9 d9 8d d3 aa 5e 9e 76 bb 9f 0d 9b 55 38 53 77 a3 95 96 89 1e 61 74 79 f5 e3 15 3a 58 91 04 49 10 f1 97 4c e6 4d 54 d1 a3 bc 80 f4 47 20 bd f1 78 Data Ascii: 1r.M8ICzA]z7@xc^m\|9-U?9.w;aI(zwqOUGRR)RXSB 5\|zhMt:+I&$?#0'\<,mE-"%8"hw,;f^vU8Swaty:XILMTG x
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 83 d4 a9 81 1c 52 2e b1 bd bd 93 36 76 12 3a 40 8a 31 27 96 4d 57 35 ad 55 31 13 c9 f4 30 5b c9 2a 11 b0 66 66 2a e3 82 93 8d 6e 54 ab 26 25 81 59 3d 5f 71 14 bd 5b ae 47 b6 5e c7 90 92 6a 56 51 b7 4c 35 93 51 74 02 09 6f 86 5c af 9b 5d 80 f4 3d 12 3b 02 69 99 23 89 52 00 92 54 08 21 d4 30 40 a1 45 ba 83 85 7c 54 50 a1 80 24 be 87 8f 21 01 1a 55 53 d9 df fb e6 2b ba 49 fb cd 85 49 18 5e 7c fc 0d 46 ba 65 cc 2f 26 37 c3 d9 35 13 eb e2 40 09 14 41 c7 2e a5 a2 8d 65 b9 1e 34 1d 35 1a 67 25 90 34 68 70 98 16 be e4 09 90 a0 90 01 49 18 56 fd 29 00 6c 15 b2 15 3f 0a b8 f4 9b ff 81 23 fd 0e 48 6f 3c be 72 17 be 8f 94 dc dd 8d 46 c6 8e 92 cd 6e c5 37 76 6a e5 0e 16 1b fa 43 02 29 96 f3 13 bb 58 a5 d2 e9 68 05 4a ee 92 ad 66 2b af 66 9b e9 0d 2d dd 72 e2 ac 9c 4b Data Ascii: R.6v:@1'MW5U10[ffnT&%Y=_q[G^jVQL5Qto\]=;i#RT!0@E\|TP$!US+II^\|Fe/&75@A.e45g%4hpIV)l?#Ho<rFn7vjC)XhJf+f-rK
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: f5 f0 1c d0 99 47 ff 54 82 84 40 72 3d db c3 0e da b0 2f 2c c0 44 20 85 30 92 10 41 92 0e 14 3f 08 33 15 76 a5 30 64 eb 2c 7f 47 25 46 d1 e7 e0 48 f2 a6 ac e8 d7 9f 23 e9 89 68 a2 56 dd 4c 0c 9b 95 58 54 80 54 26 4f aa 15 12 69 f5 c9 eb 6d 64 76 a4 7b 09 92 64 89 cb 5d 11 32 3b 0f 28 79 a2 78 9e 0d 09 8e 84 53 58 80 88 ca 01 8a 40 49 50 84 cd 04 49 26 71 42 f9 9b 10 7c 29 24 1c a7 02 8e 4c 13 cd 92 2c 2e 9b 24 82 23 6f e4 d5 53 4e f5 ee f2 14 8f 7b 5f 9e b9 64 3f bd de 94 80 6a f0 49 12 5c 8a 1b 53 98 22 e9 48 52 21 03 92 5c 49 c9 b1 64 26 14 85 cf ff ef 3b d2 2f d4 9d cb ea d3 40 14 c6 21 64 35 b1 1b a3 56 1b 1b d0 b8 70 51 7c 85 2e 5c 58 74 11 10 49 20 58 c5 95 f5 42 bc e0 35 a0 88 50 31 44 d1 62 5b b4 8d c1 95 dd 54 08 28 0a 42 05 b1 6e 5c 88 0f e0 0b Data Ascii: GT@r=/,D 0A?3v0d,G%FH#hVLXTT&Oimdv{d]2;(yxSX@IPI&qB\|)$L,.$#oSN{_d?jI\S"HR!\Id&;/@!d5VpQ\|.\XtI XB5P1Db[T(Bn\
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 1d 64 3f 38 f2 e6 fd 6b 05 52 d2 2f 29 49 f2 5c c1 94 a6 c9 3c 4f 8e e5 d0 64 3e 29 4b 4d f0 ca 52 93 b0 88 16 f2 a5 43 91 47 28 85 8c 92 a4 a6 8c 11 97 33 d5 81 14 42 e0 08 30 5e 8c 0e a1 f6 dc 47 33 5c 04 ab 3b 71 0f 7f a8 ce 5c e8 75 2f 9c 9f 76 47 dd 38 8e e1 4f 69 0a 90 72 04 27 dc 8a 96 04 28 29 88 64 25 6b 80 a4 98 90 7e a2 ca 1f 62 54 e2 06 7d 49 cc 94 5c a1 36 f3 95 77 2d 3d b5 43 fe 1f 87 bf bf dc 59 d4 ec 48 2b 17 4b 06 89 a4 9f 1f 78 9e be b6 b6 be 52 ab e3 fc 11 dd 09 e5 84 cd cf dd df b7 ef 96 10 78 3e eb de 5b 16 ea 31 66 75 b7 f6 8e 31 b5 b3 e9 5a 72 b3 45 3d 0d 83 aa b6 6f d8 2d 5f b3 2c bf 49 a4 34 e1 1e be 2d b0 a6 25 41 6a 5b 40 8e de 96 7e d2 b4 ac b6 b0 7d 60 68 58 96 21 16 06 c9 70 4d bf 5d bc 30 77 ed d9 f8 e6 f5 eb 37 6f ee f7 13 Data Ascii: d?8kR/)I\<Od>)KMRCG(3B0^G3\;q\u/vG8Oir'()d%k~bT}I\6w-=CYH+KxRx>[1fu1ZrE=o-_,I4-%Aj[@~}`hX!pM]0w7o
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 35 3f e9 69 91 4e 20 52 1c 07 22 93 c3 2a d5 2e a9 10 45 f8 3b 78 82 36 09 e6 34 f0 93 74 fe ab 24 51 59 05 21 aa b2 9a 95 33 52 89 5d 9a a0 ad c1 84 8a c0 1e 61 46 bd 2a f2 a2 c8 00 0c 4a a0 92 9e 85 14 47 d1 a7 4f 96 e3 84 21 5d 71 92 24 68 fb 16 85 9d 49 c4 12 69 7c 63 91 20 aa 88 11 62 10 3d 32 39 c4 4d 56 f3 fa 66 bf 59 7b e1 44 3a ec bb 76 bf 4c 24 8e 1b e9 ed 8d 4c 59 a4 af 6f 8e 9f f7 c3 1e 0a f7 07 af c4 c0 8a ad c0 0a 6c 14 54 a2 02 da 25 60 5c 02 7e 67 40 e5 28 ed 52 42 e5 27 4c 16 e1 a4 8f 8a aa 00 55 a5 25 a2 61 c2 b0 42 c6 25 d6 09 0b 98 cd 36 4d 17 8b ef 8b aa 2a 08 78 14 45 59 a4 12 e8 89 99 ed d0 01 39 44 e0 40 7a c0 87 a9 48 fb 1a 47 08 1c bc 2d 0b ef 2f 46 59 56 3c da 17 a9 f5 90 83 86 c7 86 f6 1a 36 4a 56 1b bf 78 c3 91 74 b9 13 e9 5e Data Ascii: 5?iN R".E;x64t$QY!3R]aFJGO!]q$hIi\|c b=29MVfY{D:vL$LYolT%`\~g@(RB'LU%aB%6M*xEY9D@zHG-/FYV<6JVxt^
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 93 32 dd d1 69 83 5a 6a 39 e6 15 df 84 ad ca d4 74 49 44 12 bc 49 9a 46 ea 91 fc d9 a2 be 6d 6b 2b 3b ac 12 95 8d a3 4d a2 49 39 81 43 40 44 9a 0c 50 5e 21 c7 70 5c 17 89 3e 48 e9 39 a1 3e 2a 98 fa 42 9c 84 7a 97 2a d5 f7 48 a8 d3 e1 14 bb ee e6 25 d0 68 da 9f 44 72 27 fd ba 28 b6 f4 e2 8c 44 a2 47 35 5e 71 42 17 5d 53 e8 69 62 2f f3 c0 5f a3 41 80 43 80 46 25 e7 e5 51 d4 cd 0f 8a 4e 84 cf 68 8a 2c 89 4d 2e af 9a e5 a6 88 2e a5 41 d4 89 03 2f 92 7c 23 e9 c9 e5 61 c5 08 ed 19 78 a3 26 52 16 11 4a 66 ab 37 aa b4 cf 00 36 15 4b 81 2e 41 81 6d 05 44 b2 50 24 28 74 0f e0 e0 3c 82 46 8e ed 6a 2b 26 6d 61 52 43 a3 ba 42 78 ed 75 b9 2e d1 ea 10 a1 41 a3 81 b5 c7 f3 83 22 91 a6 40 ed 26 31 bf f4 a6 a7 b9 e4 13 44 24 ae 72 4e 2d bf a7 d0 29 c9 48 ba e0 4b 3b 06 12 Data Ascii: 2iZj9tIDIFmk+;MI9C@DP^!p\>H9>BzH%hDr'(DG5^qB]Sib/_ACF%QNh,M..A/\|#ax&RJf76K.AmDP$(t<Fj+&maRCBxu.A"@&1D$rN-)HK;

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49741	90.84.161.21	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	587	OUT	POST /v6/collect?dt=4 HTTP/1.1 Host: collect-v6.51.la Connection: keep-alive Content-Length: 487 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telegramai.org Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:54 UTC	487	OUT	Data Raw: 1f 8b 08 00 7c 09 83 67 00 03 a5 52 cb 6e d3 40 14 fd 95 c8 4b 14 37 9e 89 1f e3 ee 58 b1 e8 92 20 01 3b c7 33 0e 55 43 52 12 bb 5e 20 24 27 0d 90 a6 54 16 52 a0 51 1b 48 03 ad 52 54 48 90 78 34 84 9a 7c 4c 33 e3 78 c5 2f d4 e3 34 8b ae bb bb 3a f7 dc 73 ce 9d 3b cf 85 75 2c ac a6 84 ec da 9a fe b8 6c 67 b5 1c 79 78 f7 d9 23 28 a4 53 42 c5 8e 3b 40 cb aa aa 2c 21 1d aa 3a 8a 41 9b 83 82 4d 8a a4 50 31 9e d2 61 27 0c de a6 c4 54 ee 5e 38 19 47 9f 3f b2 ee 64 81 a5 e9 c5 84 1e 0f c2 83 46 f8 ef 38 fc db a0 ad de 7c 3b 48 cf 87 5f e8 e1 a7 a8 d3 a3 7b fe 2c e8 b2 c3 9f d1 59 87 bd 6b 72 bf 0d 97 4b e7 6e 48 47 75 6f 3e 3a 67 f5 d3 d9 78 77 1e 04 4b df d9 f8 1b 7b ff 3a dc 69 b2 ee d7 ff 17 6f 58 a3 47 fd 7d 3a 3d 8b bc de a5 57 a3 c3 1d fa 32 9e 68 87 ed 53 Data Ascii: \|gRn@K7X ;3UCR^ $'TRQHRTHx4\|L3x/4:s;u,lgyx#(SB;@,!:AMP1a'T^8G?dF8\|;H_{,YkrKnHGuo>:gxwK{:ioXG}:=W2hS
2025-01-12 00:14:54 UTC	412	IN	HTTP/1.1 200 Date: Sun, 12 Jan 2025 00:14:54 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: https://www.telegramai.org Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE5-CACHE6[184],EU-GER-frankfurt-EDGE5-CACHE6[ovl,181] X-CCDN-REQ-ID-46B1: 51f64be4dc887e970f99f41225498c10

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49745	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	602	OUT	GET /telegram-16/top.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	936	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/jpeg Content-Length: 946 Connection: close ETag: "d048d5a47f4689e2ba0737434ff1b8b1" Last-Modified: Fri, 06 Dec 2024 01:36:06 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1QYYxnmu3AV1oLIL09Ugnv6WiKraEdOR2lLNYq%2BRO15lcoc3wz6x1mpPMJXZF7H9O%2FUhhRU%2FF8BntqFp4AhTeUrueWeHWeTdij1szIBRsfvUyfnwFuwyxPV3Ivd9AbTfS1mHh%2FsK6aI%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f5dce8728d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1892&min_rtt=1872&rtt_var=742&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=1180&delivery_rate=1436301&cwnd=234&unsent_bytes=0&cid=e3f709dab7fd626b&ts=846&x=0"
2025-01-12 00:14:55 UTC	433	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 03 6c 49 44 41 54 78 5e ed 9a 4f 48 14 61 18 c6 9f 77 d7 94 d2 a8 76 36 f1 62 41 74 88 88 4a ca 83 eb 2c 94 a7 22 22 0f fd f1 9c 9d a2 a8 9d 55 3c 95 46 5d 12 1d 8d fe 1c a2 3a 27 5e c4 0a 3c 74 08 76 54 4c 24 22 ab 5b 44 78 b1 9a 59 4b 43 50 77 de 58 82 50 70 77 67 66 3f 9d c5 fd f6 b4 b0 ef fb 7e cf f3 9b 6f 66 9e 61 87 50 e4 1f 2a 72 ff 90 00 e4 0e 28 72 02 f2 14 c8 b5 01 8e b4 59 db ca 97 e8 90 4d 08 e4 aa 2d a4 df 03 0c fb 4f 09 bf 9f b8 1b fa 95 4d 57 d6 1d a0 6a 66 37 11 b4 42 32 e6 56 0b 33 77 1a 7a b8 2d 53 5f 46 00 f5 b1 99 a3 81 40 6a dc ed 82 85 58 bf 64 d3 c1 d1 9e d0 87 d5 b4 65 04 10 6d b1 4e 81 f9 Data Ascii: PNGIHDR@@iqsRGBlIDATx^OHawv6bAtJ,""U<F]:'^<tvTL$"[DxYKCPwXPpwgf?~ofaP*r(rYM-OMWjf7B2V3wz-S_F@jXdemN
2025-01-12 00:14:55 UTC	513	IN	Data Raw: 00 6a 8b 75 1a cc 03 84 ec 4f 95 0c d8 20 6a 34 ba 42 2f 3c 7a 72 d5 b6 2e 00 ea b5 e4 71 22 7b 88 80 52 27 ea 18 58 a0 14 35 24 7a 43 c3 4e ea f3 a9 59 73 00 91 d6 e4 e1 a0 9d 32 00 2a 77 23 94 c1 b3 6c 53 dd 70 8f f2 d1 4d 9f db da 35 05 a0 5e 9f d9 43 c1 d4 5b 00 8a 5b 61 ff 6e 8f 3c 0d bb 24 62 f4 6e ff e2 a5 df 49 cf 9a 01 88 b4 cc 56 06 ec 85 71 22 ec 72 22 24 53 0d 33 be d9 81 d2 da 91 ae ad df f3 99 93 a9 77 4d 00 1c bb cc 15 4b 9b ad 51 02 0e 88 10 cd c0 64 c9 7c a8 ee cd 23 9a 13 31 6f f9 0c e1 00 f6 5e e5 b2 aa 52 eb 35 01 aa 48 b1 0c 18 f3 b3 a1 86 89 c7 b4 28 72 ae 58 00 1d 1c 50 7f 5b af 88 70 42 a4 c8 ff b3 98 07 13 ba d2 08 10 8b 9a 2f 14 80 1a 37 7b 09 b8 26 4a dc aa 69 91 a1 1b ba 12 17 b5 86 60 00 3f a7 09 54 29 4a 5c 86 39 53 89 6e a5 Data Ascii: juO j4B/<zr.q"{R'X5$zCNYs2*w#lSpM5^C[[an<$bnIVq"r"$S3wMKQd\|#1o^R5H(rXP[pB/7{&Ji`?T)J\9Sn

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49749	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	912	OUT	GET /static/js/jquery.js HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	899	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 86923 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=xUOySA6wBSa2HAfJiY70ydikP2zYLK%2Fk58yrkv%2FZxZsfpANUaxoaEE5WCVCs%2FXGlZFK5P6BdB8GVizFBHvEcHMMdsDapCX3gf1OjsCbickd%2BK16P3n6axUxfC2QfGg4nU%2BxK4Ts%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f5fb955e70-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1545&rtt_var=614&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1490&delivery_rate=1731909&cwnd=228&unsent_bytes=0&cid=bd9e1867a7fe4b43&ts=787&x=0"
2025-01-12 00:14:55 UTC	470	IN	Data Raw: 2f 2a 21 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 Data Ascii: /!jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license/!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery req
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 74 6f 53 74 72 69 6e 67 2c 66 3d 6c 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 70 3d 66 2e 74 6f 53 74 72 69 6e 67 2c 64 3d 70 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 68 3d 7b 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 74 2e 6e 6f 64 65 54 79 70 65 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 26 26 74 3d 3d 3d 74 2e 77 69 6e 64 6f 77 7d 2c 76 3d 7b 74 79 70 65 3a 21 30 2c 73 72 63 3a 21 30 2c 6e 6f 4d 6f 64 75 6c 65 3a 21 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 2c 6f 3d 28 74 3d 74 7c 7c 72 29 2e 63 72 65 61 74 65 45 Data Ascii: toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createE
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 2c 6c 3d 21 31 3b 66 6f 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 61 26 26 28 6c 3d 61 2c 61 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 7c 7c 7b 7d 2c 73 2b 2b 29 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 67 28 61 29 7c 7c 28 61 3d 7b 7d 29 2c 73 3d 3d 3d 75 26 26 28 61 3d 74 68 69 73 2c 73 2d 2d 29 3b 73 3c 75 3b 73 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 29 29 66 6f 72 28 74 20 69 6e 20 65 29 6e 3d 61 5b 74 5d 2c 61 21 3d 3d 28 72 3d 65 5b 74 5d 29 26 26 28 6c 26 26 72 26 26 28 77 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 72 29 7c 7c 28 69 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 29 29 3f 28 69 3f 28 69 3d 21 31 2c 6f 3d 6e 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 Data Ascii: ,l=!1;for("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|g(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)\|\|(i=Array.isArray(r)))?(i?(i=!1,o=n&&Array.isArra
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 5d 3b 69 66 28 43 28 65 29 29 66 6f 72 28 72 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 72 3b 6f 2b 2b 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 65 6c 73 65 20 66 6f 72 28 6f 20 69 6e 20 65 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 5b 5d 2c 73 29 7d 2c 67 75 69 64 3a 31 2c 73 75 70 70 6f 72 74 3a 68 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 77 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 77 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 Data Ascii: ];if(C(e))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.each("Boolean Number String
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 22 29 22 2b 4d 2b 22 2a 22 29 2c 7a 3d 6e 65 77 20 52 65 67 45 78 70 28 22 3d 22 2b 4d 2b 22 2a 28 5b 5e 5c 5c 5d 27 5c 22 5d 2a 3f 29 22 2b 4d 2b 22 2a 5c 5c 5d 22 2c 22 67 22 29 2c 58 3d 6e 65 77 20 52 65 67 45 78 70 28 57 29 2c 55 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 52 2b 22 24 22 29 2c 56 3d 7b 49 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 23 28 22 2b 52 2b 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 52 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 52 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 49 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 57 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 Data Ascii: ")"+M+""),z=new RegExp("="+M+"([^\\]'\"]?)"+M+"\\]","g"),X=new RegExp(W),U=new RegExp("^"+R+"$"),V={ID:new RegExp("^#("+R+")"),CLASS:new RegExp("^\\.("+R+")"),TAG:new RegExp("^("+R+"\|[*])"),ATTR:new RegExp("^"+I),PSEUDO:new RegExp("^"+W),CHILD:new Reg
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 65 6e 67 74 68 3d 6e 2d 31 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 65 28 65 2c 74 2c 72 2c 69 29 7b 76 61 72 20 6f 2c 73 2c 6c 2c 63 2c 66 2c 68 2c 76 2c 6d 3d 74 26 26 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 54 3d 74 3f 74 2e 6e 6f 64 65 54 79 70 65 3a 39 3b 69 66 28 72 3d 72 7c 7c 5b 5d 2c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 21 65 7c 7c 31 21 3d 3d 54 26 26 39 21 3d 3d 54 26 26 31 31 21 3d 3d 54 29 72 65 74 75 72 6e 20 72 3b 69 66 28 21 69 26 26 28 28 74 3f 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 3a 77 29 21 3d 3d 64 26 26 70 28 74 29 2c 74 3d 74 7c 7c 64 2c 67 29 29 7b 69 66 28 31 31 21 3d 3d 54 26 26 28 66 3d 4a 2e 65 78 65 63 28 65 29 29 29 69 66 28 6f 3d 66 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 54 29 7b 69 Data Ascii: ength=n-1}}}function oe(e,t,r,i){var o,s,l,c,f,h,v,m=t&&t.ownerDocument,T=t?t.nodeType:9;if(r=r\|\|[],"string"!=typeof e\|\|!e\|\|1!==T&&9!==T&&11!==T)return r;if(!i&&((t?t.ownerDocument\|\|t:w)!==d&&p(t),t=t\|\|d,g)){if(11!==T&&(f=J.exec(e)))if(o=f[1]){if(9===T){i
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 26 31 3d 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 26 26 31 3d 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 26 26 65 2e 73 6f 75 72 63 65 49 6e 64 65 78 2d 74 2e 73 6f 75 72 63 65 49 6e 64 65 78 3b 69 66 28 72 29 72 65 74 75 72 6e 20 72 3b 69 66 28 6e 29 77 68 69 6c 65 28 6e 3d 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 69 66 28 6e 3d 3d 3d 74 29 72 65 74 75 72 6e 2d 31 3b 72 65 74 75 72 6e 20 65 3f 31 3a 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 66 65 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 74 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 74 2e 74 79 70 65 3d 3d 3d 65 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 65 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 Data Ascii: &1===e.nodeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function fe(e){return function(t){return"input"===t.nodeName.toLowerCase()&&t.type===e}}function pe(e){return function(t)
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 28 22 2a 22 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 51 2e 74 65 73 74 28 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 2c 6e 2e 67 65 74 42 79 49 64 3d 75 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 68 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 62 2c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 62 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 42 79 49 64 3f 28 72 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 70 6c 61 63 65 28 5a 2c 65 65 29 3b 72 65 74 Data Ascii: entsByTagName("*").length}),n.getElementsByClassName=Q.test(d.getElementsByClassName),n.getById=ue(function(e){return h.appendChild(e).id=b,!d.getElementsByName\|\|!d.getElementsByName(b).length}),n.getById?(r.filter.ID=function(e){var t=e.replace(Z,ee);ret
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 3c 61 20 69 64 3d 27 22 2b 62 2b 22 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 69 64 3d 27 22 2b 62 2b 22 2d 5c 72 5c 5c 27 20 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 3d 27 27 3e 3c 6f 70 74 69 6f 6e 20 73 65 6c 65 63 74 65 64 3d 27 27 3e 3c 2f 6f 70 74 69 6f 6e 3e 3c 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 5e 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 26 26 79 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 50 Data Ascii: <a id='"+b+"'></a><select id='"+b+"-\r\\' msallowcapture=''><option selected=''></option></select>",e.querySelectorAll("[msallowcapture^='']").length&&y.push("[^$]="+M+"(?:''\|\"\")"),e.querySelectorAll("[selected]").length\|\|y.push("\\["+M+"*(?:value\|"+P
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 74 75 72 6e 20 65 3d 3d 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 72 29 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 44 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75 72 6e 20 66 3d 21 30 2c 30 3b 76 61 72 20 72 3d 21 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e Data Ascii: turn e===r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},D=t?function(e,t){if(e===t)return f=!0,0;var r=!e.compareDocumen

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49750	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	999	OUT	GET /static/image/right.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/static/css/style.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	873	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/png Content-Length: 1081 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ESYVckOVJtlan9AEpOnjqEgOmPFMt79T%2F7lzO7IUulTKmm3Cn%2FwxZmvqNFe1rPP6JFCrh1W69PQ7vYnZ8L%2BbNbo0APwhnCcM5NEu3Oc3zxeUrKAwHWMlYQ0rbP77K9ydli6DCAM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f6096b428e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1598&min_rtt=1593&rtt_var=609&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1599&delivery_rate=1780487&cwnd=222&unsent_bytes=0&cid=8aa45545ff10e390&ts=797&x=0"
2025-01-12 00:14:55 UTC	496	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 c9 50 4c 54 45 00 00 00 ef ef ff ef ff ff e7 f7 f7 ef ef f7 ef ef ff ef f7 f7 ef f7 ff ea f4 fa ef ef fa ef f4 fa ef f4 ff eb f3 fb ef f3 fb ef f3 ff ec f2 fc ef f2 fc ef f2 ff ec f2 fc ef f4 fc ed f1 fd ed f4 fd ef f4 fd ef f6 fd ef f5 fd ed f3 fd ed f5 fd ef f5 fd ef f4 fd ef f6 fd ed f4 fd ef f4 fd ef f5 fd ed f4 fd ef f5 fe ee f3 fe ee f5 fe ef f4 fe ef f6 fe ee f3 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f4 fe ef f5 fe b4 c2 d7 bf cb df bf cc de bf cc df c2 ce e0 c7 d2 e3 ca d5 e5 ca d5 e6 d5 de ed d9 e1 ef e0 e8 f4 e7 ee f9 e7 ef f9 e8 ef f9 eb f1 fc eb f2 fb eb f2 fc ef f5 fe Data Ascii: PNGIHDRxxsRGBPLTE
2025-01-12 00:14:55 UTC	585	IN	Data Raw: 64 1a d7 5d 0e 88 5c 00 39 68 b7 ae 90 15 46 e8 02 64 f6 f3 f9 0a 48 73 69 eb 4e 81 38 51 db 85 e5 58 60 29 90 27 a5 e9 e8 c3 ee 3b 43 67 1b 67 d2 61 a3 94 fa 7c 70 ec 6c 73 65 2f 4d cf d8 2a a5 94 ba 3b 10 57 76 60 7a c2 bd 52 28 79 e0 db e0 9d c2 c9 a9 67 83 61 af 90 f2 b9 5f 83 01 36 48 39 f1 6b 30 c0 fe 23 4e 6e 2c 6c ab c5 12 2b bf f4 de 95 90 72 ae 77 47 96 8f 40 ca fa f2 8a 81 55 8e 09 f6 7f 94 9c fb d4 b4 97 1c 52 1c 00 30 b2 6e 8f ba 05 66 79 45 73 c4 73 97 a5 e6 6e e8 ba bb bb cb f5 83 3c 06 76 f9 69 fd 25 1c d8 e5 c8 6f f9 c0 cb 09 41 51 a3 e4 fa b2 7e 03 ec 72 56 0b 97 c0 2e d7 2f 9a 12 fc 65 d4 44 46 df 13 8e e4 2f 86 9f d2 c2 47 f2 a6 5d f8 70 f7 07 fe d4 2a fc e0 aa af 18 58 fa bb 1f 50 c5 55 fa bb 3f 50 d3 29 63 77 35 0b c8 2d bb 0b 6f c9 Data Ascii: d]\9hFdHsiN8QX`)';Cgga\|plse/M;Wv`zR(yga_6H9k0#Nn,l+rwG@UR0nfyEssn<vi%oAQ~rV./eDF/G]pXPU?P)cw5-o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49753	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	621	OUT	GET /telegram-16/cropped-header-image-5.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	936	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/jpeg Content-Length: 66150 Connection: close ETag: "1bc64af22b7c6f477d1635b174c3e599" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=e7HKIuBeehPAtDDmhTuJkY5eAuNeeYyGEj8E31rUK86u4mGHIYodcNIvmgvbYeRXYG%2BwjmZYhs%2BMWpXPyp8xK0eTzFesms7TNdgtOVYt%2BvnQr8hTZgMJOy6O7Dxgib2zJT2cppsYB98%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f5fee64385-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1572&min_rtt=1560&rtt_var=609&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=1199&delivery_rate=1763285&cwnd=250&unsent_bytes=0&cid=c008ee8d0014ac71&ts=840&x=0"
2025-01-12 00:14:55 UTC	433	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 3b 00 00 01 f3 08 03 00 00 00 19 ee e6 6e 00 00 03 00 50 4c 54 45 00 00 00 a1 a1 a4 c0 c1 c2 d3 d3 d5 b8 b8 ba 89 8a 8c c9 c8 ca 96 97 9a a9 a9 ac ff ff ff 1a 19 19 fa fb fb fe fe fa f2 f2 f1 f6 f6 f6 28 28 2c 2d 2e 32 14 20 2a 9f b6 ee 35 36 3a 17 16 16 a9 b4 ec 11 0f 10 dd dc de 0d 17 1d e2 e3 e2 eb eb ed e8 e8 e8 96 b6 ef 31 22 22 3b 28 24 24 16 14 d7 d7 d8 44 2d 2d 82 7d a0 8d b8 f3 28 1c 1c cb cb cb 11 1d 25 37 22 1c 21 1d 24 2f 1d 18 d2 d2 d2 07 09 0c aa 74 85 83 cd cc 4a 4c 52 a7 d8 a6 63 b8 fd df df ec 50 7c a2 df 8c 7d 49 32 35 b2 b4 ec 63 63 65 72 b1 fd 6a b5 fd a4 a7 bd 58 57 5c 70 c7 e0 1e 0f 0b 7a cb d6 80 b8 f5 66 c4 e9 b3 b3 b3 52 36 38 ee f2 fb 07 04 03 7f 7f 81 38 3f 44 13 09 08 9d Data Ascii: PNGIHDR;nPLTE((,-.2 *56:1"";($$D--}(%7"!$/tJLRcP\|}I25ccerjXW\pzfR688?D
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 71 a3 71 69 b9 e0 f5 77 ce ee d0 e7 fa 35 15 06 eb d9 bf 6c cd f9 bc a8 b8 ca de f0 4f 5c 87 70 73 9a 90 76 92 a9 d0 f1 69 68 90 d6 98 90 3d 5d 75 7a 50 4d 91 5f 69 4f 1d 08 f3 d1 fc ee dc e5 f5 1b 6d 9e c4 e4 9c 63 54 d7 aa a1 70 63 83 bb a3 af 8d 53 4d f0 e1 cc 86 6a 87 fc de ac 74 ac d7 ba de 96 5f 56 79 6c 27 0f b6 92 90 b4 97 ab 64 6e 97 47 9d e4 a2 0d 13 fb e7 f8 b2 ca e3 f0 fe cc fc f2 ba ea a5 95 4f 7c a6 91 80 a3 d5 ed d1 8b b9 dc b2 73 5d 83 40 0d c6 de b1 ce b6 b9 f5 ea db f1 c7 97 a5 96 b3 4b 7b 9a 77 43 39 8f c7 ed a1 4d 0d 89 a4 c3 11 78 e8 df ed bc e7 ce aa a6 8f a3 cf e7 ed de 8a 47 62 9f d0 81 64 63 a2 66 30 2c 4a 5c ea a7 5a c5 7c 4f a0 86 83 5d 85 ae 21 aa f3 cd 93 64 b5 17 46 c8 bf f5 1d 31 4c f2 ba 79 d4 12 57 a9 c5 96 bb 5f 09 8b da Data Ascii: qqiw5lO\psvih=]uzPM_iOmcTpcSMjt_Vyl'dnGO\|s]@K{wC9MxGbdcf0,J\Z\|O]!dF1LyW_
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: a2 28 69 70 68 10 69 85 17 78 fb 3c c3 1b 10 20 1d 59 2f 85 93 61 1f 30 06 8a 92 f2 34 e5 eb 28 3d b8 1f 9d 1b 27 0b dc 42 07 8b a2 c5 ba 7f 82 26 1b 54 ca f2 d5 53 cb 27 ca 29 1a 35 69 32 5b a9 e4 2b 65 28 52 29 5d d3 6c 43 b1 14 4d b7 8c a6 a5 6a 96 65 d8 ba 65 da 2a ad b7 ed 72 10 68 58 a9 4d cb 54 10 4b d5 75 5b 55 2c c3 2c eb 16 a1 55 1a d9 f0 5b ba 9f 3e 0d a1 68 3e 34 ec b2 5d c6 aa a9 18 52 3b 24 09 66 7a df 51 57 68 0f b1 79 ec 62 3d ed 21 41 a1 d7 eb f5 83 5e d0 6f b7 db bd a0 3d 1c 66 07 b8 e4 59 29 08 6e d6 47 2d 0f 3b 41 3f 70 83 5e 3f 1b 04 86 87 f4 47 85 fe b0 3d 2c c3 c3 f0 4c 10 e8 93 fb 0d 74 13 1a c4 a3 47 4d 08 68 f4 d7 30 db 0f 50 79 a5 f0 70 6c eb 69 36 4f d4 f2 cb 27 f2 0a 76 8c 2c 04 cd 2c ae e4 2b 8d 15 c3 b2 4e 9f 3a 61 db 95 d3 Data Ascii: (iphix< Y/a04(='B&TS')5i2[+e(R)]lCMjee*rhXMTKu[U,,U[>h>4]R;$fzQWhyb=!A^o=fY)nG-;A?p^?G=,LtGMh0Pypli6O'v,,+N:a
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 52 84 fc 1d 3a 42 3e 22 d2 41 73 8b d4 16 d1 31 50 97 cb 29 aa d8 d0 b0 e0 27 d9 b8 47 c3 ee e2 ba bb 2e a4 0d c4 23 fc 94 e3 8b 15 ba 7e 61 f9 60 ed 58 90 da 21 49 26 31 ed b8 c2 92 81 06 88 c8 ce f5 1c 5c 19 1b 27 c4 85 c6 c5 9d d0 5c 7f 1a c7 27 91 10 3c 16 55 44 39 70 db ef ce a2 8a 3e c9 3a 86 45 30 7c 91 dd 2a 54 68 e3 b7 99 03 bf df c8 84 76 74 de c0 4c 07 26 e7 65 be a5 eb 84 8b 88 cf c8 f0 d1 25 44 ee 3b 24 c9 67 96 76 d0 8b 7e 07 da af 43 b2 41 aa 41 91 71 45 06 e1 00 c7 16 13 8f 1f 29 87 e3 b2 70 60 88 82 07 02 f4 75 32 ce e3 82 24 43 bc e0 2e 45 b1 95 18 d7 b4 fd 78 d3 79 d3 79 fe 06 77 1c 6f 60 70 6b 59 67 ed a0 3f 18 9e a0 48 39 9c d8 55 2d de d5 4a ed 90 24 9d b8 76 d0 dd 04 6f 33 7e 0d 52 0c 30 d1 fd 5a 46 c4 03 9a 0f 0d 63 78 6f 41 01 8d Data Ascii: R:B>"As1P)'G.#~a`X!I&1\'\'<UD9p>:E0\|*ThvtL&e%D;$gv~CAAqE)p`u2$C.Exyywo`pkYg?H9U-J$vo3~R0ZFcxoA
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: f4 7e 87 e6 18 71 d0 1d df a0 3b 94 2e a8 cb d8 a3 38 ed 20 77 08 93 10 50 d2 08 60 32 25 54 9b 83 a6 39 4b 51 a9 90 23 e2 c9 f2 c5 db 8f d6 eb 51 75 d9 80 60 ad 63 b5 2c db 71 02 66 35 2d 57 d8 66 50 6b 95 6b 96 d9 6a 7a 2e f3 2c 6e 71 36 7b 8c 5c 64 fc 85 3b 50 1e 12 32 07 3d 32 93 bd 05 3d b7 62 d1 79 87 66 fe 99 96 77 a8 4f 5f 89 83 61 f1 9a e5 25 e9 0e 11 63 aa 56 c5 50 f9 21 6e b4 50 ee e8 75 bb dd cd 9d 9d f4 9a c5 5e ec 3f ff 4a 18 5d b5 58 6d 43 d4 5a 6a dc 58 6e 36 da 1b cd e6 8d 1b ab ed 86 6d 36 56 56 5b ed 46 fb c6 56 63 a3 53 6b af d4 d8 ac e1 dd 6e d6 15 bd ee d3 ac 88 7b de 44 77 d0 0b 80 48 1d 68 0e 28 7f 65 0f 7d 5f a9 e6 38 b0 9e 77 47 26 d3 80 5a cc bd e9 35 8b 72 47 fa 96 0d 91 04 76 60 0b c0 b5 27 1f 9c 38 26 17 e6 b4 a2 dc c1 77 7a Data Ascii: ~q;.8 wP`2%T9KQ#Qu`c,qf5-WfPkkjz.,nq6{\d;P2=2=byfwO_a%cVP!nPu^?J]XmCZjXn6m6VV[FVcSkn{DwHh(e}_8wG&Z5rGv`'8&wz
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 0c c5 7a 47 98 ae 27 04 73 0c 66 ff ad f7 70 08 db 70 04 77 4d db 9c b2 66 41 31 9d 1c f4 a3 7a bd 5a 07 aa 48 08 91 64 b0 3b 1c f7 07 c3 7e bf 5a 8f c0 1e 55 38 ad ae c3 b3 69 77 ec 4f 75 c7 b7 ca 1d 47 00 9f 67 a1 6f b5 a4 27 69 49 1f 98 87 00 59 7f e4 79 44 bb 43 33 c7 14 b8 03 94 a1 ac 91 b4 64 0e a8 0f a2 3c b0 92 5b 4e c2 aa 65 1b dd e1 32 60 59 fe 81 96 4a d0 b5 31 76 56 9b e5 ce 5a b9 d9 6e 6d ac b7 5a e5 c6 fa e1 e5 21 02 db b7 b9 e7 f9 d6 d4 55 10 ba 63 10 56 17 22 40 36 61 7f a1 24 07 a5 c1 78 38 1e 0c f7 c7 fd 30 ea 0f 91 a8 14 5f 15 c2 d9 7e d6 1d fb c3 fe 70 f7 80 3b f6 77 4f 8f 87 68 94 23 b9 e3 a9 5b 5e 7f 1d dd 71 8a 5e 58 8a 5f 8f 8d e6 90 90 3e 8a fd f1 95 76 87 66 9e c9 bb 43 99 02 3a 2c 0a 1c ab b4 03 c0 5e 82 e7 92 bc a3 59 2f 5d 78 Data Ascii: zG'sfppwMfA1zZHd;~ZU8iwOuGgo'iIYyDC3d<[Ne2`YJ1vVZnmZ!UcV"@6a$x80_~p;wOh#[^q^X_>vfC:,^Y/]x
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: f9 f1 69 94 8f 51 ee b9 e9 1e 88 ad 39 fd f0 41 76 c4 07 ec 18 e8 28 a9 1b 3b 08 15 a2 e2 12 e4 e0 a2 f6 3e 3f 18 66 fe f0 1d d9 31 5f 8e 61 83 10 32 36 6e 0b f3 a0 89 93 ea 0a 8a 70 14 32 0d ca 0a 9b e6 9d 43 32 0c 49 d6 0d b9 3b 3b be 41 a2 b3 3a 07 f7 40 c9 0e c6 0e 8a 60 aa 8d 2a 12 1f 2c 30 71 1b f0 11 d5 0c e6 1a 3f 55 33 b3 8d bd 40 66 76 a3 71 5d 08 7c 08 54 b1 d5 42 be 05 80 40 13 eb 90 f2 f8 9e e4 72 db c1 a7 bc f9 8e 55 81 0e 68 93 47 28 40 07 d8 01 6c e0 e6 02 39 18 3a c0 0e 8e 0e 54 60 c7 c0 77 0c 74 84 d5 3d df 21 52 a3 1d e8 10 22 78 d0 0d b5 0e 96 f2 5c a9 1c 09 fb 72 39 1f 84 3a 9c 94 20 55 ed 3c f4 25 69 26 6b 28 68 6b 07 f2 19 fc 21 fa aa 21 59 05 e4 46 ba b2 43 79 1a 74 a8 c2 7a b8 80 03 0a 17 a8 e0 12 4d a2 2e 25 3f 11 8d 50 cc c2 d8 Data Ascii: iQ9Av(;>?f1_a26np2C2I;;A:@`*,0q?U3@fvq]\|TB@rUhG(@l9:T`wt=!R"x\r9: U<%i&k(hk!!YFCytzM.%?P
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 33 3b 04 3d ee ea c4 07 8a 68 f2 9b e0 41 41 cb aa 00 07 e9 83 52 5f d9 d1 04 3b 14 5c 42 d4 b4 97 6e 98 f2 4f c1 b9 4d dd 3e 35 35 75 6a 07 17 09 8f db 21 4c ec ec a1 47 9d 53 3b 3b a7 a6 76 f6 de de c1 e4 9e d0 ce 0e ee a9 07 77 f6 7e f8 e1 87 9d 91 91 a9 a9 1b f1 36 78 ab 9d 29 3f 9a fe 1b fd c3 11 bd 1f 31 cb b9 6e 7a 9e 0a c7 c7 26 b7 1e 54 6d e3 e2 ec c8 0f d8 71 5c 34 34 ed cf a5 d3 89 64 21 d6 6f 15 97 67 26 d2 be 5c e4 ca 13 1e d4 7f df f1 68 a7 ef e8 18 10 c6 83 f9 8e 6f 39 34 3e 3a 9b c8 f9 cf 9f 5d f9 a0 c4 44 34 61 05 95 68 e1 21 86 ba 0b 53 6d 2f 64 ec e8 94 62 72 a9 a6 4a 45 15 b5 d5 1a ff 53 69 7c 39 97 89 62 52 c5 5b 5c 96 24 79 f3 1d f9 3f d8 f1 3c 2e d1 40 e1 0d c2 07 2e 14 5c 84 10 94 6d 62 c8 f3 03 76 1c 17 5d 85 4f 85 a6 47 0a d6 3f Data Ascii: 3;=hAAR_;\BnOM>55uj!LGS;;vw~6x)?1nz&Tmq\44d!og&\ho94>:]D4ah!Sm/dbrJESi\|9bR[\$y?<.@.\mbv]OG?
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 61 0a ed b3 63 c5 ef de 10 0a 4d ce 9d 3c 39 7b dd e4 e4 24 d8 81 d4 45 9d 02 8f 26 6d b6 d4 28 00 41 07 81 4c 6d 1d a3 d4 ad 63 90 a6 a9 53 e3 21 0a 84 3c 69 09 eb eb f5 e6 8a 60 c7 ff 4f 2c df 81 43 a4 1c 1d b8 3b c5 2d 07 2f 44 0e a1 ec e9 09 6f ec b8 6a e8 9a 6b 2e bb 64 5d 8d 8b 1e 10 1a d7 e0 63 13 03 5d 9a 86 c0 8e c2 a1 24 bd 2c fa 5d 65 a6 ec 1e b3 dd 7e 2d 00 90 b1 12 47 83 1d 2d a1 f5 40 57 80 88 0b e5 30 3b 4a fe 6a 28 74 e3 c9 1b 4e 8d 86 27 46 ae 67 ec 68 6e d5 6a f5 75 64 47 41 03 da 69 41 0b 0d ca 7f d6 31 01 ad 23 ef 81 d4 68 9d a6 6a 2b 75 b4 b0 7a a5 86 4e 0d 43 35 ce 8e 0b ff 26 3b 14 24 af fb 9a 2b 05 3a ba 4b c4 2b 84 8e 36 6d 23 66 39 ed e9 3b 07 2f 8b 0c 8f a5 db 14 4e 87 51 fe be 68 79 9b c6 7c 4b 57 0e 8c cf 25 e9 9a 25 df 58 71 Data Ascii: acM<9{$E&m(ALmcS!<i`O,C;-/Dojk.d]c]$,]e~-G-@W0;Jj(tN'FghnjudGAiA1#hj+uzNC5&;$+:K+6m#f9;/NQhy\|KW%%Xq
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 68 b2 ae 64 b1 84 36 c6 b1 32 1a 89 63 58 d7 8c 4c 0b 99 08 e3 8e 63 0c 6b 89 15 13 57 64 dd 47 10 b1 41 0c 76 59 6c f0 b9 96 8d b0 71 25 12 f7 2d ce 90 f0 97 e7 ed 9a 2d 33 7a c6 ee ce 38 56 e2 e9 ea ea aa 9e ee f9 7c f3 cd fc 3c ef 5b d5 dd 1d b3 c3 ea ed ab 54 9c 3a 3b ae be ee 86 ab 2e 3a e3 e2 03 2f 3d 2a e4 8c 19 51 68 59 a1 47 f3 8f 4c 2b b0 ff f4 4b 2b 38 73 f2 bd 5b aa 9b 81 6c 5e 17 5a cb 06 71 23 b1 ce b4 77 6f 7f 8e ee 3e d6 3d 3b f6 c3 42 4c d0 89 0e 05 8e 96 52 c7 34 f8 0e a2 c7 59 3b 4c 5e fd c9 59 f7 d6 53 a1 28 aa a1 5a 34 47 94 2a 6a e9 97 69 ca 87 3e 1a 2b 2a 6a 25 73 a5 bd 1b bc 72 de db af 1c da ff ed f8 2b 26 59 3f ce 79 6b 32 ff 53 59 10 d1 fe 8f d1 ec 88 28 11 aa 62 94 24 27 54 49 a0 a3 73 76 c0 76 1c 7c 92 c3 e8 93 09 d3 59 23 28 Data Ascii: hd62cXLckWdGAvYlq%--3z8V\|<[T:;.:/=QhYGL+K+8s[l^Zq#wo>=;BLR4Y;L^YS(Z4Gji>+*j%sr+&Y?yk2SY(b$'TIsvv\|Y#(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49746	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	912	OUT	GET /static/js/public.js HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	902	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 1331 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FJo94jo%2BRjoaZNCBDYqeje%2FtnqOf7ss3e5pY%2FH8X5yDzC0FpMxC27q5gXsY4ENJGhYi%2F%2Ff2yw06%2BRcwnDsgu5zO6ES0ucuFeJ2x0FxRjjK1gdVLG9egL0y3DOA7eTTtfnrNgpuk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f5fbb94345-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&min_rtt=1558&rtt_var=602&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1490&delivery_rate=1790312&cwnd=225&unsent_bytes=0&cid=bdc5ed7013fc2854&ts=769&x=0"
2025-01-12 00:14:55 UTC	467	IN	Data Raw: 24 28 27 23 74 6f 2d 74 6f 70 27 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 24 28 27 62 6f 64 79 2c 68 74 6d 6c 27 29 2e 61 6e 69 6d 61 74 65 28 7b 73 63 72 6f 6c 6c 54 6f 70 3a 30 7d 2c 31 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 7d 29 3b 0d 0a 0d 0a 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 63 6f 6e 73 74 20 73 63 72 6f 6c 6c 54 6f 70 20 3d 20 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 3b 0d 0a 20 20 20 20 63 6f 6e 73 74 20 77 69 6e 64 6f 77 48 65 69 67 68 74 20 3d 20 24 28 77 69 6e 64 6f 77 29 2e 68 65 69 67 68 74 28 29 3b 0d 0a 20 20 20 20 69 66 20 28 73 63 72 6f 6c 6c 54 6f 70 20 3e 20 32 30 30 20 29 20 7b Data Ascii: $('#to-top').click(function() { $('body,html').animate({scrollTop:0},1); return false;});$(window).scroll(function() { const scrollTop = $(window).scrollTop(); const windowHeight = $(window).height(); if (scrollTop > 200 ) {
2025-01-12 00:14:55 UTC	864	IN	Data Raw: 67 65 6e 74 20 3d 20 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 20 7c 7c 20 6e 61 76 69 67 61 74 6f 72 2e 76 65 6e 64 6f 72 20 7c 7c 20 77 69 6e 64 6f 77 2e 6f 70 65 72 61 3b 0d 0a 20 20 20 20 69 66 20 28 2f 61 6e 64 72 6f 69 64 2f 69 2e 74 65 73 74 28 75 73 65 72 41 67 65 6e 74 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 22 61 6e 64 72 6f 69 64 22 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 69 66 20 28 2f 69 50 61 64 7c 69 50 68 6f 6e 65 7c 69 50 6f 64 2f 2e 74 65 73 74 28 75 73 65 72 41 67 65 6e 74 29 20 26 26 20 21 77 69 6e 64 6f 77 2e 4d 53 53 74 72 65 61 6d 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 22 69 6f 73 22 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 22 70 63 22 3b 0d 0a 7d 0d Data Ascii: gent = navigator.userAgent \|\| navigator.vendor \|\| window.opera; if (/android/i.test(userAgent)) { return "android"; } if (/iPad\|iPhone\|iPod/.test(userAgent) && !window.MSStream) { return "ios"; } return "pc";}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49752	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	602	OUT	GET /telegram-16/333.jpg HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:54 UTC	949	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:54 GMT Content-Type: image/jpeg Content-Length: 45082 Connection: close ETag: "48f819fabb18f36c8c078d2590c49d38" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2915 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YvdJDxkUsxaGW9Wi0TfqJ4VgXoM%2FFLEF2PtY5z3DE7vaf%2FrVU4pRtwB1Q4kXeoR5c6bOKq8aHTfbmpTE9VVckxMbCu2C9uvNUfLUcvHO%2F46wsSwh10jOmFdxkA9ET2%2BA5Ltvmljx4V4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f61cc34401-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1562&min_rtt=1557&rtt_var=595&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2873&recv_bytes=1180&delivery_rate=1820448&cwnd=216&unsent_bytes=0&cid=eb5097af5f5678aa&ts=173&x=0"
2025-01-12 00:14:54 UTC	420	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 32 0a ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 4f 04 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$O"
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 29 d1 7d f1 4d a7 45 f7 c5 00 0f d4 d3 69 cf d4 d3 68 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 Data Ascii: (((((((((((((((((((((((((((((((((((((((((((((((()}MEih(((((((((((
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: c7 fc 2b 9e b6 2e 95 35 ab 37 a5 86 a9 53 e1 47 04 39 20 28 2c 4f 61 c9 ae 87 47 f0 1e b9 ab 6d 76 81 6d 21 6f e3 9b 39 c7 d2 bd 43 48 f0 c6 95 a2 a8 16 96 91 a9 fe fb 0c b1 fc 4d 6b 90 a3 a8 af 2a b6 68 de 90 47 a7 47 2c 4b f8 87 17 a4 fc 2f d2 ad 70 d7 d2 4b 7e e0 e7 0e 70 80 fb 28 fe b5 d6 5b 5a 41 67 18 8a de 24 89 07 45 45 00 7e 55 85 e2 0f 1b d8 e9 0f f6 58 43 df 5f 31 d8 96 b0 7d e2 7d cf 61 56 fc 39 16 ae 2d 64 9f 59 9d 1a e2 66 dc b0 c6 3e 58 46 38 50 7b 9f 5a e0 a9 2a 92 57 a8 ce ea 50 a7 17 6a 68 d8 1d 79 e6 bc a7 e2 7d db 4d af db da ef ca c1 06 e2 3f da 63 ff 00 d6 af 58 c5 78 6f 89 ee fe dd e2 5d 46 7c e4 79 9e 58 f6 0b c7 f5 ae ac b2 9d ea dd 18 66 72 4a 9d 8c b6 a4 a5 6a 4a fa 44 7c e8 94 51 45 05 05 14 51 40 05 14 51 40 05 3a 2f be 29 b4 Data Ascii: +.57SG9 (,OaGmvm!o9CHMkhGG,K/pK~p([ZAg$EE~UXC_1}}aV9-dYf>XF8P{ZWPjhy}M?cXxo]F\|yXfrJjJD\|QEQ@Q@:/)
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 3b 05 14 51 40 82 8a 28 a9 b8 05 14 1e b4 86 8b 80 b4 53 55 83 36 d5 21 8f a2 f2 6a ed b6 93 a8 5d 36 21 b0 bc 93 3d c4 2c 07 e6 71 53 2a b1 8e ec b5 09 4b e1 45 4a 08 ad e8 fc 0d e2 29 4f cb a6 95 ff 00 ae 92 28 ad 3b 6f 85 fa cc c0 19 ee 2d 2d bd b9 73 fd 2b 17 8c a3 1d e4 69 1c 2d 49 6c 8e 3a 8a f4 3b 7f 84 a8 51 85 c6 aa e5 fb 18 e3 00 0f cc d7 27 e2 4f 0c 5e 78 66 78 e3 9d 84 d1 4b 9d 93 28 e0 fb 1f 43 4a 18 da 33 97 2c 58 e7 84 ab 05 76 8c 8a 28 a2 ba 56 e7 Data Ascii: EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP;Q@(SU6!j]6!=,qS*KEJ)O(;o--s+i-Il:;Q'O^xfxK(CJ3,Xv(V
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 8c 94 46 04 8a ce f2 7a 9a da 9c 74 45 a0 dc 62 83 49 4e c5 2b 96 92 b0 98 35 c7 7c 51 9a 35 f0 e0 8c b0 0e f3 26 d5 ee 70 72 6b b3 c6 05 78 e7 c4 0d 64 ea 9a fb 47 19 dd 0d 9e 63 5e 78 dc 7e f1 ae cc 15 27 52 aa b1 c3 8e aa a1 4d 9c d5 14 62 8a fa 74 7c d2 0a 28 a2 99 41 45 14 50 01 45 14 50 c0 f5 cf 04 da c5 79 e0 fb 38 26 4d f1 b0 3b 97 dc 36 47 eb 5d 33 c8 88 a5 d9 91 54 72 49 3c 2d 78 ff 00 87 fc 6f 7d e1 eb 43 69 14 11 5c 43 92 54 48 c4 15 cf d2 a8 eb 3e 28 d5 75 d6 61 75 70 52 13 ff 00 2c 63 e1 7f 1f 5a f0 25 97 d5 95 47 7d 8f 62 18 f8 42 9a b2 d4 f4 3d 73 e2 46 99 a7 33 c5 67 9b eb 81 91 84 fb 80 fb 9a bd e0 ff 00 15 2f 89 2c dd 9d 56 3b a8 8e 25 88 1c 81 dc 11 ed 5e 34 00 51 85 50 a0 74 02 ae e8 ba b5 c6 83 a9 47 7f 6d f3 15 1b 64 4c ff 00 ac 4c Data Ascii: FztEbIN+5\|Q5&prkxdGc^x~'RMbt\|(AEPEPy8&M;6G]3TrI<-xo}Ci\CTH>(uaupR,cZ%G}bB=sF3g/,V;%^4QPtGmdLL
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: ce 1b 8b 24 b2 d4 ee 52 1b 88 86 d4 79 1b 1e 6a f6 3c f7 f5 af 0b 31 c1 b4 fd a4 4f 63 2f c6 2b 7b 39 1d c4 d2 24 51 b3 bb 05 55 19 24 f6 15 e1 fe 2a d7 9b c4 1a d4 97 25 89 82 30 52 05 ed b7 b9 fc 6b ae f8 87 e2 fb 79 6d 86 95 a7 5c 47 3b 4a 7f 7e f1 36 76 28 ed c7 73 5e 74 3a 74 03 bf 15 59 7e 1e df bc 91 19 86 27 9b dc 8b 1d 48 45 2d 15 ed 23 c8 12 8a 5c 51 8a 1a 01 28 a5 c5 18 a5 60 12 8a 5c 51 54 31 a6 ba 4f 87 ba f4 5a 1e b2 c9 74 e1 2d ee d4 2b 31 e8 ac 09 20 fe a6 b9 da 51 e9 c6 3d eb 1a f4 95 58 38 b3 4a 55 5d 39 29 23 d4 7c 5f e3 e8 34 b8 05 b6 99 2c 53 de ca 3a a9 dc b1 0f ef 1c 57 96 c8 f2 4b 2b c9 2c 8d 23 c8 db 99 db ab 1a 40 aa 3e ea 2a fd 07 5a 5a cb 0f 84 8d 15 a6 e6 95 f1 32 aa ee c4 eb 8e 48 23 90 47 5c d7 6b e1 4f 88 93 d8 32 da 6a ec Data Ascii: $Ryj<1Oc/+{9$QU$%0Rkym\G;J~6v(s^t:tY~'HE-#\Q(`\QT1OZt-+1 Q=X8JU]9)#\|_4,S:WK+,#@>ZZ2H#G\kO2j
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 7c fc ca 41 07 d2 bd af 5a 06 e7 c1 f7 67 27 73 d9 93 ff 00 8e d7 89 4e c5 62 72 3b 0c d7 b6 a3 fd ab c1 61 cf 57 b0 ff 00 d9 2b c7 cc 96 b1 67 a9 97 bf 76 68 f1 81 82 a2 93 be 29 a8 70 8b f4 ae a7 c3 1e 06 b9 f1 0c 6b 73 24 df 67 b4 27 ef 01 96 93 e9 e9 5e 85 6a d1 a4 94 a5 b1 e6 d3 a7 2a 92 e5 8a 39 94 8e 59 9d 63 82 27 9a 56 e8 91 ae e2 7f 0a ed 3c 3f f0 ce f2 f0 2c fa c4 9f 66 87 af d9 e3 3f 3b 7f bc dd ab bc d1 bc 3b a7 68 30 f9 76 50 05 3d e4 6e 59 bf 1a d3 f4 af 1b 11 99 4a 7a 53 d1 1e de 1b 2e 8c 75 a9 a9 53 4d d2 2c 74 8b 71 6f 65 6f 1c 28 3f ba 39 3f 53 de ad e7 da 8a 2b cb 6d bd 59 e9 28 a5 a2 0c d1 45 14 ca b0 51 45 14 0c 28 a2 96 81 14 b5 8d 4e 1d 1f 4d b8 be 9c e1 21 52 71 ea 7b 0f c6 bc 22 69 9e ea 69 2e 66 2c 65 9d cc 8c 4f a9 ed fc ab bd Data Ascii: \|AZg'sNbr;aW+gvh)pks$g'^j*9Yc'V<?,f?;;h0vP=nYJzS.uSM,tqoeo(?9?S+mY(EQE(NM!Rq{"ii.f,eO
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 4e 47 e0 33 58 4b 15 4a 3b b3 48 d1 9c b6 47 38 16 90 8c 1a ef 6c be 13 cd 8f f4 cd 54 0c f6 82 2f ea 7f c2 b6 ad 7e 18 68 36 ff 00 eb 85 c5 c9 ff 00 a6 92 1c 7e 43 15 cd 3c ce 94 76 d4 e9 86 5d 56 6a fb 1e 4a d2 c6 9c 33 a8 fc 6a d5 b6 9d a8 5d 80 6d b4 eb c9 c1 e8 c9 11 c7 e6 78 af 6d b1 f0 de 91 a6 ae 2d 74 fb 78 fd c2 0c fe b5 a2 a8 00 da 00 03 da b8 e7 9a b7 a4 51 d7 4f 2b b7 c4 cf 1c b2 f0 17 88 6e f1 9b 34 b7 07 bc d2 01 fa 0a da b4 f8 4d 75 29 ff 00 4d d4 d6 31 e9 0c 79 3f 99 af 4a 2a 06 29 c0 d7 2c f3 0a cf 67 63 a2 9e 5d 4e 3b ea 71 b6 bf 0b 74 48 07 ef 8d cd d7 fd 74 93 1f a0 c5 6d e9 fe 13 d1 34 e2 0d be 9b 6e 87 fb c5 72 7f 5a d5 92 54 8d 4b 33 00 3d 49 e2 a9 d9 6b 16 1a 94 f3 c1 67 75 14 f2 5b 10 b2 84 6c ec 27 a0 35 cd 2a b5 26 b5 6c e8 85 Data Ascii: NG3XKJ;HG8lT/~h6~C<v]VjJ3j]mxm-txQO+n4Mu)M1y?J),gc]N;qtHtm4nrZTK3=Ikgu[l'5&l
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 7d f7 1e e7 b7 d2 b9 75 4f 2c 6d 51 b4 0e 46 0f 4a f4 69 65 73 92 bc dd 8f 32 a6 66 b9 ad 03 e8 81 82 33 46 2b 8c f0 0f 8d 3f b5 e2 1a 7e a0 ca 2f 63 1c 37 69 87 af d6 bb 42 31 5e 6d 5a 6e 9c b9 64 7a 54 6a aa 91 e6 43 4d 14 a6 92 a0 d4 29 ca 29 a3 a5 3d 68 19 1d c4 a9 02 34 b2 30 54 45 2c 49 f4 af 08 d5 f5 59 35 ad 56 e6 fe 5c fe f5 b6 a0 f4 41 c0 af 47 f8 a1 ac 8b 1d 21 2c 11 ca cb 7a 76 9c 75 11 8f bc 7f 90 af 2c 07 3d b1 ed e9 5e d6 59 43 47 51 9e 1e 67 5a f2 50 41 45 38 81 8a 6d 7b 16 3c 90 e7 b5 5a b1 d2 75 0d 53 fe 3c 2c e7 b9 00 e0 b2 2f ca 0f d4 d5 37 04 a9 c7 5c 1c 7d 6b db 3c 25 3d 9c de 1f b2 36 a5 0a 88 94 15 5c 70 d8 e7 3e f9 ae 2c 66 26 54 12 71 57 b9 d5 84 c3 46 bb b4 99 e7 96 7f 0d b5 eb a3 fb df b2 db 0f f6 9c b1 fc 80 fe b5 b7 6d f0 9e Data Ascii: }uO,mQFJies2f3F+?~/c7iB1^mZndzTjCM))=h40TE,IY5V\AG!,zvu,=^YCGQgZPAE8m{<ZuS<,/7\}k<%=6\p>,f&TqWFm

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49748	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	923	OUT	GET /static/js/swiper-bundle.min.js HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	904	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 135912 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iHL7kBveSjg0OI6iyWNW4C5ob38RMRwLL98hCKh%2FWdhh00j6FQ%2FwRBr%2Bz9RqWMxnxTWVjOUP7DoG4tTcCDLhakvCEoMYf0RNIMf%2BuZ5XBtUSUeJJLMjqTNy%2FDFs58GGzOU8O%2B%2Fo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f62def436d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2313&min_rtt=2296&rtt_var=895&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1501&delivery_rate=1199178&cwnd=162&unsent_bytes=0&cid=ee709f1ed7926c7b&ts=793&x=0"
2025-01-12 00:14:55 UTC	465	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 53 77 69 70 65 72 20 37 2e 34 2e 31 0a 20 2a 20 4d 6f 73 74 20 6d 6f 64 65 72 6e 20 6d 6f 62 69 6c 65 20 74 6f 75 63 68 20 73 6c 69 64 65 72 20 61 6e 64 20 66 72 61 6d 65 77 6f 72 6b 20 77 69 74 68 20 68 61 72 64 77 61 72 65 20 61 63 63 65 6c 65 72 61 74 65 64 20 74 72 61 6e 73 69 74 69 6f 6e 73 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 73 77 69 70 65 72 6a 73 2e 63 6f 6d 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 2d 32 30 32 31 20 56 6c 61 64 69 6d 69 72 20 4b 68 61 72 6c 61 6d 70 69 64 69 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 6f 6e 3a 20 44 65 63 65 6d 62 65 72 20 32 34 2c 20 32 30 32 31 0a 20 2a 2f Data Ascii: /** * Swiper 7.4.1 * Most modern mobile touch slider and framework with hardware accelerated transitions * https://swiperjs.com * * Copyright 2014-2021 Vladimir Kharlampidi * * Released under the MIT License * * Released on: December 24, 2021 */
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 69 6e 20 65 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4f 62 6a 65 63 74 7d 66 75 6e 63 74 69 6f 6e 20 74 28 73 3d 7b 7d 2c 61 3d 7b 7d 29 7b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2e 66 6f 72 45 61 63 68 28 28 69 3d 3e 7b 76 6f 69 64 20 30 3d 3d 3d 73 5b 69 5d 3f 73 5b 69 5d 3d 61 5b 69 5d 3a 65 28 61 5b 69 5d 29 26 26 65 28 73 5b 69 5d 29 26 26 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 5b 69 5d 29 2e 6c 65 6e 67 74 68 3e 30 26 26 74 28 73 5b 69 5d 2c 61 5b 69 5d 29 7d 29 29 7d 63 6f 6e Data Ascii: unction(){"use strict";function e(e){return null!==e&&"object"==typeof e&&"constructor"in e&&e.constructor===Object}function t(s={},a={}){Object.keys(a).forEach((i=>{void 0===s[i]?s[i]=a[i]:e(a[i])&&e(s[i])&&Object.keys(a[i]).length>0&&t(s[i],a[i])}))}con
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 79 70 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 7b 7d 3b 72 65 74 75 72 6e 20 74 28 65 2c 69 29 2c 65 7d 63 6c 61 73 73 20 6e 20 65 78 74 65 6e 64 73 20 41 72 72 61 79 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 73 75 70 65 72 28 2e 2e 2e 65 7c 7c 5b 5d 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 5f 5f 70 72 6f 74 6f 5f 5f 22 2c 7b 67 65 74 3a 28 29 3d 3e 74 2c 73 65 74 28 65 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 65 7d 7d 29 7d 28 74 68 69 73 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 3d 5b 5d 29 7b 63 6f 6e 73 74 20 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 65 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 41 72 Data Ascii: ypeof window?window:{};return t(e,i),e}class n extends Array{constructor(e){super(...e\|\|[]),function(e){const t=e.__proto__;Object.defineProperty(e,"__proto__",{get:()=>t,set(e){t.__proto__=e}})}(this)}}function l(e=[]){const t=[];return e.forEach((e=>{Ar
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 74 69 6f 6e 28 2e 2e 2e 65 29 7b 63 6f 6e 73 74 20 74 3d 6c 28 65 2e 6d 61 70 28 28 65 3d 3e 65 2e 73 70 6c 69 74 28 22 20 22 29 29 29 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 65 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 2e 2e 2e 74 29 7d 29 29 2c 74 68 69 73 7d 2c 68 61 73 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 2e 2e 2e 65 29 7b 63 6f 6e 73 74 20 74 3d 6c 28 65 2e 6d 61 70 28 28 65 3d 3e 65 2e 73 70 6c 69 74 28 22 20 22 29 29 29 29 3b 72 65 74 75 72 6e 20 6f 28 74 68 69 73 2c 28 65 3d 3e 74 2e 66 69 6c 74 65 72 28 28 74 3d 3e 65 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 74 29 29 29 2e 6c 65 6e 67 74 68 3e 30 29 29 2e 6c 65 6e 67 74 68 3e 30 7d 2c 74 6f 67 67 6c 65 43 6c 61 73 73 Data Ascii: tion(...e){const t=l(e.map((e=>e.split(" "))));return this.forEach((e=>{e.classList.remove(...t)})),this},hasClass:function(...e){const t=l(e.map((e=>e.split(" "))));return o(this,(e=>t.filter((t=>e.classList.contains(t))).length>0)).length>0},toggleClass
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 3d 21 31 29 3b 63 6f 6e 73 74 20 6c 3d 74 2e 73 70 6c 69 74 28 22 20 22 29 3b 6c 65 74 20 6f 3b 66 6f 72 28 6c 65 74 20 65 3d 30 3b 65 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 65 2b 3d 31 29 7b 63 6f 6e 73 74 20 74 3d 74 68 69 73 5b 65 5d 3b 69 66 28 73 29 66 6f 72 28 6f 3d 30 3b 6f 3c 6c 2e 6c 65 6e 67 74 68 3b 6f 2b 3d 31 29 7b 63 6f 6e 73 74 20 65 3d 6c 5b 6f 5d 3b 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 7c 7c 28 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 3d 7b 7d 29 2c 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 5b 65 5d 7c 7c 28 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 5b 65 5d 3d 5b 5d 29 2c 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 5b 65 5d 2e 70 75 73 68 28 7b 6c 69 73 74 65 Data Ascii: =!1);const l=t.split(" ");let o;for(let e=0;e<this.length;e+=1){const t=this[e];if(s)for(o=0;o<l.length;o+=1){const e=l[o];t.dom7LiveListeners\|\|(t.dom7LiveListeners={}),t.dom7LiveListeners[e]\|\|(t.dom7LiveListeners[e]=[]),t.dom7LiveListeners[e].push({liste
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 29 29 2c 69 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 73 29 2c 69 2e 64 6f 6d 37 45 76 65 6e 74 44 61 74 61 3d 5b 5d 2c 64 65 6c 65 74 65 20 69 2e 64 6f 6d 37 45 76 65 6e 74 44 61 74 61 7d 7d 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 74 72 61 6e 73 69 74 69 6f 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 65 26 26 74 2e 6f 6e 28 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 28 66 75 6e 63 74 69 6f 6e 20 73 28 61 29 7b 61 2e 74 61 72 67 65 74 3d 3d 3d 74 68 69 73 26 26 28 65 2e 63 61 6c 6c 28 74 68 69 73 2c 61 29 2c 74 2e 6f 66 66 28 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 73 29 29 7d 29 29 2c 74 68 69 73 7d 2c 6f 75 74 65 72 57 69 64 74 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b Data Ascii: )),i.dispatchEvent(s),i.dom7EventData=[],delete i.dom7EventData}}}return this},transitionEnd:function(e){const t=this;return e&&t.on("transitionend",(function s(a){a.target===this&&(e.call(this,a),t.off("transitionend",s))})),this},outerWidth:function(e){
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 65 5d 3d 74 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 28 74 68 69 73 2e 66 6f 72 45 61 63 68 28 28 28 74 2c 73 29 3d 3e 7b 65 2e 61 70 70 6c 79 28 74 2c 5b 74 2c 73 5d 29 7d 29 29 2c 74 68 69 73 29 3a 74 68 69 73 7d 2c 68 74 6d 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 29 72 65 74 75 72 6e 20 74 68 69 73 5b 30 5d 3f 74 68 69 73 5b 30 5d 2e 69 6e 6e 65 72 48 54 4d 4c 3a 6e 75 6c 6c 3b 66 6f 72 28 6c 65 74 20 74 3d 30 3b 74 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 74 2b 3d 31 29 74 68 69 73 5b 74 5d 2e 69 6e 6e 65 72 48 54 4d 4c 3d 65 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 Data Ascii: e]=t;return this}return this},each:function(e){return e?(this.forEach(((t,s)=>{e.apply(t,[t,s])})),this):this},html:function(e){if(void 0===e)return this[0]?this[0].innerHTML:null;for(let t=0;t<this.length;t+=1)this[t].innerHTML=e;return this},text:functi
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 72 28 6c 65 74 20 73 3d 30 3b 73 3c 74 2e 6c 65 6e 67 74 68 3b 73 2b 3d 31 29 74 68 69 73 5b 65 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 5b 73 5d 29 3b 65 6c 73 65 20 74 68 69 73 5b 65 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 61 28 29 3b 6c 65 74 20 73 2c 69 3b 66 6f 72 28 73 3d 30 3b 73 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 73 2b 3d 31 29 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 29 7b 63 6f 6e 73 74 20 61 3d 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 66 6f 72 28 61 2e 69 6e 6e 65 72 48 54 4d 4c 3d 65 2c 69 3d 61 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 2d 31 Data Ascii: r(let s=0;s<t.length;s+=1)this[e].appendChild(t[s]);else this[e].appendChild(t)}return this},prepend:function(e){const t=a();let s,i;for(s=0;s<this.length;s+=1)if("string"==typeof e){const a=t.createElement("div");for(a.innerHTML=e,i=a.childNodes.length-1
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 26 26 28 65 3f 64 28 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 29 2e 69 73 28 65 29 26 26 74 2e 70 75 73 68 28 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 29 3a 74 2e 70 75 73 68 28 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 29 29 3b 72 65 74 75 72 6e 20 64 28 74 29 7d 2c 70 61 72 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 73 3d 30 3b 73 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 73 2b 3d 31 29 7b 6c 65 74 20 61 3d 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 66 6f 72 28 3b 61 3b 29 65 3f 64 28 61 29 2e 69 73 28 65 29 26 26 74 2e 70 75 73 68 28 61 29 3a 74 2e 70 75 73 68 28 61 29 2c 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 20 64 Data Ascii: &&(e?d(this[s].parentNode).is(e)&&t.push(this[s].parentNode):t.push(this[s].parentNode));return d(t)},parents:function(e){const t=[];for(let s=0;s<this.length;s+=1){let a=this[s].parentNode;for(;a;)e?d(a).is(e)&&t.push(a):t.push(a),a=a.parentNode}return d
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 61 6c 75 65 28 22 74 72 61 6e 73 66 6f 72 6d 22 29 2e 72 65 70 6c 61 63 65 28 22 74 72 61 6e 73 6c 61 74 65 28 22 2c 22 6d 61 74 72 69 78 28 31 2c 20 30 2c 20 30 2c 20 31 2c 22 29 2c 61 3d 6e 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 70 6c 69 74 28 22 2c 22 29 29 2c 22 78 22 3d 3d 3d 74 26 26 28 69 3d 73 2e 57 65 62 4b 69 74 43 53 53 4d 61 74 72 69 78 3f 6e 2e 6d 34 31 3a 31 36 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 70 61 72 73 65 46 6c 6f 61 74 28 61 5b 31 32 5d 29 3a 70 61 72 73 65 46 6c 6f 61 74 28 61 5b 34 5d 29 29 2c 22 79 22 3d 3d 3d 74 26 26 28 69 3d 73 2e 57 65 62 4b 69 74 43 53 53 4d 61 74 72 69 78 3f 6e 2e 6d 34 32 3a 31 36 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 70 61 72 73 65 46 6c 6f 61 74 28 61 5b 31 33 5d 29 3a 70 61 72 73 65 46 6c 6f 61 74 28 61 5b Data Ascii: alue("transform").replace("translate(","matrix(1, 0, 0, 1,"),a=n.toString().split(",")),"x"===t&&(i=s.WebKitCSSMatrix?n.m41:16===a.length?parseFloat(a[12]):parseFloat(a[4])),"y"===t&&(i=s.WebKitCSSMatrix?n.m42:16===a.length?parseFloat(a[13]):parseFloat(a[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49751	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	997	OUT	GET /static/image/gou.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/static/css/style.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	871	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/png Content-Length: 2321 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7qmdgFGWjVV2%2BBjzwJesGV2SaCH286MVTKFWoKl3hgJ9ECWe2ER3o9BItFaKU98cj9Jfu892IL9xgxpAQYGvcdHDraiZsz2yHnHJl%2FkTVAn8ZWERbdC6VOYlN2cL2NjkuqOh79A%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f60acd72ad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2060&min_rtt=2025&rtt_var=784&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1597&delivery_rate=1441975&cwnd=237&unsent_bytes=0&cid=5c33ab519a09bd0b&ts=800&x=0"
2025-01-12 00:14:55 UTC	498	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 05 bb 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 62 30 66 38 62 65 39 2c 20 32 30 32 31 2f 31 32 2f 30 38 2d 31 39 3a 31 31 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 Data Ascii: PNGIHDR@@iqpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:R
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 45 76 74 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 45 76 65 6e 74 23 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 32 34 2d 31 32 2d 30 34 54 31 30 3a 31 36 3a 33 32 2b 30 38 3a 30 30 22 20 78 6d 70 3a 4d 6f 64 69 66 79 44 61 74 65 3d 22 32 30 32 34 2d 31 32 2d 30 35 54 31 37 3a 35 39 3a 32 34 2b 30 38 3a 30 30 22 20 78 6d 70 3a 4d 65 74 61 64 61 74 61 44 61 74 65 3d 22 32 30 32 34 2d 31 32 2d Data Ascii: tp://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-04T10:16:32+08:00" xmp:ModifyDate="2024-12-05T17:59:24+08:00" xmp:MetadataDate="2024-12-
2025-01-12 00:14:55 UTC	454	IN	Data Raw: 08 df 3c 73 fe 1d 76 2f a3 fe 36 fc 80 75 96 7e 29 fb 24 93 0a a3 88 11 30 88 af db ae ed c2 c5 8c f5 47 a5 61 bf be 87 9e 09 05 04 bd 76 8a 30 60 1c 6b 3b 5c df 85 0b 3d ea 7e 8e 73 3d ee 69 4a 06 1d 5b b6 b2 0c e4 fd 04 5e 91 86 7f 27 23 1b f8 08 f7 f0 69 87 b2 49 1c ec d1 7e 13 b3 f8 40 f7 b5 40 2e f2 1a 70 50 f7 80 a5 55 76 58 5a b1 1d 69 5d db 80 ef 65 0b 96 ff e1 2d 69 e3 53 0a 45 8c 80 2c 6f e6 33 cc e1 8c b4 ac 1d c9 d8 fe 28 fe ec 4b 59 46 f2 c6 80 4b 78 21 e3 bd 27 f0 97 f4 f0 59 ea 7c d5 6a bf 54 f2 1a 70 1e 3f 2f e3 fe 4d 7a 3f 7c 53 da e2 8e f5 a9 69 59 14 31 0b 7c 88 1b 8a 59 99 cd e3 a6 34 83 54 42 11 06 dc c7 bb 52 a0 cb 63 42 53 0a 7a 6f 2b 31 e8 b5 53 d4 52 f8 6f ec 6c 1d f7 3b 5d 0d 60 4f ab ad ca 28 72 2f 70 45 ca d1 2d 35 2d 2e c5 97 Data Ascii: <sv/6u~)$0Gav0`k;\=~s=iJ[^'#iI~@@.pPUvXZi]e-iSE,o3(KYFKx!'Y\|jTp?/Mz?\|SiY1\|Y4TBRcBSzo+1SRol;]`O(r/pE-5-.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49747	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	603	OUT	GET /telegram-16/555.jpeg HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:54 UTC	953	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:54 GMT Content-Type: image/jpeg Content-Length: 59978 Connection: close ETag: "4116e064ac15ff520a5a123614cd9b32" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2914 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rGlCNUM5SjPQWAz%2FwCwxlOqi43HNTxbcxIvcieE%2BrggXVmVcRDcW3ddMrQnQB5JZrEHy%2FCG0UsARo1%2FuGmimJqXGGizzS2C%2FZSDaQZ4IfudALtNtCBDJ79nGPgbtfKFukx%2FfXLB12Ws%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f6e8e842e6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1565&min_rtt=1564&rtt_var=589&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=1181&delivery_rate=1852791&cwnd=202&unsent_bytes=0&cid=f00ed4f7c9f0fa9d&ts=295&x=0"
2025-01-12 00:14:54 UTC	416	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 32 0a ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 40 04 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$@"
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: cd 66 f1 51 d9 a3 39 62 e3 b3 45 0b 69 a3 1b 89 00 92 6a ad c3 20 dd 8e 84 d2 dc 44 63 6c ae 70 4d 46 90 19 08 27 3c d6 91 8c 7e 23 48 46 37 e6 b9 35 b9 12 2a 00 7b d5 cb 98 42 ec 60 d9 c1 aa b0 da 30 7e 38 15 62 58 dd 97 e5 27 35 94 da e6 56 66 53 6b 9b 46 52 94 8d e7 9a 83 18 1f 8d 4a f6 d2 00 59 8f 22 aa ee 20 9c d7 54 2c d6 87 54 15 d6 8c b0 9d 4f 34 8c 48 61 4c 89 9d b9 55 34 17 3b 80 20 e4 75 a7 6d 47 cb a8 3f 50 7d ea 68 49 50 a4 7a d5 76 7c 75 1c d5 ab 40 24 c0 f7 a5 3d 22 2a 9a 47 53 4e 29 dc aa e4 f4 aa f7 d3 b3 8c 7b d6 82 db a0 8c 15 39 c1 aa 97 d6 d8 52 47 3c d7 9f 4e 51 e7 3c ea 72 8f 39 93 ff 00 2d 09 c5 4f 08 0d da a2 61 89 48 ab 56 b0 96 c9 c5 76 d4 92 51 b9 dd 52 5a 5c 6c 91 80 33 54 24 4c b6 6b 66 78 3f 75 d2 b3 26 4c 1a 54 67 70 a1 3b Data Ascii: fQ9bEij DclpMF'<~#HF75{B`0~8bX'5VfSkFRJY" T,TO4HaLU4; umG?P}hIPzv\|u@$="GSN){9RG<NQ<r9-OaHVvQRZ\l3T$Lkfx?u&LTgp;
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 09 1e 5f 20 0c 0a f3 a3 5d c5 5a c7 95 1c 4b 8a b5 8e 2d e1 99 26 60 47 e3 53 db 3b c4 fb 58 1c 1a e8 26 b3 8d 93 76 07 5a 8a 3d 3d 1a 60 0f 61 5d 5f 5a 4e 3a a3 b7 eb 91 94 75 45 a8 2f 36 42 a0 a7 ca 3d aa 78 af 61 2d bb 03 8e d5 1b da 95 85 b0 72 05 63 b4 72 46 e5 d7 a1 ae 38 d3 8d 4b 9c 10 a5 0a 97 b1 26 ab 2c 2b 23 b2 70 08 e9 58 b2 4a 0a d4 97 be 63 38 24 e3 3c 55 57 42 56 bd 5a 14 d4 62 8f 63 0f 49 46 2b 52 d4 32 05 2b cf 71 5b 96 4a 24 9b ad 73 28 1b 19 e6 af d9 5f 34 7c 13 83 ea 69 62 28 b9 2f 74 9c 4d 07 25 ee 9a 57 b1 f9 72 b8 27 83 58 d2 0e 2a c5 e6 a3 bc e0 b8 aa 0d 32 f6 6c fe 14 f0 f4 a5 15 a8 f0 f4 64 96 a5 a5 e5 6a 7b 51 9c d5 01 74 00 c6 6a 68 2f 11 47 51 57 38 49 ad 0b 9d 39 5b 62 79 3e 59 41 35 28 39 89 b9 aa af 38 72 0e 41 c7 a5 4d 0c Data Ascii: _ ]ZK-&`GS;X&vZ==`a]_ZN:uE/6B=xa-rcrF8K&,+#pXJc8$<UWBVZbcIF+R2+q[J$s(_4\|ib(/tM%Wr'X*2ldj{Qtjh/GQW8I9[by>YA5(98rAM
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 54 af 22 0e c7 1e b5 95 39 2e 73 0a 73 5c ef 42 99 98 95 a5 b3 98 c6 cc 57 39 35 27 d9 c6 da bd a6 58 a9 39 23 9a d6 73 8a 8b b9 b5 4a 90 8c 19 46 f2 66 75 c3 03 f8 d0 93 80 98 cf 6a d8 d4 34 e5 09 9c 0a c3 fb 3b 21 22 a6 94 e3 38 e8 4d 1a 90 a9 1d 0d cd 22 75 7d a0 90 3b 57 49 71 24 0b 02 95 3c 81 5c 0d bc d2 5b 4a 02 9a d0 9f 52 97 ca e3 39 c5 72 e2 30 8e 53 4d 33 8b 13 82 73 a8 9a 67 42 6f 62 03 ef 76 aa 52 dc ab ed da 6b 9f 8e ea 57 e7 26 91 6e de 29 46 e3 c5 38 e0 ec 54 70 1c af 73 6a f5 1b c9 46 e0 d1 61 86 0b cf a8 ac f9 6f cb 47 c9 ed 4c b3 bd 21 b0 33 c5 3f 63 2e 4b 0f d8 4b 91 a3 6d 90 0b 98 cd 5b bb 4c db 9e 3b 56 42 de 13 2a 1f 4a b7 35 db 98 b9 07 15 cd 2a 72 ba 39 27 4a 57 89 98 b0 65 49 fa d5 8b 63 b1 14 1a 85 2e 55 53 1d e9 22 b9 57 2a 3b Data Ascii: T"9.ss\BW95'X9#sJFfuj4;!"8M"u};WIq$<\[JR9r0SM3sgBobvRkW&n)F8TpsjFaoGL!3?c.KKm[L;VBJ5r9'JWeIc.US"W*;
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 26 85 6f 9e a3 04 93 46 48 39 ae 9b 1d bc a6 84 4a 59 86 2a d2 3e c0 46 6b 3e 1b 8d a2 95 ee 8e ea c2 50 6d 9c b2 a6 e4 cb 4c a5 c9 22 90 fd dc 53 12 e4 6d a8 8d c8 66 c5 25 16 25 06 4a 84 a8 ef 53 58 ce 52 73 9e b5 0f 9c a1 31 de a0 8e 7d 92 93 43 87 32 68 39 39 93 46 9e a5 75 ba 22 33 50 d8 dc 9f 27 19 aa 57 13 ef 5c 52 5b 49 b5 3a f7 a1 51 b4 2c 0a 82 54 ec 3a f9 b7 4a 0d 3c 7f ab fc 2a b4 ef bd 81 ab 0a e3 cb c5 69 6b 45 23 56 ad 14 86 5a 71 75 5a 33 f4 04 d6 7d 9a ef bc 02 b5 ee 21 1b 46 3a d6 35 9d a4 8c 2b ca d3 43 23 3f 76 ab cc 39 fc 6a ed bd b3 48 14 0a ad 79 0b 42 c4 30 c1 15 94 24 b9 ac 61 09 2e 6b 22 1c fc b8 ab b6 8c 55 41 1d 6a 87 55 ab b6 8a 59 38 14 ea 2d 0a aa bd d2 fd dc be 60 19 fe ed 64 48 a0 b9 3e d5 ad 34 2f b0 12 0f dd ac b9 01 0e Data Ascii: &oFH9JY>Fk>PmL"Smf%%JSXRs1}C2h99Fu"3P'W\R[I:Q,T:J<ikE#VZquZ3}!F:5+C#?v9jHyB0$a.k"UAjUY8-`dH>4/
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: ad 6e ad 73 a1 49 72 dc 3c c6 03 15 0b 9d dc 9a d7 1a 7e e8 f2 05 66 dc c4 63 38 a9 85 48 c9 e8 45 2a 91 93 b2 2b 8e bd 29 68 a3 15 b9 b8 87 06 9e 9d 69 bf 85 49 0a ee 35 2f 60 6f 42 c2 1c 8a 8e 51 cd 5c 4b 37 d9 90 2a b4 c9 b1 b0 6b 08 c9 37 a1 cd 09 26 f4 12 0a b0 40 c5 43 00 dc 71 57 4d b3 04 dd 53 36 93 22 a4 92 66 1b 8f 98 d3 69 ce 3e 63 f5 a6 d7 59 de 14 51 45 00 39 0e 0d 4e b2 11 50 0e b5 20 e4 54 c9 11 24 58 8e 72 0f 5a 59 a7 2c b8 cd 57 07 14 31 c8 a8 e5 57 32 e4 57 1b bb 9a 7c 4d 83 51 52 a9 ab 68 d1 a3 56 d6 e3 69 15 a6 6e 43 47 8a e7 e1 93 1d ea d8 9f 8c 66 b8 ea 52 bb 38 6a d1 bb b8 b7 b2 e4 11 59 64 f3 56 6e 65 cd 53 ce 6b a6 94 6c 8e ba 30 b4 45 27 34 d1 46 73 45 6a 6e 2d 28 a4 1c d2 ed a4 21 4d 36 94 d2 66 80 42 66 8a 28 a6 31 69 d4 da 77 Data Ascii: nsIr<~fc8HE+)hiI5/`oBQ\K7k7&@CqWMS6"fi>cYQE9NP T$XrZY,W1W2W\|MQRhVinCGfR8jYdVneSkl0E'4FsEjn-(!M6fBf(1iw
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 71 2c 47 86 3f 43 51 ec 2d 1b 45 99 3c 2d 95 a2 cd fd a7 3d 69 ac 84 77 ac e8 f5 53 80 1d 71 ee 2a c0 bd 59 14 6d 70 4f a7 7a e5 74 26 99 c9 2a 13 8e e8 94 2f cf 9a bf 07 dd ac cf 34 8e 49 ab 30 5d ed 1c 8a ce ad 39 34 63 52 9b 68 96 ed 4f 39 ac 7b 8e a6 b4 ee 2e 43 29 ac 89 df 71 ad b0 d1 6b 73 a3 09 17 d4 86 97 14 99 38 39 a0 1a ed 67 a0 21 51 d6 a5 83 86 15 11 34 f8 df 69 a5 25 a0 a4 ae 8d ab 73 f2 8a b4 7e e7 e1 59 d6 b3 8c 00 4d 5d 33 a8 5e b5 e5 d5 83 52 3c 7a b0 7c c6 65 da e2 5c d5 ab 33 c5 54 ba 90 33 f1 53 59 ca 07 06 b6 94 5b 82 3a 26 9b a6 8b ae 72 bc d6 3d e2 e1 ab 55 d8 6d eb 59 57 8c 0b 1a 58 75 a8 61 95 a4 5a d3 17 24 1a da c0 2b 8c 56 26 98 e0 10 2b 68 1f 97 3c 56 18 9f 8c e6 c5 df 9c c5 d5 21 c6 48 aa 96 4b 97 15 a1 aa 30 20 d5 0b 12 37 Data Ascii: q,G?CQ-E<-=iwSqYmpOzt&/4I0]94cRhO9{.C)qks89g!Q4i%s~YM]3^R<z\|e\3T3SY[:&r=UmYWXuaZ$+V&+h<V!HK0 7
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: b8 ba 9b 23 86 20 fc ab f8 9f d0 1a fb 7e 14 da 00 aa b0 fa 12 a2 e0 0a 90 0c 52 28 c7 14 ea 4c 02 94 0a 4c 73 4e 03 34 80 28 a2 96 80 12 96 8e 94 50 01 8a 36 d2 d1 40 0d c0 34 85 69 f4 94 01 19 4f 5a 63 46 0d 4f 8a 4c 7b 53 02 a3 db 2b 0c 10 2b 37 54 f0 d6 9d ab 42 d0 5e d9 c1 71 13 f0 52 44 0c 0f e0 6b 73 6e 69 36 d3 e6 61 63 c4 fc 53 fb 32 f8 3f 5b 2f 25 94 32 e9 73 b7 21 ad 9b 0b ff 00 7c 9e 3f 2c 57 8e 78 b3 f6 63 f1 76 88 1e 6d 29 a1 d5 ed d7 90 23 3b 25 c7 fb a7 83 f8 1a fb 34 a0 a6 34 2a c3 90 2a b9 fb 93 cb d8 fc db d4 74 cb cd 2a e9 ed 2f ed 66 b5 b8 8c e1 a2 99 0a 32 9f 70 6a 99 5c 57 e8 27 8f 3e 17 f8 77 e2 0e 9c d6 9a b5 9a 19 42 91 15 d4 60 09 61 3e aa de 9e c7 83 5f 11 fc 41 f0 36 a3 f0 f7 c4 d7 3a 1e a1 f3 98 8e e8 a6 03 e5 9a 33 f7 5c 7f Data Ascii: # ~R(LLsN4(P6@4iOZcFOL{S++7TB^qRDksni6acS2?[/%2s!\|?,Wxcvm)#;%44*t/f2pj\W'>wB`a>_A6:3\
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 83 38 3d 2b 63 fb 3e 29 e4 66 da 08 5a 9c 5a 44 6d c9 e3 8a e6 a9 8b 8c ad 74 72 55 c7 46 49 5d 6a 73 b6 da a9 53 b6 4e 18 75 14 b7 3a a2 99 55 c9 e2 ab ea 76 60 5c 6e 41 8a a6 f6 cc e4 2f 3c d7 54 69 d3 95 a4 75 c2 95 29 5a 67 55 a3 dd a1 cc 80 67 3d ea 3b fb f5 8a 51 db 26 a5 d1 6c 0c 70 05 5e 69 6e 74 7f b5 4e 59 bf 86 bc eb d3 55 1d f6 3c be 6a 4a b3 6f 62 a4 d7 fb a0 22 b9 f5 9f 63 b7 b9 ae c5 f4 75 36 ff 00 77 8c 57 27 a8 69 ed 0c e7 6f 43 5d 78 49 d3 95 e2 8e dc 15 4a 52 bc 51 4e ee 71 26 3d 8d 6a 43 7a ab 08 5a c6 b8 85 93 93 da 9d 18 72 83 ad 77 ce 94 65 14 7a 73 a5 19 45 1a 56 37 0a b7 b2 31 3c 1a b1 aa dc ac 90 30 06 b0 e3 32 09 88 19 c9 a9 6e 7c c2 9c 93 51 2a 0b 9d 4a e6 72 c3 af 68 a5 72 fd b3 a8 84 64 f6 aa 7c 7d ac e3 a6 2a 18 65 7d b8 e6 Data Ascii: 8=+c>)fZZDmtrUFI]jsSNu:Uv`\nA/<Tiu)ZgUg=;Q&lp^intNYU<jJob"cu6wW'ioC]xIJRQNq&=jCzZrwezsEV71<02n\|QJrhrd\|}e}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49756	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	998	OUT	GET /static/image/left.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/static/css/style.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	875	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/png Content-Length: 1090 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3M6rOU3NnlNNZssbG1SLnBQAs3mV3NfVB%2FGYlIagln3xmy1bazRFcbJZTOGRTxtpfqcFR8METzzNOw%2BGUkBco1y%2Bkr1np5qFLzoIux9l5%2BZkAX2GZd4No3w3PFlGQndUNgeFteY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f87984429d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1641&min_rtt=1600&rtt_var=629&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1598&delivery_rate=1825000&cwnd=247&unsent_bytes=0&cid=e2e527e4553d9fc7&ts=804&x=0"
2025-01-12 00:14:55 UTC	494	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 d5 50 4c 54 45 00 00 00 ef ef ff ef ff ff e7 f7 f7 ef ef f7 ef ef ff ef f7 f7 ef f7 ff ea f4 fa ef ef fa ef f4 fa ef f4 ff eb f3 fb ef f3 fb ef f3 ff ec f2 fc ef f2 fc ef f2 ff ec f2 fc ef f4 fc ed f1 fd ed f4 fd ef f4 fd ef f6 fd ef f5 fd ed f3 fd ed f5 fd ef f5 fd ef f4 fd ef f6 fd ed f4 fd ef f4 fd ef f5 fd ed f4 fd ef f5 fe ee f3 fe ee f5 fe ef f4 fe ef f6 fe ee f3 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f4 fe ef f5 fe b4 c2 d7 bf cb df bf cc de bf cc df c2 ce e0 c3 cf e1 c6 d1 e2 c7 d2 e3 ca d5 e5 d5 de ec d5 de ed d5 df ec d8 e1 ef d9 e1 ef d9 e2 ef e0 e8 f4 e7 ef f9 e8 ee f9 Data Ascii: PNGIHDRxxsRGBPLTE
2025-01-12 00:14:55 UTC	596	IN	Data Raw: 90 dd ed 25 00 87 90 1f ac 80 1c 73 74 18 17 23 f3 b8 ee b2 c7 e4 02 98 5e b3 75 85 ac 30 46 17 20 ae 3f 9f cf 80 35 a7 75 dd 21 30 67 d2 74 61 39 16 58 04 ec 89 0e d2 d1 35 3b 1b 33 93 3e 6d de 7d a9 e8 ec ea ca 9e 3b b3 77 eb 3c cf f3 35 b1 b2 3d a4 9b e7 d7 e5 3f eb 71 37 f8 8f 9b 6f 48 f5 e5 a1 dd fc aa e2 97 c7 ac 0d de b9 f9 4d d5 9e 97 b3 c1 7b ee 9b ca a7 48 87 6f 0e ef bb 3f 2a 7f fd 94 6d 55 72 73 21 b1 bb 7d 49 b7 ac bc b4 a8 0b 9a a5 a7 dd 5d 7b 5f 7b b2 2e 80 4f af 69 94 6b 5d a3 2e 85 5d 58 50 87 18 e9 82 b1 9c 0d a5 5d db 20 0f c4 5d 78 58 7c 08 17 77 2d d5 a5 c5 5d cb 0a 75 29 ee 5a ca fa 85 b8 0b 71 21 9c 89 bb 96 87 a6 11 77 2d 13 b9 fa 7f 1f 88 2e 00 0e fe 46 76 91 f0 d7 2d fc 1d 1a 85 6f b7 f0 fa 8e 13 ae 2e ae 0d 55 36 c8 e9 74 fb 96 Data Ascii: %st#^u0F ?5u!0gta9X5;3>m};w<5=?q7oHM{Ho?*mUrs!}I]{_{.Oik].]XP] ]xX\|w-]u)Zq!w-.Fv-o.U6t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49755	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	366	OUT	GET /telegram-16/phone.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:54 UTC	951	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:54 GMT Content-Type: image/jpeg Content-Length: 687893 Connection: close ETag: "7ea114f508dd0209331bff9f4f8f2bba" Last-Modified: Fri, 06 Dec 2024 01:40:29 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2921 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2GjsNp2UmAZuOdPXJ1Uu%2BTgIQ0a%2F6V6wIbbmTSZCyElKe5EE02bN%2FL8rB53DGxMetMJae7urLluCKHay44Rb6E7soOkRnRTS9GsKC0y%2FXksQ7knFYREX3N%2FHveD6pZsaDBp2uWpr27g%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f89b238c69-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1790&min_rtt=1780&rtt_var=688&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=944&delivery_rate=1568206&cwnd=217&unsent_bytes=0&cid=28506682e038dba9&ts=242&x=0"
2025-01-12 00:14:54 UTC	418	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 0a 68 00 00 0a b8 08 03 00 00 00 7e 23 5e 76 00 00 02 8b 50 4c 54 45 00 00 00 76 76 76 71 71 71 6d 6d 6d 67 67 67 5e 5e 5e 63 63 63 47 47 49 54 53 54 ff ff ff 6d 6d 6d ff ff ff 84 84 83 ff ff ff 7c 7c 7c 87 87 87 ff ff ff ff ff ff ff ff ff 9a 9a 9a 92 91 91 ff ff ff ff ff ff 77 77 75 e4 e4 e4 c9 c9 c9 fe fe fe f2 f2 f2 e5 ee f7 18 18 18 bc d3 f7 c0 c7 f7 c0 da f5 c4 bc f6 b4 dc f8 d0 d0 d0 e6 e6 e6 cb d6 f0 f7 c0 db de de de f0 c6 e2 08 07 08 b5 d1 ee b4 b4 b4 dd d0 ea d5 d5 d5 c6 c5 c5 bd bd bd d4 d3 ed 99 9a 9a a6 c9 e6 e7 ca e5 a8 bc dc 25 24 24 ba c9 f0 be b6 ed a3 b7 d5 2e 2e 2e 90 91 90 39 84 f7 ad c4 e2 63 b0 e0 c0 d2 ea 00 7f db a9 aa ab 3d 3d 3d b3 ae e0 03 89 db a3 a4 a4 a7 a2 d3 5d cb 90 34 Data Ascii: PNGIHDRh~#^vPLTEvvvqqqmmmggg^^^cccGGITSTmmm\|\|\|wwu%$$...9c===]4
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: c6 09 a4 e5 d0 c1 b9 5a c4 d8 8b 75 6a b9 b3 c9 81 cc df e6 d5 d6 d0 d5 df b0 d1 dc 67 56 53 a4 cc d7 cd bf d6 81 6b 62 5d a0 f3 5a 64 75 c1 d4 de d4 ba a9 7c 54 41 a6 b4 c8 8c 61 4b 70 47 36 cc e3 f8 4a 91 e0 5e 4c 44 e2 c4 ac 59 40 31 ae 9c 90 99 6e 58 f3 d6 e7 77 61 57 9c 7d 71 98 a7 bc ae 7c 5c 91 83 79 bf ca d3 fb 4d 62 9a 94 87 bd 84 65 25 6a b9 47 35 28 3a 7f d0 59 77 3b 74 b2 cc bb ab a0 4b 91 f6 72 aa 62 c0 91 73 a6 8a 7e 68 8e 5e e4 d0 bf 70 ac f7 39 24 19 8f df fa cf 98 7c 16 5a a7 f8 7f 8f 61 9f ba aa 6d 49 d0 a7 8f 46 5e 2c 79 92 b0 8c 80 95 c7 33 06 47 77 b2 58 93 48 4b 8f 9c fd d7 b3 f9 a2 ad 77 57 c4 c6 e3 ce e8 b6 93 9f c5 9c 64 75 95 89 b9 7f 6d 9a 84 37 5b 89 49 c8 fb 2b 3c 5f b5 d4 b4 5e 4c 9e 69 31 18 6f d5 fb fa e4 cd f3 a7 6e f7 7d Data Ascii: ZujgVSkb]Zdu\|TAaKpG6J^LDY@1nXwaW}q\|\yMbe%jG5(:Yw;tKrbs~h^p9$\|ZamIF^,y3GwXHKwWdum7[I+<_^Li1on}
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 55 82 61 58 19 48 06 1e a4 03 c1 d2 44 93 33 4e 9f 30 39 19 09 2c 4a 56 4b b9 f3 d5 f7 68 c9 dc 4c e6 c6 f6 69 b9 27 17 9b fe 7a 50 b9 8b e2 b9 2b 2e b2 b7 af 6c 93 b6 09 02 33 82 1c 31 8a 49 73 4e 55 fa 27 e0 c7 4a a7 c1 bb 36 70 27 28 88 5e 05 ce aa aa aa ea 6d 24 d7 93 2e dc 1f 19 7e 87 0e b9 5e db d0 4b 01 56 ae 91 08 d3 0a a0 18 2e 05 88 c4 11 00 b9 84 8f c2 da 36 6f 2b d9 77 4d 2b 75 31 f5 4c b2 e3 ad 90 0a 0c 4f ca 04 de 85 30 64 70 06 72 db c8 d9 0b 60 48 fc 71 79 1a af 41 1b cb 0a 48 0b 62 0d 78 bb 1f fe ca 7f 84 a9 81 cc aa aa aa ea 3d a5 d9 86 a0 d8 cc 97 42 45 ea 8a 52 76 93 21 3d 58 06 24 ae 28 0f 8a 14 2b 9b ef 0e d0 12 38 e3 eb 7d 00 38 31 69 7d 70 62 7b f6 95 c2 5d e0 db 37 0c 3a b4 09 4b 82 b4 01 7f 00 af 4c b5 99 34 51 e1 79 98 3a 5b 6c Data Ascii: UaXHD3N09,JVKhLi'zP+.l31IsNU'J6p'(^m$.~^KV.6o+wM+u1LO0dpr`HqyAHbx=BERv!=X$(+8}81i}pb{]7:KL4Qy:[l
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 75 19 7b 83 c3 ed 1c 61 cc 14 e6 21 a7 10 2e 37 0e 89 f6 2c 50 a4 cd 83 30 dc 86 61 da 25 33 bf 11 5e b3 5b 21 bd cf ff 25 f3 26 21 fe ad a8 06 35 ab aa aa aa ef 17 5e a9 bd da 6d c4 16 9f 08 8f cf 7f 6a 4e 0c 23 0e 2d 83 0b be d2 e6 17 82 a1 87 d3 e2 03 cc 47 50 09 77 20 c2 40 c0 f4 27 60 ca 33 37 40 e4 04 38 6e 33 66 62 bd 87 22 9a 6e 70 8e bf 20 5a 7d 02 0e a1 05 01 5c 3a af 8b 8b b2 83 6d 4c 61 03 53 84 4d 6e 68 c3 3d 2a ce 37 14 32 ab aa aa aa e7 2a fe f2 e1 9e 1f 6c c9 ce 65 64 40 94 4c 9b 76 06 60 c3 11 c2 7c 6c d9 1d f7 38 db cb 94 34 0d 5e 7c b3 f8 20 42 f1 8c b6 10 bc 56 83 65 df 3e 8e a7 22 24 4e c9 73 6a 46 bb cf b1 d8 bc d2 5b e8 26 9a c6 1f ad 5b 99 36 99 a1 50 ef d4 ac aa aa aa be 57 32 77 3a 09 4e e2 44 f3 c1 32 bf 68 85 59 dc 0d 1e a7 c0 Data Ascii: u{a!.7,P0a%3^[!%&!5^mjN#-GPw @'`37@8n3fb"np Z}\:mLaSMnh=72led@Lv`\|l84^\| BVe>"$NsjF[&[6PW2w:ND2hY
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 67 1b 50 14 45 51 f4 4a e9 8c 13 7f 37 d3 0f 75 7c 35 5d d6 fb 98 bd 5b e4 e9 71 86 7e 69 e4 52 11 17 3a 6f 49 dd 2e 26 de 4c dd a3 e6 3c c7 f6 00 98 03 cc 14 e0 28 f6 d3 9c d8 64 59 f4 e8 89 ca 9c 68 64 a3 d5 3f 51 55 8c b9 a4 71 2f 69 ae c5 58 55 3b 19 33 fd c6 1d 1f 2d 65 d4 5c a0 b6 0e 4a 6b bb 7e 2f 56 cf df 27 cd 79 3b 50 a2 99 51 14 45 d1 0b 8f 67 37 65 16 a1 4c c5 46 ee 49 30 e9 90 22 6e 91 e5 e5 88 a6 3a 63 a8 a2 4c 87 fb 69 46 a1 02 26 9e ee 31 a9 93 ab 40 0b 05 4e 7b a9 b5 41 44 87 0a 45 b2 54 0e 53 f2 e2 3a 17 aa 0c 71 9c 43 83 34 52 ac ef c3 ef f6 b5 ba 3f 6b cd eb fe 85 2b 60 53 5f ea 2d f5 c0 d8 5f 5a 40 d7 d1 ed f9 aa 66 14 45 51 74 4b e3 18 cd 34 65 92 fc a8 c8 db 60 59 2c 63 e3 2f d1 ea 15 27 16 9a 8e aa 2f 0a 0a 56 ea 61 38 b8 6a 21 d8 Data Ascii: gPEQJ7u\|5][q~iR:oI.&L<(dYhd?QUq/iXU;3-e\Jk~/V'y;PQEg7eLFI0"n:cLiF&1@N{ADETS:qC4R?k+`S_-_Z@fEQtK4e`Y,c/'/Va8j!
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 58 ca 28 8a a2 e8 e9 a3 26 07 a1 4d 18 b3 fd 5a 26 6c 09 5f 9a 31 af 32 a5 8f 15 14 69 c2 26 f7 f6 86 88 f2 a8 92 4c 68 73 93 e6 a0 ab 26 02 b8 ea f5 5e fc 02 c2 3a 3b 66 87 13 4b d8 56 bc 68 2d 48 48 dc 88 9f 91 4c e6 b9 d4 b9 20 3d 33 a1 67 f8 76 5a 50 f3 dd af 38 f4 1b c7 bc 19 0f da 34 65 f2 4f 81 76 a1 1f 29 73 24 a8 19 45 51 14 2d 1a 2b 70 72 d9 12 99 12 11 07 f1 c1 eb 67 8f 27 02 1d 79 bd 97 44 85 f2 19 f7 c8 42 3f 37 c8 3b 57 14 88 f3 da 2e 4e 7a 20 66 01 2d b5 6e da 61 a6 50 0c 47 83 99 00 ae 22 7e 48 1c 27 ec 73 2f fb ad 8f e2 61 f0 d2 6f 9f 8f 2d fa a4 24 e8 b4 b4 0f bd 40 4d 54 6c 0b 7a 3f a2 39 12 d3 fc c5 de 99 28 b7 0d c3 50 30 6a d3 fc ff 27 77 a8 a2 5d 8a 6b 14 b6 c7 cd a4 12 1e 29 12 3c 24 cb e9 b5 05 af 56 ab d5 6a 0d e9 34 f3 30 0d 99 Data Ascii: X(&MZ&l_12i&Lhs&^:;fKVh-HHL =3gvZP84eOv)s$EQ-+prg'yDB?7;W.Nz f-naPG"~H's/ao-$@MTlz?9(P0j'w]k)<$Vj40
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 88 89 38 fc 4f b6 59 b3 d5 6a b5 2e 24 86 b6 e4 ce 5c 3c 15 de 36 13 cc dc 0a ca 2c c7 c9 f3 75 b6 91 94 d0 06 03 ba 53 13 dd 95 f5 71 30 31 c6 85 4d 86 35 c2 ef 04 93 ec 5f 85 88 8f 29 7e fb 6b b6 08 be 4d cb fb 1e 31 90 2e d8 64 49 90 c7 cf 59 73 ae 41 74 c6 4b 9a 31 5b ad 56 eb ba 02 33 21 cd 7a d7 cc 88 82 4c af fb a9 01 b3 00 4b 8d 03 37 32 7e 82 32 de 31 a1 3d 1b c1 b6 97 11 1c 49 fe f0 a5 b7 5f 85 64 bd 7d c9 05 a8 4b 24 d1 3d 8e 74 78 1e 3d 41 cd db 9b 22 59 f6 6a da af c9 1f f8 79 5d 90 04 60 7a aa 66 ef da de 6a b5 5a 57 12 4e 4c e2 1c 46 cc 7c 99 70 66 be 53 66 84 3b 18 53 8b 71 76 85 79 42 9c fc 70 01 1a 21 da f3 e6 8a b8 6b 86 be 97 87 a2 e9 59 ce 34 5b e5 91 fc ae 40 52 77 74 9f c8 f6 17 23 9d da 22 1f e6 30 c8 b0 88 a3 97 6a b9 55 2d d5 cf Data Ascii: 8OYj.$\<6,uSq01M5_)~kM1.dIYsAtK1[V3!zLK72~21=I_d}K$=tx=A"Yjy]`zfjZWNLF\|pfSf;SqvyBp!kY4[@Rwt#"0jU-
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 8d 64 e9 c6 99 72 97 99 36 33 13 48 63 ea 96 a8 cc df 5b e8 8d 10 74 53 bb c9 06 57 28 d4 c3 bd 97 97 51 76 21 45 70 5d e2 8a 27 57 80 54 c8 c2 a9 4e d5 92 6b 3c 43 4c 44 18 4d 27 f3 72 49 19 71 bb 17 5e 9e fd 09 ea 8e 6b 4e ff 95 14 de bd a0 09 bd dd dd 9b f3 07 e9 c9 de cf 33 94 ba 4d d2 bb 8e ef 47 1f 06 93 c3 2a 7b 48 d7 06 a1 35 93 3d dc e5 ae 35 f1 89 be 1c 6a e9 79 51 14 c5 a3 64 08 b7 7c a6 2e 60 76 26 9b b3 0f 49 36 73 8c cf ca 04 db 95 72 31 71 19 50 4e 14 82 7a bc 69 85 b8 86 72 85 e3 4a 8f 2e 4a 14 4e f1 b9 e4 a2 47 15 53 3e 74 9e ee bc 28 73 8a 2e d9 64 e9 0b 04 6f f2 5f 48 9c 96 c5 04 ab f9 22 a7 a5 3e cd 17 ff 84 4c a6 53 38 cc d9 64 93 d9 31 93 53 2a 8f 4f d6 44 64 ce a5 26 86 ce 74 a9 e9 59 cd 52 98 45 51 14 8f 8c 5f 6c d2 4e 46 b3 07 f1 Data Ascii: dr63Hc[tSW(Qv!Ep]'WTNk<CLDM'rIq^kN3MG{H5=5jyQd\|.`v&I6sr1qPNzirJ.JNGS>t(s.do_H">LS8d1SODd&tYREQ_lNF
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 5d c7 e6 0a d8 b3 b9 27 f8 c2 c7 9a d0 bc 0d 39 18 34 5d 78 8d dc 6d fe 7b ec bb d0 ec 32 13 50 9c c8 cd eb 3e 90 ae ad dd 7d 11 7a ba 8d bb 4b 4d 3f 29 48 7f 6b d8 7e 9a e0 cb cf e5 b5 08 bd 28 8a 62 f5 1c d1 98 0b 2a d3 27 67 fa b6 99 11 e7 27 ff 08 54 66 10 1a 73 df 35 66 28 cc 0f 23 ba d6 bc 93 99 ff 02 a4 d8 32 53 41 96 0b 36 1e 94 63 d4 a6 ad 14 0e 15 4c 61 ec 9e d1 9c 77 51 0d 93 f3 42 35 d2 4c a5 db 8a 52 a2 09 3b 6f 69 86 6a e4 52 b4 81 7d ba 5c 1c e6 aa 72 7e c3 70 a1 5a 0c 7b c3 f5 6e 9a 5d e5 63 39 87 94 a6 74 e6 17 f8 1a 16 7c ff 1a 72 f3 6e 2c fd cd 6b be 39 81 d9 9a 30 19 40 f7 2d 35 db 6d 8a 6b 4d 60 7f 0b 1b 30 af a3 81 8a a2 28 d6 cc 80 d4 1c 5b be da 5c 2e 10 99 be 6d 26 28 91 39 4b 66 46 e8 89 cc b7 bb a6 5d b6 68 4c 54 e6 4c 63 ae 5e Data Ascii: ]'94]xm{2P>}zKM?)Hk~(b*'g'Tfs5f(#2SA6cLawQB5LR;oijR}\r~pZ{n]c9t\|rn,k90@-5mkM`0([\.m&(9KfF]hLTLc^
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 4d e5 35 7b 5a 33 d9 c1 1d 7c 4f 4d d9 7c f5 79 5c a6 31 f3 11 f4 46 2d 07 2a 8a a2 58 21 83 ad 36 8f 9b 29 4d 4f 66 f6 80 ca 24 9b c9 ec 4c e8 67 ff ec 3e 6f 19 32 9f aa cc 6d a3 55 2a 89 99 73 a5 8b fa 3d 6a 30 97 5d de b1 3c 9b 92 d2 f9 0a ec c1 8f f7 ff 75 da e8 36 0b db ee 4f 68 92 0d 66 28 bd fd 50 d7 31 90 3e 39 3e 28 1c a9 e9 1b b9 3f 9f 66 35 e5 e9 a1 94 30 a4 9b 1d 91 d1 f4 39 9a 43 0d 9e ff 60 ef fc 79 d3 08 82 28 9e 23 7f a0 b0 92 22 69 53 25 52 84 10 20 8a 2b 4c 05 92 0b 24 17 d7 50 a7 a1 f3 07 f0 e7 cf bc e5 45 ef f6 86 cd 25 98 d8 47 32 bf 99 dd bd db 23 0e ce 1f f1 3c 3b 3b 1b 04 41 30 78 94 96 e9 95 a6 af d1 ae 53 8a 13 5c 06 eb ae 9a 1b e8 bc ca e4 36 f3 9f c1 cc af 5f bf 5a 67 32 53 2b e6 10 99 2a a3 99 6f cc 48 1d 99 5f 4f f6 61 30 a4 Data Ascii: M5{Z3\|OM\|y\1F-X!6)MOf$Lg>o2mUs=j0]<u6Ohf(P1>9>(?f509C`y(#"iS%R +L$PE%G2#<;;A0xS\6_Zg2S+*oH_Oa0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49758	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	370	OUT	GET /telegram-16/td_laptop.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:54 UTC	936	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:54 GMT Content-Type: image/jpeg Content-Length: 53316 Connection: close ETag: "f4ebbd76b086c583a0271b487fe34b85" Last-Modified: Fri, 06 Dec 2024 01:36:06 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yp7twBo6dXmEmWF6edc7xdwRZ4TbSK7mtwA14NFwv4zBHqNAWloEqzsCY4TcdaLyZAFv2VB3ueJoMS45GgmKumlWe4f1gB08YRWSNEhXK7rjiHSjdq0F55bm1Ztt6bwzsEPa9xVAq18%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2f9487f8c6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1802&min_rtt=1802&rtt_var=901&sent=6&recv=7&lost=0&retrans=1&sent_bytes=4286&recv_bytes=948&delivery_rate=279238&cwnd=168&unsent_bytes=0&cid=c1e86ab4ec335308&ts=177&x=0"
2025-01-12 00:14:54 UTC	433	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 48 00 00 01 e7 08 03 00 00 00 b5 ec 8d fb 00 00 02 fd 50 4c 54 45 00 00 00 00 00 00 cd cd cd 12 12 12 a6 a4 a3 36 36 36 d6 d6 d6 15 15 15 8b 8b 8b 41 41 41 ff ff ff d6 d6 d6 41 41 41 02 02 02 30 99 da 1e 87 c7 f0 ff de 20 8a ca 26 8e ce f2 f2 f2 2c 95 d6 29 92 d2 3a 9e db 2f 2f 2f 39 38 38 0e 0e 0d 17 16 17 f7 f8 f8 27 27 27 1f 1f 1f ed ed ed df dc b3 f4 ff e2 e4 e0 b7 dc d8 af 98 98 98 d8 d6 ad ed fa d8 9c af 85 18 80 c0 99 ab 81 bb c5 97 95 a8 80 30 8a bd 66 66 66 92 ac 80 bf c8 9a 90 a6 7e b1 bc 8f 8d ab 7e 72 9d 77 b5 bd 97 b8 c2 96 6b 9b 75 6a 97 6f 71 a0 7c b6 c0 92 89 ac 83 71 9c 71 8b a5 7b 8c a1 80 f8 f0 dd dc e5 eb e2 e1 df 7e a5 7b fa ff e7 83 a9 82 d2 d3 a8 ac bb 8f 79 a2 76 a4 af 88 ed Data Ascii: PNGIHDRHPLTE666AAAAAA0 &,):///988'''0fff~~rwkujoq\|qq{~{yv
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: b5 b4 bb c6 7a 98 77 73 7e 86 47 46 46 b3 c5 b4 87 9d b0 94 92 92 da f0 ce 65 7b 8e 71 b8 e4 91 a9 c1 c2 ea bc dc d8 c2 c6 e2 f4 88 84 84 7e a5 89 d8 ea f7 56 7a 94 8d 8c 8c 69 73 7c 6c 5e 56 48 7d a4 b0 d7 f0 80 7f 7f 9b cd eb 8b 95 9f 6b 8d a8 9c a0 a0 88 6e 6a cb c2 bb bd d1 b1 ea f3 cd cc d1 b1 fe fd f2 a9 d7 a3 ac b9 a2 7c 92 a7 8c ac 92 77 65 64 69 a6 6c 9e b5 a3 5e 68 75 9c 88 80 da e6 c5 ee dc a4 78 84 95 bd e4 ac fb ba 97 87 7e 6e cc db c3 77 ad 6f 3c 74 9a d9 be b3 c3 d0 dc c3 87 73 de ab 99 97 7a 74 44 99 cc c6 b5 ab aa 96 8e 94 d6 89 b0 8a 7d b1 a8 8c ad 7d 6e ea bc ab 80 90 90 78 73 5a 4f 8a 60 fb ca a6 e5 9b 85 fa a9 82 67 53 44 d2 93 7d e9 d3 c7 92 8e 72 bc a7 9f fc db b9 a2 9a 7d 30 43 69 bd d4 c4 23 6a 9e 57 3e 37 4b 55 6f ca 9b 8e 05 37 Data Ascii: zws~GFFe{q~Vzis\|l^VH}knj\|wedil^hux~nwo<tsztD}}nxsZO`gSD}r}0Ci#jW>7KUo7
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 1a 3f 6f 3c 8f a2 8b 9f ba dd 27 61 37 ec 45 03 7f 10 75 fb 9d bb 40 cb 3c fd a3 0b 0a 69 96 25 8d 3a 81 89 7b a4 82 bc 47 c2 1f 35 c7 81 95 e2 48 f8 32 5a ce d9 99 e3 3d d2 d5 83 98 ef 40 af 9c 9f 10 d2 ef fd 98 0f 65 7f 28 af 75 77 df 7f fd fc 7a 3b ac 85 ef a3 ae ff e9 51 ff 49 7d c5 6d b9 b5 8b cf 6e 7d ba 57 f6 d9 cf e5 48 ab b3 be 13 83 3d aa 4a 09 cc 5c 2f ed a4 1b 45 21 c9 86 34 e1 40 f2 b9 10 92 e4 48 eb aa 23 39 94 53 e6 9d d2 5a d7 e8 7e 3d d5 db 7e da 7a ba b2 fd 08 1e de db de bd 1d 85 9d 66 1f 76 76 1f 7e 85 b2 4f 7f 5e 21 a5 6d 8a a4 3e a1 6a 15 ea 77 36 58 69 5a ea a4 18 12 3a 92 74 3e 76 a4 f5 03 c1 17 e0 c3 2b bf 84 8e f6 2e 51 8e bd 2f 78 09 62 5c d6 c5 8d a8 6b af 76 7f dc eb 3d d9 b9 b1 f3 a4 7f a3 d7 ef 72 21 3d 6c 85 9b 2b 03 e8 73 Data Ascii: ?o<'a7Eu@<i%:{G5H2Z=@e(uwz;QI}mn}WH=J\/E!4@H#9SZ~=~zfvv~O^!m>jw6XiZ:t>v+.Q/xb\kv=r!=l+s
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 71 a6 81 20 2e 2c e3 ab 8c 34 fe 95 dc de ab 76 9d 3e 71 5c 69 24 96 a4 1d 52 0c 8d d4 22 32 01 85 86 8c 9f 33 c1 79 a3 a9 ac 19 b6 5b d9 dd 33 92 d2 85 26 9e d9 3c 0a 27 1f fa 94 ab 8d 84 9c f6 bd b4 73 e8 13 a9 f9 4c 58 d0 43 03 96 54 ed 38 c4 9c 19 36 02 9e d8 35 52 ad 2c d1 56 19 12 69 93 1b ab 6a a2 e1 1e 8f 0b 93 21 99 82 cb ec 27 23 2d 3a ab a0 8d 16 76 bb bf 46 c2 2f 61 d1 4a ad 91 20 ba 6e 7e fe 0f 77 36 e8 4b 1d 99 a2 ac 2f b9 d2 91 2e 95 29 f3 d2 94 86 78 56 80 46 5a 74 6e e1 a6 d5 26 8e f0 0b 59 4c 77 00 8b 0d 83 54 1a 4d dd f9 32 23 cd fb 68 cb 9a 9d 6b 24 a3 20 ac 05 1f a9 db 41 a2 fa b5 88 bc 92 1e 93 48 ce 39 e4 ce 81 f1 d2 ee 00 46 ea 39 75 0d 77 36 b4 0d ba 99 b7 0c c3 e2 4d ab 0d dc 8d ed ff 38 d2 31 52 5d e6 ca 16 96 94 3a ba 1d ac d4 Data Ascii: q .,4v>q\i$R"23y[3&<'sLXCT865R,Vij!'#-:vF/aJ n~w6K/.)xVFZtn&YLwTM2#hk$ AH9F9uw6M81R]:
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: bf 4d fc 84 38 e2 a3 95 99 12 49 f2 43 04 a1 13 92 19 9c 04 89 7a ec b5 d1 8a 41 bb 5d a4 7a b8 37 b9 9d cf db 96 c5 11 0b 40 12 ef b5 78 f3 63 5e 6d 7c ec b9 39 2d e5 ba 94 ce 55 3f 39 9d 9e 9e 9e b6 2e cb 77 e5 3b f2 a7 61 ab c0 49 fa 0e 28 09 9e c8 86 7a 77 d2 a2 dc b5 0c e9 cd a0 7f 71 a4 d7 4f ed 88 b7 55 47 52 12 9b 9b 04 52 a7 d2 29 a4 52 e3 d4 58 53 9f 87 42 20 35 7c b9 b6 e5 7a de 68 bc 91 9a 4d 74 1b dc b8 af c2 3a 86 2b 49 1d f1 26 24 ba ec cf ad b6 3f 23 02 30 10 27 c9 ef ad 5c 11 ad 98 3c e1 2c a8 6d 98 45 a6 14 2d 22 88 9f 25 38 22 80 68 88 bd 8b 77 86 2c fd b6 df ef 3b d5 66 b5 f9 d9 8d d3 aa 5e 9e 76 bb 9f 0d 9b 55 38 53 77 a3 95 96 89 1e 61 74 79 f5 e3 15 3a 58 91 04 49 10 f1 97 4c e6 4d 54 d1 a3 bc 80 f4 47 20 bd f1 78 0d 3f fd ad ef 56 Data Ascii: M8ICzA]z7@xc^m\|9-U?9.w;aI(zwqOUGRR)RXSB 5\|zhMt:+I&$?#0'\<,mE-"%8"hw,;f^vU8Swaty:XILMTG x?V
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 2e b1 bd bd 93 36 76 12 3a 40 8a 31 27 96 4d 57 35 ad 55 31 13 c9 f4 30 5b c9 2a 11 b0 66 66 2a e3 82 93 8d 6e 54 ab 26 25 81 59 3d 5f 71 14 bd 5b ae 47 b6 5e c7 90 92 6a 56 51 b7 4c 35 93 51 74 02 09 6f 86 5c af 9b 5d 80 f4 3d 12 3b 02 69 99 23 89 52 00 92 54 08 21 d4 30 40 a1 45 ba 83 85 7c 54 50 a1 80 24 be 87 8f 21 01 1a 55 53 d9 df fb e6 2b ba 49 fb cd 85 49 18 5e 7c fc 0d 46 ba 65 cc 2f 26 37 c3 d9 35 13 eb e2 40 09 14 41 c7 2e a5 a2 8d 65 b9 1e 34 1d 35 1a 67 25 90 34 68 70 98 16 be e4 09 90 a0 90 01 49 18 56 fd 29 00 6c 15 b2 15 3f 0a b8 f4 9b ff 81 23 fd 0e 48 6f 3c be 72 17 be 8f 94 dc dd 8d 46 c6 8e 92 cd 6e c5 37 76 6a e5 0e 16 1b fa 43 02 29 96 f3 13 bb 58 a5 d2 e9 68 05 4a ee 92 ad 66 2b af 66 9b e9 0d 2d dd 72 e2 ac 9c 4b 25 33 7d ec af 16 Data Ascii: .6v:@1'MW5U10[ffnT&%Y=_q[G^jVQL5Qto\]=;i#RT!0@E\|TP$!US+II^\|Fe/&75@A.e45g%4hpIV)l?#Ho<rFn7vjC)XhJf+f-rK%3}
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: ff 54 82 84 40 72 3d db c3 0e da b0 2f 2c c0 44 20 85 30 92 10 41 92 0e 14 3f 08 33 15 76 a5 30 64 eb 2c 7f 47 25 46 d1 e7 e0 48 f2 a6 ac e8 d7 9f 23 e9 89 68 a2 56 dd 4c 0c 9b 95 58 54 80 54 26 4f aa 15 12 69 f5 c9 eb 6d 64 76 a4 7b 09 92 64 89 cb 5d 11 32 3b 0f 28 79 a2 78 9e 0d 09 8e 84 53 58 80 88 ca 01 8a 40 49 50 84 cd 04 49 26 71 42 f9 9b 10 7c 29 24 1c a7 02 8e 4c 13 cd 92 2c 2e 9b 24 82 23 6f e4 d5 53 4e f5 ee f2 14 8f 7b 5f 9e b9 64 3f bd de 94 80 6a f0 49 12 5c 8a 1b 53 98 22 e9 48 52 21 03 92 5c 49 c9 b1 64 26 14 85 cf ff ef 3b d2 2f d4 9d cb ea d3 40 14 c6 21 64 35 b1 1b a3 56 1b 1b d0 b8 70 51 7c 85 2e 5c 58 74 11 10 49 20 58 c5 95 f5 42 bc e0 35 a0 88 50 31 44 d1 62 5b b4 8d c1 95 dd 54 08 28 0a 42 05 b1 6e 5c 88 0f e0 0b b8 12 c4 b5 f8 9d Data Ascii: T@r=/,D 0A?3v0d,G%FH#hVLXTT&Oimdv{d]2;(yxSX@IPI&qB\|)$L,.$#oSN{_d?jI\S"HR!\Id&;/@!d5VpQ\|.\XtI XB5P1Db[T(Bn\
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: fd 6b 05 52 d2 2f 29 49 f2 5c c1 94 a6 c9 3c 4f 8e e5 d0 64 3e 29 4b 4d f0 ca 52 93 b0 88 16 f2 a5 43 91 47 28 85 8c 92 a4 a6 8c 11 97 33 d5 81 14 42 e0 08 30 5e 8c 0e a1 f6 dc 47 33 5c 04 ab 3b 71 0f 7f a8 ce 5c e8 75 2f 9c 9f 76 47 dd 38 8e e1 4f 69 0a 90 72 04 27 dc 8a 96 04 28 29 88 64 25 6b 80 a4 98 90 7e a2 ca 1f 62 54 e2 06 7d 49 cc 94 5c a1 36 f3 95 77 2d 3d b5 43 fe 1f 87 bf bf dc 59 d4 ec 48 2b 17 4b 06 89 a4 9f 1f 78 9e be b6 b6 be 52 ab e3 fc 11 dd 09 e5 84 cd cf dd df b7 ef 96 10 78 3e eb de 5b 16 ea 31 66 75 b7 f6 8e 31 b5 b3 e9 5a 72 b3 45 3d 0d 83 aa b6 6f d8 2d 5f b3 2c bf 49 a4 34 e1 1e be 2d b0 a6 25 41 6a 5b 40 8e de 96 7e d2 b4 ac b6 b0 7d 60 68 58 96 21 16 06 c9 70 4d bf 5d bc 30 77 ed d9 f8 e6 f5 eb 37 6f ee f7 13 35 c0 48 7d 99 83 Data Ascii: kR/)I\<Od>)KMRCG(3B0^G3\;q\u/vG8Oir'()d%k~bT}I\6w-=CYH+KxRx>[1fu1ZrE=o-_,I4-%Aj[@~}`hX!pM]0w7o5H}
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 20 52 1c 07 22 93 c3 2a d5 2e a9 10 45 f8 3b 78 82 36 09 e6 34 f0 93 74 fe ab 24 51 59 05 21 aa b2 9a 95 33 52 89 5d 9a a0 ad c1 84 8a c0 1e 61 46 bd 2a f2 a2 c8 00 0c 4a a0 92 9e 85 14 47 d1 a7 4f 96 e3 84 21 5d 71 92 24 68 fb 16 85 9d 49 c4 12 69 7c 63 91 20 aa 88 11 62 10 3d 32 39 c4 4d 56 f3 fa 66 bf 59 7b e1 44 3a ec bb 76 bf 4c 24 8e 1b e9 ed 8d 4c 59 a4 af 6f 8e 9f f7 c3 1e 0a f7 07 af c4 c0 8a ad c0 0a 6c 14 54 a2 02 da 25 60 5c 02 7e 67 40 e5 28 ed 52 42 e5 27 4c 16 e1 a4 8f 8a aa 00 55 a5 25 a2 61 c2 b0 42 c6 25 d6 09 0b 98 cd 36 4d 17 8b ef 8b aa 2a 08 78 14 45 59 a4 12 e8 89 99 ed d0 01 39 44 e0 40 7a c0 87 a9 48 fb 1a 47 08 1c bc 2d 0b ef 2f 46 59 56 3c da 17 a9 f5 90 83 86 c7 86 f6 1a 36 4a 56 1b bf 78 c3 91 74 b9 13 e9 5e a7 48 1d 89 64 cc Data Ascii: R".E;x64t$QY!3R]aFJGO!]q$hIi\|c b=29MVfY{D:vL$LYolT%`\~g@(RB'LU%aB%6M*xEY9D@zHG-/FYV<6JVxt^Hd
2025-01-12 00:14:54 UTC	1369	IN	Data Raw: 5a 6a 39 e6 15 df 84 ad ca d4 74 49 44 12 bc 49 9a 46 ea 91 fc d9 a2 be 6d 6b 2b 3b ac 12 95 8d a3 4d a2 49 39 81 43 40 44 9a 0c 50 5e 21 c7 70 5c 17 89 3e 48 e9 39 a1 3e 2a 98 fa 42 9c 84 7a 97 2a d5 f7 48 a8 d3 e1 14 bb ee e6 25 d0 68 da 9f 44 72 27 fd ba 28 b6 f4 e2 8c 44 a2 47 35 5e 71 42 17 5d 53 e8 69 62 2f f3 c0 5f a3 41 80 43 80 46 25 e7 e5 51 d4 cd 0f 8a 4e 84 cf 68 8a 2c 89 4d 2e af 9a e5 a6 88 2e a5 41 d4 89 03 2f 92 7c 23 e9 c9 e5 61 c5 08 ed 19 78 a3 26 52 16 11 4a 66 ab 37 aa b4 cf 00 36 15 4b 81 2e 41 81 6d 05 44 b2 50 24 28 74 0f e0 e0 3c 82 46 8e ed 6a 2b 26 6d 61 52 43 a3 ba 42 78 ed 75 b9 2e d1 ea 10 a1 41 a3 81 b5 c7 f3 83 22 91 a6 40 ed 26 31 bf f4 a6 a7 b9 e4 13 44 24 ae 72 4e 2d bf a7 d0 29 c9 48 ba e0 4b 3b 06 12 46 ed 66 22 b1 79 Data Ascii: Zj9tIDIFmk+;MI9C@DP^!p\>H9>BzH%hDr'(DG5^qB]Sib/_ACF%QNh,M..A/\|#ax&RJf76K.AmDP$(t<Fj+&maRCBxu.A"@&1D$rN-)HK;Ff"y

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49757	90.84.161.20	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:54 UTC	390	OUT	GET /js-sdk-pro.min.js?id=3KK9Zot37TeXAqY2&ck=3KK9Zot37TeXAqY2 HTTP/1.1 Host: sdk.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	433	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: openresty Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE5-CACHE4[139],EU-GER-frankfurt-EDGE5-CACHE4[ovl,138],CHN-HElangfang-GLOBAL6-CACHE43[ovl,15] X-CCDN-REQ-ID-46B1: fc42ce26c47f73b12351f04744add0b7
2025-01-12 00:14:55 UTC	15951	IN	Data Raw: 61 35 39 0d 0a 2f 2a 21 0a 2a 20 35 31 4c 41 20 41 6e 61 6c 79 73 69 73 20 4a 61 76 61 73 63 72 69 70 74 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 20 4b 69 74 0a 2a 20 6a 73 2d 73 64 6b 2d 70 72 6f 20 76 31 2e 35 38 2e 33 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 36 2d 32 30 32 32 20 35 31 2e 6c 61 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 67 3d 65 5b 27 64 6f 63 75 6d 65 6e 74 27 5d 2c 68 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 69 3d 41 28 27 4f 62 6a 65 63 74 27 29 2c 6a 3d 41 28 27 4e 75 6d 62 65 72 27 29 2c 6b 3d 41 28 27 53 74 72 69 6e 67 27 29 2c 6d Data Ascii: a59/! 51LA Analysis Javascript Software Development Kit* js-sdk-pro v1.58.3* Copyright 2016-2022 51.la All Rights Reserved*/(function(c){'use strict';var e=window,g=e['document'],h=encodeURIComponent,i=A('Object'),j=A('Number'),k=A('String'),m
2025-01-12 00:14:55 UTC	16384	IN	Data Raw: 68 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 72 76 3a 27 29 2c 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 68 2b 30 78 33 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 68 29 29 2c 30 78 61 29 29 3a 28 66 66 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 45 64 67 65 2f 27 29 29 3e 30 78 30 26 26 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 66 2b 30 78 35 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 66 29 29 2c 30 78 61 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 66 6a 28 66 6b 2c 66 6c 2c 66 6d 29 7b 76 61 72 20 66 6e 2c 66 6f 2c 66 70 2c 66 71 2c 66 72 2c 66 73 2c 66 74 2c 66 75 3d 5b 5d 2c 66 76 3d 5b 5d 2c 66 77 3d 30 78 30 2c 66 78 3d 66 65 28 29 7c 7c 4e 61 Data Ascii: h=fi['indexOf']('rv:'),parseInt(fi['substring'](fh+0x3,fi['indexOf']('.',fh)),0xa)):(ff=fi['indexOf']('Edge/'))>0x0&&parseInt(fi['substring'](ff+0x5,fi['indexOf']('.',ff)),0xa);}function fj(fk,fl,fm){var fn,fo,fp,fq,fr,fs,ft,fu=[],fv=[],fw=0x0,fx=fe()\|\|Na
2025-01-12 00:14:55 UTC	3705	IN	Data Raw: 61 6e 6f 6e 79 6d 6f 75 73 27 29 2c 6a 6b 5b 27 73 65 74 41 74 74 72 69 62 75 74 65 27 5d 28 27 63 68 61 72 73 65 74 27 2c 27 55 54 46 2d 38 27 29 2c 64 6f 63 75 6d 65 6e 74 5b 27 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 54 61 67 4e 61 6d 65 27 5d 28 27 68 65 61 64 27 29 5b 30 78 30 5d 5b 27 61 70 70 65 6e 64 43 68 69 6c 64 27 5d 28 6a 6b 29 2c 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 3f 6a 6b 5b 27 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 27 5d 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 28 27 63 6f 6d 70 6c 65 74 65 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 7c 7c 27 6c 6f 61 64 65 64 27 3d 3d 6a 6b 5b 27 72 65 61 64 79 53 74 61 74 65 27 5d 29 26 26 6a 69 26 26 6a 69 28 29 3b 7d 3a 6a 6b 5b 27 6f 6e 6c 6f 61 64 27 5d 3d 66 75 6e Data Ascii: anonymous'),jk['setAttribute']('charset','UTF-8'),document['getElementsByTagName']('head')[0x0]['appendChild'](jk),jk['readyState']?jk['onreadystatechange']=function(){('complete'==jk['readyState']\|\|'loaded'==jk['readyState'])&&ji&&ji();}:jk['onload']=fun

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49759	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	603	OUT	GET /telegram-16/777.jpeg HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	938	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/jpeg Content-Length: 41526 Connection: close ETag: "880c2cb4fa191a2f538463d69af44489" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zpLzY%2BUJNsiR7pMZ%2F2cc8h2lLlvEzrjeNxs4XH7afDyrn8bu5tVeq9r25xFfa5zbpBKXxLNdk3Cgss%2B6fbT5rOj0cYOYZyRZr6bgO3RGcgs6nGBFCWH2ASkSV6bFNeF1N%2FIyuVdul1s%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2fb4a8d7c6c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1883&min_rtt=1882&rtt_var=708&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2871&recv_bytes=1181&delivery_rate=1543340&cwnd=196&unsent_bytes=0&cid=9a24d743c96e3154&ts=389&x=0"
2025-01-12 00:14:55 UTC	431	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 38 30 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 32 0a ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 00 04 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 00 02 11 03 11 00 3f 00 9e 7f Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 14 8a 50 72 d9 16 b3 4a 2b 35 b5 5f ee c4 7f 1a 68 d5 65 ed 18 c5 16 66 8a 84 cd 4c d2 d6 62 ea df de 8b f2 a9 e3 d4 e1 7e b9 5f ad 16 13 a3 35 d0 b6 69 e2 a3 49 12 41 95 6c fd 2a 41 52 cc 9a b0 51 45 14 84 c2 94 52 52 8a 00 5a 28 a2 80 14 50 05 02 94 52 18 50 28 a5 14 98 98 b4 51 40 a0 03 34 b4 62 8a 40 14 51 45 20 0a 50 69 05 28 14 08 75 14 51 48 02 8c 51 47 5a 06 02 9c 29 29 45 00 14 a0 66 92 95 6a 44 d8 b4 0a 28 14 0a 22 d1 45 14 8a 0a 07 34 52 81 40 05 14 51 40 05 14 51 40 05 41 7d 7a b6 36 8f 33 0e 17 15 3d 41 a8 5a 0b db 29 a0 18 cb af 1f 5e d5 95 6a 6a 71 e5 67 4e 0f 11 2a 15 a3 52 3d 0e 2f 52 d6 67 be 63 96 c2 7f 76 ae e9 93 79 f6 ab ce 59 78 35 83 2a 98 9d e3 60 77 29 20 fd 6a c6 93 77 f6 6b b5 0c 48 46 e0 d6 34 5a a6 d5 8f 6b 13 cd 55 73 3d ce Data Ascii: PrJ+5_hefLb~_5iIAlARQERRZ(PRP(Q@4b@QE Pi(uQHQGZ))EfjD("E4R@Q@Q@A}z63=AZ)^jjqgNR=/RgcvyYx5*`w) jwkHF4ZkUs=
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 4b 73 67 33 c1 20 3d 54 e0 11 e8 47 7a f1 b1 99 4f b7 d6 3a 33 e9 30 3c 40 b0 cb 96 6e f1 fe b6 3e 9f d2 f5 db 7d 4e 01 22 48 11 87 de 46 e0 8a f3 9f 89 1a d5 be a3 7d 14 16 ee 24 10 03 b9 87 4c 9f 4a e7 cf 89 b5 29 2c fe ca 64 44 52 30 ec 89 b5 9c 7d 6b 39 db 23 15 96 5d 93 ba 15 3d ac de ab 63 83 88 38 8e 38 ca 5f 56 a1 1f 75 ee df 97 62 36 f6 eb 4e b7 87 cc 97 2c 7e 45 e4 d3 02 96 60 00 ce 4d 5b 55 58 d3 cb 4c fb 9f 7a f7 e4 ed a2 3e 42 3a 6a c1 dc c8 ec e7 a9 39 a6 d2 f4 a4 a8 4a ca c2 0a 28 a2 98 11 dc 1d a9 8c f2 6b 1f 55 93 6c 2a 99 fb dd 6b 52 e0 ee 60 2b 07 54 97 cc b9 23 23 0a 31 55 7e 58 15 41 73 4c ad 11 db 32 36 71 82 2b a7 1d 06 3d 2b 95 07 9a e8 e1 93 74 48 7d 85 4d 25 74 6b 8b 5b 32 c7 e1 49 f8 54 59 a3 27 d6 b6 e5 38 89 33 46 4d 47 b8 fa Data Ascii: Ksg3 =TGzO:30<@n>}N"HF}$LJ),dDR0}k9#]=c88_Vub6N,~E`M[UXLz>B:j9J(kUl*kR`+T##1U~XAsL26q+=+tH}M%tk[2ITY'83FMG
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 42 12 01 81 5a 5d d8 f4 c7 f8 d7 96 fc 31 f8 25 ae 78 df 4f 87 5d f3 ed d2 c9 d9 82 3c ee 59 98 83 83 c7 b1 15 eb da 77 ec f1 6a a0 1d 47 5a 99 fd 56 de 30 a2 b2 fe d3 c5 54 f7 95 92 3a df 0e e5 b4 97 24 e4 dc 93 d6 df 97 63 26 0f 88 3e 12 24 09 ee 35 70 3b 98 ec 81 1f ab d6 c5 8e bd e1 4d 5d 84 7a 7f 88 23 49 db a4 57 d1 18 1b 3e 99 39 53 f9 d7 45 69 f0 3f c1 96 ca 43 d9 dc dc b1 fe 29 6e 1b 3f a5 50 d6 7e 01 78 76 f2 36 3a 6d c5 cd 8c a7 a0 63 e6 27 e4 69 47 1b 89 4e fc f7 f9 69 f9 15 2c a3 2b 94 79 3d 9b 5e 7d 7f 32 2b ab 1b 8b 22 04 d1 95 dd d1 81 ca b7 d0 8e 0d 41 5c cb 4f e2 af 85 13 ad 9e b3 09 d4 f4 49 0e cf 2d d8 98 c8 f5 43 d5 5b da ba e1 1d a5 fe 9b 1e b3 a4 cd f6 8d 3e 63 8c e7 2f 0b ff 00 71 fd 0d 7a f8 3c cd 55 7c 93 56 97 e6 7c c6 6b c3 f5 Data Ascii: BZ]1%xO]<YwjGZV0T:$c&>$5p;M]z#IW>9SEi?C)n?P~xv6:mc'iGNi,+y=^}2+"A\OI-C[>c/qz<U\|V\|k
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: d3 20 a3 ed b6 fd 3c f4 fc eb 9b 32 a8 1d 06 6a 12 c0 9c d3 58 d7 fc a3 58 24 fa 9d 51 bd b6 ef 3a 1f a9 a5 8a ee dc b8 55 99 09 3d 00 35 cb 6e fa 55 9d 3c 83 7b 0f bb 55 47 14 e4 d4 6d b9 32 c1 45 26 ee 75 63 9e 69 71 9a 45 e8 29 d5 d2 79 65 5d 52 7f b3 d8 cb 27 70 b8 1f 53 c5 62 22 85 50 3d ab 43 c4 6e 56 c1 47 63 2a e7 f3 ac 66 b9 c9 eb 50 a5 ef 33 d3 c3 53 7e ca fd d9 6c 10 3b d3 b7 81 c7 3f 5a d7 f0 37 85 25 f1 b6 a5 25 9c 57 4b 6e b1 26 f7 76 19 38 f6 15 eb fa 3f c1 cf 0e e9 a1 5e e4 4f 7e e0 72 65 38 5c fd 05 79 b8 dc e7 0f 85 97 24 db 72 ec bf ab 1e de 0b 21 c4 e2 d7 3c 55 a3 dd 9e 1d 05 b5 c5 db 88 ed a1 92 67 3d a3 52 c7 f4 ae a7 49 f8 55 e2 8d 50 ab 3d a2 d9 c4 dc ef b9 60 3f 41 cd 7b c5 8e 93 63 a6 c6 23 b2 b4 86 dd 47 68 d0 0a b6 01 15 f3 f8 Data Ascii: <2jXX$Q:U=5nU<{UGm2E&uciqE)ye]R'pSb"P=CnVGc*fP3S~l;?Z7%%WKn&v8?^O~re8\y$r!<Ug=RIUP=`?A{c#Gh
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: d0 ae 98 80 62 08 3d c8 ad 4b 4d 12 38 88 33 36 fc 1c ed 1d 2b 4e 8a d2 34 22 8c 2a e6 75 ea 69 7b 7a 12 4b 34 93 05 0e c4 84 1b 55 7b 28 f4 03 b5 47 45 15 a4 62 96 c7 0c a4 e4 ef 27 76 14 51 45 51 21 45 14 50 30 a8 26 b8 85 1b 6b c8 aa 47 24 13 53 d6 06 ac 37 5f 48 7d 85 27 2b 6a 54 22 a4 ec 6a 7d ae df b4 cb f9 d2 fd aa 0f f9 ee bf 9d 73 db 3d a9 0a 63 b5 4f b5 f2 35 f6 0b b9 d1 8b 98 0f fc b7 4f ce 90 dc c1 9f f5 cb f9 d7 39 b7 da 8d be d4 2a a3 f6 0b b9 d1 7d a6 db fe 7b af e7 47 da 20 ff 00 9e cb f9 d7 3d 83 47 34 7b 61 7d 5d 77 3a 2f b4 db ff 00 cf 65 fc e8 fb 4d b8 eb 32 7e 75 ce 64 fa d1 c9 a3 db 0f ea cb b9 d1 1b ab 7e d3 2f e7 47 da ad ff 00 e7 b2 fe 75 ce 66 8a 3d b0 7d 55 77 3a 3f b4 db 7f cf 68 e9 3e d5 6f ff 00 3d 97 f3 ae 77 9a 4f c4 d1 ed Data Ascii: b=KM836+N4"ui{zK4U{(GEb'vQEQ!EP0&kG$S7_H}'+jT"j}s=cO5O9}{G =G4{a}]w:/eM2~ud~/Guf=}Uw:?h>o=wO
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: f5 2f 14 99 62 49 70 d1 da 21 da c5 7d 58 f5 15 eb 3a 67 c3 5f 07 68 f8 16 7e 1f b1 56 5f e3 91 3c c6 fc db 35 d2 e4 7d e3 80 0f a5 34 9d c7 35 d7 47 0b 4e 9a b2 46 55 f1 b5 ab 4a f2 93 f4 1b 6f 6f 0d ba ed 82 18 a2 51 da 34 0b fc ab 2f c6 7e 1c 4f 16 78 6a fb 48 94 2e e9 a3 3e 5b 30 e1 5c 7d d3 5b 0a 29 e0 7e 75 ac e0 9a e5 39 e3 37 19 29 2d cf 86 f5 ef 0f ea 1e 1b d4 66 d3 b5 3b 59 2d ae 62 24 15 71 d4 7a 8f 51 59 80 64 d7 dc 7a e7 85 74 3f 13 44 22 d6 34 bb 6b c0 a3 6a b3 a7 cc a3 d0 1e a2 b2 74 ef 85 3e 09 d2 9f 7d bf 87 6c cb 67 39 95 4c 98 fc 0d 78 72 ca e5 cd ee bd 0f a2 86 79 0e 5f 7e 2e e7 c7 b6 9a 5d e5 f3 05 b5 b3 b8 b8 63 d0 45 1b 37 f2 15 d5 e9 5f 06 fc 6f ab aa b4 5a 05 d4 28 df c7 70 3c b5 fd 6b eb db 5b 3b 5b 14 09 69 6b 05 b2 8e 8b 14 61 Data Ascii: /bIp!}X:g_h~V_<5}45GNFUJooQ4/~OxjH.>[0\}[)~u97)-f;Y-b$qzQYdzt?D"4kjt>}lg9Lxry_~.]cE7_oZ(p<k[;[ika
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 8b 7a 54 26 6b c4 cf 01 72 c6 b7 32 4f e7 52 e9 9a 5a d8 78 7c de dc 2f ef ef 58 2c 2a 7a 84 1f 79 bf 90 fc ea 31 d2 b9 a1 51 4d bb 74 fe bf e0 1c 98 c8 f2 c9 27 d8 28 a4 34 b5 a1 ca 2a f4 ac af 15 ea 73 69 1e 1e d4 2f 61 62 92 c3 09 31 b0 ec 78 03 f9 d6 a8 3c 55 2d 6a c6 3d 4b 4d 9e d6 52 3c b9 00 ce 7d 88 35 cd 8a 4d d2 92 5d 99 db 97 f2 fd 6a 97 36 dc cb f3 38 0f 0e 69 92 dd 7c 39 d6 e2 bd 0e f7 13 c5 34 e0 1e a4 95 07 3f f8 e9 ac 8f d9 c7 51 8a cf c6 d3 5a cb 80 d7 76 ac 89 93 dc 10 d8 fc b3 5d dd af 88 ac 21 d7 61 d2 21 54 6c 47 b4 fa 11 fd df e7 f9 d7 92 6a 16 d2 fc 39 f8 8f 0c e8 c7 ca b6 ba 4b 98 99 78 2f 0b 1c ff 00 22 47 e1 5f 17 8a 5e c6 ad 2a 8b 6b 25 f7 6f f8 58 fd 4f 0c 95 65 89 c3 f5 6f 9b e4 d6 9f 73 4f fa 67 d6 c4 f3 4f 03 35 5a ce ee 2b Data Ascii: zT&kr2ORZx\|/X,zy1QMt'(4si/ab1x<U-j=KMR<}5M]j68i\|94?QZv]!a!TlGj9Kx/"G_^*k%oXOeosOgO5Z+
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 7a 11 8a eb c0 56 f6 94 57 74 73 e6 98 7f 63 88 7d 9e bf d7 cc 76 69 69 0d 2d 76 1e 78 66 96 92 81 c8 a0 05 a5 14 94 a0 52 1a 14 75 a5 ea 4d 18 c1 a7 46 85 df 00 75 a9 6f a9 45 db 18 8b be 48 e0 56 98 1c 0c 54 30 46 22 40 a0 54 c0 d7 9f 52 5c ce e7 54 23 64 2d 1d e9 69 2b 32 90 ec 50 b4 80 f3 4a 3a 9a 4c a1 c3 9a 5a 40 31 4b 48 04 a7 01 cd 36 9c 0f 34 14 3a bc d3 e3 ae 80 ba 97 85 d3 54 8e 3d d3 69 f2 82 48 1c f9 6d c3 7f 8d 7a 55 56 d4 2c 21 d4 ec 67 b2 b8 01 a2 9d 0a 30 3e e2 a1 ab e8 69 4a a7 b3 9a 97 63 c9 7c 27 ad 43 e2 4f 03 da 6e 7f f8 98 68 ed f6 39 94 9e 5a 23 ca 37 f3 1f 85 4f 5e 55 e1 0d 79 7c 1d f1 76 eb c3 97 b2 18 ec e7 76 b0 94 b1 e0 f3 98 d8 d7 ac dc 40 f6 b7 12 5b c8 30 d1 92 a7 db 06 bd cc 9b 10 a5 4d d2 ea 99 f2 9c 59 86 e4 c6 7b 68 ed Data Ascii: zVWtsc}vii-vxfRuMFuoEHVT0F"@TR\T#d-i+2PJ:LZ@1KH64:T=iHmzUV,!g0>iJc\|'COnh9Z#7O^Uy\|vv@[0MY{h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49760	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	364	OUT	GET /telegram-16/333.jpg HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	948	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/jpeg Content-Length: 45082 Connection: close ETag: "48f819fabb18f36c8c078d2590c49d38" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2916 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=oSMivnndzRTqMKD661HLHk9wRprTkfn4Yz9P5GKxIRGYVqK7mVCtL5kpq0s2lx4Ti%2FR4KBIbVmQfVquT7YQiP0BMK9EZJMKyZjXrMA89d7D%2BRf%2BCM3yICbEf3Cqz4%2BgpZHhnQx2ayDo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2fb9b908c4e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1781&min_rtt=1776&rtt_var=677&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=942&delivery_rate=1603514&cwnd=205&unsent_bytes=0&cid=1646bc06ded8cbfa&ts=162&x=0"
2025-01-12 00:14:55 UTC	421	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 32 0a ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 4f 04 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$O"
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 28 a2 8a 00 29 d1 7d f1 4d a7 45 f7 c5 00 0f d4 d3 69 cf d4 d3 68 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 Data Ascii: (((((((((((((((((((((((((((((((((((((((((((((((()}MEih(((((((((((
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: fc 2b 9e b6 2e 95 35 ab 37 a5 86 a9 53 e1 47 04 39 20 28 2c 4f 61 c9 ae 87 47 f0 1e b9 ab 6d 76 81 6d 21 6f e3 9b 39 c7 d2 bd 43 48 f0 c6 95 a2 a8 16 96 91 a9 fe fb 0c b1 fc 4d 6b 90 a3 a8 af 2a b6 68 de 90 47 a7 47 2c 4b f8 87 17 a4 fc 2f d2 ad 70 d7 d2 4b 7e e0 e7 0e 70 80 fb 28 fe b5 d6 5b 5a 41 67 18 8a de 24 89 07 45 45 00 7e 55 85 e2 0f 1b d8 e9 0f f6 58 43 df 5f 31 d8 96 b0 7d e2 7d cf 61 56 fc 39 16 ae 2d 64 9f 59 9d 1a e2 66 dc b0 c6 3e 58 46 38 50 7b 9f 5a e0 a9 2a 92 57 a8 ce ea 50 a7 17 6a 68 d8 1d 79 e6 bc a7 e2 7d db 4d af db da ef ca c1 06 e2 3f da 63 ff 00 d6 af 58 c5 78 6f 89 ee fe dd e2 5d 46 7c e4 79 9e 58 f6 0b c7 f5 ae ac b2 9d ea dd 18 66 72 4a 9d 8c b6 a4 a5 6a 4a fa 44 7c e8 94 51 45 05 05 14 51 40 05 14 51 40 05 3a 2f be 29 b4 e8 Data Ascii: +.57SG9 (,OaGmvm!o9CHMkhGG,K/pK~p([ZAg$EE~UXC_1}}aV9-dYf>XF8P{ZWPjhy}M?cXxo]F\|yXfrJjJD\|QEQ@Q@:/)
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 3b 05 14 51 40 82 8a 28 a9 b8 05 14 1e b4 86 8b 80 b4 53 55 83 36 d5 21 8f a2 f2 6a ed b6 93 a8 5d 36 21 b0 bc 93 3d c4 2c 07 e6 71 53 2a b1 8e ec b5 09 4b e1 45 4a 08 ad e8 fc 0d e2 29 4f cb a6 95 ff 00 ae 92 28 ad 3b 6f 85 fa cc c0 19 ee 2d 2d bd b9 73 fd 2b 17 8c a3 1d e4 69 1c 2d 49 6c 8e 3a 8a f4 3b 7f 84 a8 51 85 c6 aa e5 fb 18 e3 00 0f cc d7 27 e2 4f 0c 5e 78 66 78 e3 9d 84 d1 4b 9d 93 28 e0 fb 1f 43 4a 18 da 33 97 2c 58 e7 84 ab 05 76 8c 8a 28 a2 ba 56 e7 3a Data Ascii: PEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP;Q@(SU6!j]6!=,qS*KEJ)O(;o--s+i-Il:;Q'O^xfxK(CJ3,Xv(V:
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 94 46 04 8a ce f2 7a 9a da 9c 74 45 a0 dc 62 83 49 4e c5 2b 96 92 b0 98 35 c7 7c 51 9a 35 f0 e0 8c b0 0e f3 26 d5 ee 70 72 6b b3 c6 05 78 e7 c4 0d 64 ea 9a fb 47 19 dd 0d 9e 63 5e 78 dc 7e f1 ae cc 15 27 52 aa b1 c3 8e aa a1 4d 9c d5 14 62 8a fa 74 7c d2 0a 28 a2 99 41 45 14 50 01 45 14 50 c0 f5 cf 04 da c5 79 e0 fb 38 26 4d f1 b0 3b 97 dc 36 47 eb 5d 33 c8 88 a5 d9 91 54 72 49 3c 2d 78 ff 00 87 fc 6f 7d e1 eb 43 69 14 11 5c 43 92 54 48 c4 15 cf d2 a8 eb 3e 28 d5 75 d6 61 75 70 52 13 ff 00 2c 63 e1 7f 1f 5a f0 25 97 d5 95 47 7d 8f 62 18 f8 42 9a b2 d4 f4 3d 73 e2 46 99 a7 33 c5 67 9b eb 81 91 84 fb 80 fb 9a bd e0 ff 00 15 2f 89 2c dd 9d 56 3b a8 8e 25 88 1c 81 dc 11 ed 5e 34 00 51 85 50 a0 74 02 ae e8 ba b5 c6 83 a9 47 7f 6d f3 15 1b 64 4c ff 00 ac 4c f2 Data Ascii: FztEbIN+5\|Q5&prkxdGc^x~'RMbt\|(AEPEPy8&M;6G]3TrI<-xo}Ci\CTH>(uaupR,cZ%G}bB=sF3g/,V;%^4QPtGmdLL
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 1b 8b 24 b2 d4 ee 52 1b 88 86 d4 79 1b 1e 6a f6 3c f7 f5 af 0b 31 c1 b4 fd a4 4f 63 2f c6 2b 7b 39 1d c4 d2 24 51 b3 bb 05 55 19 24 f6 15 e1 fe 2a d7 9b c4 1a d4 97 25 89 82 30 52 05 ed b7 b9 fc 6b ae f8 87 e2 fb 79 6d 86 95 a7 5c 47 3b 4a 7f 7e f1 36 76 28 ed c7 73 5e 74 3a 74 03 bf 15 59 7e 1e df bc 91 19 86 27 9b dc 8b 1d 48 45 2d 15 ed 23 c8 12 8a 5c 51 8a 1a 01 28 a5 c5 18 a5 60 12 8a 5c 51 54 31 a6 ba 4f 87 ba f4 5a 1e b2 c9 74 e1 2d ee d4 2b 31 e8 ac 09 20 fe a6 b9 da 51 e9 c6 3d eb 1a f4 95 58 38 b3 4a 55 5d 39 29 23 d4 7c 5f e3 e8 34 b8 05 b6 99 2c 53 de ca 3a a9 dc b1 0f ef 1c 57 96 c8 f2 4b 2b c9 2c 8d 23 c8 db 99 db ab 1a 40 aa 3e ea 2a fd 07 5a 5a cb 0f 84 8d 15 a6 e6 95 f1 32 aa ee c4 eb 8e 48 23 90 47 5c d7 6b e1 4f 88 93 d8 32 da 6a ec d3 Data Ascii: $Ryj<1Oc/+{9$QU$%0Rkym\G;J~6v(s^t:tY~'HE-#\Q(`\QT1OZt-+1 Q=X8JU]9)#\|_4,S:WK+,#@>ZZ2H#G\kO2j
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: fc ca 41 07 d2 bd af 5a 06 e7 c1 f7 67 27 73 d9 93 ff 00 8e d7 89 4e c5 62 72 3b 0c d7 b6 a3 fd ab c1 61 cf 57 b0 ff 00 d9 2b c7 cc 96 b1 67 a9 97 bf 76 68 f1 81 82 a2 93 be 29 a8 70 8b f4 ae a7 c3 1e 06 b9 f1 0c 6b 73 24 df 67 b4 27 ef 01 96 93 e9 e9 5e 85 6a d1 a4 94 a5 b1 e6 d3 a7 2a 92 e5 8a 39 94 8e 59 9d 63 82 27 9a 56 e8 91 ae e2 7f 0a ed 3c 3f f0 ce f2 f0 2c fa c4 9f 66 87 af d9 e3 3f 3b 7f bc dd ab bc d1 bc 3b a7 68 30 f9 76 50 05 3d e4 6e 59 bf 1a d3 f4 af 1b 11 99 4a 7a 53 d1 1e de 1b 2e 8c 75 a9 a9 53 4d d2 2c 74 8b 71 6f 65 6f 1c 28 3f ba 39 3f 53 de ad e7 da 8a 2b cb 6d bd 59 e9 28 a5 a2 0c d1 45 14 ca b0 51 45 14 0c 28 a2 96 81 14 b5 8d 4e 1d 1f 4d b8 be 9c e1 21 52 71 ea 7b 0f c6 bc 22 69 9e ea 69 2e 66 2c 65 9d cc 8c 4f a9 ed fc ab bd f8 Data Ascii: AZg'sNbr;aW+gvh)pks$g'^j*9Yc'V<?,f?;;h0vP=nYJzS.uSM,tqoeo(?9?S+mY(EQE(NM!Rq{"ii.f,eO
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 47 e0 33 58 4b 15 4a 3b b3 48 d1 9c b6 47 38 16 90 8c 1a ef 6c be 13 cd 8f f4 cd 54 0c f6 82 2f ea 7f c2 b6 ad 7e 18 68 36 ff 00 eb 85 c5 c9 ff 00 a6 92 1c 7e 43 15 cd 3c ce 94 76 d4 e9 86 5d 56 6a fb 1e 4a d2 c6 9c 33 a8 fc 6a d5 b6 9d a8 5d 80 6d b4 eb c9 c1 e8 c9 11 c7 e6 78 af 6d b1 f0 de 91 a6 ae 2d 74 fb 78 fd c2 0c fe b5 a2 a8 00 da 00 03 da b8 e7 9a b7 a4 51 d7 4f 2b b7 c4 cf 1c b2 f0 17 88 6e f1 9b 34 b7 07 bc d2 01 fa 0a da b4 f8 4d 75 29 ff 00 4d d4 d6 31 e9 0c 79 3f 99 af 4a 2a 06 29 c0 d7 2c f3 0a cf 67 63 a2 9e 5d 4e 3b ea 71 b6 bf 0b 74 48 07 ef 8d cd d7 fd 74 93 1f a0 c5 6d e9 fe 13 d1 34 e2 0d be 9b 6e 87 fb c5 72 7f 5a d5 92 54 8d 4b 33 00 3d 49 e2 a9 d9 6b 16 1a 94 f3 c1 67 75 14 f2 5b 10 b2 84 6c ec 27 a0 35 cd 2a b5 26 b5 6c e8 85 1a Data Ascii: G3XKJ;HG8lT/~h6~C<v]VjJ3j]mxm-txQO+n4Mu)M1y?J),gc]N;qtHtm4nrZTK3=Ikgu[l'5&l
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: f7 1e e7 b7 d2 b9 75 4f 2c 6d 51 b4 0e 46 0f 4a f4 69 65 73 92 bc dd 8f 32 a6 66 b9 ad 03 e8 81 82 33 46 2b 8c f0 0f 8d 3f b5 e2 1a 7e a0 ca 2f 63 1c 37 69 87 af d6 bb 42 31 5e 6d 5a 6e 9c b9 64 7a 54 6a aa 91 e6 43 4d 14 a6 92 a0 d4 29 ca 29 a3 a5 3d 68 19 1d c4 a9 02 34 b2 30 54 45 2c 49 f4 af 08 d5 f5 59 35 ad 56 e6 fe 5c fe f5 b6 a0 f4 41 c0 af 47 f8 a1 ac 8b 1d 21 2c 11 ca cb 7a 76 9c 75 11 8f bc 7f 90 af 2c 07 3d b1 ed e9 5e d6 59 43 47 51 9e 1e 67 5a f2 50 41 45 38 81 8a 6d 7b 16 3c 90 e7 b5 5a b1 d2 75 0d 53 fe 3c 2c e7 b9 00 e0 b2 2f ca 0f d4 d5 37 04 a9 c7 5c 1c 7d 6b db 3c 25 3d 9c de 1f b2 36 a5 0a 88 94 15 5c 70 d8 e7 3e f9 ae 2c 66 26 54 12 71 57 b9 d5 84 c3 46 bb b4 99 e7 96 7f 0d b5 eb a3 fb df b2 db 0f f6 9c b1 fc 80 fe b5 b7 6d f0 9e 32 Data Ascii: uO,mQFJies2f3F+?~/c7iB1^mZndzTjCM))=h40TE,IY5V\AG!,zvu,=^YCGQgZPAE8m{<ZuS<,/7\}k<%=6\p>,f&TqWFm2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49762	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	365	OUT	GET /telegram-16/555.jpeg HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	948	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/jpeg Content-Length: 59978 Connection: close ETag: "4116e064ac15ff520a5a123614cd9b32" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 2915 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=N5ETQZ9VLSNt%2F4WbpRT6b9pq4teahKMQggo0wFkmV%2FUEFyvIPT1kHc2FIPPKZRpYq8zHXxPuznJTZ%2B%2BOjJA9BJYxEgaZqeVQQTfQjTM2DPCE9cY8OBJCvurZf311zImhxKz5JDNoUHA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2fbfe7b43e3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1567&min_rtt=1560&rtt_var=600&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=943&delivery_rate=1799137&cwnd=229&unsent_bytes=0&cid=3189ddd0a16fd578&ts=151&x=0"
2025-01-12 00:14:55 UTC	421	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 32 0a ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 40 04 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 82C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$@"
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da 00 0c 03 01 Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: a3 39 62 e3 b3 45 0b 69 a3 1b 89 00 92 6a ad c3 20 dd 8e 84 d2 dc 44 63 6c ae 70 4d 46 90 19 08 27 3c d6 91 8c 7e 23 48 46 37 e6 b9 35 b9 12 2a 00 7b d5 cb 98 42 ec 60 d9 c1 aa b0 da 30 7e 38 15 62 58 dd 97 e5 27 35 94 da e6 56 66 53 6b 9b 46 52 94 8d e7 9a 83 18 1f 8d 4a f6 d2 00 59 8f 22 aa ee 20 9c d7 54 2c d6 87 54 15 d6 8c b0 9d 4f 34 8c 48 61 4c 89 9d b9 55 34 17 3b 80 20 e4 75 a7 6d 47 cb a8 3f 50 7d ea 68 49 50 a4 7a d5 76 7c 75 1c d5 ab 40 24 c0 f7 a5 3d 22 2a 9a 47 53 4e 29 dc aa e4 f4 aa f7 d3 b3 8c 7b d6 82 db a0 8c 15 39 c1 aa 97 d6 d8 52 47 3c d7 9f 4e 51 e7 3c ea 72 8f 39 93 ff 00 2d 09 c5 4f 08 0d da a2 61 89 48 ab 56 b0 96 c9 c5 76 d4 92 51 b9 dd 52 5a 5c 6c 91 80 33 54 24 4c b6 6b 66 78 3f 75 d2 b3 26 4c 1a 54 67 70 a1 3b 8c 8f e5 3c 74 Data Ascii: 9bEij DclpMF'<~#HF75{B`0~8bX'5VfSkFRJY" T,TO4HaLU4; umG?P}hIPzv\|u@$="GSN){9RG<NQ<r9-OaHVvQRZ\l3T$Lkfx?u&LTgp;<t
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 0a f3 a3 5d c5 5a c7 95 1c 4b 8a b5 8e 2d e1 99 26 60 47 e3 53 db 3b c4 fb 58 1c 1a e8 26 b3 8d 93 76 07 5a 8a 3d 3d 1a 60 0f 61 5d 5f 5a 4e 3a a3 b7 eb 91 94 75 45 a8 2f 36 42 a0 a7 ca 3d aa 78 af 61 2d bb 03 8e d5 1b da 95 85 b0 72 05 63 b4 72 46 e5 d7 a1 ae 38 d3 8d 4b 9c 10 a5 0a 97 b1 26 ab 2c 2b 23 b2 70 08 e9 58 b2 4a 0a d4 97 be 63 38 24 e3 3c 55 57 42 56 bd 5a 14 d4 62 8f 63 0f 49 46 2b 52 d4 32 05 2b cf 71 5b 96 4a 24 9b ad 73 28 1b 19 e6 af d9 5f 34 7c 13 83 ea 69 62 28 b9 2f 74 9c 4d 07 25 ee 9a 57 b1 f9 72 b8 27 83 58 d2 0e 2a c5 e6 a3 bc e0 b8 aa 0d 32 f6 6c fe 14 f0 f4 a5 15 a8 f0 f4 64 96 a5 a5 e5 6a 7b 51 9c d5 01 74 00 c6 6a 68 2f 11 47 51 57 38 49 ad 0b 9d 39 5b 62 79 3e 59 41 35 28 39 89 b9 aa af 38 72 0e 41 c7 a5 4d 0c a0 82 a7 bd 44 Data Ascii: ]ZK-&`GS;X&vZ==`a]_ZN:uE/6B=xa-rcrF8K&,+#pXJc8$<UWBVZbcIF+R2+q[J$s(_4\|ib(/tM%Wr'X*2ldj{Qtjh/GQW8I9[by>YA5(98rAMD
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 1e b5 95 39 2e 73 0a 73 5c ef 42 99 98 95 a5 b3 98 c6 cc 57 39 35 27 d9 c6 da bd a6 58 a9 39 23 9a d6 73 8a 8b b9 b5 4a 90 8c 19 46 f2 66 75 c3 03 f8 d0 93 80 98 cf 6a d8 d4 34 e5 09 9c 0a c3 fb 3b 21 22 a6 94 e3 38 e8 4d 1a 90 a9 1d 0d cd 22 75 7d a0 90 3b 57 49 71 24 0b 02 95 3c 81 5c 0d bc d2 5b 4a 02 9a d0 9f 52 97 ca e3 39 c5 72 e2 30 8e 53 4d 33 8b 13 82 73 a8 9a 67 42 6f 62 03 ef 76 aa 52 dc ab ed da 6b 9f 8e ea 57 e7 26 91 6e de 29 46 e3 c5 38 e0 ec 54 70 1c af 73 6a f5 1b c9 46 e0 d1 61 86 0b cf a8 ac f9 6f cb 47 c9 ed 4c b3 bd 21 b0 33 c5 3f 63 2e 4b 0f d8 4b 91 a3 6d 90 0b 98 cd 5b bb 4c db 9e 3b 56 42 de 13 2a 1f 4a b7 35 db 98 b9 07 15 cd 2a 72 ba 39 27 4a 57 89 98 b0 65 49 fa d5 8b 63 b1 14 1a 85 2e 55 53 1d e9 22 b9 57 2a 3b 83 5d 32 52 68 Data Ascii: 9.ss\BW95'X9#sJFfuj4;!"8M"u};WIq$<\[JR9r0SM3sgBobvRkW&n)F8TpsjFaoGL!3?c.KKm[L;VBJ5r9'JWeIc.US"W*;]2Rh
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 04 93 46 48 39 ae 9b 1d bc a6 84 4a 59 86 2a d2 3e c0 46 6b 3e 1b 8d a2 95 ee 8e ea c2 50 6d 9c b2 a6 e4 cb 4c a5 c9 22 90 fd dc 53 12 e4 6d a8 8d c8 66 c5 25 16 25 06 4a 84 a8 ef 53 58 ce 52 73 9e b5 0f 9c a1 31 de a0 8e 7d 92 93 43 87 32 68 39 39 93 46 9e a5 75 ba 22 33 50 d8 dc 9f 27 19 aa 57 13 ef 5c 52 5b 49 b5 3a f7 a1 51 b4 2c 0a 82 54 ec 3a f9 b7 4a 0d 3c 7f ab fc 2a b4 ef bd 81 ab 0a e3 cb c5 69 6b 45 23 56 ad 14 86 5a 71 75 5a 33 f4 04 d6 7d 9a ef bc 02 b5 ee 21 1b 46 3a d6 35 9d a4 8c 2b ca d3 43 23 3f 76 ab cc 39 fc 6a ed bd b3 48 14 0a ad 79 0b 42 c4 30 c1 15 94 24 b9 ac 61 09 2e 6b 22 1c fc b8 ab b6 8c 55 41 1d 6a 87 55 ab b6 8a 59 38 14 ea 2d 0a aa bd d2 fd dc be 60 19 fe ed 64 48 a0 b9 3e d5 ad 34 2f b0 12 0f dd ac b9 01 0e 73 59 d0 b2 d8 Data Ascii: FH9JY>Fk>PmL"Smf%%JSXRs1}C2h99Fu"3P'W\R[I:Q,T:J<ikE#VZquZ3}!F:5+C#?v9jHyB0$a.k"UAjUY8-`dH>4/sY
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 49 72 dc 3c c6 03 15 0b 9d dc 9a d7 1a 7e e8 f2 05 66 dc c4 63 38 a9 85 48 c9 e8 45 2a 91 93 b2 2b 8e bd 29 68 a3 15 b9 b8 87 06 9e 9d 69 bf 85 49 0a ee 35 2f 60 6f 42 c2 1c 8a 8e 51 cd 5c 4b 37 d9 90 2a b4 c9 b1 b0 6b 08 c9 37 a1 cd 09 26 f4 12 0a b0 40 c5 43 00 dc 71 57 4d b3 04 dd 53 36 93 22 a4 92 66 1b 8f 98 d3 69 ce 3e 63 f5 a6 d7 59 de 14 51 45 00 39 0e 0d 4e b2 11 50 0e b5 20 e4 54 c9 11 24 58 8e 72 0f 5a 59 a7 2c b8 cd 57 07 14 31 c8 a8 e5 57 32 e4 57 1b bb 9a 7c 4d 83 51 52 a9 ab 68 d1 a3 56 d6 e3 69 15 a6 6e 43 47 8a e7 e1 93 1d ea d8 9f 8c 66 b8 ea 52 bb 38 6a d1 bb b8 b7 b2 e4 11 59 64 f3 56 6e 65 cd 53 ce 6b a6 94 6c 8e ba 30 b4 45 27 34 d1 46 73 45 6a 6e 2d 28 a4 1c d2 ed a4 21 4d 36 94 d2 66 80 42 66 8a 28 a6 31 69 d4 da 77 6a 04 c6 d1 4b Data Ascii: Ir<~fc8HE+)hiI5/`oBQ\K7k7&@CqWMS6"fi>cYQE9NP T$XrZY,W1W2W\|MQRhVinCGfR8jYdVneSkl0E'4FsEjn-(!M6fBf(1iwjK
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 43 51 ec 2d 1b 45 99 3c 2d 95 a2 cd fd a7 3d 69 ac 84 77 ac e8 f5 53 80 1d 71 ee 2a c0 bd 59 14 6d 70 4f a7 7a e5 74 26 99 c9 2a 13 8e e8 94 2f cf 9a bf 07 dd ac cf 34 8e 49 ab 30 5d ed 1c 8a ce ad 39 34 63 52 9b 68 96 ed 4f 39 ac 7b 8e a6 b4 ee 2e 43 29 ac 89 df 71 ad b0 d1 6b 73 a3 09 17 d4 86 97 14 99 38 39 a0 1a ed 67 a0 21 51 d6 a5 83 86 15 11 34 f8 df 69 a5 25 a0 a4 ae 8d ab 73 f2 8a b4 7e e7 e1 59 d6 b3 8c 00 4d 5d 33 a8 5e b5 e5 d5 83 52 3c 7a b0 7c c6 65 da e2 5c d5 ab 33 c5 54 ba 90 33 f1 53 59 ca 07 06 b6 94 5b 82 3a 26 9b a6 8b ae 72 bc d6 3d e2 e1 ab 55 d8 6d eb 59 57 8c 0b 1a 58 75 a8 61 95 a4 5a d3 17 24 1a da c0 2b 8c 56 26 98 e0 10 2b 68 1f 97 3c 56 18 9f 8c e6 c5 df 9c c5 d5 21 c6 48 aa 96 4b 97 15 a1 aa 30 20 d5 0b 12 37 fe 35 d7 4d bf Data Ascii: CQ-E<-=iwSqYmpOzt&/4I0]94cRhO9{.C)qks89g!Q4i%s~YM]3^R<z\|e\3T3SY[:&r=UmYWXuaZ$+V&+h<V!HK0 75M
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 20 fc ab f8 9f d0 1a fb 7e 14 da 00 aa b0 fa 12 a2 e0 0a 90 0c 52 28 c7 14 ea 4c 02 94 0a 4c 73 4e 03 34 80 28 a2 96 80 12 96 8e 94 50 01 8a 36 d2 d1 40 0d c0 34 85 69 f4 94 01 19 4f 5a 63 46 0d 4f 8a 4c 7b 53 02 a3 db 2b 0c 10 2b 37 54 f0 d6 9d ab 42 d0 5e d9 c1 71 13 f0 52 44 0c 0f e0 6b 73 6e 69 36 d3 e6 61 63 c4 fc 53 fb 32 f8 3f 5b 2f 25 94 32 e9 73 b7 21 ad 9b 0b ff 00 7c 9e 3f 2c 57 8e 78 b3 f6 63 f1 76 88 1e 6d 29 a1 d5 ed d7 90 23 3b 25 c7 fb a7 83 f8 1a fb 34 a0 a6 34 2a c3 90 2a b9 fb 93 cb d8 fc db d4 74 cb cd 2a e9 ed 2f ed 66 b5 b8 8c e1 a2 99 0a 32 9f 70 6a 99 5c 57 e8 27 8f 3e 17 f8 77 e2 0e 9c d6 9a b5 9a 19 42 91 15 d4 60 09 61 3e aa de 9e c7 83 5f 11 fc 41 f0 36 a3 f0 f7 c4 d7 3a 1e a1 f3 98 8e e8 a6 03 e5 9a 33 f7 5c 7f 51 d8 e4 51 64 Data Ascii: ~R(LLsN4(P6@4iOZcFOL{S++7TB^qRDksni6acS2?[/%2s!\|?,Wxcvm)#;%44*t/f2pj\W'>wB`a>_A6:3\QQd
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: fb 3e 29 e4 66 da 08 5a 9c 5a 44 6d c9 e3 8a e6 a9 8b 8c ad 74 72 55 c7 46 49 5d 6a 73 b6 da a9 53 b6 4e 18 75 14 b7 3a a2 99 55 c9 e2 ab ea 76 60 5c 6e 41 8a a6 f6 cc e4 2f 3c d7 54 69 d3 95 a4 75 c2 95 29 5a 67 55 a3 dd a1 cc 80 67 3d ea 3b fb f5 8a 51 db 26 a5 d1 6c 0c 70 05 5e 69 6e 74 7f b5 4e 59 bf 86 bc eb d3 55 1d f6 3c be 6a 4a b3 6f 62 a4 d7 fb a0 22 b9 f5 9f 63 b7 b9 ae c5 f4 75 36 ff 00 77 8c 57 27 a8 69 ed 0c e7 6f 43 5d 78 49 d3 95 e2 8e dc 15 4a 52 bc 51 4e ee 71 26 3d 8d 6a 43 7a ab 08 5a c6 b8 85 93 93 da 9d 18 72 83 ad 77 ce 94 65 14 7a 73 a5 19 45 1a 56 37 0a b7 b2 31 3c 1a b1 aa dc ac 90 30 06 b0 e3 32 09 88 19 c9 a9 6e 7c c2 9c 93 51 2a 0b 9d 4a e6 72 c3 af 68 a5 72 fd b3 a8 84 64 f6 aa 7c 7d ac e3 a6 2a 18 65 7d b8 e6 88 84 92 4f c0 Data Ascii: >)fZZDmtrUFI]jsSNu:Uv`\nA/<Tiu)ZgUg=;Q&lp^intNYU<jJob"cu6wW'ioC]xIJRQNq&=jCzZrwezsEV71<02n\|QJrhrd\|}e}O

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49761	90.84.161.20	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	355	OUT	GET /v6/collect?dt=4 HTTP/1.1 Host: collect-v6.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:56 UTC	315	IN	HTTP/1.1 220 Date: Sun, 12 Jan 2025 00:14:56 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers via: EU-GER-frankfurt-EDGE5-CACHE6[765],EU-GER-frankfurt-EDGE5-CACHE6[ovl,761] X-CCDN-REQ-ID-46B1: 258d53d5f5d2d90ff384e35894b0b79e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49765	172.67.187.243	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	733	OUT	GET /static/js/public.js HTTP/1.1 Host: www.telegramai.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	892	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 1331 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=o4Ow40zQ30k0lLxZW73mxCSmd6ncjbngubl10lZQK7D5ZMyS%2FLZCyE656JEoJeIqsTXddyebJUnI9fWz4W5S7hrFrZFPSy4LoWuz%2BQarGDhYDqnRmePWlCR3ksfkwh1BxxiTFQY%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2fddbc043cb-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1605&min_rtt=1605&rtt_var=602&sent=3&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1311&delivery_rate=1819314&cwnd=198&unsent_bytes=0&cid=a179da8f86a0dd7f&ts=135&x=0"
2025-01-12 00:14:55 UTC	477	IN	Data Raw: 24 28 27 23 74 6f 2d 74 6f 70 27 29 2e 63 6c 69 63 6b 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 24 28 27 62 6f 64 79 2c 68 74 6d 6c 27 29 2e 61 6e 69 6d 61 74 65 28 7b 73 63 72 6f 6c 6c 54 6f 70 3a 30 7d 2c 31 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 66 61 6c 73 65 3b 0d 0a 7d 29 3b 0d 0a 0d 0a 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 28 66 75 6e 63 74 69 6f 6e 28 29 20 7b 0d 0a 20 20 20 20 63 6f 6e 73 74 20 73 63 72 6f 6c 6c 54 6f 70 20 3d 20 24 28 77 69 6e 64 6f 77 29 2e 73 63 72 6f 6c 6c 54 6f 70 28 29 3b 0d 0a 20 20 20 20 63 6f 6e 73 74 20 77 69 6e 64 6f 77 48 65 69 67 68 74 20 3d 20 24 28 77 69 6e 64 6f 77 29 2e 68 65 69 67 68 74 28 29 3b 0d 0a 20 20 20 20 69 66 20 28 73 63 72 6f 6c 6c 54 6f 70 20 3e 20 32 30 30 20 29 20 7b Data Ascii: $('#to-top').click(function() { $('body,html').animate({scrollTop:0},1); return false;});$(window).scroll(function() { const scrollTop = $(window).scrollTop(); const windowHeight = $(window).height(); if (scrollTop > 200 ) {
2025-01-12 00:14:55 UTC	854	IN	Data Raw: 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 20 7c 7c 20 6e 61 76 69 67 61 74 6f 72 2e 76 65 6e 64 6f 72 20 7c 7c 20 77 69 6e 64 6f 77 2e 6f 70 65 72 61 3b 0d 0a 20 20 20 20 69 66 20 28 2f 61 6e 64 72 6f 69 64 2f 69 2e 74 65 73 74 28 75 73 65 72 41 67 65 6e 74 29 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 22 61 6e 64 72 6f 69 64 22 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 69 66 20 28 2f 69 50 61 64 7c 69 50 68 6f 6e 65 7c 69 50 6f 64 2f 2e 74 65 73 74 28 75 73 65 72 41 67 65 6e 74 29 20 26 26 20 21 77 69 6e 64 6f 77 2e 4d 53 53 74 72 65 61 6d 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 22 69 6f 73 22 3b 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 22 70 63 22 3b 0d 0a 7d 0d 0a 0d 0a 69 66 28 67 65 74 4f Data Ascii: igator.userAgent \|\| navigator.vendor \|\| window.opera; if (/android/i.test(userAgent)) { return "android"; } if (/iPad\|iPhone\|iPod/.test(userAgent) && !window.MSStream) { return "ios"; } return "pc";}if(getO

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49764	172.67.187.243	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	736	OUT	GET /static/image/right.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	881	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/png Content-Length: 1081 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XnHWkUD3BTrJl2NJo3Ng6H%2B2IRrH57BO%2FZXhsKIQbFwZa6Siq8akfTeEEUSiO7xo1ZYB4aHE6PKSP0iPdUakexNXXheF%2Bi6%2BObHpYdT%2Bhgiy%2Bkqgx9Nv%2BipODmm7kABk7xIamvo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2fdf95819a1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1848&min_rtt=1847&rtt_var=694&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1314&delivery_rate=1580942&cwnd=118&unsent_bytes=0&cid=add3deb244a8a359&ts=167&x=0"
2025-01-12 00:14:55 UTC	488	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 c9 50 4c 54 45 00 00 00 ef ef ff ef ff ff e7 f7 f7 ef ef f7 ef ef ff ef f7 f7 ef f7 ff ea f4 fa ef ef fa ef f4 fa ef f4 ff eb f3 fb ef f3 fb ef f3 ff ec f2 fc ef f2 fc ef f2 ff ec f2 fc ef f4 fc ed f1 fd ed f4 fd ef f4 fd ef f6 fd ef f5 fd ed f3 fd ed f5 fd ef f5 fd ef f4 fd ef f6 fd ed f4 fd ef f4 fd ef f5 fd ed f4 fd ef f5 fe ee f3 fe ee f5 fe ef f4 fe ef f6 fe ee f3 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f4 fe ef f5 fe b4 c2 d7 bf cb df bf cc de bf cc df c2 ce e0 c7 d2 e3 ca d5 e5 ca d5 e6 d5 de ed d9 e1 ef e0 e8 f4 e7 ee f9 e7 ef f9 e8 ef f9 eb f1 fc eb f2 fb eb f2 fc ef f5 fe Data Ascii: PNGIHDRxxsRGBPLTE
2025-01-12 00:14:55 UTC	593	IN	Data Raw: 93 0a bc 23 cf 4e e3 62 64 1a d7 5d 0e 88 5c 00 39 68 b7 ae 90 15 46 e8 02 64 f6 f3 f9 0a 48 73 69 eb 4e 81 38 51 db 85 e5 58 60 29 90 27 a5 e9 e8 c3 ee 3b 43 67 1b 67 d2 61 a3 94 fa 7c 70 ec 6c 73 65 2f 4d cf d8 2a a5 94 ba 3b 10 57 76 60 7a c2 bd 52 28 79 e0 db e0 9d c2 c9 a9 67 83 61 af 90 f2 b9 5f 83 01 36 48 39 f1 6b 30 c0 fe 23 4e 6e 2c 6c ab c5 12 2b bf f4 de 95 90 72 ae 77 47 96 8f 40 ca fa f2 8a 81 55 8e 09 f6 7f 94 9c fb d4 b4 97 1c 52 1c 00 30 b2 6e 8f ba 05 66 79 45 73 c4 73 97 a5 e6 6e e8 ba bb bb cb f5 83 3c 06 76 f9 69 fd 25 1c d8 e5 c8 6f f9 c0 cb 09 41 51 a3 e4 fa b2 7e 03 ec 72 56 0b 97 c0 2e d7 2f 9a 12 fc 65 d4 44 46 df 13 8e e4 2f 86 9f d2 c2 47 f2 a6 5d f8 70 f7 07 fe d4 2a fc e0 aa af 18 58 fa bb 1f 50 c5 55 fa bb 3f 50 d3 29 63 77 Data Ascii: #Nbd]\9hFdHsiN8QX`)';Cgga\|plse/M;Wv`zR(yga_6H9k0#Nn,l+rwG@UR0nfyEssn<vi%oAQ~rV./eDF/G]pXPU?P)cw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49766	172.67.187.243	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	734	OUT	GET /static/image/gou.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	881	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/png Content-Length: 2321 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fTIg25KUHmLe%2BmtBKkXXqQL%2BsJb0r7z2RBVzP54WIhKIp%2FQzWPKQln0sCEVnJz4SzmDrelIrje%2B9uXJ%2Flnvs2Ks2eEscPQVf3sbUGKiQno01iU8wjeF72T3mZSCzxd%2Bm%2BMeG8A8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2fe0b1d43a3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1549&min_rtt=1542&rtt_var=593&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2837&recv_bytes=1312&delivery_rate=1822721&cwnd=226&unsent_bytes=0&cid=20976896984a8e80&ts=144&x=0"
2025-01-12 00:14:55 UTC	488	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 05 bb 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 62 30 66 38 62 65 39 2c 20 32 30 32 31 2f 31 32 2f 30 38 2d 31 39 3a 31 31 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 Data Ascii: PNGIHDR@@iqpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.b0f8be9, 2021/12/08-19:11:22 "> <rdf:R
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c 6e 73 3a 73 74 45 76 74 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 73 54 79 70 65 2f 52 65 73 6f 75 72 63 65 45 76 65 6e 74 23 22 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 33 2e 32 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 32 34 2d 31 32 2d 30 34 54 31 30 3a 31 36 3a 33 32 2b 30 38 3a 30 30 22 20 78 6d 70 3a 4d 6f 64 69 66 79 44 61 74 65 3d 22 32 30 32 34 2d 31 32 2d 30 35 54 31 37 3a 35 39 3a 32 34 2b 30 38 3a 30 30 22 20 78 6d 70 3a 4d 65 74 61 64 61 74 61 44 61 74 65 Data Ascii: :xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 23.2 (Windows)" xmp:CreateDate="2024-12-04T10:16:32+08:00" xmp:ModifyDate="2024-12-05T17:59:24+08:00" xmp:MetadataDate
2025-01-12 00:14:55 UTC	464	IN	Data Raw: 76 e0 6e 9f 7d 2c a2 a8 11 70 08 df 3c 73 fe 1d 76 2f a3 fe 36 fc 80 75 96 7e 29 fb 24 93 0a a3 88 11 30 88 af db ae ed c2 c5 8c f5 47 a5 61 bf be 87 9e 09 05 04 bd 76 8a 30 60 1c 6b 3b 5c df 85 0b 3d ea 7e 8e 73 3d ee 69 4a 06 1d 5b b6 b2 0c e4 fd 04 5e 91 86 7f 27 23 1b f8 08 f7 f0 69 87 b2 49 1c ec d1 7e 13 b3 f8 40 f7 b5 40 2e f2 1a 70 50 f7 80 a5 55 76 58 5a b1 1d 69 5d db 80 ef 65 0b 96 ff e1 2d 69 e3 53 0a 45 8c 80 2c 6f e6 33 cc e1 8c b4 ac 1d c9 d8 fe 28 fe ec 4b 59 46 f2 c6 80 4b 78 21 e3 bd 27 f0 97 f4 f0 59 ea 7c d5 6a bf 54 f2 1a 70 1e 3f 2f e3 fe 4d 7a 3f 7c 53 da e2 8e f5 a9 69 59 14 31 0b 7c 88 1b 8a 59 99 cd e3 a6 34 83 54 42 11 06 dc c7 bb 52 a0 cb 63 42 53 0a 7a 6f 2b 31 e8 b5 53 d4 52 f8 6f ec 6c 1d f7 3b 5d 0d 60 4f ab ad ca 28 72 2f Data Ascii: vn},p<sv/6u~)$0Gav0`k;\=~s=iJ[^'#iI~@@.pPUvXZi]e-iSE,o3(KYFKx!'Y\|jTp?/Mz?\|SiY1\|Y4TBRcBSzo+1SRol;]`O(r/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49767	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	364	OUT	GET /telegram-16/top.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	951	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/jpeg Content-Length: 946 Connection: close ETag: "d048d5a47f4689e2ba0737434ff1b8b1" Last-Modified: Fri, 06 Dec 2024 01:36:06 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6QRXTeQR1X%2FCByFO56tnW2Txz3vYx%2FUWDKMZdqtboSxRZPtYwjIy3oUZ%2B4aC5r%2F%2FaCQxb2KdJU94puKH2dRWHE%2BHdfl1BwxbYx9QKyotkMwJk0GCQ%2BXQe7%2BkN9QysKPMQaBsVYwT7t8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2fe2dff42e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1559&min_rtt=1557&rtt_var=589&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=942&delivery_rate=1850443&cwnd=252&unsent_bytes=0&cid=a541606389fed2cb&ts=146&x=0"
2025-01-12 00:14:55 UTC	418	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 03 6c 49 44 41 54 78 5e ed 9a 4f 48 14 61 18 c6 9f 77 d7 94 d2 a8 76 36 f1 62 41 74 88 88 4a ca 83 eb 2c 94 a7 22 22 0f fd f1 9c 9d a2 a8 9d 55 3c 95 46 5d 12 1d 8d fe 1c a2 3a 27 5e c4 0a 3c 74 08 76 54 4c 24 22 ab 5b 44 78 b1 9a 59 4b 43 50 77 de 58 82 50 70 77 67 66 3f 9d c5 fd f6 b4 b0 ef fb 7e cf f3 9b 6f 66 9e 61 87 50 e4 1f 2a 72 ff 90 00 e4 0e 28 72 02 f2 14 c8 b5 01 8e b4 59 db ca 97 e8 90 4d 08 e4 aa 2d a4 df 03 0c fb 4f 09 bf 9f b8 1b fa 95 4d 57 d6 1d a0 6a 66 37 11 b4 42 32 e6 56 0b 33 77 1a 7a b8 2d 53 5f 46 00 f5 b1 99 a3 81 40 6a dc ed 82 85 58 bf 64 d3 c1 d1 9e d0 87 d5 b4 65 04 10 6d b1 4e 81 f9 Data Ascii: PNGIHDR@@iqsRGBlIDATx^OHawv6bAtJ,""U<F]:'^<tvTL$"[DxYKCPwXPpwgf?~ofaP*r(rYM-OMWjf7B2V3wz-S_F@jXdemN
2025-01-12 00:14:55 UTC	528	IN	Data Raw: a7 d9 54 32 a3 d9 d0 95 67 ae 9d 78 6c 58 37 00 6a 8b 75 1a cc 03 84 ec 4f 95 0c d8 20 6a 34 ba 42 2f 3c 7a 72 d5 b6 2e 00 ea b5 e4 71 22 7b 88 80 52 27 ea 18 58 a0 14 35 24 7a 43 c3 4e ea f3 a9 59 73 00 91 d6 e4 e1 a0 9d 32 00 2a 77 23 94 c1 b3 6c 53 dd 70 8f f2 d1 4d 9f db da 35 05 a0 5e 9f d9 43 c1 d4 5b 00 8a 5b 61 ff 6e 8f 3c 0d bb 24 62 f4 6e ff e2 a5 df 49 cf 9a 01 88 b4 cc 56 06 ec 85 71 22 ec 72 22 24 53 0d 33 be d9 81 d2 da 91 ae ad df f3 99 93 a9 77 4d 00 1c bb cc 15 4b 9b ad 51 02 0e 88 10 cd c0 64 c9 7c a8 ee cd 23 9a 13 31 6f f9 0c e1 00 f6 5e e5 b2 aa 52 eb 35 01 aa 48 b1 0c 18 f3 b3 a1 86 89 c7 b4 28 72 ae 58 00 1d 1c 50 7f 5b af 88 70 42 a4 c8 ff b3 98 07 13 ba d2 08 10 8b 9a 2f 14 80 1a 37 7b 09 b8 26 4a dc aa 69 91 a1 1b ba 12 17 b5 86 Data Ascii: T2gxlX7juO j4B/<zr.q"{R'X5$zCNYs2*w#lSpM5^C[[an<$bnIVq"r"$S3wMKQd\|#1o^R5H(rXP[pB/7{&Ji

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49770	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	383	OUT	GET /telegram-16/cropped-header-image-5.png HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:55 UTC	943	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: image/jpeg Content-Length: 66150 Connection: close ETag: "1bc64af22b7c6f477d1635b174c3e599" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ifkufHfx9x9lklbOLIZ5PzC6%2FXKqKVm3DZWVCKdELYQ4b1TTkuUrQGMQYPIu48tnBF1QDdJtRd733PinwTjZjDst%2FwQWrzlX4FErg6w7rdgNj%2FFTHIvoMZXAtShRKor5AypsdiuOQZA%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2ff3ca18cca-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1808&min_rtt=1804&rtt_var=685&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2873&recv_bytes=961&delivery_rate=1588683&cwnd=239&unsent_bytes=0&cid=e6b55fbcc024c5a7&ts=154&x=0"
2025-01-12 00:14:55 UTC	426	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 3b 00 00 01 f3 08 03 00 00 00 19 ee e6 6e 00 00 03 00 50 4c 54 45 00 00 00 a1 a1 a4 c0 c1 c2 d3 d3 d5 b8 b8 ba 89 8a 8c c9 c8 ca 96 97 9a a9 a9 ac ff ff ff 1a 19 19 fa fb fb fe fe fa f2 f2 f1 f6 f6 f6 28 28 2c 2d 2e 32 14 20 2a 9f b6 ee 35 36 3a 17 16 16 a9 b4 ec 11 0f 10 dd dc de 0d 17 1d e2 e3 e2 eb eb ed e8 e8 e8 96 b6 ef 31 22 22 3b 28 24 24 16 14 d7 d7 d8 44 2d 2d 82 7d a0 8d b8 f3 28 1c 1c cb cb cb 11 1d 25 37 22 1c 21 1d 24 2f 1d 18 d2 d2 d2 07 09 0c aa 74 85 83 cd cc 4a 4c 52 a7 d8 a6 63 b8 fd df df ec 50 7c a2 df 8c 7d 49 32 35 b2 b4 ec 63 63 65 72 b1 fd 6a b5 fd a4 a7 bd 58 57 5c 70 c7 e0 1e 0f 0b 7a cb d6 80 b8 f5 66 c4 e9 b3 b3 b3 52 36 38 ee f2 fb 07 04 03 7f 7f 81 38 3f 44 13 09 08 9d Data Ascii: PNGIHDR;nPLTE((,-.2 *56:1"";($$D--}(%7"!$/tJLRcP\|}I25ccerjXW\pzfR688?D
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 92 ac 9a 98 9a b8 7f 71 a3 71 69 b9 e0 f5 77 ce ee d0 e7 fa 35 15 06 eb d9 bf 6c cd f9 bc a8 b8 ca de f0 4f 5c 87 70 73 9a 90 76 92 a9 d0 f1 69 68 90 d6 98 90 3d 5d 75 7a 50 4d 91 5f 69 4f 1d 08 f3 d1 fc ee dc e5 f5 1b 6d 9e c4 e4 9c 63 54 d7 aa a1 70 63 83 bb a3 af 8d 53 4d f0 e1 cc 86 6a 87 fc de ac 74 ac d7 ba de 96 5f 56 79 6c 27 0f b6 92 90 b4 97 ab 64 6e 97 47 9d e4 a2 0d 13 fb e7 f8 b2 ca e3 f0 fe cc fc f2 ba ea a5 95 4f 7c a6 91 80 a3 d5 ed d1 8b b9 dc b2 73 5d 83 40 0d c6 de b1 ce b6 b9 f5 ea db f1 c7 97 a5 96 b3 4b 7b 9a 77 43 39 8f c7 ed a1 4d 0d 89 a4 c3 11 78 e8 df ed bc e7 ce aa a6 8f a3 cf e7 ed de 8a 47 62 9f d0 81 64 63 a2 66 30 2c 4a 5c ea a7 5a c5 7c 4f a0 86 83 5d 85 ae 21 aa f3 cd 93 64 b5 17 46 c8 bf f5 1d 31 4c f2 ba 79 d4 12 57 a9 Data Ascii: qqiw5lO\psvih=]uzPM_iOmcTpcSMjt_Vyl'dnGO\|s]@K{wC9MxGbdcf0,J\Z\|O]!dF1LyW
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 1e 20 46 a0 a7 d2 9e a2 28 69 70 68 10 69 85 17 78 fb 3c c3 1b 10 20 1d 59 2f 85 93 61 1f 30 06 8a 92 f2 34 e5 eb 28 3d b8 1f 9d 1b 27 0b dc 42 07 8b a2 c5 ba 7f 82 26 1b 54 ca f2 d5 53 cb 27 ca 29 1a 35 69 32 5b a9 e4 2b 65 28 52 29 5d d3 6c 43 b1 14 4d b7 8c a6 a5 6a 96 65 d8 ba 65 da 2a ad b7 ed 72 10 68 58 a9 4d cb 54 10 4b d5 75 5b 55 2c c3 2c eb 16 a1 55 1a d9 f0 5b ba 9f 3e 0d a1 68 3e 34 ec b2 5d c6 aa a9 18 52 3b 24 09 66 7a df 51 57 68 0f b1 79 ec 62 3d ed 21 41 a1 d7 eb f5 83 5e d0 6f b7 db bd a0 3d 1c 66 07 b8 e4 59 29 08 6e d6 47 2d 0f 3b 41 3f 70 83 5e 3f 1b 04 86 87 f4 47 85 fe b0 3d 2c c3 c3 f0 4c 10 e8 93 fb 0d 74 13 1a c4 a3 47 4d 08 68 f4 d7 30 db 0f 50 79 a5 f0 70 6c eb 69 36 4f d4 f2 cb 27 f2 0a 76 8c 2c 04 cd 2c ae e4 2b 8d 15 c3 b2 Data Ascii: F(iphix< Y/a04(='B&TS')5i2[+e(R)]lCMjee*rhXMTKu[U,,U[>h>4]R;$fzQWhyb=!A^o=fY)nG-;A?p^?G=,LtGMh0Pypli6O'v,,+
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 46 b8 0c e9 08 52 ad 52 84 fc 1d 3a 42 3e 22 d2 41 73 8b d4 16 d1 31 50 97 cb 29 aa d8 d0 b0 e0 27 d9 b8 47 c3 ee e2 ba bb 2e a4 0d c4 23 fc 94 e3 8b 15 ba 7e 61 f9 60 ed 58 90 da 21 49 26 31 ed b8 c2 92 81 06 88 c8 ce f5 1c 5c 19 1b 27 c4 85 c6 c5 9d d0 5c 7f 1a c7 27 91 10 3c 16 55 44 39 70 db ef ce a2 8a 3e c9 3a 86 45 30 7c 91 dd 2a 54 68 e3 b7 99 03 bf df c8 84 76 74 de c0 4c 07 26 e7 65 be a5 eb 84 8b 88 cf c8 f0 d1 25 44 ee 3b 24 c9 67 96 76 d0 8b 7e 07 da af 43 b2 41 aa 41 91 71 45 06 e1 00 c7 16 13 8f 1f 29 87 e3 b2 70 60 88 82 07 02 f4 75 32 ce e3 82 24 43 bc e0 2e 45 b1 95 18 d7 b4 fd 78 d3 79 d3 79 fe 06 77 1c 6f 60 70 6b 59 67 ed a0 3f 18 9e a0 48 39 9c d8 55 2d de d5 4a ed 90 24 9d b8 76 d0 dd 04 6f 33 7e 0d 52 0c 30 d1 fd 5a 46 c4 03 9a 0f Data Ascii: FRR:B>"As1P)'G.#~a`X!I&1\'\'<UD9p>:E0\|*ThvtL&e%D;$gv~CAAqE)p`u2$C.Exyywo`pkYg?H9U-J$vo3~R0ZF
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 51 ea 56 d2 67 a0 4a f4 7e 87 e6 18 71 d0 1d df a0 3b 94 2e a8 cb d8 a3 38 ed 20 77 08 93 10 50 d2 08 60 32 25 54 9b 83 a6 39 4b 51 a9 90 23 e2 c9 f2 c5 db 8f d6 eb 51 75 d9 80 60 ad 63 b5 2c db 71 02 66 35 2d 57 d8 66 50 6b 95 6b 96 d9 6a 7a 2e f3 2c 6e 71 36 7b 8c 5c 64 fc 85 3b 50 1e 12 32 07 3d 32 93 bd 05 3d b7 62 d1 79 87 66 fe 99 96 77 a8 4f 5f 89 83 61 f1 9a e5 25 e9 0e 11 63 aa 56 c5 50 f9 21 6e b4 50 ee e8 75 bb dd cd 9d 9d f4 9a c5 5e ec 3f ff 4a 18 5d b5 58 6d 43 d4 5a 6a dc 58 6e 36 da 1b cd e6 8d 1b ab ed 86 6d 36 56 56 5b ed 46 fb c6 56 63 a3 53 6b af d4 d8 ac e1 dd 6e d6 15 bd ee d3 ac 88 7b de 44 77 d0 0b 80 48 1d 68 0e 28 7f 65 0f 7d 5f a9 e6 38 b0 9e 77 47 26 d3 80 5a cc bd e9 35 8b 72 47 fa 96 0d 91 04 76 60 0b c0 b5 27 1f 9c 38 26 17 Data Ascii: QVgJ~q;.8 wP`2%T9KQ#Qu`c,qf5-WfPkkjz.,nq6{\d;P2=2=byfwO_a%cVP!nPu^?J]XmCZjXn6m6VV[FVcSkn{DwHh(e}_8wG&Z5rGv`'8&
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 47 fb 82 ba e4 ca 96 0c c5 7a 47 98 ae 27 04 73 0c 66 ff ad f7 70 08 db 70 04 77 4d db 9c b2 66 41 31 9d 1c f4 a3 7a bd 5a 07 aa 48 08 91 64 b0 3b 1c f7 07 c3 7e bf 5a 8f c0 1e 55 38 ad ae c3 b3 69 77 ec 4f 75 c7 b7 ca 1d 47 00 9f 67 a1 6f b5 a4 27 69 49 1f 98 87 00 59 7f e4 79 44 bb 43 33 c7 14 b8 03 94 a1 ac 91 b4 64 0e a8 0f a2 3c b0 92 5b 4e c2 aa 65 1b dd e1 32 60 59 fe 81 96 4a d0 b5 31 76 56 9b e5 ce 5a b9 d9 6e 6d ac b7 5a e5 c6 fa e1 e5 21 02 db b7 b9 e7 f9 d6 d4 55 10 ba 63 10 56 17 22 40 36 61 7f a1 24 07 a5 c1 78 38 1e 0c f7 c7 fd 30 ea 0f 91 a8 14 5f 15 c2 d9 7e d6 1d fb c3 fe 70 f7 80 3b f6 77 4f 8f 87 68 94 23 b9 e3 a9 5b 5e 7f 1d dd 71 8a 5e 58 8a 5f 8f 8d e6 90 90 3e 8a fd f1 95 76 87 66 9e c9 bb 43 99 02 3a 2c 0a 1c ab b4 03 c0 5e 82 e7 Data Ascii: GzG'sfppwMfA1zZHd;~ZU8iwOuGgo'iIYyDC3d<[Ne2`YJ1vVZnmZ!UcV"@6a$x80_~p;wOh#[^q^X_>vfC:,^
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 38 c0 0e 8c 30 7c 7c f9 f1 69 94 8f 51 ee b9 e9 1e 88 ad 39 fd f0 41 76 c4 07 ec 18 e8 28 a9 1b 3b 08 15 a2 e2 12 e4 e0 a2 f6 3e 3f 18 66 fe f0 1d d9 31 5f 8e 61 83 10 32 36 6e 0b f3 a0 89 93 ea 0a 8a 70 14 32 0d ca 0a 9b e6 9d 43 32 0c 49 d6 0d b9 3b 3b be 41 a2 b3 3a 07 f7 40 c9 0e c6 0e 8a 60 aa 8d 2a 12 1f 2c 30 71 1b f0 11 d5 0c e6 1a 3f 55 33 b3 8d bd 40 66 76 a3 71 5d 08 7c 08 54 b1 d5 42 be 05 80 40 13 eb 90 f2 f8 9e e4 72 db c1 a7 bc f9 8e 55 81 0e 68 93 47 28 40 07 d8 01 6c e0 e6 02 39 18 3a c0 0e 8e 0e 54 60 c7 c0 77 0c 74 84 d5 3d df 21 52 a3 1d e8 10 22 78 d0 0d b5 0e 96 f2 5c a9 1c 09 fb 72 39 1f 84 3a 9c 94 20 55 ed 3c f4 25 69 26 6b 28 68 6b 07 f2 19 fc 21 fa aa 21 59 05 e4 46 ba b2 43 79 1a 74 a8 c2 7a b8 80 03 0a 17 a8 e0 12 4d a2 2e 25 Data Ascii: 80\|\|iQ9Av(;>?f1_a26np2C2I;;A:@`*,0q?U3@fvq]\|TB@rUhG(@l9:T`wt=!R"x\r9: U<%i&k(hk!!YFCytzM.%
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: fc 33 57 7b f8 e3 e8 33 3b 04 3d ee ea c4 07 8a 68 f2 9b e0 41 41 cb aa 00 07 e9 83 52 5f d9 d1 04 3b 14 5c 42 d4 b4 97 6e 98 f2 4f c1 b9 4d dd 3e 35 35 75 6a 07 17 09 8f db 21 4c ec ec a1 47 9d 53 3b 3b a7 a6 76 f6 de de c1 e4 9e d0 ce 0e ee a9 07 77 f6 7e f8 e1 87 9d 91 91 a9 a9 1b f1 36 78 ab 9d 29 3f 9a fe 1b fd c3 11 bd 1f 31 cb b9 6e 7a 9e 0a c7 c7 26 b7 1e 54 6d e3 e2 ec c8 0f d8 71 5c 34 34 ed cf a5 d3 89 64 21 d6 6f 15 97 67 26 d2 be 5c e4 ca 13 1e d4 7f df f1 68 a7 ef e8 18 10 c6 83 f9 8e 6f 39 34 3e 3a 9b c8 f9 cf 9f 5d f9 a0 c4 44 34 61 05 95 68 e1 21 86 ba 0b 53 6d 2f 64 ec e8 94 62 72 a9 a6 4a 45 15 b5 d5 1a ff 53 69 7c 39 97 89 62 52 c5 5b 5c 96 24 79 f3 1d f9 3f d8 f1 3c 2e d1 40 e1 0d c2 07 2e 14 5c 84 10 94 6d 62 c8 f3 03 76 1c 17 5d 85 Data Ascii: 3W{3;=hAAR_;\BnOM>55uj!LGS;;vw~6x)?1nz&Tmq\44d!og&\ho94>:]D4ah!Sm/dbrJESi\|9bR[\$y?<.@.\mbv]
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 67 c7 a3 bd e1 d1 3d 61 0a ed b3 63 c5 ef de 10 0a 4d ce 9d 3c 39 7b dd e4 e4 24 d8 81 d4 45 9d 02 8f 26 6d b6 d4 28 00 41 07 81 4c 6d 1d a3 d4 ad 63 90 a6 a9 53 e3 21 0a 84 3c 69 09 eb eb f5 e6 8a 60 c7 ff 4f 2c df 81 43 a4 1c 1d b8 3b c5 2d 07 2f 44 0e a1 ec e9 09 6f ec b8 6a e8 9a 6b 2e bb 64 5d 8d 8b 1e 10 1a d7 e0 63 13 03 5d 9a 86 c0 8e c2 a1 24 bd 2c fa 5d 65 a6 ec 1e b3 dd 7e 2d 00 90 b1 12 47 83 1d 2d a1 f5 40 57 80 88 0b e5 30 3b 4a fe 6a 28 74 e3 c9 1b 4e 8d 86 27 46 ae 67 ec 68 6e d5 6a f5 75 64 47 41 03 da 69 41 0b 0d ca 7f d6 31 01 ad 23 ef 81 d4 68 9d a6 6a 2b 75 b4 b0 7a a5 86 4e 0d 43 35 ce 8e 0b ff 26 3b 14 24 af fb 9a 2b 05 3a ba 4b c4 2b 84 8e 36 6d 23 66 39 ed e9 3b 07 2f 8b 0c 8f a5 db 14 4e 87 51 fe be 68 79 9b c6 7c 4b 57 0e 8c cf Data Ascii: g=acM<9{$E&m(ALmcS!<i`O,C;-/Dojk.d]c]$,]e~-G-@W0;Jj(tN'FghnjudGAiA1#hj+uzNC5&;$+:K+6m#f9;/NQhy\|KW
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 73 f5 76 b7 a3 1d ed 68 b2 ae 64 b1 84 36 c6 b1 32 1a 89 63 58 d7 8c 4c 0b 99 08 e3 8e 63 0c 6b 89 15 13 57 64 dd 47 10 b1 41 0c 76 59 6c f0 b9 96 8d b0 71 25 12 f7 2d ce 90 f0 97 e7 ed 9a 2d 33 7a c6 ee ce 38 56 e2 e9 ea ea aa 9e ee f9 7c f3 cd fc 3c ef 5b d5 dd 1d b3 c3 ea ed ab 54 9c 3a 3b ae be ee 86 ab 2e 3a e3 e2 03 2f 3d 2a e4 8c 19 51 68 59 a1 47 f3 8f 4c 2b b0 ff f4 4b 2b 38 73 f2 bd 5b aa 9b 81 6c 5e 17 5a cb 06 71 23 b1 ce b4 77 6f 7f 8e ee 3e d6 3d 3b f6 c3 42 4c d0 89 0e 05 8e 96 52 c7 34 f8 0e a2 c7 59 3b 4c 5e fd c9 59 f7 d6 53 a1 28 aa a1 5a 34 47 94 2a 6a e9 97 69 ca 87 3e 1a 2b 2a 6a 25 73 a5 bd 1b bc 72 de db af 1c da ff ed f8 2b 26 59 3f ce 79 6b 32 ff 53 59 10 d1 fe 8f d1 ec 88 28 11 aa 62 94 24 27 54 49 a0 a3 73 76 c0 76 1c 7c 92 c3 Data Ascii: svhd62cXLckWdGAvYlq%--3z8V\|<[T:;.:/=QhYGL+K+8s[l^Zq#wo>=;BLR4Y;L^YS(Z4Gji>+*j%sr+&Y?yk2SY(b$'TIsvv\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49768	172.67.187.243	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:55 UTC	733	OUT	GET /static/js/jquery.js HTTP/1.1 Host: www.telegramai.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:55 UTC	891	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:55 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 86923 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 0 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2VIsYFflZOns3kw1cQbkUY5dyIvlReomQ6snbqOhbI7udiYfITxJv7BYGrTn4XP9FJzPX9NGvYPFYdn0BBHfgc8vlsm5hB6bO%2BtDWHFKEKREbLhAgGjAfZ8QC5CT3RWHAVDAAjg%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f2ff2b60424d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1707&min_rtt=1698&rtt_var=655&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1311&delivery_rate=1645997&cwnd=208&unsent_bytes=0&cid=0c5095757cded350&ts=184&x=0"
2025-01-12 00:14:55 UTC	478	IN	Data Raw: 2f 2a 21 6a 51 75 65 72 79 20 76 33 2e 33 2e 31 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e 74 72 69 62 75 74 6f 72 73 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 2a 2f 21 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 65 2e 64 6f 63 75 6d 65 6e 74 3f 74 28 65 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 21 65 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 Data Ascii: /!jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license/!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery req
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 2c 66 3d 6c 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 70 3d 66 2e 74 6f 53 74 72 69 6e 67 2c 64 3d 70 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 2c 68 3d 7b 7d 2c 67 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 74 26 26 22 6e 75 6d 62 65 72 22 21 3d 74 79 70 65 6f 66 20 74 2e 6e 6f 64 65 54 79 70 65 7d 2c 79 3d 66 75 6e 63 74 69 6f 6e 20 65 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 74 26 26 74 3d 3d 3d 74 2e 77 69 6e 64 6f 77 7d 2c 76 3d 7b 74 79 70 65 3a 21 30 2c 73 72 63 3a 21 30 2c 6e 6f 4d 6f 64 75 6c 65 3a 21 30 7d 3b 66 75 6e 63 74 69 6f 6e 20 6d 28 65 2c 74 2c 6e 29 7b 76 61 72 20 69 2c 6f 3d 28 74 3d 74 7c 7c 72 29 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 Data Ascii: ,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 72 28 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 61 26 26 28 6c 3d 61 2c 61 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 7c 7c 7b 7d 2c 73 2b 2b 29 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 67 28 61 29 7c 7c 28 61 3d 7b 7d 29 2c 73 3d 3d 3d 75 26 26 28 61 3d 74 68 69 73 2c 73 2d 2d 29 3b 73 3c 75 3b 73 2b 2b 29 69 66 28 6e 75 6c 6c 21 3d 28 65 3d 61 72 67 75 6d 65 6e 74 73 5b 73 5d 29 29 66 6f 72 28 74 20 69 6e 20 65 29 6e 3d 61 5b 74 5d 2c 61 21 3d 3d 28 72 3d 65 5b 74 5d 29 26 26 28 6c 26 26 72 26 26 28 77 2e 69 73 50 6c 61 69 6e 4f 62 6a 65 63 74 28 72 29 7c 7c 28 69 3d 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 72 29 29 29 3f 28 69 3f 28 69 3d 21 31 2c 6f 3d 6e 26 26 41 72 72 61 79 2e 69 73 41 72 72 61 79 28 6e 29 3f 6e 3a 5b Data Ascii: r("boolean"==typeof a&&(l=a,a=arguments[s]\|\|{},s++),"object"==typeof a\|\|g(a)\|\|(a={}),s===u&&(a=this,s--);s<u;s++)if(null!=(e=arguments[s]))for(t in e)n=a[t],a!==(r=e[t])&&(l&&r&&(w.isPlainObject(r)\|\|(i=Array.isArray(r)))?(i?(i=!1,o=n&&Array.isArray(n)?n:[
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 29 29 66 6f 72 28 72 3d 65 2e 6c 65 6e 67 74 68 3b 6f 3c 72 3b 6f 2b 2b 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 65 6c 73 65 20 66 6f 72 28 6f 20 69 6e 20 65 29 6e 75 6c 6c 21 3d 28 69 3d 74 28 65 5b 6f 5d 2c 6f 2c 6e 29 29 26 26 73 2e 70 75 73 68 28 69 29 3b 72 65 74 75 72 6e 20 61 2e 61 70 70 6c 79 28 5b 5d 2c 73 29 7d 2c 67 75 69 64 3a 31 2c 73 75 70 70 6f 72 74 3a 68 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 77 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 77 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f Data Ascii: ))for(r=e.length;o<r;o++)null!=(i=t(e[o],o,n))&&s.push(i);else for(o in e)null!=(i=t(e[o],o,n))&&s.push(i);return a.apply([],s)},guid:1,support:h}),"function"==typeof Symbol&&(w.fn[Symbol.iterator]=n[Symbol.iterator]),w.each("Boolean Number String Functio
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 22 29 2c 7a 3d 6e 65 77 20 52 65 67 45 78 70 28 22 3d 22 2b 4d 2b 22 2a 28 5b 5e 5c 5c 5d 27 5c 22 5d 2a 3f 29 22 2b 4d 2b 22 2a 5c 5c 5d 22 2c 22 67 22 29 2c 58 3d 6e 65 77 20 52 65 67 45 78 70 28 57 29 2c 55 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 52 2b 22 24 22 29 2c 56 3d 7b 49 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 23 28 22 2b 52 2b 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 52 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 52 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 49 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 57 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 3a 28 Data Ascii: "),z=new RegExp("="+M+"([^\\]'\"]?)"+M+"\\]","g"),X=new RegExp(W),U=new RegExp("^"+R+"$"),V={ID:new RegExp("^#("+R+")"),CLASS:new RegExp("^\\.("+R+")"),TAG:new RegExp("^("+R+"\|[])"),ATTR:new RegExp("^"+I),PSEUDO:new RegExp("^"+W),CHILD:new RegExp("^:(
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 31 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 65 28 65 2c 74 2c 72 2c 69 29 7b 76 61 72 20 6f 2c 73 2c 6c 2c 63 2c 66 2c 68 2c 76 2c 6d 3d 74 26 26 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2c 54 3d 74 3f 74 2e 6e 6f 64 65 54 79 70 65 3a 39 3b 69 66 28 72 3d 72 7c 7c 5b 5d 2c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 65 7c 7c 21 65 7c 7c 31 21 3d 3d 54 26 26 39 21 3d 3d 54 26 26 31 31 21 3d 3d 54 29 72 65 74 75 72 6e 20 72 3b 69 66 28 21 69 26 26 28 28 74 3f 74 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 74 3a 77 29 21 3d 3d 64 26 26 70 28 74 29 2c 74 3d 74 7c 7c 64 2c 67 29 29 7b 69 66 28 31 31 21 3d 3d 54 26 26 28 66 3d 4a 2e 65 78 65 63 28 65 29 29 29 69 66 28 6f 3d 66 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 54 29 7b 69 66 28 21 28 6c 3d 74 2e Data Ascii: 1}}}function oe(e,t,r,i){var o,s,l,c,f,h,v,m=t&&t.ownerDocument,T=t?t.nodeType:9;if(r=r\|\|[],"string"!=typeof e\|\|!e\|\|1!==T&&9!==T&&11!==T)return r;if(!i&&((t?t.ownerDocument\|\|t:w)!==d&&p(t),t=t\|\|d,g)){if(11!==T&&(f=J.exec(e)))if(o=f[1]){if(9===T){if(!(l=t.
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 6f 64 65 54 79 70 65 26 26 31 3d 3d 3d 74 2e 6e 6f 64 65 54 79 70 65 26 26 65 2e 73 6f 75 72 63 65 49 6e 64 65 78 2d 74 2e 73 6f 75 72 63 65 49 6e 64 65 78 3b 69 66 28 72 29 72 65 74 75 72 6e 20 72 3b 69 66 28 6e 29 77 68 69 6c 65 28 6e 3d 6e 2e 6e 65 78 74 53 69 62 6c 69 6e 67 29 69 66 28 6e 3d 3d 3d 74 29 72 65 74 75 72 6e 2d 31 3b 72 65 74 75 72 6e 20 65 3f 31 3a 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 66 65 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 74 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 26 26 74 2e 74 79 70 65 3d 3d 3d 65 7d 7d 66 75 6e 63 74 69 6f 6e 20 70 65 28 65 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 6e 3d 74 Data Ascii: odeType&&1===t.nodeType&&e.sourceIndex-t.sourceIndex;if(r)return r;if(n)while(n=n.nextSibling)if(n===t)return-1;return e?1:-1}function fe(e){return function(t){return"input"===t.nodeName.toLowerCase()&&t.type===e}}function pe(e){return function(t){var n=t
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 67 4e 61 6d 65 28 22 2a 22 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3d 51 2e 74 65 73 74 28 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 29 2c 6e 2e 67 65 74 42 79 49 64 3d 75 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 68 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 65 29 2e 69 64 3d 62 2c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 64 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 62 29 2e 6c 65 6e 67 74 68 7d 29 2c 6e 2e 67 65 74 42 79 49 64 3f 28 72 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 72 65 70 6c 61 63 65 28 5a 2c 65 65 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 Data Ascii: gName("*").length}),n.getElementsByClassName=Q.test(d.getElementsByClassName),n.getById=ue(function(e){return h.appendChild(e).id=b,!d.getElementsByName\|\|!d.getElementsByName(b).length}),n.getById?(r.filter.ID=function(e){var t=e.replace(Z,ee);return func
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 2b 62 2b 22 27 3e 3c 2f 61 3e 3c 73 65 6c 65 63 74 20 69 64 3d 27 22 2b 62 2b 22 2d 5c 72 5c 5c 27 20 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 3d 27 27 3e 3c 6f 70 74 69 6f 6e 20 73 65 6c 65 63 74 65 64 3d 27 27 3e 3c 2f 6f 70 74 69 6f 6e 3e 3c 2f 73 65 6c 65 63 74 3e 22 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 6d 73 61 6c 6c 6f 77 63 61 70 74 75 72 65 5e 3d 27 27 5d 22 29 2e 6c 65 6e 67 74 68 26 26 79 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4d 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 65 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 79 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4d 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 50 2b 22 29 22 29 2c 65 2e Data Ascii: +b+"'></a><select id='"+b+"-\r\\' msallowcapture=''><option selected=''></option></select>",e.querySelectorAll("[msallowcapture^='']").length&&y.push("[^$]="+M+"(?:''\|\"\")"),e.querySelectorAll("[selected]").length\|\|y.push("\\["+M+"*(?:value\|"+P+")"),e.
2025-01-12 00:14:55 UTC	1369	IN	Data Raw: 3d 72 7c 7c 21 28 21 72 7c 7c 31 21 3d 3d 72 2e 6e 6f 64 65 54 79 70 65 7c 7c 21 28 6e 2e 63 6f 6e 74 61 69 6e 73 3f 6e 2e 63 6f 6e 74 61 69 6e 73 28 72 29 3a 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 26 26 31 36 26 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 72 29 29 29 7d 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 74 29 77 68 69 6c 65 28 74 3d 74 2e 70 61 72 65 6e 74 4e 6f 64 65 29 69 66 28 74 3d 3d 3d 65 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 44 3d 74 3f 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 69 66 28 65 3d 3d 3d 74 29 72 65 74 75 72 6e 20 66 3d 21 30 2c 30 3b 76 61 72 20 72 3d 21 65 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f Data Ascii: =r\|\|!(!r\|\|1!==r.nodeType\|\|!(n.contains?n.contains(r):e.compareDocumentPosition&&16&e.compareDocumentPosition(r)))}:function(e,t){if(t)while(t=t.parentNode)if(t===e)return!0;return!1},D=t?function(e,t){if(e===t)return f=!0,0;var r=!e.compareDocumentPositio

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49771	172.67.187.243	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:56 UTC	744	OUT	GET /static/js/swiper-bundle.min.js HTTP/1.1 Host: www.telegramai.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:56 UTC	902	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:56 GMT Content-Type: text/javascript; charset=utf-8 Content-Length: 135912 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dLFFA0HnMIC9xeYqe%2FMm%2F3HIOj%2Fawjs0%2Br70PxYR5%2FfB5JS5%2BJEwdWePNLxnraEao8PLXByKJK9VNK60nUKHdBbrCtTa3WQYFOrd2ZMYVYcGNqA1MJN4g38My158rLW3WhWl990%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f30088964343-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2053&min_rtt=2039&rtt_var=794&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1322&delivery_rate=1353732&cwnd=244&unsent_bytes=0&cid=a8d8fba151882e47&ts=251&x=0"
2025-01-12 00:14:56 UTC	467	IN	Data Raw: 2f 2a 2a 0a 20 2a 20 53 77 69 70 65 72 20 37 2e 34 2e 31 0a 20 2a 20 4d 6f 73 74 20 6d 6f 64 65 72 6e 20 6d 6f 62 69 6c 65 20 74 6f 75 63 68 20 73 6c 69 64 65 72 20 61 6e 64 20 66 72 61 6d 65 77 6f 72 6b 20 77 69 74 68 20 68 61 72 64 77 61 72 65 20 61 63 63 65 6c 65 72 61 74 65 64 20 74 72 61 6e 73 69 74 69 6f 6e 73 0a 20 2a 20 68 74 74 70 73 3a 2f 2f 73 77 69 70 65 72 6a 73 2e 63 6f 6d 0a 20 2a 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 34 2d 32 30 32 31 20 56 6c 61 64 69 6d 69 72 20 4b 68 61 72 6c 61 6d 70 69 64 69 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 0a 20 2a 0a 20 2a 20 52 65 6c 65 61 73 65 64 20 6f 6e 3a 20 44 65 63 65 6d 62 65 72 20 32 34 2c 20 32 30 32 31 0a 20 2a 2f Data Ascii: /** * Swiper 7.4.1 * Most modern mobile touch slider and framework with hardware accelerated transitions * https://swiperjs.com * * Copyright 2014-2021 Vladimir Kharlampidi * * Released under the MIT License * * Released on: December 24, 2021 */
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 63 74 69 6f 6e 28 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 66 75 6e 63 74 69 6f 6e 20 65 28 65 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 21 3d 3d 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 65 26 26 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 69 6e 20 65 26 26 65 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3d 3d 3d 4f 62 6a 65 63 74 7d 66 75 6e 63 74 69 6f 6e 20 74 28 73 3d 7b 7d 2c 61 3d 7b 7d 29 7b 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 29 2e 66 6f 72 45 61 63 68 28 28 69 3d 3e 7b 76 6f 69 64 20 30 3d 3d 3d 73 5b 69 5d 3f 73 5b 69 5d 3d 61 5b 69 5d 3a 65 28 61 5b 69 5d 29 26 26 65 28 73 5b 69 5d 29 26 26 4f 62 6a 65 63 74 2e 6b 65 79 73 28 61 5b 69 5d 29 2e 6c 65 6e 67 74 68 3e 30 26 26 74 28 73 5b 69 5d 2c 61 5b 69 5d 29 7d 29 29 7d 63 6f 6e 73 74 Data Ascii: ction(){"use strict";function e(e){return null!==e&&"object"==typeof e&&"constructor"in e&&e.constructor===Object}function t(s={},a={}){Object.keys(a).forEach((i=>{void 0===s[i]?s[i]=a[i]:e(a[i])&&e(s[i])&&Object.keys(a[i]).length>0&&t(s[i],a[i])}))}const
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 65 6f 66 20 77 69 6e 64 6f 77 3f 77 69 6e 64 6f 77 3a 7b 7d 3b 72 65 74 75 72 6e 20 74 28 65 2c 69 29 2c 65 7d 63 6c 61 73 73 20 6e 20 65 78 74 65 6e 64 73 20 41 72 72 61 79 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 65 29 7b 73 75 70 65 72 28 2e 2e 2e 65 7c 7c 5b 5d 29 2c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 65 2e 5f 5f 70 72 6f 74 6f 5f 5f 3b 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 22 5f 5f 70 72 6f 74 6f 5f 5f 22 2c 7b 67 65 74 3a 28 29 3d 3e 74 2c 73 65 74 28 65 29 7b 74 2e 5f 5f 70 72 6f 74 6f 5f 5f 3d 65 7d 7d 29 7d 28 74 68 69 73 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 6c 28 65 3d 5b 5d 29 7b 63 6f 6e 73 74 20 74 3d 5b 5d 3b 72 65 74 75 72 6e 20 65 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 41 72 72 61 Data Ascii: eof window?window:{};return t(e,i),e}class n extends Array{constructor(e){super(...e\|\|[]),function(e){const t=e.__proto__;Object.defineProperty(e,"__proto__",{get:()=>t,set(e){t.__proto__=e}})}(this)}}function l(e=[]){const t=[];return e.forEach((e=>{Arra
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 6f 6e 28 2e 2e 2e 65 29 7b 63 6f 6e 73 74 20 74 3d 6c 28 65 2e 6d 61 70 28 28 65 3d 3e 65 2e 73 70 6c 69 74 28 22 20 22 29 29 29 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 66 6f 72 45 61 63 68 28 28 65 3d 3e 7b 65 2e 63 6c 61 73 73 4c 69 73 74 2e 72 65 6d 6f 76 65 28 2e 2e 2e 74 29 7d 29 29 2c 74 68 69 73 7d 2c 68 61 73 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 2e 2e 2e 65 29 7b 63 6f 6e 73 74 20 74 3d 6c 28 65 2e 6d 61 70 28 28 65 3d 3e 65 2e 73 70 6c 69 74 28 22 20 22 29 29 29 29 3b 72 65 74 75 72 6e 20 6f 28 74 68 69 73 2c 28 65 3d 3e 74 2e 66 69 6c 74 65 72 28 28 74 3d 3e 65 2e 63 6c 61 73 73 4c 69 73 74 2e 63 6f 6e 74 61 69 6e 73 28 74 29 29 29 2e 6c 65 6e 67 74 68 3e 30 29 29 2e 6c 65 6e 67 74 68 3e 30 7d 2c 74 6f 67 67 6c 65 43 6c 61 73 73 3a 66 Data Ascii: on(...e){const t=l(e.map((e=>e.split(" "))));return this.forEach((e=>{e.classList.remove(...t)})),this},hasClass:function(...e){const t=l(e.map((e=>e.split(" "))));return o(this,(e=>t.filter((t=>e.classList.contains(t))).length>0)).length>0},toggleClass:f
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 31 29 3b 63 6f 6e 73 74 20 6c 3d 74 2e 73 70 6c 69 74 28 22 20 22 29 3b 6c 65 74 20 6f 3b 66 6f 72 28 6c 65 74 20 65 3d 30 3b 65 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 65 2b 3d 31 29 7b 63 6f 6e 73 74 20 74 3d 74 68 69 73 5b 65 5d 3b 69 66 28 73 29 66 6f 72 28 6f 3d 30 3b 6f 3c 6c 2e 6c 65 6e 67 74 68 3b 6f 2b 3d 31 29 7b 63 6f 6e 73 74 20 65 3d 6c 5b 6f 5d 3b 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 7c 7c 28 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 3d 7b 7d 29 2c 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 5b 65 5d 7c 7c 28 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 5b 65 5d 3d 5b 5d 29 2c 74 2e 64 6f 6d 37 4c 69 76 65 4c 69 73 74 65 6e 65 72 73 5b 65 5d 2e 70 75 73 68 28 7b 6c 69 73 74 65 6e 65 Data Ascii: 1);const l=t.split(" ");let o;for(let e=0;e<this.length;e+=1){const t=this[e];if(s)for(o=0;o<l.length;o+=1){const e=l[o];t.dom7LiveListeners\|\|(t.dom7LiveListeners={}),t.dom7LiveListeners[e]\|\|(t.dom7LiveListeners[e]=[]),t.dom7LiveListeners[e].push({listene
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 2c 69 2e 64 69 73 70 61 74 63 68 45 76 65 6e 74 28 73 29 2c 69 2e 64 6f 6d 37 45 76 65 6e 74 44 61 74 61 3d 5b 5d 2c 64 65 6c 65 74 65 20 69 2e 64 6f 6d 37 45 76 65 6e 74 44 61 74 61 7d 7d 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 74 72 61 6e 73 69 74 69 6f 6e 45 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 74 68 69 73 3b 72 65 74 75 72 6e 20 65 26 26 74 2e 6f 6e 28 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 28 66 75 6e 63 74 69 6f 6e 20 73 28 61 29 7b 61 2e 74 61 72 67 65 74 3d 3d 3d 74 68 69 73 26 26 28 65 2e 63 61 6c 6c 28 74 68 69 73 2c 61 29 2c 74 2e 6f 66 66 28 22 74 72 61 6e 73 69 74 69 6f 6e 65 6e 64 22 2c 73 29 29 7d 29 29 2c 74 68 69 73 7d 2c 6f 75 74 65 72 57 69 64 74 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 Data Ascii: ,i.dispatchEvent(s),i.dom7EventData=[],delete i.dom7EventData}}}return this},transitionEnd:function(e){const t=this;return e&&t.on("transitionend",(function s(a){a.target===this&&(e.call(this,a),t.off("transitionend",s))})),this},outerWidth:function(e){if
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 3d 74 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 3f 28 74 68 69 73 2e 66 6f 72 45 61 63 68 28 28 28 74 2c 73 29 3d 3e 7b 65 2e 61 70 70 6c 79 28 74 2c 5b 74 2c 73 5d 29 7d 29 29 2c 74 68 69 73 29 3a 74 68 69 73 7d 2c 68 74 6d 6c 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 65 29 72 65 74 75 72 6e 20 74 68 69 73 5b 30 5d 3f 74 68 69 73 5b 30 5d 2e 69 6e 6e 65 72 48 54 4d 4c 3a 6e 75 6c 6c 3b 66 6f 72 28 6c 65 74 20 74 3d 30 3b 74 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 74 2b 3d 31 29 74 68 69 73 5b 74 5d 2e 69 6e 6e 65 72 48 54 4d 4c 3d 65 3b 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 74 65 78 74 3a 66 75 6e 63 74 69 6f 6e Data Ascii: =t;return this}return this},each:function(e){return e?(this.forEach(((t,s)=>{e.apply(t,[t,s])})),this):this},html:function(e){if(void 0===e)return this[0]?this[0].innerHTML:null;for(let t=0;t<this.length;t+=1)this[t].innerHTML=e;return this},text:function
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 6c 65 74 20 73 3d 30 3b 73 3c 74 2e 6c 65 6e 67 74 68 3b 73 2b 3d 31 29 74 68 69 73 5b 65 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 5b 73 5d 29 3b 65 6c 73 65 20 74 68 69 73 5b 65 5d 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 74 29 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 70 72 65 70 65 6e 64 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 61 28 29 3b 6c 65 74 20 73 2c 69 3b 66 6f 72 28 73 3d 30 3b 73 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 73 2b 3d 31 29 69 66 28 22 73 74 72 69 6e 67 22 3d 3d 74 79 70 65 6f 66 20 65 29 7b 63 6f 6e 73 74 20 61 3d 74 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 3b 66 6f 72 28 61 2e 69 6e 6e 65 72 48 54 4d 4c 3d 65 2c 69 3d 61 2e 63 68 69 6c 64 4e 6f 64 65 73 2e 6c 65 6e 67 74 68 2d 31 3b 69 Data Ascii: let s=0;s<t.length;s+=1)this[e].appendChild(t[s]);else this[e].appendChild(t)}return this},prepend:function(e){const t=a();let s,i;for(s=0;s<this.length;s+=1)if("string"==typeof e){const a=t.createElement("div");for(a.innerHTML=e,i=a.childNodes.length-1;i
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 28 65 3f 64 28 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 29 2e 69 73 28 65 29 26 26 74 2e 70 75 73 68 28 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 29 3a 74 2e 70 75 73 68 28 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 29 29 3b 72 65 74 75 72 6e 20 64 28 74 29 7d 2c 70 61 72 65 6e 74 73 3a 66 75 6e 63 74 69 6f 6e 28 65 29 7b 63 6f 6e 73 74 20 74 3d 5b 5d 3b 66 6f 72 28 6c 65 74 20 73 3d 30 3b 73 3c 74 68 69 73 2e 6c 65 6e 67 74 68 3b 73 2b 3d 31 29 7b 6c 65 74 20 61 3d 74 68 69 73 5b 73 5d 2e 70 61 72 65 6e 74 4e 6f 64 65 3b 66 6f 72 28 3b 61 3b 29 65 3f 64 28 61 29 2e 69 73 28 65 29 26 26 74 2e 70 75 73 68 28 61 29 3a 74 2e 70 75 73 68 28 61 29 2c 61 3d 61 2e 70 61 72 65 6e 74 4e 6f 64 65 7d 72 65 74 75 72 6e 20 64 28 74 Data Ascii: (e?d(this[s].parentNode).is(e)&&t.push(this[s].parentNode):t.push(this[s].parentNode));return d(t)},parents:function(e){const t=[];for(let s=0;s<this.length;s+=1){let a=this[s].parentNode;for(;a;)e?d(a).is(e)&&t.push(a):t.push(a),a=a.parentNode}return d(t
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 75 65 28 22 74 72 61 6e 73 66 6f 72 6d 22 29 2e 72 65 70 6c 61 63 65 28 22 74 72 61 6e 73 6c 61 74 65 28 22 2c 22 6d 61 74 72 69 78 28 31 2c 20 30 2c 20 30 2c 20 31 2c 22 29 2c 61 3d 6e 2e 74 6f 53 74 72 69 6e 67 28 29 2e 73 70 6c 69 74 28 22 2c 22 29 29 2c 22 78 22 3d 3d 3d 74 26 26 28 69 3d 73 2e 57 65 62 4b 69 74 43 53 53 4d 61 74 72 69 78 3f 6e 2e 6d 34 31 3a 31 36 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 70 61 72 73 65 46 6c 6f 61 74 28 61 5b 31 32 5d 29 3a 70 61 72 73 65 46 6c 6f 61 74 28 61 5b 34 5d 29 29 2c 22 79 22 3d 3d 3d 74 26 26 28 69 3d 73 2e 57 65 62 4b 69 74 43 53 53 4d 61 74 72 69 78 3f 6e 2e 6d 34 32 3a 31 36 3d 3d 3d 61 2e 6c 65 6e 67 74 68 3f 70 61 72 73 65 46 6c 6f 61 74 28 61 5b 31 33 5d 29 3a 70 61 72 73 65 46 6c 6f 61 74 28 61 5b 35 5d Data Ascii: ue("transform").replace("translate(","matrix(1, 0, 0, 1,"),a=n.toString().split(",")),"x"===t&&(i=s.WebKitCSSMatrix?n.m41:16===a.length?parseFloat(a[12]):parseFloat(a[4])),"y"===t&&(i=s.WebKitCSSMatrix?n.m42:16===a.length?parseFloat(a[13]):parseFloat(a[5]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49772	172.67.187.243	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:56 UTC	735	OUT	GET /static/image/left.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:56 UTC	873	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:56 GMT Content-Type: image/png Content-Length: 1090 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L0SQWupSA0%2BA1SjSKtscI6dFMsrljIYLzYLQ9lKNpnIjWIOJnmIgs7tr2XX1zRDr9GJVTo4xP%2ByuVxFjW%2BSn6wA0TRE7y0e85GHtxCak4ASi92SBwWz9jjIUe0XQe0nVqF6l3rE%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f3009b0143b8-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1563&min_rtt=1562&rtt_var=588&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1313&delivery_rate=1855146&cwnd=233&unsent_bytes=0&cid=deeb775319deb4ba&ts=160&x=0"
2025-01-12 00:14:56 UTC	496	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 78 00 00 00 78 08 03 00 00 00 0e ba c6 e0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 d5 50 4c 54 45 00 00 00 ef ef ff ef ff ff e7 f7 f7 ef ef f7 ef ef ff ef f7 f7 ef f7 ff ea f4 fa ef ef fa ef f4 fa ef f4 ff eb f3 fb ef f3 fb ef f3 ff ec f2 fc ef f2 fc ef f2 ff ec f2 fc ef f4 fc ed f1 fd ed f4 fd ef f4 fd ef f6 fd ef f5 fd ed f3 fd ed f5 fd ef f5 fd ef f4 fd ef f6 fd ed f4 fd ef f4 fd ef f5 fd ed f4 fd ef f5 fe ee f3 fe ee f5 fe ef f4 fe ef f6 fe ee f3 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f5 fe ef f6 fe ee f4 fe ef f4 fe ef f5 fe b4 c2 d7 bf cb df bf cc de bf cc df c2 ce e0 c3 cf e1 c6 d1 e2 c7 d2 e3 ca d5 e5 d5 de ec d5 de ed d5 df ec d8 e1 ef d9 e1 ef d9 e2 ef e0 e8 f4 e7 ef f9 e8 ee f9 Data Ascii: PNGIHDRxxsRGBPLTE
2025-01-12 00:14:56 UTC	594	IN	Data Raw: ed 25 00 87 90 1f ac 80 1c 73 74 18 17 23 f3 b8 ee b2 c7 e4 02 98 5e b3 75 85 ac 30 46 17 20 ae 3f 9f cf 80 35 a7 75 dd 21 30 67 d2 74 61 39 16 58 04 ec 89 0e d2 d1 35 3b 1b 33 93 3e 6d de 7d a9 e8 ec ea ca 9e 3b b3 77 eb 3c cf f3 35 b1 b2 3d a4 9b e7 d7 e5 3f eb 71 37 f8 8f 9b 6f 48 f5 e5 a1 dd fc aa e2 97 c7 ac 0d de b9 f9 4d d5 9e 97 b3 c1 7b ee 9b ca a7 48 87 6f 0e ef bb 3f 2a 7f fd 94 6d 55 72 73 21 b1 bb 7d 49 b7 ac bc b4 a8 0b 9a a5 a7 dd 5d 7b 5f 7b b2 2e 80 4f af 69 94 6b 5d a3 2e 85 5d 58 50 87 18 e9 82 b1 9c 0d a5 5d db 20 0f c4 5d 78 58 7c 08 17 77 2d d5 a5 c5 5d cb 0a 75 29 ee 5a ca fa 85 b8 0b 71 21 9c 89 bb 96 87 a6 11 77 2d 13 b9 fa 7f 1f 88 2e 00 0e fe 46 76 91 f0 d7 2d fc 1d 1a 85 6f b7 f0 fa 8e 13 ae 2e ae 0d 55 36 c8 e9 74 fb 96 28 17 Data Ascii: %st#^u0F ?5u!0gta9X5;3>m};w<5=?q7oHM{Ho?*mUrs!}I]{_{.Oik].]XP] ]xX\|w-]u)Zq!w-.Fv-o.U6t(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49775	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:56 UTC	365	OUT	GET /telegram-16/777.jpeg HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:56 UTC	952	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:56 GMT Content-Type: image/jpeg Content-Length: 41526 Connection: close ETag: "880c2cb4fa191a2f538463d69af44489" Last-Modified: Fri, 06 Dec 2024 01:36:03 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fg6P%2BV3wenARb5IZfsl6d4GckPb%2F%2BVOeYxWDapBvL%2FNkEyC5UVYgaH07duc0bZd9HqvDu5n2HCf7SS3KsqAs2c41kkVZ%2F%2BVuVf7EFW1xfj3ihzu6q5DAci%2FTApmqNczF5cczIa%2BbwOc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f304ad6b4397-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1683&min_rtt=1681&rtt_var=634&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2873&recv_bytes=943&delivery_rate=1720683&cwnd=96&unsent_bytes=0&cid=072ed183a1f56586&ts=159&x=0"
2025-01-12 00:14:56 UTC	417	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 38 30 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 38 32 0a ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 00 04 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v80), quality = 82C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e1 e2 e3 e4 e5 e6 e7 e8 e9 ea f1 f2 f3 f4 f5 f6 f7 f8 f9 fa ff c4 00 1f 01 00 03 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 11 00 02 01 02 04 04 03 04 07 05 04 04 00 01 02 77 00 01 02 03 11 04 05 21 31 06 12 41 51 07 61 71 13 22 32 81 08 14 42 91 a1 b1 c1 09 23 33 52 f0 15 62 72 d1 0a 16 24 34 e1 25 f1 17 18 19 1a 26 27 28 29 2a 35 36 37 38 39 3a 43 44 45 46 47 48 49 4a 53 54 55 56 57 58 59 5a 63 64 65 66 67 68 69 6a 73 74 75 76 77 78 79 7a 82 83 84 85 86 87 88 89 8a 92 93 94 95 96 97 98 99 9a a2 a3 a4 a5 a6 a7 a8 a9 aa b2 b3 b4 b5 b6 b7 b8 b9 ba c2 c3 c4 c5 c6 c7 c8 c9 ca d2 d3 d4 d5 d6 d7 d8 d9 da e2 e3 e4 e5 e6 e7 e8 e9 ea f2 f3 f4 f5 f6 f7 f8 f9 fa ff da Data Ascii: w!1AQaq"2B#3Rbr$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 48 4e 58 81 f5 aa f2 ea 56 f1 f0 18 b1 f6 14 8a 50 72 d9 16 b3 4a 2b 35 b5 5f ee c4 7f 1a 68 d5 65 ed 18 c5 16 66 8a 84 cd 4c d2 d6 62 ea df de 8b f2 a9 e3 d4 e1 7e b9 5f ad 16 13 a3 35 d0 b6 69 e2 a3 49 12 41 95 6c fd 2a 41 52 cc 9a b0 51 45 14 84 c2 94 52 52 8a 00 5a 28 a2 80 14 50 05 02 94 52 18 50 28 a5 14 98 98 b4 51 40 a0 03 34 b4 62 8a 40 14 51 45 20 0a 50 69 05 28 14 08 75 14 51 48 02 8c 51 47 5a 06 02 9c 29 29 45 00 14 a0 66 92 95 6a 44 d8 b4 0a 28 14 0a 22 d1 45 14 8a 0a 07 34 52 81 40 05 14 51 40 05 14 51 40 05 41 7d 7a b6 36 8f 33 0e 17 15 3d 41 a8 5a 0b db 29 a0 18 cb af 1f 5e d5 95 6a 6a 71 e5 67 4e 0f 11 2a 15 a3 52 3d 0e 2f 52 d6 67 be 63 96 c2 7f 76 ae e9 93 79 f6 ab ce 59 78 35 83 2a 98 9d e3 60 77 29 20 fd 6a c6 93 77 f6 6b b5 0c 48 46 Data Ascii: HNXVPrJ+5_hefLb~_5iIAlARQERRZ(PRP(Q@4b@QE Pi(uQHQGZ))EfjD("E4R@Q@Q@A}z63=AZ)^jjqgNR=/RgcvyYx5*`w) jwkHF
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 63 3e 90 b3 12 0a 82 0d 49 a5 e8 d2 e9 b7 4b 73 67 33 c1 20 3d 54 e0 11 e8 47 7a f1 b1 99 4f b7 d6 3a 33 e9 30 3c 40 b0 cb 96 6e f1 fe b6 3e 9f d2 f5 db 7d 4e 01 22 48 11 87 de 46 e0 8a f3 9f 89 1a d5 be a3 7d 14 16 ee 24 10 03 b9 87 4c 9f 4a e7 cf 89 b5 29 2c fe ca 64 44 52 30 ec 89 b5 9c 7d 6b 39 db 23 15 96 5d 93 ba 15 3d ac de ab 63 83 88 38 8e 38 ca 5f 56 a1 1f 75 ee df 97 62 36 f6 eb 4e b7 87 cc 97 2c 7e 45 e4 d3 02 96 60 00 ce 4d 5b 55 58 d3 cb 4c fb 9f 7a f7 e4 ed a2 3e 42 3a 6a c1 dc c8 ec e7 a9 39 a6 d2 f4 a4 a8 4a ca c2 0a 28 a2 98 11 dc 1d a9 8c f2 6b 1f 55 93 6c 2a 99 fb dd 6b 52 e0 ee 60 2b 07 54 97 cc b9 23 23 0a 31 55 7e 58 15 41 73 4c ad 11 db 32 36 71 82 2b a7 1d 06 3d 2b 95 07 9a e8 e1 93 74 48 7d 85 4d 25 74 6b 8b 5b 32 c7 e1 49 f8 54 Data Ascii: c>IKsg3 =TGzO:30<@n>}N"HF}$LJ),dDR0}k9#]=c88_Vub6N,~E`M[UXLz>B:j9J(kUl*kR`+T##1U~XAsL26q+=+tH}M%tk[2IT
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: f8 d5 0b ff 00 14 f8 7b 4f 91 d1 f5 ab 69 42 12 01 81 5a 5d d8 f4 c7 f8 d7 96 fc 31 f8 25 ae 78 df 4f 87 5d f3 ed d2 c9 d9 82 3c ee 59 98 83 83 c7 b1 15 eb da 77 ec f1 6a a0 1d 47 5a 99 fd 56 de 30 a2 b2 fe d3 c5 54 f7 95 92 3a df 0e e5 b4 97 24 e4 dc 93 d6 df 97 63 26 0f 88 3e 12 24 09 ee 35 70 3b 98 ec 81 1f ab d6 c5 8e bd e1 4d 5d 84 7a 7f 88 23 49 db a4 57 d1 18 1b 3e 99 39 53 f9 d7 45 69 f0 3f c1 96 ca 43 d9 dc dc b1 fe 29 6e 1b 3f a5 50 d6 7e 01 78 76 f2 36 3a 6d c5 cd 8c a7 a0 63 e6 27 e4 69 47 1b 89 4e fc f7 f9 69 f9 15 2c a3 2b 94 79 3d 9b 5e 7d 7f 32 2b ab 1b 8b 22 04 d1 95 dd d1 81 ca b7 d0 8e 0d 41 5c cb 4f e2 af 85 13 ad 9e b3 09 d4 f4 49 0e cf 2d d8 98 c8 f5 43 d5 5b da ba e1 1d a5 fe 9b 1e b3 a4 cd f6 8d 3e 63 8c e7 2f 0b ff 00 71 fd 0d 7a Data Ascii: {OiBZ]1%xO]<YwjGZV0T:$c&>$5p;M]z#IW>9SEi?C)n?P~xv6:mc'iGNi,+y=^}2+"A\OI-C[>c/qz
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 81 d8 52 fa f3 ec 2f a9 47 b9 d2 8b bb 7e d3 20 a3 ed b6 fd 3c f4 fc eb 9b 32 a8 1d 06 6a 12 c0 9c d3 58 d7 fc a3 58 24 fa 9d 51 bd b6 ef 3a 1f a9 a5 8a ee dc b8 55 99 09 3d 00 35 cb 6e fa 55 9d 3c 83 7b 0f bb 55 47 14 e4 d4 6d b9 32 c1 45 26 ee 75 63 9e 69 71 9a 45 e8 29 d5 d2 79 65 5d 52 7f b3 d8 cb 27 70 b8 1f 53 c5 62 22 85 50 3d ab 43 c4 6e 56 c1 47 63 2a e7 f3 ac 66 b9 c9 eb 50 a5 ef 33 d3 c3 53 7e ca fd d9 6c 10 3b d3 b7 81 c7 3f 5a d7 f0 37 85 25 f1 b6 a5 25 9c 57 4b 6e b1 26 f7 76 19 38 f6 15 eb fa 3f c1 cf 0e e9 a1 5e e4 4f 7e e0 72 65 38 5c fd 05 79 b8 dc e7 0f 85 97 24 db 72 ec bf ab 1e de 0b 21 c4 e2 d7 3c 55 a3 dd 9e 1d 05 b5 c5 db 88 ed a1 92 67 3d a3 52 c7 f4 ae a7 49 f8 55 e2 8d 50 ab 3d a2 d9 c4 dc ef b9 60 3f 41 cd 7b c5 8e 93 63 a6 c6 Data Ascii: R/G~ <2jXX$Q:U=5nU<{UGm2E&uciqE)ye]R'pSb"P=CnVGc*fP3S~l;?Z7%%WKn&v8?^O~re8\y$r!<Ug=RIUP=`?A{c
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 68 ac fe ab 1e e7 52 ce 6a da ce 28 e6 20 d0 ae 98 80 62 08 3d c8 ad 4b 4d 12 38 88 33 36 fc 1c ed 1d 2b 4e 8a d2 34 22 8c 2a e6 75 ea 69 7b 7a 12 4b 34 93 05 0e c4 84 1b 55 7b 28 f4 03 b5 47 45 15 a4 62 96 c7 0c a4 e4 ef 27 76 14 51 45 51 21 45 14 50 30 a8 26 b8 85 1b 6b c8 aa 47 24 13 53 d6 06 ac 37 5f 48 7d 85 27 2b 6a 54 22 a4 ec 6a 7d ae df b4 cb f9 d2 fd aa 0f f9 ee bf 9d 73 db 3d a9 0a 63 b5 4f b5 f2 35 f6 0b b9 d1 8b 98 0f fc b7 4f ce 90 dc c1 9f f5 cb f9 d7 39 b7 da 8d be d4 2a a3 f6 0b b9 d1 7d a6 db fe 7b af e7 47 da 20 ff 00 9e cb f9 d7 3d 83 47 34 7b 61 7d 5d 77 3a 2f b4 db ff 00 cf 65 fc e8 fb 4d b8 eb 32 7e 75 ce 64 fa d1 c9 a3 db 0f ea cb b9 d1 1b ab 7e d3 2f e7 47 da ad ff 00 e7 b2 fe 75 ce 66 8a 3d b0 7d 55 77 3a 3f b4 db 7f cf 68 e9 3e Data Ascii: hRj( b=KM836+N4"ui{zK4U{(GEb'vQEQ!EP0&kG$S7_H}'+jT"j}s=cO5O9}{G =G4{a}]w:/eM2~ud~/Guf=}Uw:?h>
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: eb 6b db f1 5f 33 af f8 77 f0 05 75 0b 38 f5 2f 14 99 62 49 70 d1 da 21 da c5 7d 58 f5 15 eb 3a 67 c3 5f 07 68 f8 16 7e 1f b1 56 5f e3 91 3c c6 fc db 35 d2 e4 7d e3 80 0f a5 34 9d c7 35 d7 47 0b 4e 9a b2 46 55 f1 b5 ab 4a f2 93 f4 1b 6f 6f 0d ba ed 82 18 a2 51 da 34 0b fc ab 2f c6 7e 1c 4f 16 78 6a fb 48 94 2e e9 a3 3e 5b 30 e1 5c 7d d3 5b 0a 29 e0 7e 75 ac e0 9a e5 39 e3 37 19 29 2d cf 86 f5 ef 0f ea 1e 1b d4 66 d3 b5 3b 59 2d ae 62 24 15 71 d4 7a 8f 51 59 80 64 d7 dc 7a e7 85 74 3f 13 44 22 d6 34 bb 6b c0 a3 6a b3 a7 cc a3 d0 1e a2 b2 74 ef 85 3e 09 d2 9f 7d bf 87 6c cb 67 39 95 4c 98 fc 0d 78 72 ca e5 cd ee bd 0f a2 86 79 0e 5f 7e 2e e7 c7 b6 9a 5d e5 f3 05 b5 b3 b8 b8 63 d0 45 1b 37 f2 15 d5 e9 5f 06 fc 6f ab aa b4 5a 05 d4 28 df c7 70 3c b5 fd 6b eb Data Ascii: k_3wu8/bIp!}X:g_h~V_<5}45GNFUJooQ4/~OxjH.>[0\}[)~u97)-f;Y-b$qzQYdzt?D"4kjt>}lg9Lxry_~.]cE7_oZ(p<k
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: 3a 46 cb 53 31 93 c7 5a fb 79 33 e0 e0 ac 8b 7a 54 26 6b c4 cf 01 72 c6 b7 32 4f e7 52 e9 9a 5a d8 78 7c de dc 2f ef ef 58 2c 2a 7a 84 1f 79 bf 90 fc ea 31 d2 b9 a1 51 4d bb 74 fe bf e0 1c 98 c8 f2 c9 27 d8 28 a4 34 b5 a1 ca 2a f4 ac af 15 ea 73 69 1e 1e d4 2f 61 62 92 c3 09 31 b0 ec 78 03 f9 d6 a8 3c 55 2d 6a c6 3d 4b 4d 9e d6 52 3c b9 00 ce 7d 88 35 cd 8a 4d d2 92 5d 99 db 97 f2 fd 6a 97 36 dc cb f3 38 0f 0e 69 92 dd 7c 39 d6 e2 bd 0e f7 13 c5 34 e0 1e a4 95 07 3f f8 e9 ac 8f d9 c7 51 8a cf c6 d3 5a cb 80 d7 76 ac 89 93 dc 10 d8 fc b3 5d dd af 88 ac 21 d7 61 d2 21 54 6c 47 b4 fa 11 fd df e7 f9 d7 92 6a 16 d2 fc 39 f8 8f 0c e8 c7 ca b6 ba 4b 98 99 78 2f 0b 1c ff 00 22 47 e1 5f 17 8a 5e c6 ad 2a 8b 6b 25 f7 6f f8 58 fd 4f 0c 95 65 89 c3 f5 6f 9b e4 d6 9f Data Ascii: :FS1Zy3zT&kr2ORZx\|/X,zy1QMt'(4si/ab1x<U-j=KMR<}5M]j68i\|94?QZv]!a!TlGj9Kx/"G_^*k%oXOeo
2025-01-12 00:14:56 UTC	1369	IN	Data Raw: fb 34 88 dd 03 e7 e5 3f 50 72 3f 1a fa 98 7a 11 8a eb c0 56 f6 94 57 74 73 e6 98 7f 63 88 7d 9e bf d7 cc 76 69 69 0d 2d 76 1e 78 66 96 92 81 c8 a0 05 a5 14 94 a0 52 1a 14 75 a5 ea 4d 18 c1 a7 46 85 df 00 75 a9 6f a9 45 db 18 8b be 48 e0 56 98 1c 0c 54 30 46 22 40 a0 54 c0 d7 9f 52 5c ce e7 54 23 64 2d 1d e9 69 2b 32 90 ec 50 b4 80 f3 4a 3a 9a 4c a1 c3 9a 5a 40 31 4b 48 04 a7 01 cd 36 9c 0f 34 14 3a bc d3 e3 ae 80 ba 97 85 d3 54 8e 3d d3 69 f2 82 48 1c f9 6d c3 7f 8d 7a 55 56 d4 2c 21 d4 ec 67 b2 b8 01 a2 9d 0a 30 3e e2 a1 ab e8 69 4a a7 b3 9a 97 63 c9 7c 27 ad 43 e2 4f 03 da 6e 7f f8 98 68 ed f6 39 94 9e 5a 23 ca 37 f3 1f 85 4f 5e 55 e1 0d 79 7c 1d f1 76 eb c3 97 b2 18 ec e7 76 b0 94 b1 e0 f3 98 d8 d7 ac dc 40 f6 b7 12 5b c8 30 d1 92 a7 db 06 bd cc 9b 10 Data Ascii: 4?Pr?zVWtsc}vii-vxfRuMFuoEHVT0F"@TR\T#d-i+2PJ:LZ@1KH64:T=iHmzUV,!g0>iJc\|'COnh9Z#7O^Uy\|vv@[0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49779	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:57 UTC	603	OUT	GET /telegram-favicon.ico HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:57 UTC	944	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:57 GMT Content-Type: image/jpeg Content-Length: 4286 Connection: close ETag: "975b4112a366cca6b9bf2c84e268268c" Last-Modified: Fri, 06 Dec 2024 07:06:32 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5665 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=s90PpuWIs6zHySzB1OZ5lrSfkbuZ3jE3R6B5UJwwDwbQ72iNFcEsShiHIZek1Z0iI3Bb0X0ultY1iNa3hOnS3R7yg3KOp3jC7mXjZ5CR0xApLmmaV4Iuj3LX8WVnH%2Fza%2FMp5gIqX8p8%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f30788ef43b0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1576&min_rtt=1566&rtt_var=608&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2871&recv_bytes=1181&delivery_rate=1767554&cwnd=252&unsent_bytes=0&cid=ccf9d03e89994115&ts=297&x=0"
2025-01-12 00:14:57 UTC	425	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 aa 2b 06 d4 9e 2b 47 d3 9a 27 95 d3 9c 28 bf d2 9b 29 d9 d2 9a 28 f3 d3 9b 29 f3 d1 9b 28 d9 d2 9b 28 bf d3 9a 27 95 d4 9a 28 47 d5 aa 2b 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 9f 2b 18 d3 9c 29 96 d3 9c 28 f1 d2 9b 28 ff d2 9b 28 ff d2 9b 28 ff d2 9b 28 ff d2 9b 28 ff d2 Data Ascii: ( @ ++G'()()(('(G++)((((((
2025-01-12 00:14:57 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 9f 2b 18 d5 9c 29 c7 d4 9c 29 ff d4 9c 29 ff d4 9c 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d5 9c 29 c7 d5 9f 2b 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 a1 2c 2e d5 9d 2b e3 d5 9d 2a ff d4 9c 29 ff d5 9d 2a ff d4 9c 29 ff d4 9c 29 ff d5 9d 2a ff d4 9c 29 ff d5 9d 2a ff d5 9d 2a ff d4 9c 29 ff d5 9d 2a ff d4 9c 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9d 29 ff d5 9d 29 ff d4 9d 29 ff d5 9d 29 ff d5 9d Data Ascii: +))))))))))))))))))))+,.+))))))))))))))
2025-01-12 00:14:57 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e3 b6 5a ff dc a2 2e ff dc a3 2f ff dc a3 2f ff dc a3 2e ff dc a3 2f ff dc a3 2e ff dc a3 2e ff dc a3 2f bf de a3 2f d9 dd a3 2e ff dd a3 2e ff dd a3 2f ff dd a3 2e ff dd a3 2f ff e3 b3 53 ff ed d1 96 ff f7 ea d1 ff fe fc f9 ff fe fd fc ff f4 e1 bc ff e1 b0 4c ff dd a3 2f ff dd a3 2f ff ec cc 8c ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ea c6 7e ff dc a3 2e ff dd a3 2f ff dd a3 2f ff dc a3 2e ff dd a3 2f ff dc a3 2e ff dc a3 2e ff de a3 2f d9 de a5 30 f3 de a4 2f ff de a4 2f ff dd a3 2f ff de a4 2f ff e8 c2 76 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fb f7 ff ed ce 90 ff de a5 32 ff de a4 30 ff ea c7 7f Data Ascii: Z.//./..//.././SL//~.//./../0////v20
2025-01-12 00:14:57 UTC	1123	IN	Data Raw: a9 34 ff e5 a9 34 ff e4 a9 34 ff e4 a9 34 ff e5 a9 34 ff e4 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 aa 34 ff e5 a9 34 ff e5 aa 34 ff e5 aa 34 ff e5 a9 34 ff e5 aa 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e6 ab 35 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff b6 49 07 e7 aa 36 c7 e6 aa 35 ff e6 aa 35 ff e6 aa 35 ff e5 aa 34 ff e6 aa 35 ff e5 aa 34 ff e5 aa 34 ff e6 aa 34 ff e5 aa 34 ff e6 aa 34 ff e6 aa 34 ff e6 aa 35 ff e6 aa 34 ff e6 aa 35 ff e6 aa 35 ff e6 aa 34 ff e6 aa 35 ff e6 aa 34 ff e6 aa 34 ff e6 aa 35 ff e6 aa 34 ff e6 aa 35 ff e6 aa 35 ff e5 aa 34 ff e7 aa 36 c7 ff b6 49 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ea aa 35 18 e7 ac 37 e3 e6 aa 35 ff e6 aa 35 ff Data Ascii: 44444444444444444444445I65554544444454554544545546I5755

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49781	104.21.7.172	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:57 UTC	1002	OUT	GET /static/image/icon_nav.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramai.org/static/css/style.min.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:57 UTC	872	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:57 GMT Content-Type: image/png Content-Length: 346 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: REVALIDATED Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aRwEvcYMr9fjfqeAAL0YWbgGxQ%2FpKA1PydFR8vIxmm0wkIsTdo58dQK4kfEjJSuEY1UMQb5dezgajwa3vdinDsYpwcHbPRkwBAdstAerv1JRXwxlrFGtQg4JSaIv%2Fo%2BoB5H4lTo%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f3082c4243df-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1728&min_rtt=1728&rtt_var=648&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=1602&delivery_rate=1687861&cwnd=244&unsent_bytes=0&cid=c21daa9db0dd8cec&ts=789&x=0"
2025-01-12 00:14:57 UTC	346	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 54 00 00 00 48 08 06 00 00 00 68 7f d2 21 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 01 11 49 44 41 54 78 5e ed dc d1 09 84 30 14 45 c1 a4 e3 94 92 8e d5 22 e6 43 78 67 0b b8 ac c3 41 14 82 fb 9c f3 ac c1 bf 7b ef 96 97 bf 03 0d 54 06 b5 2a 94 72 ae 40 b1 67 a0 81 6a 01 bc d7 3d f4 ef a0 f8 ff 8d 9f a3 0f b5 e3 35 3f 80 40 71 05 81 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 6a d0 e9 c7 19 b1 e7 1a 7f 3e 34 50 2d 80 f7 2a 34 50 2c 80 e7 2a 34 50 2c 80 e7 2a 54 83 e2 bd f1 73 bd 29 e1 04 02 0d 14 0b e0 b9 0a 0d 14 0b e0 b9 0a 0d 14 0b e0 b9 0a 0d 14 0b e0 Data Ascii: PNGIHDRTHh!sBIT\|dIDATx^0E"CxgA{Tr@gj=5?@q\\\\\\\\\\j>4P-4P,4P,Ts)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49784	172.67.193.48	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:57 UTC	365	OUT	GET /telegram-favicon.ico HTTP/1.1 Host: image.sanxiang-sh.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:14:57 UTC	947	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:57 GMT Content-Type: image/jpeg Content-Length: 4286 Connection: close ETag: "975b4112a366cca6b9bf2c84e268268c" Last-Modified: Fri, 06 Dec 2024 07:06:32 GMT Vary: Accept-Encoding Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 5665 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=vh8QHsDQvealhZdD6ZSMYH99ACKxstf%2BZvTJvtpoX6V8KBLm96ugnI1ZOM%2Bn2PvlCeX2I8BBs6iwoovKHJTgC5o92HmAQH9DfmvlCwNSNFeXARgb%2BtD02YDcHLK7D2BOOu0mPK%2Fe3ow%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f30b5fc9de93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1483&min_rtt=1483&rtt_var=556&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2872&recv_bytes=943&delivery_rate=1967654&cwnd=248&unsent_bytes=0&cid=f4f3ea8aaa056f91&ts=139&x=0"
2025-01-12 00:14:57 UTC	422	IN	Data Raw: 00 00 01 00 01 00 20 20 00 00 01 00 20 00 a8 10 00 00 16 00 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 aa 2b 06 d4 9e 2b 47 d3 9a 27 95 d3 9c 28 bf d2 9b 29 d9 d2 9a 28 f3 d3 9b 29 f3 d1 9b 28 d9 d2 9b 28 bf d3 9a 27 95 d4 9a 28 47 d5 aa 2b 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 9f 2b 18 d3 9c 29 96 d3 9c 28 f1 d2 9b 28 ff d2 9b 28 ff d2 9b 28 ff d2 9b 28 ff d2 9b 28 ff d2 Data Ascii: ( @ ++G'()()(('(G++)((((((
2025-01-12 00:14:57 UTC	1369	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d5 9f 2b 18 d5 9c 29 c7 d4 9c 29 ff d4 9c 29 ff d4 9c 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d5 9c 29 c7 d5 9f 2b 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 a1 2c 2e d5 9d 2b e3 d5 9d 2a ff d4 9c 29 ff d5 9d 2a ff d4 9c 29 ff d4 9c 29 ff d5 9d 2a ff d4 9c 29 ff d5 9d 2a ff d5 9d 2a ff d4 9c 29 ff d5 9d 2a ff d4 9c 29 ff d4 9c 29 ff d4 9d 29 ff d4 9c 29 ff d4 9d 29 ff d4 9d 29 ff d5 9d 29 ff d4 9d 29 ff d5 9d 29 Data Ascii: +))))))))))))))))))))+,.+))))))))))))))
2025-01-12 00:14:57 UTC	1369	IN	Data Raw: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff e3 b6 5a ff dc a2 2e ff dc a3 2f ff dc a3 2f ff dc a3 2e ff dc a3 2f ff dc a3 2e ff dc a3 2e ff dc a3 2f bf de a3 2f d9 dd a3 2e ff dd a3 2e ff dd a3 2f ff dd a3 2e ff dd a3 2f ff e3 b3 53 ff ed d1 96 ff f7 ea d1 ff fe fc f9 ff fe fd fc ff f4 e1 bc ff e1 b0 4c ff dd a3 2f ff dd a3 2f ff ec cc 8c ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ea c6 7e ff dc a3 2e ff dd a3 2f ff dd a3 2f ff dc a3 2e ff dd a3 2f ff dc a3 2e ff dc a3 2e ff de a3 2f d9 de a5 30 f3 de a4 2f ff de a4 2f ff dd a3 2f ff de a4 2f ff e8 c2 76 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff fd fb f7 ff ed ce 90 ff de a5 32 ff de a4 30 ff Data Ascii: Z.//./..//.././SL//~.//./../0////v20
2025-01-12 00:14:57 UTC	1126	IN	Data Raw: 34 ff e4 a9 34 ff e5 a9 34 ff e4 a9 34 ff e4 a9 34 ff e5 a9 34 ff e4 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 aa 34 ff e5 a9 34 ff e5 aa 34 ff e5 aa 34 ff e5 a9 34 ff e5 aa 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e5 a9 34 ff e6 ab 35 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff b6 49 07 e7 aa 36 c7 e6 aa 35 ff e6 aa 35 ff e6 aa 35 ff e5 aa 34 ff e6 aa 35 ff e5 aa 34 ff e5 aa 34 ff e6 aa 34 ff e5 aa 34 ff e6 aa 34 ff e6 aa 34 ff e6 aa 35 ff e6 aa 34 ff e6 aa 35 ff e6 aa 35 ff e6 aa 34 ff e6 aa 35 ff e6 aa 34 ff e6 aa 34 ff e6 aa 35 ff e6 aa 34 ff e6 aa 35 ff e6 aa 35 ff e5 aa 34 ff e7 aa 36 c7 ff b6 49 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ea aa 35 18 e7 ac 37 e3 e6 aa 35 ff e6 Data Ascii: 444444444444444444444445I65554544444454554544545546I575

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49791	172.67.187.243	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:14:58 UTC	739	OUT	GET /static/image/icon_nav.png HTTP/1.1 Host: www.telegramai.org Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
2025-01-12 00:14:58 UTC	874	IN	HTTP/1.1 200 OK Date: Sun, 12 Jan 2025 00:14:58 GMT Content-Type: image/png Content-Length: 346 Connection: close Last-Modified: Fri, 06 Dec 2024 02:33:43 GMT Cache-Control: max-age=14400 CF-Cache-Status: HIT Age: 1 Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GNjggf4rLJf%2FWIKEzfB2vnE0tFEZmwOXBoMti%2Ftl6UXiTx86hn00t%2FqBZ7bfE8vCJINn3xICczteUZ38MrJGosB18Fdny6xqaNzvxhWuN%2FvsATtu0zHBYYy7e4rmceHWUsozYeM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 9008f310dc82429b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1969&min_rtt=1924&rtt_var=754&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=1317&delivery_rate=1517671&cwnd=238&unsent_bytes=0&cid=30c52612116e62d0&ts=309&x=0"
2025-01-12 00:14:58 UTC	346	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 54 00 00 00 48 08 06 00 00 00 68 7f d2 21 00 00 00 04 73 42 49 54 08 08 08 08 7c 08 64 88 00 00 01 11 49 44 41 54 78 5e ed dc d1 09 84 30 14 45 c1 a4 e3 94 92 8e d5 22 e6 43 78 67 0b b8 ac c3 41 14 82 fb 9c f3 ac c1 bf 7b ef 96 97 bf 03 0d 54 06 b5 2a 94 72 ae 40 b1 67 a0 81 6a 01 bc d7 3d f4 ef a0 f8 ff 8d 9f a3 0f b5 e3 35 3f 80 40 71 05 81 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 06 8a 05 f0 5c 85 6a d0 e9 c7 19 b1 e7 1a 7f 3e 34 50 2d 80 f7 2a 34 50 2c 80 e7 2a 34 50 2c 80 e7 2a 54 83 e2 bd f1 73 bd 29 e1 04 02 0d 14 0b e0 b9 0a 0d 14 0b e0 b9 0a 0d 14 0b e0 b9 0a 0d 14 0b e0 Data Ascii: PNGIHDRTHh!sBIT\|dIDATx^0E"CxgA{Tr@gj=5?@q\\\\\\\\\\j>4P-4P,4P,Ts)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49928	43.132.105.108	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:15:21 UTC	742	OUT	GET /shater.zip HTTP/1.1 Host: 00-25-1333705940.cos.ap-hongkong.myqcloud.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:15:21 UTC	506	IN	HTTP/1.1 200 OK Content-Type: application/zip Content-Length: 62506228 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Sun, 12 Jan 2025 00:15:21 GMT ETag: "d2fc5aa89eabd3cd8918984037895a73-8" Last-Modified: Mon, 06 Jan 2025 08:08:37 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 13442301155271637664 x-cos-request-id: Njc4MzA5OTlfZjAzNDUxMGJfYjA2Y18zNTE0MzIz x-cos-storage-class: MAZ_STANDARD x-cosindex-replication-status: Complete
2025-01-12 00:15:21 UTC	7698	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 dd 80 26 5a e5 85 3c e6 7e c4 b9 03 b8 a7 bf 03 0a 00 00 00 73 68 61 74 65 72 2e 65 78 65 ec bc 79 3c 54 6f fc 37 3c 9c b1 8f 8e 32 15 b2 66 8f 84 09 d1 66 34 84 10 a2 6c 95 a2 93 be 69 d7 ae 32 8c 65 cc 4c a9 c6 1a 95 48 b2 a4 b2 2f 31 87 64 86 08 13 21 0a 25 43 9b a5 8c 7d ee 6b 7c 7f f7 7d ff 7e f7 f3 dc af fb 9f e7 f5 fc 75 9f 57 de ef cf b5 9c eb 5c e7 3a d7 f2 79 9f 73 4d ce 3e 71 18 08 83 c1 60 c1 9f 40 80 c1 94 61 fe 3d ac 31 ff e7 23 0c fc 2d 53 ab 58 86 29 92 6a d6 28 13 71 6a d6 f0 08 3a 76 4e fd f4 d9 53 47 cf 1e 3a a1 1e 70 e8 e4 c9 53 21 ea 87 8f a8 9f 3d 7f 52 fd d8 49 75 d2 ee 3d ea 27 4e 05 1e 31 92 95 95 d6 fa 8f 32 5c 6d 31 18 27 11 49 8c dc cd ab 47 ff 7b b9 fd 18 51 11 19 11 69 0c 26 44 1e 83 09 82 84 d5 Data Ascii: PK&Z<~shater.exey<To7<2ff4li2eLH/1d!%C}k\|}~uW\:ysM>q`@a=1#-SX)j(qj:vNSG:pS!=RIu='N12\m1'IG{Qi&D
2025-01-12 00:15:21 UTC	16368	IN	Data Raw: 68 07 da e3 38 94 71 f5 79 21 7d 6e e3 64 fc eb 63 04 ac bd cf 73 5f b5 a4 e8 c2 ec e6 4b 0d 37 64 8d b7 b5 15 e1 2a fa bf ed bd af 90 b9 cb 5d 58 ac de 26 dc a5 6b 4e 17 2d a1 a1 9b ed 5f 86 70 1b c6 0e 6d de dc 7c b8 ee 7a eb 33 61 ea cb c5 b0 a0 d7 3e 6f 0f fd e3 f8 bc 54 81 f6 51 e0 22 4b 15 a5 dc 7b 3b c7 df bb 43 63 d3 e3 be dd c9 7f 92 82 86 95 b5 9e 26 9f 0b cc 1b bd ec 6e 6e 91 b1 35 87 7a 07 90 4d c0 09 1b 40 6f db cf 28 01 da 28 9d 1f 0b a8 f9 51 fd 55 23 f1 36 b6 99 64 75 54 b9 3b 83 ee 90 ef a4 b8 82 81 f3 0c ff f8 ec 19 97 45 e8 f2 e6 7d 08 97 c2 7c de 27 c7 fc 7b e4 b8 d6 42 88 df aa 1f 24 ad 46 73 9a 93 f6 7c 44 fd 3c a1 a9 6c f9 cb aa ab fc 7e 07 d9 12 19 f9 79 20 79 4f a1 1c 68 24 43 b0 09 2a 17 4d 5a 31 14 51 8f 9b 02 ab 35 01 78 1b 6d Data Ascii: h8qy!}ndcs_K7d]X&kN-_pm\|z3a>oTQ"K{;Cc&nn5zM@o((QU#6duT;E}\|'{B$Fs\|D<l~y yOh$CMZ1Q5xm
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: 8d 0a 0e 2d 36 8d 1a 59 f1 ab 3d dd 67 5d ae c2 b6 e4 5c 3a 2b e3 70 73 9d ae dc b6 59 3b 04 cd 4d 8a bf 7b 68 ba 66 8b c4 99 e3 76 69 03 ee fd f8 a0 83 75 f3 a2 df 49 36 b9 cf 5f 6c 88 04 e2 f5 d3 38 3a 10 4a ab b4 d0 98 bf e6 96 66 60 a0 15 44 d3 3d 88 f1 dc c3 92 5e 77 d3 50 27 44 6b 61 ca 75 0c 16 43 68 b0 0e 5b 7b 9e b0 cb 83 61 35 d9 73 0f 42 73 64 6a 37 3f d9 f4 d1 b8 93 20 ab bc 62 a4 6b 15 f8 be 28 4e 41 c7 66 c4 65 11 39 9f e4 3a 61 2e 83 4e 20 86 37 7e 41 ca b1 4f ad e6 c5 47 60 2e 9c 46 69 3a f6 74 40 bc b2 1c 5b 0a 52 8c db f0 3d 44 d4 31 84 d2 2c 5c c5 41 3d d2 3f 01 a9 8c 22 a9 42 20 46 9a 55 25 31 24 7c a3 31 e8 1c 16 3c f4 25 49 56 cf 58 24 a9 55 8f 41 8f 80 ce be 75 64 b1 43 91 81 4b a4 55 2f f5 18 ca af 8b 8f 5a 89 90 91 3e 12 be 1b 46 Data Ascii: -6Y=g]\:+psY;M{hfviuI6_l8:Jf`D=^wP'DkauCh[{a5sBsdj7? bk(NAfe9:a.N 7~AOG`.Fi:t@[R=D1,\A=?"B FU%1$\|1<%IVX$UAudCKU/Z>F
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: e0 2d b8 15 60 d0 5c 37 28 71 4b f1 49 35 50 e2 fd 50 a3 4f c9 07 88 54 df e3 f2 2a 9d 3e c1 e7 0d b3 f2 06 2f d6 db 96 af 8e f6 8d 28 55 77 89 3e 0b b0 f3 a2 15 40 f5 55 12 ef de 2d 73 12 06 9d 35 82 46 72 76 5b 42 34 a6 44 e9 25 b1 98 35 93 03 57 72 60 2e 95 d9 ca ee 9a 13 2f 50 9c ca ff 2c 88 49 54 3a f6 33 c8 05 1d 6b ef 25 74 68 8c 3f 3d f8 bf 91 37 40 36 97 d4 6a ce db 59 31 70 b7 8c 5d a9 d9 c9 cc cd c3 10 ab 0d 75 2f 2e d4 4b 2f 84 14 99 fe ec 5f 09 5d 31 93 2f a7 f9 ba 5d 70 15 9b c7 45 77 a2 ef e1 71 49 62 8a 32 e6 92 e3 77 12 99 ae 2c 09 e4 36 7b 8b 1e 92 98 c5 f0 c0 61 61 fa 8b 06 1d 08 25 11 0c 3a 57 56 79 f9 ba 20 74 43 7b 03 03 40 24 6c 05 77 0d 19 e4 84 e8 ba e3 c9 74 73 b6 49 58 b7 f0 85 69 39 84 0e e8 39 c0 f7 58 3e 34 ec 0d 46 84 d1 3c Data Ascii: -`\7(qKI5PPOT*>/(Uw>@U-s5Frv[B4D%5Wr`./P,IT:3k%th?=7@6jY1p]u/.K/_]1/]pEwqIb2w,6{aa%:WVy tC{@$lwtsIXi99X>4F<
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: 01 f9 97 1f 00 35 38 5e 7e d4 b2 64 a9 af 81 96 6a 5f d1 94 2b 01 50 d7 de 16 a0 2a 8f 87 9d de 62 fb 57 09 dd 8b 0a 6b a3 8f 5e be 3a 93 68 9b c7 b8 ab 75 a7 f6 0d 39 e3 c0 1d fa d5 1e 6d 9d e0 9f ad 96 2b bf 87 14 84 5e 60 37 07 71 37 c7 ee 5a dd 3f ea ac 90 fe 54 9c 71 de 62 54 fe 97 d0 8c f9 7a d3 c1 83 ea 81 2f cf bf ae 1b 39 70 ef c8 d0 0f 56 55 9b 91 ad 7d e3 07 9d 05 eb 6f 9e 7c 47 4f 3c 76 38 63 16 dd 6a ca 7c 10 ec 68 f4 d8 e7 49 b3 5d ec 8d 7f c3 e9 55 ff 3c db 25 d2 9d 3f 36 f5 ee ce 7c 23 c3 2f b6 e3 aa 80 6e f7 0f 6c 60 bf 81 4a f3 52 f6 97 e9 ad 61 93 6d b8 dc f5 7f 7a 3a 5a 07 f5 9d f4 ed 1e 88 a9 d9 3f d2 e1 9a ea a5 6f e2 ac d5 d1 d8 c0 2b 6b e7 83 5b fb cc e6 47 5d 7a e9 21 7e 1a 0a 9b a5 55 4d 3f fd 1c 51 4f d0 1a b3 4f c6 96 40 a9 db Data Ascii: 58^~dj_+P*bWk^:hu9m+^`7q7Z?TqbTz/9pVU}o\|GO<v8cj\|hI]U<%?6\|#/nl`JRamz:Z?o+k[G]z!~UM?QOO@
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: 8d f9 3a 40 f5 5f 74 80 79 bf 0e ee cd df 9f eb 14 74 4c 5b 8c ef a1 bf c6 96 08 99 f7 4d 76 3a 03 15 7f 63 44 ee b9 86 80 73 01 fd ca ee e9 89 47 51 62 0a a1 c6 9f 5e 54 7e 78 42 af d8 c9 93 62 dd 53 7b 83 e6 00 4a ac 70 09 03 a5 d4 87 d4 02 0c b5 89 01 68 51 0b 4a 7c 5e ba d6 b2 72 e2 8d 60 79 98 4d a8 14 69 b1 16 90 c7 0c f1 ec ea ee 9b 69 c7 ce de 21 1c c5 df 98 5e 89 0e e4 72 41 98 6d 5f f6 a9 cc 9e 18 fc 7e 57 a8 3d bf 98 61 f2 9c f7 dd bf ae 1a 31 ae 77 35 a4 09 cf b4 ee 1d 6a 65 36 f2 fa 75 81 37 58 a9 ff 0e 0c cb c7 de bd 79 d1 9b eb c2 c9 6b 1b fb 4d 06 14 45 8a 55 0a ae b6 eb fd b9 28 f5 67 f7 1e 8d dc 77 d6 a9 9f 34 75 3c 42 5f 69 df 63 4b 8c 94 55 8e 11 af f0 07 1c bd b8 56 28 73 7f dc 4c c5 e7 fa 87 cd 17 9f f9 1e 31 0c ff 9d 7e 91 f0 cb e2 Data Ascii: :@_tytL[Mv:cDsGQb^T~xBbS{JphQJ\|^r`yMii!^rAm_~W=a1w5je6u7XykMEU(gw4u<B_icKUV(sL1~
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: cd b3 0a 8d 6e 8b 18 7e eb e2 89 87 60 78 69 18 1e 0b 8c 18 7e 82 87 e9 e7 e1 f6 3a 26 83 39 8a c4 1d 62 d7 18 0d 43 85 30 9e e4 1e fd 8e cc c2 73 1b c9 36 fc 3f 1d e8 ab 36 51 03 ab d8 26 74 0f 67 10 1f cb 80 57 a2 23 16 ad 38 4c a8 0d b2 61 40 b5 0b 12 db 74 3c f4 d3 a8 14 d7 8c 3f af 17 7a c7 61 3a 1a 3b 08 af 4c c1 0b fd e8 65 a8 b0 9d dd f3 f3 05 c8 e1 f8 52 30 72 c1 22 fc 92 cb 3b 9c 44 30 ad 18 27 23 1c e5 17 9e 6c e3 8c c2 0b 3b 89 f2 b2 63 0f 69 a0 c9 67 fc cd 4b 04 e2 ed 15 cc 2f 39 0d 47 00 96 ae 8e 02 8e de 0a 04 14 1f df 07 18 38 13 07 f8 e3 11 92 a3 76 e3 e3 e6 70 f7 dd 06 07 7f 6d 24 95 5e ce 15 2b b7 71 d8 fa a2 82 4d 5b 9a 8b 51 2d 99 f8 fb da 2a ce 20 fd bf fe 33 ef 37 5c fc 43 f8 bf df 73 97 74 ab 0c ca 0f d0 3a 97 fe 45 97 f4 47 76 52 Data Ascii: n~`xi~:&9bC0s6?6Q&tgW#8La@t<?za:;LeR0r";D0'#l;cigK/9G8vpm$^+qM[Q-* 37\Cst:EGvR
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: 88 5c db c8 9d a2 19 83 0b 0f 8a 4a d2 d5 ce fb c8 a7 ab 8f ef b0 79 f5 f5 aa 9f f6 c9 0b 64 ce 8c 93 eb c1 02 3b 91 bb e5 28 9b 48 77 ff b5 05 8f c8 c1 23 2e 27 ce 68 a5 d4 5b e8 77 1b 1f 88 3a b3 ff fc 66 f5 f6 f4 20 c5 3f 89 e7 86 86 f7 8c 1c 52 5f d1 69 b2 8b 57 fd 70 49 70 58 e9 fa f4 94 be 6b bd e7 ce 84 c9 bc e5 d3 2d 95 bc fb 75 4e b2 b0 05 f1 33 62 b0 10 37 43 d3 b7 a0 71 f3 2d b6 7a c2 52 e0 5d bc cb f0 2d 52 ec c0 d9 c0 6d 4f fc 68 17 78 d2 4e d3 d6 2a aa d6 43 de 3d 4c 4d d2 26 5c 54 34 fd 70 46 69 26 ec e2 5d df 8f d9 b1 39 96 8d 7b 99 27 67 6e 12 05 2b c6 37 1b 85 9b 7a 34 e9 fd 19 3b 3c d3 b6 dd 7a 77 74 aa e4 1f b6 bb c8 d7 76 3d a9 79 d9 ea 59 9b d1 31 cd a5 57 18 b3 19 96 f2 96 26 e7 63 9e 75 d2 b3 d2 3e 36 4f 0e 4a 9c 2c 9a 99 bb a5 bb Data Ascii: \Jyd;(Hw#.'h[w:f ?R_iWpIpXk-uN3b7Cq-zR]-RmOhxN*C=LM&\T4pFi&]9{'gn+7z4;<zwtv=yY1W&cu>6OJ,
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: e5 2a 9e 7b 72 af ce 3e 7f 1b 94 dc 2f bf 18 fd 13 3d 92 7f b1 4a ee 8a da 41 4b 61 1a ba ca 5e e3 1f 35 94 e4 cc 07 e2 fc b9 8f 8a 1b 8f a1 33 57 66 65 fe 1d 9c b5 e3 d5 76 dc ec e4 05 29 08 9d 74 b7 4f d4 84 18 e8 6c cf 53 43 e3 58 fa d2 4e 65 5a eb bd f1 cd 6e f5 ba 88 f7 45 ad 07 7e 58 16 ba c2 bd ae 7c 10 ad dd 33 41 64 7b cc 48 9f e4 58 1a a5 cb 9f e1 05 a5 2d 5c 00 c5 28 a4 3e b7 01 49 e7 d3 b0 16 28 2d 85 ab 4d 57 ef 80 26 d7 f7 f7 4b a7 fa cc 89 c7 6b d7 67 b3 05 ed 9e 49 06 68 8f 2a 8d 70 98 37 4c 80 78 52 7a 0e c4 27 a6 3d 20 02 0d eb 91 04 4e 7d 50 93 04 88 7d 24 42 1c 56 e0 80 7e a1 7c 1b 2f 40 07 49 15 ff 5f 8e 36 b1 8d 77 da 7f 66 4c 87 4f 48 63 f1 ab 74 f4 a1 03 e3 7d 5c e3 07 63 fe 55 6d ac d3 01 58 33 b2 cb f0 c7 aa 8b c1 eb 1f 9c cb a5 Data Ascii: {r>/=JAKa^53Wfev)tOlSCXNeZnE~X\|3Ad{HX-\(>I(-MW&KkgIhp7LxRz'= N}P}$BV~\|/@I_6wfLOHct}\cUmX3
2025-01-12 00:15:21 UTC	8184	IN	Data Raw: 10 dd 4b b9 5c 70 02 c1 07 cd 94 1b 41 82 03 79 43 c4 33 e8 0f e0 44 8f d5 21 83 33 37 2c dd 91 4b 00 34 0a 09 79 fa 15 c3 48 e2 1a 9b 8e 0d 0c 86 e9 43 0a 9b c0 58 30 43 cc 4e 5d 4c 31 26 30 e6 34 9d 11 06 0d f5 21 a5 61 b0 2b 47 61 26 11 93 f9 48 62 00 8c e9 3a 50 0e 83 45 ac f3 22 89 3b 88 6d 01 18 90 a0 1e 96 0b 8d 0b 11 a0 cb 27 1b ea c8 20 e1 43 48 62 4f de 45 68 3b 66 05 48 7c 3d 50 0c 8d a0 f2 d2 56 ad b6 c9 c4 f5 d7 db 24 e2 dc 77 ae 76 da 32 b8 a0 50 8e 10 77 36 b6 97 f9 3f 6f 4f 80 fd fd 1e 88 bc 29 f5 16 3a 76 51 20 ea c7 43 13 b9 6d 4b eb 93 cb da 07 54 fd f1 6c a8 03 43 cf be f2 7f 8a 36 a1 b7 00 88 a4 c6 17 ff a7 e3 37 24 37 08 5b 52 9a 35 aa a1 43 7d 40 13 01 88 fa 10 26 00 6d ac b9 d0 90 c2 f0 c9 89 c5 a9 fd a3 d3 29 c9 0f cb a0 d4 97 4a Data Ascii: K\pAyC3D!37,K4yHCX0CN]L1&04!a+Ga&Hb:PE";m' CHbOEh;fH\|=PV$wv2Pw6?oO):vQ CmKTlC67$7[R5C}@&m)J

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49927	43.132.105.108	443	3364	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-12 00:15:50 UTC	742	OUT	GET /shater.zip HTTP/1.1 Host: 00-25-1333705940.cos.ap-hongkong.myqcloud.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://www.telegramai.org/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-12 00:15:50 UTC	506	IN	HTTP/1.1 200 OK Content-Type: application/zip Content-Length: 62506228 Connection: close Accept-Ranges: bytes Content-Disposition: attachment Date: Sun, 12 Jan 2025 00:15:50 GMT ETag: "d2fc5aa89eabd3cd8918984037895a73-8" Last-Modified: Mon, 06 Jan 2025 08:08:37 GMT Server: tencent-cos x-cos-force-download: true x-cos-hash-crc64ecma: 13442301155271637664 x-cos-request-id: Njc4MzA5YjZfZjAzNDUxMGJfYjBhMF8zNTRmNzVh x-cos-storage-class: MAZ_STANDARD x-cosindex-replication-status: Complete
2025-01-12 00:15:50 UTC	7698	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 dd 80 26 5a e5 85 3c e6 7e c4 b9 03 b8 a7 bf 03 0a 00 00 00 73 68 61 74 65 72 2e 65 78 65 ec bc 79 3c 54 6f fc 37 3c 9c b1 8f 8e 32 15 b2 66 8f 84 09 d1 66 34 84 10 a2 6c 95 a2 93 be 69 d7 ae 32 8c 65 cc 4c a9 c6 1a 95 48 b2 a4 b2 2f 31 87 64 86 08 13 21 0a 25 43 9b a5 8c 7d ee 6b 7c 7f f7 7d ff 7e f7 f3 dc af fb 9f e7 f5 fc 75 9f 57 de ef cf b5 9c eb 5c e7 3a d7 f2 79 9f 73 4d ce 3e 71 18 08 83 c1 60 c1 9f 40 80 c1 94 61 fe 3d ac 31 ff e7 23 0c fc 2d 53 ab 58 86 29 92 6a d6 28 13 71 6a d6 f0 08 3a 76 4e fd f4 d9 53 47 cf 1e 3a a1 1e 70 e8 e4 c9 53 21 ea 87 8f a8 9f 3d 7f 52 fd d8 49 75 d2 ee 3d ea 27 4e 05 1e 31 92 95 95 d6 fa 8f 32 5c 6d 31 18 27 11 49 8c dc cd ab 47 ff 7b b9 fd 18 51 11 19 11 69 0c 26 44 1e 83 09 82 84 d5 Data Ascii: PK&Z<~shater.exey<To7<2ff4li2eLH/1d!%C}k\|}~uW\:ysM>q`@a=1#-SX)j(qj:vNSG:pS!=RIu='N12\m1'IG{Qi&D
2025-01-12 00:15:51 UTC	16368	IN	Data Raw: 68 07 da e3 38 94 71 f5 79 21 7d 6e e3 64 fc eb 63 04 ac bd cf 73 5f b5 a4 e8 c2 ec e6 4b 0d 37 64 8d b7 b5 15 e1 2a fa bf ed bd af 90 b9 cb 5d 58 ac de 26 dc a5 6b 4e 17 2d a1 a1 9b ed 5f 86 70 1b c6 0e 6d de dc 7c b8 ee 7a eb 33 61 ea cb c5 b0 a0 d7 3e 6f 0f fd e3 f8 bc 54 81 f6 51 e0 22 4b 15 a5 dc 7b 3b c7 df bb 43 63 d3 e3 be dd c9 7f 92 82 86 95 b5 9e 26 9f 0b cc 1b bd ec 6e 6e 91 b1 35 87 7a 07 90 4d c0 09 1b 40 6f db cf 28 01 da 28 9d 1f 0b a8 f9 51 fd 55 23 f1 36 b6 99 64 75 54 b9 3b 83 ee 90 ef a4 b8 82 81 f3 0c ff f8 ec 19 97 45 e8 f2 e6 7d 08 97 c2 7c de 27 c7 fc 7b e4 b8 d6 42 88 df aa 1f 24 ad 46 73 9a 93 f6 7c 44 fd 3c a1 a9 6c f9 cb aa ab fc 7e 07 d9 12 19 f9 79 20 79 4f a1 1c 68 24 43 b0 09 2a 17 4d 5a 31 14 51 8f 9b 02 ab 35 01 78 1b 6d Data Ascii: h8qy!}ndcs_K7d]X&kN-_pm\|z3a>oTQ"K{;Cc&nn5zM@o((QU#6duT;E}\|'{B$Fs\|D<l~y yOh$CMZ1Q5xm
2025-01-12 00:15:51 UTC	8184	IN	Data Raw: 8d 0a 0e 2d 36 8d 1a 59 f1 ab 3d dd 67 5d ae c2 b6 e4 5c 3a 2b e3 70 73 9d ae dc b6 59 3b 04 cd 4d 8a bf 7b 68 ba 66 8b c4 99 e3 76 69 03 ee fd f8 a0 83 75 f3 a2 df 49 36 b9 cf 5f 6c 88 04 e2 f5 d3 38 3a 10 4a ab b4 d0 98 bf e6 96 66 60 a0 15 44 d3 3d 88 f1 dc c3 92 5e 77 d3 50 27 44 6b 61 ca 75 0c 16 43 68 b0 0e 5b 7b 9e b0 cb 83 61 35 d9 73 0f 42 73 64 6a 37 3f d9 f4 d1 b8 93 20 ab bc 62 a4 6b 15 f8 be 28 4e 41 c7 66 c4 65 11 39 9f e4 3a 61 2e 83 4e 20 86 37 7e 41 ca b1 4f ad e6 c5 47 60 2e 9c 46 69 3a f6 74 40 bc b2 1c 5b 0a 52 8c db f0 3d 44 d4 31 84 d2 2c 5c c5 41 3d d2 3f 01 a9 8c 22 a9 42 20 46 9a 55 25 31 24 7c a3 31 e8 1c 16 3c f4 25 49 56 cf 58 24 a9 55 8f 41 8f 80 ce be 75 64 b1 43 91 81 4b a4 55 2f f5 18 ca af 8b 8f 5a 89 90 91 3e 12 be 1b 46 Data Ascii: -6Y=g]\:+psY;M{hfviuI6_l8:Jf`D=^wP'DkauCh[{a5sBsdj7? bk(NAfe9:a.N 7~AOG`.Fi:t@[R=D1,\A=?"B FU%1$\|1<%IVX$UAudCKU/Z>F
2025-01-12 00:15:51 UTC	8184	IN	Data Raw: e0 2d b8 15 60 d0 5c 37 28 71 4b f1 49 35 50 e2 fd 50 a3 4f c9 07 88 54 df e3 f2 2a 9d 3e c1 e7 0d b3 f2 06 2f d6 db 96 af 8e f6 8d 28 55 77 89 3e 0b b0 f3 a2 15 40 f5 55 12 ef de 2d 73 12 06 9d 35 82 46 72 76 5b 42 34 a6 44 e9 25 b1 98 35 93 03 57 72 60 2e 95 d9 ca ee 9a 13 2f 50 9c ca ff 2c 88 49 54 3a f6 33 c8 05 1d 6b ef 25 74 68 8c 3f 3d f8 bf 91 37 40 36 97 d4 6a ce db 59 31 70 b7 8c 5d a9 d9 c9 cc cd c3 10 ab 0d 75 2f 2e d4 4b 2f 84 14 99 fe ec 5f 09 5d 31 93 2f a7 f9 ba 5d 70 15 9b c7 45 77 a2 ef e1 71 49 62 8a 32 e6 92 e3 77 12 99 ae 2c 09 e4 36 7b 8b 1e 92 98 c5 f0 c0 61 61 fa 8b 06 1d 08 25 11 0c 3a 57 56 79 f9 ba 20 74 43 7b 03 03 40 24 6c 05 77 0d 19 e4 84 e8 ba e3 c9 74 73 b6 49 58 b7 f0 85 69 39 84 0e e8 39 c0 f7 58 3e 34 ec 0d 46 84 d1 3c Data Ascii: -`\7(qKI5PPOT*>/(Uw>@U-s5Frv[B4D%5Wr`./P,IT:3k%th?=7@6jY1p]u/.K/_]1/]pEwqIb2w,6{aa%:WVy tC{@$lwtsIXi99X>4F<
2025-01-12 00:15:51 UTC	8184	IN	Data Raw: 01 f9 97 1f 00 35 38 5e 7e d4 b2 64 a9 af 81 96 6a 5f d1 94 2b 01 50 d7 de 16 a0 2a 8f 87 9d de 62 fb 57 09 dd 8b 0a 6b a3 8f 5e be 3a 93 68 9b c7 b8 ab 75 a7 f6 0d 39 e3 c0 1d fa d5 1e 6d 9d e0 9f ad 96 2b bf 87 14 84 5e 60 37 07 71 37 c7 ee 5a dd 3f ea ac 90 fe 54 9c 71 de 62 54 fe 97 d0 8c f9 7a d3 c1 83 ea 81 2f cf bf ae 1b 39 70 ef c8 d0 0f 56 55 9b 91 ad 7d e3 07 9d 05 eb 6f 9e 7c 47 4f 3c 76 38 63 16 dd 6a ca 7c 10 ec 68 f4 d8 e7 49 b3 5d ec 8d 7f c3 e9 55 ff 3c db 25 d2 9d 3f 36 f5 ee ce 7c 23 c3 2f b6 e3 aa 80 6e f7 0f 6c 60 bf 81 4a f3 52 f6 97 e9 ad 61 93 6d b8 dc f5 7f 7a 3a 5a 07 f5 9d f4 ed 1e 88 a9 d9 3f d2 e1 9a ea a5 6f e2 ac d5 d1 d8 c0 2b 6b e7 83 5b fb cc e6 47 5d 7a e9 21 7e 1a 0a 9b a5 55 4d 3f fd 1c 51 4f d0 1a b3 4f c6 96 40 a9 db Data Ascii: 58^~dj_+P*bWk^:hu9m+^`7q7Z?TqbTz/9pVU}o\|GO<v8cj\|hI]U<%?6\|#/nl`JRamz:Z?o+k[G]z!~UM?QOO@
2025-01-12 00:15:51 UTC	8184	IN	Data Raw: 8d f9 3a 40 f5 5f 74 80 79 bf 0e ee cd df 9f eb 14 74 4c 5b 8c ef a1 bf c6 96 08 99 f7 4d 76 3a 03 15 7f 63 44 ee b9 86 80 73 01 fd ca ee e9 89 47 51 62 0a a1 c6 9f 5e 54 7e 78 42 af d8 c9 93 62 dd 53 7b 83 e6 00 4a ac 70 09 03 a5 d4 87 d4 02 0c b5 89 01 68 51 0b 4a 7c 5e ba d6 b2 72 e2 8d 60 79 98 4d a8 14 69 b1 16 90 c7 0c f1 ec ea ee 9b 69 c7 ce de 21 1c c5 df 98 5e 89 0e e4 72 41 98 6d 5f f6 a9 cc 9e 18 fc 7e 57 a8 3d bf 98 61 f2 9c f7 dd bf ae 1a 31 ae 77 35 a4 09 cf b4 ee 1d 6a 65 36 f2 fa 75 81 37 58 a9 ff 0e 0c cb c7 de bd 79 d1 9b eb c2 c9 6b 1b fb 4d 06 14 45 8a 55 0a ae b6 eb fd b9 28 f5 67 f7 1e 8d dc 77 d6 a9 9f 34 75 3c 42 5f 69 df 63 4b 8c 94 55 8e 11 af f0 07 1c bd b8 56 28 73 7f dc 4c c5 e7 fa 87 cd 17 9f f9 1e 31 0c ff 9d 7e 91 f0 cb e2 Data Ascii: :@_tytL[Mv:cDsGQb^T~xBbS{JphQJ\|^r`yMii!^rAm_~W=a1w5je6u7XykMEU(gw4u<B_icKUV(sL1~
2025-01-12 00:15:51 UTC	8184	IN	Data Raw: cd b3 0a 8d 6e 8b 18 7e eb e2 89 87 60 78 69 18 1e 0b 8c 18 7e 82 87 e9 e7 e1 f6 3a 26 83 39 8a c4 1d 62 d7 18 0d 43 85 30 9e e4 1e fd 8e cc c2 73 1b c9 36 fc 3f 1d e8 ab 36 51 03 ab d8 26 74 0f 67 10 1f cb 80 57 a2 23 16 ad 38 4c a8 0d b2 61 40 b5 0b 12 db 74 3c f4 d3 a8 14 d7 8c 3f af 17 7a c7 61 3a 1a 3b 08 af 4c c1 0b fd e8 65 a8 b0 9d dd f3 f3 05 c8 e1 f8 52 30 72 c1 22 fc 92 cb 3b 9c 44 30 ad 18 27 23 1c e5 17 9e 6c e3 8c c2 0b 3b 89 f2 b2 63 0f 69 a0 c9 67 fc cd 4b 04 e2 ed 15 cc 2f 39 0d 47 00 96 ae 8e 02 8e de 0a 04 14 1f df 07 18 38 13 07 f8 e3 11 92 a3 76 e3 e3 e6 70 f7 dd 06 07 7f 6d 24 95 5e ce 15 2b b7 71 d8 fa a2 82 4d 5b 9a 8b 51 2d 99 f8 fb da 2a ce 20 fd bf fe 33 ef 37 5c fc 43 f8 bf df 73 97 74 ab 0c ca 0f d0 3a 97 fe 45 97 f4 47 76 52 Data Ascii: n~`xi~:&9bC0s6?6Q&tgW#8La@t<?za:;LeR0r";D0'#l;cigK/9G8vpm$^+qM[Q-* 37\Cst:EGvR
2025-01-12 00:15:51 UTC	8184	IN	Data Raw: 88 5c db c8 9d a2 19 83 0b 0f 8a 4a d2 d5 ce fb c8 a7 ab 8f ef b0 79 f5 f5 aa 9f f6 c9 0b 64 ce 8c 93 eb c1 02 3b 91 bb e5 28 9b 48 77 ff b5 05 8f c8 c1 23 2e 27 ce 68 a5 d4 5b e8 77 1b 1f 88 3a b3 ff fc 66 f5 f6 f4 20 c5 3f 89 e7 86 86 f7 8c 1c 52 5f d1 69 b2 8b 57 fd 70 49 70 58 e9 fa f4 94 be 6b bd e7 ce 84 c9 bc e5 d3 2d 95 bc fb 75 4e b2 b0 05 f1 33 62 b0 10 37 43 d3 b7 a0 71 f3 2d b6 7a c2 52 e0 5d bc cb f0 2d 52 ec c0 d9 c0 6d 4f fc 68 17 78 d2 4e d3 d6 2a aa d6 43 de 3d 4c 4d d2 26 5c 54 34 fd 70 46 69 26 ec e2 5d df 8f d9 b1 39 96 8d 7b 99 27 67 6e 12 05 2b c6 37 1b 85 9b 7a 34 e9 fd 19 3b 3c d3 b6 dd 7a 77 74 aa e4 1f b6 bb c8 d7 76 3d a9 79 d9 ea 59 9b d1 31 cd a5 57 18 b3 19 96 f2 96 26 e7 63 9e 75 d2 b3 d2 3e 36 4f 0e 4a 9c 2c 9a 99 bb a5 bb Data Ascii: \Jyd;(Hw#.'h[w:f ?R_iWpIpXk-uN3b7Cq-zR]-RmOhxN*C=LM&\T4pFi&]9{'gn+7z4;<zwtv=yY1W&cu>6OJ,
2025-01-12 00:15:51 UTC	8184	IN	Data Raw: e5 2a 9e 7b 72 af ce 3e 7f 1b 94 dc 2f bf 18 fd 13 3d 92 7f b1 4a ee 8a da 41 4b 61 1a ba ca 5e e3 1f 35 94 e4 cc 07 e2 fc b9 8f 8a 1b 8f a1 33 57 66 65 fe 1d 9c b5 e3 d5 76 dc ec e4 05 29 08 9d 74 b7 4f d4 84 18 e8 6c cf 53 43 e3 58 fa d2 4e 65 5a eb bd f1 cd 6e f5 ba 88 f7 45 ad 07 7e 58 16 ba c2 bd ae 7c 10 ad dd 33 41 64 7b cc 48 9f e4 58 1a a5 cb 9f e1 05 a5 2d 5c 00 c5 28 a4 3e b7 01 49 e7 d3 b0 16 28 2d 85 ab 4d 57 ef 80 26 d7 f7 f7 4b a7 fa cc 89 c7 6b d7 67 b3 05 ed 9e 49 06 68 8f 2a 8d 70 98 37 4c 80 78 52 7a 0e c4 27 a6 3d 20 02 0d eb 91 04 4e 7d 50 93 04 88 7d 24 42 1c 56 e0 80 7e a1 7c 1b 2f 40 07 49 15 ff 5f 8e 36 b1 8d 77 da 7f 66 4c 87 4f 48 63 f1 ab 74 f4 a1 03 e3 7d 5c e3 07 63 fe 55 6d ac d3 01 58 33 b2 cb f0 c7 aa 8b c1 eb 1f 9c cb a5 Data Ascii: {r>/=JAKa^53Wfev)tOlSCXNeZnE~X\|3Ad{HX-\(>I(-MW&KkgIhp7LxRz'= N}P}$BV~\|/@I_6wfLOHct}\cUmX3
2025-01-12 00:15:51 UTC	16368	IN	Data Raw: 10 dd 4b b9 5c 70 02 c1 07 cd 94 1b 41 82 03 79 43 c4 33 e8 0f e0 44 8f d5 21 83 33 37 2c dd 91 4b 00 34 0a 09 79 fa 15 c3 48 e2 1a 9b 8e 0d 0c 86 e9 43 0a 9b c0 58 30 43 cc 4e 5d 4c 31 26 30 e6 34 9d 11 06 0d f5 21 a5 61 b0 2b 47 61 26 11 93 f9 48 62 00 8c e9 3a 50 0e 83 45 ac f3 22 89 3b 88 6d 01 18 90 a0 1e 96 0b 8d 0b 11 a0 cb 27 1b ea c8 20 e1 43 48 62 4f de 45 68 3b 66 05 48 7c 3d 50 0c 8d a0 f2 d2 56 ad b6 c9 c4 f5 d7 db 24 e2 dc 77 ae 76 da 32 b8 a0 50 8e 10 77 36 b6 97 f9 3f 6f 4f 80 fd fd 1e 88 bc 29 f5 16 3a 76 51 20 ea c7 43 13 b9 6d 4b eb 93 cb da 07 54 fd f1 6c a8 03 43 cf be f2 7f 8a 36 a1 b7 00 88 a4 c6 17 ff a7 e3 37 24 37 08 5b 52 9a 35 aa a1 43 7d 40 13 01 88 fa 10 26 00 6d ac b9 d0 90 c2 f0 c9 89 c5 a9 fd a3 d3 29 c9 0f cb a0 d4 97 4a Data Ascii: K\pAyC3D!37,K4yHCX0CN]L1&04!a+Ga&Hb:PE";m' CHbOEh;fH\|=PV$wv2Pw6?oO):vQ CmKTlC67$7[R5C}@&m)J

Target ID:	0
Start time:	19:14:38
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	19:14:41
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2028 --field-trial-handle=1992,i,2141554347047288,12388819619459372047,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	19:14:47
Start date:	11/01/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramai.org/"
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: https://www.telegramai.org/static/image/gou.png	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/image/right.png	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/image/left.png	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/js/public.js	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/css/swiper-bundle.min.css	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/js/jquery.js	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/js/swiper-bundle.min.js	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/image/icon_nav.png	Avira URL Cloud: Label: phishing
Source: https://www.telegramai.org/static/css/style.min.css	Avira URL Cloud: Label: phishing

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: http://www.telegramai.org
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: http://www.telegramai.org

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-logo.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/swiper-bundle.min.css HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/css/style.min.css HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/logo.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js?id=3KK9Zot37TeXAqY2&ck=3KK9Zot37TeXAqY2 HTTP/1.1Host: sdk.51.laConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-logo.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/logo.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/phone.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/td_laptop.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/top.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/jquery.js HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /static/image/right.png HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/static/css/style.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /telegram-16/cropped-header-image-5.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/public.js HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /telegram-16/333.jpg HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/swiper-bundle.min.js HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /static/image/gou.png HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/static/css/style.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /telegram-16/555.jpeg HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/left.png HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/static/css/style.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /telegram-16/phone.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/td_laptop.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js?id=3KK9Zot37TeXAqY2&ck=3KK9Zot37TeXAqY2 HTTP/1.1Host: sdk.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/777.jpeg HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/333.jpg HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/555.jpeg HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/public.js HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /static/image/right.png HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /static/image/gou.png HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /telegram-16/top.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-16/cropped-header-image-5.png HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/js/jquery.js HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /static/js/swiper-bundle.min.js HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /static/image/left.png HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /telegram-16/777.jpeg HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /telegram-favicon.ico HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/icon_nav.png HTTP/1.1Host: www.telegramai.orgConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramai.org/static/css/style.min.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /telegram-favicon.ico HTTP/1.1Host: image.sanxiang-sh.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/image/icon_nav.png HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: __vtins__3KK9Zot37TeXAqY2=%7B%22sid%22%3A%20%222d9979bf-fc82-5db8-a7e1-925c8bed1015%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201736642692698%2C%20%22ct%22%3A%201736640892698%7D; __51uvsct__3KK9Zot37TeXAqY2=1; __51vcke__3KK9Zot37TeXAqY2=a5a16e04-18d1-5841-9176-8e8fc1dd2d5f; __51vuft__3KK9Zot37TeXAqY2=1736640892704
Source: global traffic	HTTP traffic detected: GET /shater.zip HTTP/1.1Host: 00-25-1333705940.cos.ap-hongkong.myqcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shater.zip HTTP/1.1Host: 00-25-1333705940.cos.ap-hongkong.myqcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://www.telegramai.org/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.telegramai.orgConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: www.telegramai.org
Source: global traffic	DNS traffic detected: DNS query: sdk.51.la
Source: global traffic	DNS traffic detected: DNS query: image.sanxiang-sh.com
Source: global traffic	DNS traffic detected: DNS query: collect-v6.51.la
Source: global traffic	DNS traffic detected: DNS query: 00-25-1333705940.cos.ap-hongkong.myqcloud.com

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.telegramai.org/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Boot Survival

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

C:\Users\user\Downloads\42275caf-472a-4a81-b0f0-faa185fa9241.tmp

C:\Users\user\Downloads\shater (1).zip.crdownload

C:\Users\user\Downloads\shater.zip.crdownload

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Windows Analysis Report
http://www.telegramai.org/