Edit tour

Windows Analysis Report
http://c.vip3656jun27.cc/

Overview

General Information

Sample URL:	http://c.vip3656jun27.cc/
Analysis ID:	1520178
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Found suspicious QR code URL

Performs DNS queries to domains with low reputation

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 4216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2180,i,3094351015145464012,17547472614160585637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6880 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://c.vip3656jun27.cc/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://365kkf.cc/xiazai.html MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5476 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,18340160629433268202,6812252358326559700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2648 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://get365kapp.xyz/xiazai.html MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 8 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1972,i,660926040008573878,15648109473410569246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: POST /stat.htm?id=1275613349&r=&lg=en-us&ntime=none&cnzz_eid=801000927-1727410252-&showp=1280x1024&p=http%3A%2F%2Fc.vip3656jun27.cc%2F&t=bet365%E9%9B%86%E5%9B%A2%20365%E4%BD%93%E8%82%B2%E5%9C%A8%E7%BA%BF-%E4%B8%8A%E7%BD%91%E5%AF%BC%E8%88%AA&umuuid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da&h=1 HTTP/1.1Host: z2.cnzz.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: http://c.vip3656jun27.ccSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: http://c.vip3656jun27.cc/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: http://c.vip3656jun27.cc/images/wangzhi_22.png	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/xiazai.png	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/saved_resource	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/remen_01.jpg	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/js/jquery-1.9.1.min.js	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/saved_resource(2)	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/long_qr_240818.gif	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/saved_resource(1)	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/css/style.css	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/remen_05.jpg	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/jt.png	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/kongtou4_240216.gif	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/nav.png	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/remen_03.jpg	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/js/move.js	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/bg.jpg	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/wangzhi_11.png	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/js/js.js	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/remen_02.jpg	Avira URL Cloud: Label: phishing
Source: http://c.vip3656jun27.cc/images/zhongjiang.jpg	Avira URL Cloud: Label: phishing

Source: https://365ckk.com:8989/verify-page/index.html	HTTP Parser: No favicon
Source: https://d.qw66za.com:8989/verify-page/index.html	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.7:49727 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: get365kapp.xyz
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	DNS query: get365kapp.xyz

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	TCP traffic detected without corresponding DNS query: 20.50.201.200
Source: unknown	TCP traffic detected without corresponding DNS query: 104.98.116.138
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 13.95.65.251
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: c.vip3656jun27.cc
Source: global traffic	DNS traffic detected: DNS query: s96.cnzz.com
Source: global traffic	DNS traffic detected: DNS query: 3656.tstdmn.cc
Source: global traffic	DNS traffic detected: DNS query: c.cnzz.com
Source: global traffic	DNS traffic detected: DNS query: z2.cnzz.com
Source: global traffic	DNS traffic detected: DNS query: 365kkf.cc
Source: global traffic	DNS traffic detected: DNS query: get365kapp.xyz
Source: global traffic	DNS traffic detected: DNS query: 365ckk.com
Source: global traffic	DNS traffic detected: DNS query: _8989._https.365ckk.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: use.fontawesome.com
Source: global traffic	DNS traffic detected: DNS query: d.qw66za.com
Source: global traffic	DNS traffic detected: DNS query: _8989._https.d.qw66za.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 552Content-Type: text/html; charset=utf-8Date: Fri, 27 Sep 2024 04:11:19 GMTX-Cache: BYPASS, Status: 404X-Request-Id: 1839518154817015808Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 552Content-Type: text/html; charset=utf-8Date: Fri, 27 Sep 2024 04:11:29 GMTX-Cache: BYPASS, Status: 404X-Request-Id: 1839518131647680512Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 552Content-Type: text/html; charset=utf-8Date: Fri, 27 Sep 2024 04:11:30 GMTX-Cache: BYPASSX-Request-Id: 1839518201663197184Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 552Content-Type: text/html; charset=utf-8Date: Fri, 27 Sep 2024 04:11:47 GMTX-Cache: BYPASS, Status: 404X-Request-Id: 1839518209040977920Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Length: 552Content-Type: text/html; charset=utf-8Date: Fri, 27 Sep 2024 04:12:10 GMTX-Cache: BYPASS, Status: 404X-Request-Id: 1839518303266017280Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 04:10:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 552Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 04:10:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 552Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 04:10:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 552Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 27 Sep 2024 04:10:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 552Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: Http://bugs.jqueryui.com/ticket/9446
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/accordion/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/autocomplete/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/blind-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/bounce-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/button/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/category/effects-core/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/checkboxradio/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/clip-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/controlgroup/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/data-selector/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/datepicker/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/dialog/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/disableSelection/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/draggable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/drop-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/droppable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/explode-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/fade-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/focusable-selector/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/fold-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/form-reset-mixin/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/highlight-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/jQuery.ui.keyCode/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/jQuery.widget/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/labels/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/menu/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/mouse/
Source: chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/position/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/progressbar/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/puff-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/pulsate-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/resizable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/scale-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/scrollParent/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/selectable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/selectmenu/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/shake-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/size-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/slide-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/slider/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/sortable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/spinner/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/tabbable-selector/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/tabs/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/tooltip/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/transfer-effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://api.jqueryui.com/uniqueId/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://bugs.jquery.com/ticket/11778
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://bugs.jqueryui.com/ticket/7552
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jquery.org/license
Source: chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/accordion/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/autocomplete/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/button/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/checkboxradio/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/controlgroup/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/datepicker/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/dialog/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/draggable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/droppable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/effect/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/menu/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/position/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/progressbar/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/resizable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/selectable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/selectmenu/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/slider/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/sortable/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/spinner/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/tabs/
Source: chromecache_154.3.dr, chromecache_221.3.dr	String found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=no
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/tooltip/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jqueryui.com/widget/
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://jsfiddle.net/JZSMt/3/
Source: chromecache_171.3.dr	String found in binary or memory: http://www.baidu.com/xx.apk
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: http://www.robertpenner.com/easing)
Source: chromecache_144.3.dr, chromecache_164.3.dr	String found in binary or memory: http://www.w.org/1999/02/22-rdf-syntax-ns#
Source: chromecache_171.3.dr	String found in binary or memory: https://365kkf.cc/365kkefu_4722.apk
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=107380
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=47182
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=561664
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=313082
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://code.google.com/p/maashaack/source/browse/packages/graphics/trunk/src/graphics/colors/HUE2RG
Source: chromecache_222.3.dr, chromecache_208.3.dr	String found in binary or memory: https://developer.matomo.org/api-reference/tracking-javascript
Source: chromecache_222.3.dr, chromecache_208.3.dr	String found in binary or memory: https://developer.matomo.org/guides/tracking-javascript-guide#multiple-piwik-trackers
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://drafts.csswg.org/cssom/#common-serializing-idioms
Source: chromecache_164.3.dr	String found in binary or memory: https://ezgif.com/overlay
Source: chromecache_190.3.dr, chromecache_113.3.dr, chromecache_170.3.dr	String found in binary or memory: https://fontawesome.com
Source: chromecache_190.3.dr, chromecache_113.3.dr, chromecache_170.3.dr	String found in binary or memory: https://fontawesome.com/license
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://github.com/jquery/jquery-color
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe
Source: chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	String found in binary or memory: https://github.com/jquery/jquery/issues/4382
Source: chromecache_222.3.dr, chromecache_208.3.dr	String found in binary or memory: https://github.com/matomo-org/matomo/blob/master/js/piwik.js
Source: chromecache_222.3.dr, chromecache_208.3.dr	String found in binary or memory: https://piwik.org
Source: chromecache_222.3.dr, chromecache_208.3.dr	String found in binary or memory: https://piwik.org/free-software/bsd/
Source: chromecache_155.3.dr, chromecache_211.3.dr	String found in binary or memory: https://quanjing.cnzz.com
Source: chromecache_155.3.dr, chromecache_211.3.dr	String found in binary or memory: https://www.cnzz.com/stat/website.php?web_id=

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49677 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2180,i,3094351015145464012,17547472614160585637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://c.vip3656jun27.cc/"
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://365kkf.cc/xiazai.html
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://get365kapp.xyz/xiazai.html
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,18340160629433268202,6812252358326559700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1972,i,660926040008573878,15648109473410569246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 --field-trial-handle=2180,i,3094351015145464012,17547472614160585637,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=2000,i,18340160629433268202,6812252358326559700,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1972,i,660926040008573878,15648109473410569246,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

IP	Domain	Country	ASN	ASN Name	Malicious
54.150.17.124	get365kapp.xyz	United States	16509	AMAZON-02US	true
172.217.18.4	www.google.com	United States	15169	GOOGLEUS	false
122.225.212.209	all.cnzz.com.danuoyi.tbcache.com	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
223.109.148.140	z.gds.cnzz.com	China	56046	CMNET-JIANGSU-APChinaMobilecommunicationscorporationCN	false
151.101.2.137	code.jquery.com	United States	54113	FASTLYUS	false
20.239.97.157	cluster91f2e088.hysjs168.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
148.66.1.82	ty20cnd00.safeproduc08.xyz	Hong Kong	45753	NETSEC-HKNETSECHK	false
34.92.211.102	3656.tstdmn.cc	United States	15169	GOOGLEUS	false
34.85.36.87	c.vip3656jun27.cc	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520178
Start date and time:	2024-09-27 06:09:43 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 18s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://c.vip3656jun27.cc/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.troj.win@32/211@47/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://365ckk.com:8989/ Browse: https://d.qw66za.com:8989/

Source	URL
Screenshot	https://365kkf.cc/xiazai.html
Screenshot	https://get365kapp.xyz/xiazai.html

Source	Detection	Scanner	Label
http://jqueryui.com	0%	URL Reputation	safe
https://fontawesome.com	0%	URL Reputation	safe
http://c.vip3656jun27.cc/images/wangzhi_22.png	100%	Avira URL Cloud	phishing
http://c.vip3656jun27.cc/images/xiazai.png	100%	Avira URL Cloud	phishing
http://jqueryui.com/menu/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/tooltip/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/saved_resource	100%	Avira URL Cloud	phishing
http://jqueryui.com/accordion/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/slide-effect/	0%	Avira URL Cloud	safe
https://365kkf.cc/static/qrcode.png	0%	Avira URL Cloud	safe
http://api.jqueryui.com/data-selector/	0%	Avira URL Cloud	safe
http://www.baidu.com/xx.apk	0%	Avira URL Cloud	safe
http://jquery.org/license	0%	URL Reputation	safe
https://drafts.csswg.org/cssom/#common-serializing-idioms	0%	URL Reputation	safe
http://c.vip3656jun27.cc/images/remen_01.jpg	100%	Avira URL Cloud	phishing
http://c.vip3656jun27.cc/js/jquery-1.9.1.min.js	100%	Avira URL Cloud	phishing
https://piwik.org/free-software/bsd/	0%	Avira URL Cloud	safe
http://jsfiddle.net/JZSMt/3/	0%	Avira URL Cloud	safe
https://365kkf.cc/ftl/bet365-627/images/favicon.png	0%	Avira URL Cloud	safe
http://jqueryui.com/position/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/mouse/	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery-color	0%	Avira URL Cloud	safe
http://jqueryui.com/button/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/jQuery.widget/	0%	Avira URL Cloud	safe
http://bugs.jquery.com/ticket/11778	0%	Avira URL Cloud	safe
https://365kkf.cc/static/41-1530778231.png	0%	Avira URL Cloud	safe
http://api.jqueryui.com/focusable-selector/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/draggable/	0%	Avira URL Cloud	safe
https://bugzilla.mozilla.org/show_bug.cgi?id=561664	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/saved_resource(2)	100%	Avira URL Cloud	phishing
https://bugs.webkit.org/show_bug.cgi?id=107380	0%	Avira URL Cloud	safe
http://api.jqueryui.com/fade-effect/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/long_qr_240818.gif	100%	Avira URL Cloud	phishing
https://developer.matomo.org/guides/tracking-javascript-guide#multiple-piwik-trackers	0%	Avira URL Cloud	safe
http://api.jqueryui.com/form-reset-mixin/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/saved_resource(1)	100%	Avira URL Cloud	phishing
https://github.com/matomo-org/matomo/blob/master/js/piwik.js	0%	Avira URL Cloud	safe
http://api.jqueryui.com/fold-effect/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/button/	0%	Avira URL Cloud	safe
https://365kkf.cc/static/guide/ab.css	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/css/style.css	100%	Avira URL Cloud	phishing
https://ezgif.com/overlay	0%	Avira URL Cloud	safe
http://jqueryui.com/spinner/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/size-effect/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/spinner/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/puff-effect/	0%	Avira URL Cloud	safe
https://365kkf.cc/tip.png	0%	Avira URL Cloud	safe
https://developer.matomo.org/api-reference/tracking-javascript	0%	Avira URL Cloud	safe
http://api.jqueryui.com/uniqueId/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/tabs/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/slider/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/checkboxradio/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/remen_05.jpg	100%	Avira URL Cloud	phishing
http://api.jqueryui.com/selectable/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/jt.png	100%	Avira URL Cloud	phishing
http://jqueryui.com/slider/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/disableSelection/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/kongtou4_240216.gif	100%	Avira URL Cloud	phishing
https://365kkf.cc/xiazai.html	0%	Avira URL Cloud	safe
http://jqueryui.com/droppable/	0%	Avira URL Cloud	safe
https://365kkf.cc/static/d_icomoon.ttf?ts9lih	0%	Avira URL Cloud	safe
https://code.google.com/p/chromium/issues/detail?id=313082	0%	Avira URL Cloud	safe
http://jqueryui.com/controlgroup/	0%	Avira URL Cloud	safe
http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=no	0%	Avira URL Cloud	safe
https://quanjing.cnzz.com	0%	Avira URL Cloud	safe
http://api.jqueryui.com/scrollParent/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/nav.png	100%	Avira URL Cloud	phishing
http://api.jqueryui.com/pulsate-effect/	0%	Avira URL Cloud	safe
http://bugs.jqueryui.com/ticket/7552	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/remen_03.jpg	100%	Avira URL Cloud	phishing
http://jqueryui.com/sortable/	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/issues/4382	0%	Avira URL Cloud	safe
http://jqueryui.com/draggable/	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/js/move.js	100%	Avira URL Cloud	phishing
http://c.vip3656jun27.cc/images/bg.jpg	100%	Avira URL Cloud	phishing
http://api.jqueryui.com/resizable/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/transfer-effect/	0%	Avira URL Cloud	safe
https://s96.cnzz.com/z_stat.php?id=1275613349&web_id=1275613349	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/wangzhi_11.png	100%	Avira URL Cloud	phishing
https://code.jquery.com/ui/1.13.2/themes/base/jquery-ui.css	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/js/js.js	100%	Avira URL Cloud	phishing
https://bugs.webkit.org/show_bug.cgi?id=47182	0%	Avira URL Cloud	safe
https://365kkf.cc/static/swiper-3.3.1.min.css	0%	Avira URL Cloud	safe
http://api.jqueryui.com/labels/	0%	Avira URL Cloud	safe
http://jqueryui.com/datepicker/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/sortable/	0%	Avira URL Cloud	safe
http://www.robertpenner.com/easing)	0%	Avira URL Cloud	safe
https://365kkf.cc/static/download.css	0%	Avira URL Cloud	safe
Http://bugs.jqueryui.com/ticket/9446	0%	Avira URL Cloud	safe
http://api.jqueryui.com/drop-effect/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/datepicker/	0%	Avira URL Cloud	safe
http://api.jqueryui.com/highlight-effect/	0%	Avira URL Cloud	safe
https://code.google.com/p/maashaack/source/browse/packages/graphics/trunk/src/graphics/colors/HUE2RG	0%	Avira URL Cloud	safe
http://api.jqueryui.com/tabbable-selector/	0%	Avira URL Cloud	safe
https://code.jquery.com/ui/1.13.2/jquery-ui.js	0%	Avira URL Cloud	safe
https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/remen_02.jpg	100%	Avira URL Cloud	phishing
http://3656.tstdmn.cc/matomo.js	0%	Avira URL Cloud	safe
http://c.vip3656jun27.cc/images/zhongjiang.jpg	100%	Avira URL Cloud	phishing

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	unknown
c.vip3656jun27.cc	34.85.36.87	true	false	unknown
all.cnzz.com.danuoyi.tbcache.com	122.225.212.209	true	false	unknown
get365kapp.xyz	54.150.17.124	true	true	unknown
code.jquery.com	151.101.2.137	true	false	unknown
www.google.com	172.217.18.4	true	false	unknown
3656.tstdmn.cc	34.92.211.102	true	false	unknown
cluster91f2e088.hysjs168.com	20.239.97.157	true	false	unknown
ty20cnd00.safeproduc08.xyz	148.66.1.82	true	false	unknown
z.gds.cnzz.com	223.109.148.140	true	false	unknown
_8989._https.365ckk.com	unknown	unknown	false	unknown
d.qw66za.com	unknown	unknown	false	unknown
z2.cnzz.com	unknown	unknown	false	unknown
365ckk.com	unknown	unknown	false	unknown
_8989._https.d.qw66za.com	unknown	unknown	false	unknown
365kkf.cc	unknown	unknown	false	unknown
use.fontawesome.com	unknown	unknown	false	unknown
c.cnzz.com	unknown	unknown	false	unknown
s96.cnzz.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
http://c.vip3656jun27.cc/images/xiazai.png	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/images/wangzhi_22.png	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/images/saved_resource	false	Avira URL Cloud: phishing	unknown
https://365kkf.cc/static/qrcode.png	false	Avira URL Cloud: safe	unknown
http://c.vip3656jun27.cc/images/remen_01.jpg	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/js/jquery-1.9.1.min.js	false	Avira URL Cloud: phishing	unknown
https://365kkf.cc/ftl/bet365-627/images/favicon.png	false	Avira URL Cloud: safe	unknown
https://365kkf.cc/static/41-1530778231.png	false	Avira URL Cloud: safe	unknown
http://c.vip3656jun27.cc/images/saved_resource(2)	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/images/long_qr_240818.gif	false	Avira URL Cloud: phishing	unknown
https://365kkf.cc/static/guide/ab.css	false	Avira URL Cloud: safe	unknown
http://c.vip3656jun27.cc/images/saved_resource(1)	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/css/style.css	false	Avira URL Cloud: phishing	unknown
https://365kkf.cc/tip.png	false	Avira URL Cloud: safe	unknown
http://c.vip3656jun27.cc/images/remen_05.jpg	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/images/jt.png	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/images/kongtou4_240216.gif	false	Avira URL Cloud: phishing	unknown
https://365kkf.cc/static/d_icomoon.ttf?ts9lih	false	Avira URL Cloud: safe	unknown
https://365kkf.cc/xiazai.html	false	Avira URL Cloud: safe	unknown
http://c.vip3656jun27.cc/images/nav.png	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/images/remen_03.jpg	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/js/move.js	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/images/bg.jpg	false	Avira URL Cloud: phishing	unknown
https://s96.cnzz.com/z_stat.php?id=1275613349&web_id=1275613349	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/ui/1.13.2/themes/base/jquery-ui.css	false	Avira URL Cloud: safe	unknown
https://365kkf.cc/static/swiper-3.3.1.min.css	false	Avira URL Cloud: safe	unknown
http://c.vip3656jun27.cc/images/wangzhi_11.png	false	Avira URL Cloud: phishing	unknown
http://c.vip3656jun27.cc/js/js.js	false	Avira URL Cloud: phishing	unknown
https://365kkf.cc/static/download.css	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/ui/1.13.2/jquery-ui.js	false	Avira URL Cloud: safe	unknown
https://365ckk.com:8989/verify-page/index.html	false		unknown
http://c.vip3656jun27.cc/images/remen_02.jpg	false	Avira URL Cloud: phishing	unknown
http://3656.tstdmn.cc/matomo.js	false	Avira URL Cloud: safe	unknown
http://c.vip3656jun27.cc/images/zhongjiang.jpg	false	Avira URL Cloud: phishing	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://jqueryui.com/menu/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/slide-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/accordion/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/data-selector/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/tooltip/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://www.baidu.com/xx.apk	chromecache_171.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com	chromecache_174.3.dr	false	URL Reputation: safe	unknown
https://piwik.org/free-software/bsd/	chromecache_222.3.dr, chromecache_208.3.dr	false	Avira URL Cloud: safe	unknown
http://jsfiddle.net/JZSMt/3/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/mouse/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery-color	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/position/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/jQuery.widget/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/button/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/focusable-selector/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=561664	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://fontawesome.com	chromecache_190.3.dr, chromecache_113.3.dr, chromecache_170.3.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/fade-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jquery.com/ticket/11778	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/draggable/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=107380	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://developer.matomo.org/guides/tracking-javascript-guide#multiple-piwik-trackers	chromecache_222.3.dr, chromecache_208.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/form-reset-mixin/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/matomo-org/matomo/blob/master/js/piwik.js	chromecache_222.3.dr, chromecache_208.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/fold-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/button/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://ezgif.com/overlay	chromecache_164.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/spinner/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/size-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/spinner/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/tabs/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/puff-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/uniqueId/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://developer.matomo.org/api-reference/tracking-javascript	chromecache_222.3.dr, chromecache_208.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/slider/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/checkboxradio/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/selectable/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/slider/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/disableSelection/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://code.google.com/p/chromium/issues/detail?id=313082	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/droppable/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/controlgroup/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/themeroller/?ffDefault=Arial%2CHelvetica%2Csans-serif&fsDefault=1em&fwDefault=no	chromecache_154.3.dr, chromecache_221.3.dr	false	Avira URL Cloud: safe	unknown
https://quanjing.cnzz.com	chromecache_155.3.dr, chromecache_211.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/pulsate-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/scrollParent/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://bugs.jqueryui.com/ticket/7552	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/draggable/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/sortable/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://github.com/jquery/jquery/issues/4382	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/resizable/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/transfer-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/labels/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://bugs.webkit.org/show_bug.cgi?id=47182	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://www.robertpenner.com/easing)	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/sortable/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jqueryui.com/datepicker/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
Http://bugs.jqueryui.com/ticket/9446	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/tabbable-selector/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/datepicker/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://jquery.org/license	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	URL Reputation: safe	unknown
http://api.jqueryui.com/highlight-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://code.google.com/p/maashaack/source/browse/packages/graphics/trunk/src/graphics/colors/HUE2RG	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
http://api.jqueryui.com/drop-effect/	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown
https://drafts.csswg.org/cssom/#common-serializing-idioms	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	URL Reputation: safe	unknown
https://github.com/jquery/jquery/blob/e539bac79e666bba95bba86d690b4e609dca2286/src/selector/escapeSe	chromecache_199.3.dr, chromecache_173.3.dr, chromecache_174.3.dr	false	Avira URL Cloud: safe	unknown

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2617
Entropy (8bit):	4.990331830270091
Encrypted:	false
SSDEEP:	24:RspoBVlAyQAwTZZFviG5JaJdUU9DTh34uAtFLCO5XRzvoXGR5fv7uEQF7dQmQ8/q:CpoBLkZiG5UBhcXyAuZMPU5tgR
MD5:	425A3A8AA81264726625F62CE71C72D7
SHA1:	F76546E7C1A1C46119F9A0DBCE6E111395677484
SHA-256:	0F245934BCFFC2B0521E0F6DA6761D3C6CFA72BCECA13F1DBEBD03C9854DDBE6
SHA-512:	611A1ABA8410B8F3BA2C915ADE69472C6F645106CB60F96AC8E8F2F17451025A009D9267F0AD0A52C28D7D6D2560FAECFD8CD47DA997707180492752AD80CA13
Malicious:	false
Reputation:	low
URL:	https://365kkf.cc/xiazai.html
Preview:	<html> .. <head> .. <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> .. <title>......</title> .... <script type="text/javascript"> .. /* .. * ..........: .. * .. / .. var browser = { .. versions: function() { .. var u = navigator.userAgent, app = navigator.appVersion; .. return {//........... .. trident: u.indexOf('Trident') > -1, //IE.. .. presto: u.indexOf('Presto') > -1, //opera.. .. webKit: u.indexOf('AppleWebKit') > -1, //....... .. gecko: u.indexOf('Gecko') > -1 && u.indexOf('KHTML') == -1, //.... .. mobile: !!u.match(/AppleWebKit.Mobile.*/) \|\| !!u.match(/AppleWebKit/), //....... ..

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 06:10:46.753365040 CEST	192.168.2.7	1.1.1.1	0xfe8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:46.753582001 CEST	192.168.2.7	1.1.1.1	0x6f45	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 27, 2024 06:10:47.575546980 CEST	192.168.2.7	1.1.1.1	0x7c1e	Standard query (0)	c.vip3656jun27.cc	65	IN (0x0001)	false
Sep 27, 2024 06:10:47.575546980 CEST	192.168.2.7	1.1.1.1	0xcca1	Standard query (0)	c.vip3656jun27.cc	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:49.340913057 CEST	192.168.2.7	1.1.1.1	0xd462	Standard query (0)	c.vip3656jun27.cc	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:49.341242075 CEST	192.168.2.7	1.1.1.1	0x9f78	Standard query (0)	c.vip3656jun27.cc	65	IN (0x0001)	false
Sep 27, 2024 06:10:49.619941950 CEST	192.168.2.7	1.1.1.1	0xd0bd	Standard query (0)	s96.cnzz.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:49.620316982 CEST	192.168.2.7	1.1.1.1	0x2c11	Standard query (0)	s96.cnzz.com	65	IN (0x0001)	false
Sep 27, 2024 06:10:49.632184982 CEST	192.168.2.7	1.1.1.1	0x154b	Standard query (0)	3656.tstdmn.cc	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:49.632364035 CEST	192.168.2.7	1.1.1.1	0x5d0f	Standard query (0)	3656.tstdmn.cc	65	IN (0x0001)	false
Sep 27, 2024 06:10:52.402007103 CEST	192.168.2.7	1.1.1.1	0xd945	Standard query (0)	c.cnzz.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:52.402493954 CEST	192.168.2.7	1.1.1.1	0x367d	Standard query (0)	c.cnzz.com	65	IN (0x0001)	false
Sep 27, 2024 06:10:52.446417093 CEST	192.168.2.7	1.1.1.1	0xad9	Standard query (0)	z2.cnzz.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:52.446944952 CEST	192.168.2.7	1.1.1.1	0x89f1	Standard query (0)	z2.cnzz.com	65	IN (0x0001)	false
Sep 27, 2024 06:10:53.735460997 CEST	192.168.2.7	1.1.1.1	0x840	Standard query (0)	365kkf.cc	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:53.735857964 CEST	192.168.2.7	1.1.1.1	0x3729	Standard query (0)	365kkf.cc	65	IN (0x0001)	false
Sep 27, 2024 06:10:53.741100073 CEST	192.168.2.7	1.1.1.1	0xf4d8	Standard query (0)	get365kapp.xyz	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:53.741570950 CEST	192.168.2.7	1.1.1.1	0x60da	Standard query (0)	get365kapp.xyz	65	IN (0x0001)	false
Sep 27, 2024 06:10:54.636214972 CEST	192.168.2.7	1.1.1.1	0x221	Standard query (0)	3656.tstdmn.cc	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:54.636785984 CEST	192.168.2.7	1.1.1.1	0x2e70	Standard query (0)	3656.tstdmn.cc	65	IN (0x0001)	false
Sep 27, 2024 06:10:54.639125109 CEST	192.168.2.7	1.1.1.1	0x1da	Standard query (0)	s96.cnzz.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:54.639837980 CEST	192.168.2.7	1.1.1.1	0xd037	Standard query (0)	s96.cnzz.com	65	IN (0x0001)	false
Sep 27, 2024 06:10:54.679653883 CEST	192.168.2.7	1.1.1.1	0xb49d	Standard query (0)	c.cnzz.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:54.680461884 CEST	192.168.2.7	1.1.1.1	0x3ab	Standard query (0)	c.cnzz.com	65	IN (0x0001)	false
Sep 27, 2024 06:11:16.428612947 CEST	192.168.2.7	1.1.1.1	0xe505	Standard query (0)	365kkf.cc	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:16.429096937 CEST	192.168.2.7	1.1.1.1	0x278	Standard query (0)	365kkf.cc	65	IN (0x0001)	false
Sep 27, 2024 06:11:37.907742023 CEST	192.168.2.7	1.1.1.1	0x21ad	Standard query (0)	365ckk.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:37.909043074 CEST	192.168.2.7	1.1.1.1	0x176c	Standard query (0)	_8989._https.365ckk.com	65	IN (0x0001)	false
Sep 27, 2024 06:11:40.597345114 CEST	192.168.2.7	1.1.1.1	0xe83e	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:40.597651005 CEST	192.168.2.7	1.1.1.1	0xb29d	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 27, 2024 06:11:41.414834976 CEST	192.168.2.7	1.1.1.1	0xec64	Standard query (0)	365ckk.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:41.415222883 CEST	192.168.2.7	1.1.1.1	0x1124	Standard query (0)	_8989._https.365ckk.com	65	IN (0x0001)	false
Sep 27, 2024 06:11:41.633135080 CEST	192.168.2.7	1.1.1.1	0x150a	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:41.633548021 CEST	192.168.2.7	1.1.1.1	0x21af	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Sep 27, 2024 06:11:42.278626919 CEST	192.168.2.7	1.1.1.1	0x8b5e	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:42.279237986 CEST	192.168.2.7	1.1.1.1	0x8dbd	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 27, 2024 06:11:42.425915003 CEST	192.168.2.7	1.1.1.1	0xbaf0	Standard query (0)	365ckk.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:43.406255007 CEST	192.168.2.7	1.1.1.1	0x9902	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:43.407183886 CEST	192.168.2.7	1.1.1.1	0xd665	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Sep 27, 2024 06:12:04.841716051 CEST	192.168.2.7	1.1.1.1	0xacfe	Standard query (0)	d.qw66za.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:04.841948032 CEST	192.168.2.7	1.1.1.1	0x6a2	Standard query (0)	_8989._https.d.qw66za.com	65	IN (0x0001)	false
Sep 27, 2024 06:12:07.916474104 CEST	192.168.2.7	1.1.1.1	0x4493	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:07.916829109 CEST	192.168.2.7	1.1.1.1	0x5c1a	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Sep 27, 2024 06:12:10.081355095 CEST	192.168.2.7	1.1.1.1	0x8a9d	Standard query (0)	use.fontawesome.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:10.082679033 CEST	192.168.2.7	1.1.1.1	0x201e	Standard query (0)	use.fontawesome.com	65	IN (0x0001)	false
Sep 27, 2024 06:12:19.882021904 CEST	192.168.2.7	1.1.1.1	0xb968	Standard query (0)	d.qw66za.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:19.883341074 CEST	192.168.2.7	1.1.1.1	0xb41a	Standard query (0)	_8989._https.d.qw66za.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 06:10:46.760330915 CEST	1.1.1.1	192.168.2.7	0x6f45	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 27, 2024 06:10:46.760421991 CEST	1.1.1.1	192.168.2.7	0xfe8	No error (0)	www.google.com		172.217.18.4	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:47.920736074 CEST	1.1.1.1	192.168.2.7	0xcca1	No error (0)	c.vip3656jun27.cc		34.85.36.87	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:49.650002003 CEST	1.1.1.1	192.168.2.7	0xd462	No error (0)	c.vip3656jun27.cc		34.85.36.87	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:50.061351061 CEST	1.1.1.1	192.168.2.7	0x2c11	No error (0)	s96.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:50.061351061 CEST	1.1.1.1	192.168.2.7	0x2c11	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:50.209392071 CEST	1.1.1.1	192.168.2.7	0x154b	No error (0)	3656.tstdmn.cc		34.92.211.102	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:50.309727907 CEST	1.1.1.1	192.168.2.7	0xd0bd	No error (0)	s96.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:50.309727907 CEST	1.1.1.1	192.168.2.7	0xd0bd	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:50.309727907 CEST	1.1.1.1	192.168.2.7	0xd0bd	No error (0)	all.cnzz.com.danuoyi.tbcache.com		122.225.212.209	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:52.703572035 CEST	1.1.1.1	192.168.2.7	0x367d	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:52.871963978 CEST	1.1.1.1	192.168.2.7	0xd945	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:52.871963978 CEST	1.1.1.1	192.168.2.7	0xd945	No error (0)	all.cnzz.com.danuoyi.tbcache.com		122.225.212.209	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:52.979147911 CEST	1.1.1.1	192.168.2.7	0xad9	No error (0)	z2.cnzz.com	z.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:52.979147911 CEST	1.1.1.1	192.168.2.7	0xad9	No error (0)	z.cnzz.com	z.gds.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:52.979147911 CEST	1.1.1.1	192.168.2.7	0xad9	No error (0)	z.gds.cnzz.com		223.109.148.140	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:53.067498922 CEST	1.1.1.1	192.168.2.7	0x89f1	No error (0)	z2.cnzz.com	z.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:53.067498922 CEST	1.1.1.1	192.168.2.7	0x89f1	No error (0)	z.cnzz.com	z.gds.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:53.762636900 CEST	1.1.1.1	192.168.2.7	0xf4d8	No error (0)	get365kapp.xyz		54.150.17.124	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:54.495876074 CEST	1.1.1.1	192.168.2.7	0x840	No error (0)	365kkf.cc	ty20cnd00.safeproduc08.xyz		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:54.495876074 CEST	1.1.1.1	192.168.2.7	0x840	No error (0)	ty20cnd00.safeproduc08.xyz		148.66.1.82	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:54.646485090 CEST	1.1.1.1	192.168.2.7	0x1da	No error (0)	s96.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:54.646485090 CEST	1.1.1.1	192.168.2.7	0x1da	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:54.646485090 CEST	1.1.1.1	192.168.2.7	0x1da	No error (0)	all.cnzz.com.danuoyi.tbcache.com		122.225.212.209	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:54.897341967 CEST	1.1.1.1	192.168.2.7	0x3ab	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:55.067233086 CEST	1.1.1.1	192.168.2.7	0x221	No error (0)	3656.tstdmn.cc		34.92.211.102	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:55.158936977 CEST	1.1.1.1	192.168.2.7	0xb49d	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:55.158936977 CEST	1.1.1.1	192.168.2.7	0xb49d	No error (0)	all.cnzz.com.danuoyi.tbcache.com		122.225.212.209	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:55.228764057 CEST	1.1.1.1	192.168.2.7	0xd037	No error (0)	s96.cnzz.com	c.cnzz.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:55.228764057 CEST	1.1.1.1	192.168.2.7	0xd037	No error (0)	c.cnzz.com	all.cnzz.com.danuoyi.tbcache.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:10:57.772666931 CEST	1.1.1.1	192.168.2.7	0x8556	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:10:57.772666931 CEST	1.1.1.1	192.168.2.7	0x8556	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:11.751104116 CEST	1.1.1.1	192.168.2.7	0x150d	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:11.751104116 CEST	1.1.1.1	192.168.2.7	0x150d	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:17.103563070 CEST	1.1.1.1	192.168.2.7	0xe505	No error (0)	365kkf.cc	ty20cnd00.safeproduc08.xyz		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:17.103563070 CEST	1.1.1.1	192.168.2.7	0xe505	No error (0)	ty20cnd00.safeproduc08.xyz		148.66.1.82	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:38.303877115 CEST	1.1.1.1	192.168.2.7	0x84ec	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:38.303877115 CEST	1.1.1.1	192.168.2.7	0x84ec	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:38.601651907 CEST	1.1.1.1	192.168.2.7	0x21ad	No error (0)	365ckk.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:38.601651907 CEST	1.1.1.1	192.168.2.7	0x21ad	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:38.601651907 CEST	1.1.1.1	192.168.2.7	0x21ad	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:38.601651907 CEST	1.1.1.1	192.168.2.7	0x21ad	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:38.692962885 CEST	1.1.1.1	192.168.2.7	0x176c	Name error (3)	_8989._https.365ckk.com	none	none	65	IN (0x0001)	false
Sep 27, 2024 06:11:40.604985952 CEST	1.1.1.1	192.168.2.7	0xe83e	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:40.604985952 CEST	1.1.1.1	192.168.2.7	0xe83e	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:40.604985952 CEST	1.1.1.1	192.168.2.7	0xe83e	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:40.604985952 CEST	1.1.1.1	192.168.2.7	0xe83e	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:41.640249014 CEST	1.1.1.1	192.168.2.7	0x150a	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:41.641366005 CEST	1.1.1.1	192.168.2.7	0x21af	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:42.078035116 CEST	1.1.1.1	192.168.2.7	0x1124	Name error (3)	_8989._https.365ckk.com	none	none	65	IN (0x0001)	false
Sep 27, 2024 06:11:42.286393881 CEST	1.1.1.1	192.168.2.7	0x8b5e	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:42.286393881 CEST	1.1.1.1	192.168.2.7	0x8b5e	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:42.286393881 CEST	1.1.1.1	192.168.2.7	0x8b5e	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:42.286393881 CEST	1.1.1.1	192.168.2.7	0x8b5e	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:42.750488997 CEST	1.1.1.1	192.168.2.7	0xbaf0	No error (0)	365ckk.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:42.750488997 CEST	1.1.1.1	192.168.2.7	0xbaf0	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:42.750488997 CEST	1.1.1.1	192.168.2.7	0xbaf0	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:42.750488997 CEST	1.1.1.1	192.168.2.7	0xbaf0	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:43.417571068 CEST	1.1.1.1	192.168.2.7	0x9902	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:43.418786049 CEST	1.1.1.1	192.168.2.7	0xd665	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:43.623492956 CEST	1.1.1.1	192.168.2.7	0xec64	No error (0)	365ckk.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:43.623492956 CEST	1.1.1.1	192.168.2.7	0xec64	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:43.623492956 CEST	1.1.1.1	192.168.2.7	0xec64	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:11:43.623492956 CEST	1.1.1.1	192.168.2.7	0xec64	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:58.230629921 CEST	1.1.1.1	192.168.2.7	0xbd0	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:11:58.230629921 CEST	1.1.1.1	192.168.2.7	0xbd0	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:05.284660101 CEST	1.1.1.1	192.168.2.7	0xacfe	No error (0)	d.qw66za.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:05.284660101 CEST	1.1.1.1	192.168.2.7	0xacfe	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:05.284660101 CEST	1.1.1.1	192.168.2.7	0xacfe	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:05.284660101 CEST	1.1.1.1	192.168.2.7	0xacfe	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:05.518707037 CEST	1.1.1.1	192.168.2.7	0x6a2	Name error (3)	_8989._https.d.qw66za.com	none	none	65	IN (0x0001)	false
Sep 27, 2024 06:12:07.924027920 CEST	1.1.1.1	192.168.2.7	0x4493	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:07.924027920 CEST	1.1.1.1	192.168.2.7	0x4493	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:07.924027920 CEST	1.1.1.1	192.168.2.7	0x4493	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:07.924027920 CEST	1.1.1.1	192.168.2.7	0x4493	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:10.091644049 CEST	1.1.1.1	192.168.2.7	0x8a9d	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:10.093560934 CEST	1.1.1.1	192.168.2.7	0x201e	No error (0)	use.fontawesome.com	use.fontawesome.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:20.498883009 CEST	1.1.1.1	192.168.2.7	0xb41a	Name error (3)	_8989._https.d.qw66za.com	none	none	65	IN (0x0001)	false
Sep 27, 2024 06:12:20.527687073 CEST	1.1.1.1	192.168.2.7	0xb968	No error (0)	d.qw66za.com	site.36ok56cname.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:20.527687073 CEST	1.1.1.1	192.168.2.7	0xb968	No error (0)	site.36ok56cname.com	ee754749.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:20.527687073 CEST	1.1.1.1	192.168.2.7	0xb968	No error (0)	ee754749.hysjs168.com	cluster91f2e088.hysjs168.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 06:12:20.527687073 CEST	1.1.1.1	192.168.2.7	0xb968	No error (0)	cluster91f2e088.hysjs168.com		20.239.97.157	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:29.350644112 CEST	1.1.1.1	192.168.2.7	0x8841	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Sep 27, 2024 06:12:29.350644112 CEST	1.1.1.1	192.168.2.7	0x8841	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:47.989945889 CEST	432	OUT	GET / HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:48.746084929 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:48 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 31 32 62 36 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5b 7d 73 db 54 d6 ff bb 9d e9 77 d0 8a 5d ec 10 db b2 f3 62 92 36 0e 53 0a 3b f4 19 0a cc 50 76 9f 1d 66 27 23 5b 37 b6 1a 59 72 25 39 4e f2 d0 99 40 b7 ef 2d 0d 0b b4 05 ca 03 2d 2d 04 0a 69 77 0b 4b 9b 36 ed 77 81 c8 76 fe e2 2b 3c bf 73 af 24 cb 56 de 1a f6 d9 dd 52 1a e9 ea 9e 73 cf 3d e7 dc f3 7a f3 cb 83 c7 7b 76 8f fd e6 85 57 0f 1c fe d3 6b 2f 4a 15 b7 6a 8c 63 80 7e 4a 86 6a 96 0b f2 5c 25 7d e0 15 19 83 d2 58 85 a9 da b8 84 27 69 ac ca 5c 55 32 d5 2a 2b c8 3f cd 7f 6a 33 53 63 36 b3 f1 28 4b 25 cb 74 99 e9 f2 0f 0d 56 9c d2 5d 3e ac 44 21 2b ae 5b 4b b3 a3 75 7d 9a 4f fb ef f4 1b fb d3 07 5e 3d f4 da fe c3 07 9f 7f f9 c5 18 9a 83 2f 16 98 56 66 a9 52 c5 b6 b0 64 ee a7 f9 bb 84 90 53 e2 ea ae c1 c6 8b cc 1d cc 0f af 7d 72 d2 fb e4 ba 84 a7 d5 95 f7 db ef fc dd bb ba d8 5a 7e 9c 5e bd 77 b6 b5 f2 9e 77 fb 61 fb f4 37 63 8a 00 e8 dd c5 14 9b 6d 58 b6 e6 44 e8 ef 41 f3 cb c3 f3 e1 48 f3 ec 87 cd bb 8b 62 c4 bb 71 aa f5 c1 22 2d f0 e9 3c 46 40 [TRUNCATED] Data Ascii: 12b6[}sTw]b6S;Pvf'#[7Yr%9N@---iwK6wv+<s$VRs=z{vWk/Jjc~Jj\%}X'i\U2+?j3Sc6(K%tV]>D!+[Ku}O^=/VfRdS}rZ~^wwa7cmXDAHbq"-<F@I ":wJgj+5l1+ZEl3wwNgW4k^>><v\|s[K7S9AO@vy[]]ymA'=y;qu^]]{gd3 ;vKuW:&^UQ&iYi5jkn04MIuij`l6??TUAZ#4)U.VX&+VpJB6<Np{.q2REdzq3c:y`oiiLIufIfKiYpK1dLF(s,SU6)YUP#)btZ#.T9oJ/QQU1:3{6frnv2`+TN70{ TNNM%>zjKu&RYu-;Cb>Z/[fP(tTPuwKc@gw>)NJzmb,_{xknjV@G-% [TRUNCATED]
Sep 27, 2024 06:10:48.746104002 CEST	224	IN	Data Raw: 95 54 e2 72 86 94 86 84 d1 50 6b 0a 56 66 33 19 3a 67 b2 60 e4 31 f1 23 5c 46 d5 b6 85 4b f0 79 1d 64 c7 fa 20 23 08 39 54 f0 3d bb 29 08 c0 a9 3a 04 b1 56 2d 89 2b bc af 27 5c f5 49 f6 13 35 f5 28 48 f4 29 5f e7 0d 1b 7d f3 cf 5c 96 ca 33 92 6b Data Ascii: TrPkVf3:g`1#\FKyd #9T=):V-+'\I5(H)_}\3kL"PX#dukWp?]74$WL&s\|YQ5JMt?rJL\:?33)?u{zrr:OKtXg31f9)Be\
Sep 27, 2024 06:10:48.746126890 CEST	1236	IN	Data Raw: c7 d5 aa 26 e8 53 02 25 8a 10 98 c0 c6 38 46 66 bf 61 1b 09 b8 9f fe 04 ce 0e 24 93 a9 55 6a c1 1a 5d bc 20 90 d7 75 97 1d d4 30 3d 31 d8 99 43 92 d3 0a 9a 55 aa 83 e1 6e 4a 2a 17 b4 4c c9 66 aa cb 5e 34 18 0d 25 13 c2 1e 24 fa 52 92 83 8f 65 e6 Data Ascii: &S%8Ffa$Uj] u0=1CUnJLf^4%$Re_gWur1ov<$IN"4t_4My.d9pUD/Z,0864}Z*OlFhCt Vf6/c<x\|qSx8uT
Sep 27, 2024 06:10:48.746140957 CEST	224	IN	Data Raw: e0 0c 0f 11 a7 57 58 26 ce 01 c5 67 01 c6 fc b8 c6 b7 b0 3d e7 c8 4f bf 05 fb a2 91 8e ff 41 1c a8 5d bb 76 f5 7c cb 11 04 86 77 8d d5 44 e0 02 83 91 9b a8 31 a6 21 e6 a6 cc b4 20 6b ba 03 b3 31 bb d7 44 6e 25 8f 6f 68 ad 7d 34 e1 a9 ca 28 fe f1 Data Ascii: WX&g=OA]v\|wD1! k1Dn%oh}4(piMAPB@TL`+)I<jO?58/XmQ:pHRM?405r<?.\$e{^<?Th0SIS7k("J
Sep 27, 2024 06:10:48.746153116 CEST	1236	IN	Data Raw: 54 c2 9d 71 73 09 51 e2 49 50 89 27 e1 13 90 e0 93 f0 69 5a 35 ea 98 d7 fc e1 5c fb 36 22 b9 ef 32 99 4c 42 54 a6 83 e5 ba d6 c3 19 4a 74 fc 53 e0 66 8e b8 dc 40 2b f0 0f 41 94 d5 81 8e 92 53 b7 8d 4d c8 19 08 c9 81 ab 84 43 91 10 59 b6 6e 7d 94 Data Ascii: TqsQIP'iZ5\6"2LBTJtSf@+ASMCYn}@Kd`^JgH\,f -Uc&)8J;A;iZ\|Jw\_>/.u=q^z*>@T{"I(<bbB
Sep 27, 2024 06:10:48.746167898 CEST	863	IN	Data Raw: 03 54 4e 4a 26 44 f2 01 74 74 11 08 06 07 bd ca 0c e2 41 e0 ee 99 10 20 00 25 e2 ba 94 c4 1f 00 c9 8e 26 f5 be cc 4e 51 1e 43 eb 77 d7 31 a2 af eb 7e 06 b1 9a 98 17 c9 06 31 14 cf 2a bb b2 29 52 49 b2 72 7e 55 29 fa 4d 2b 16 fd 5e 4b 24 a3 2c e2 Data Ascii: TNJ&DttA %&NQCw1~1)RIr~U)M+^K$,>(,{dbEv>:PE/MG4(UeP-zSO@~eMjwZ^PrD3I>0Ja*[xawFqim]xZm
Sep 27, 2024 06:10:48.764287949 CEST	334	OUT	GET /css/style.css HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/css,/;q=0.1 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.013710976 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:48 GMT Content-Type: text/css Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 65 30 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 b5 5a dd 8f db c6 11 7f 96 01 ff 0f 5b 1f 0a db 09 25 8b 94 74 27 f1 10 a0 8d 93 4b f2 d0 a7 04 68 fb 64 50 e4 4a 64 8e 22 55 8a b2 ef 2c 14 68 d1 7c 21 68 90 7e 20 75 1b b4 41 50 14 41 3f d0 a0 0f 41 e3 26 41 f3 cf f8 2e f6 53 fe 85 cc cc ce 92 cb 0f c9 97 34 75 7c 8e 8e dc 9d 9d 99 fd cd 6f 66 67 f5 e5 a7 9f 7f cf 0f bd 6c 25 73 71 65 3e 75 06 b6 73 e5 f0 f2 a5 1b 4f 88 9b 2f be 28 9e 49 fd f5 42 26 b9 78 e2 c6 e5 4b d3 34 38 dd 2c d3 55 94 47 69 e2 66 32 f6 f2 e8 b6 3c fc a9 7a 63 05 d1 6d 2b 88 ad 20 b7 82 c0 5a c7 56 1a 5b 71 64 85 b6 15 3a 56 38 b0 c2 a1 15 8e ac 70 df 5a 66 d2 9a a5 d9 c2 9a 45 32 0e 60 5d 2b 4a 96 eb dc ca e5 49 ee 65 d2 b3 96 d6 34 4e fd e3 9f ac d3 5c 5a 79 68 e5 01 8c 4f f2 cd d2 0b 82 28 99 bb fd 43 b1 f0 b2 79 94 b8 02 3e e2 ab ee cc 5b 44 f1 a9 2b ae fc 20 f2 b3 74 95 ce 72 f1 63 2f 94 d1 15 ab fa e8 79 7a f4 fd 2c f2 62 4b 3c 2f e3 db 32 8f 7c cf 12 2b 2f 59 75 57 32 8b 66 68 4e ee 4d 63 b9 99 a6 59 20 b3 ae 9f c6 b1 b7 5c [TRUNCATED] Data Ascii: e0fZ[%t'KhdPJd"U,h\|!h~ uAPA?A&A.S4u\|ofgl%sqe>usO/(IB&xK48,UGif2<zcm+ ZV[qd:V8pZfE2`]+JIe4N\ZyhO(Cy>[D+ trc/yz,bK</2\|+/YuW2fhNMcY \IW8f\|Nke6;WQ_6/cQ<qtwd4s7z1;`y?8_o&Vyw%guI{?4=V2~ne^]$9)S?g:h)XO3@@Iq[{;`}`bsugP-._}K+c9sp[vy>FV(SPY0CC;h%sttKwlMyvd>Wo?2X(RYn^~?o};"bAC{C~-~aYy<YEtZn.\28+piuIbrDe^sW42b&8{TP?WuwraENb-L<4_R9a$E@4It4a,'f!8BD;PN-)/dk}4R]Io{G3bzr~FzCv^U=7&~i([q#s2xxB&&V [TRUNCATED]
Sep 27, 2024 06:10:49.013752937 CEST	224	IN	Data Raw: 49 0e 45 80 2b 30 e3 c9 ae 47 ec 7e c8 9a 0b d2 47 4d a4 ec d5 05 ea 5e ac 5c e1 c3 14 99 99 9a e2 c2 10 8a 3a b3 92 62 b0 2f 25 44 1c ef 60 b8 df 67 61 44 fe 2a 1f 6a 59 6a 15 f5 af 5e 9e 28 45 3d 32 bd 24 34 d5 74 b4 9f 68 75 cf 4d f2 b0 eb 87 Data Ascii: IE+0G~GM^\:b/%D`gaD*jYj^(E=2$4thuMQ\2P@I}cW&S1u`LuS+VnYS'n5}EQf;5ZVP`8;<Z\FGS!F(P1$
Sep 27, 2024 06:10:49.013766050 CEST	1236	IN	Data Raw: 93 38 a0 22 d1 60 73 9d 82 60 ec ad ac 21 6a 80 a2 78 34 aa ee 16 b2 03 55 53 7c 13 e7 0d c6 00 72 06 a9 41 20 35 e6 48 bc db bd 65 32 bf de 18 48 55 07 16 1d 40 8a 6a 57 4a 21 dd 4c 2e 25 44 39 90 32 7f 54 7e 02 67 9c 44 c9 49 b4 d1 5b 3d 39 40 Data Ascii: 8"`s`!jx4US\|rA 5He2HU@jWJ!L.%D92T~gDI[=9@9jFHJTmkln08AbH3WhX\(Q1NZUYPamVHX5BS<7U}XnVLt\|MRtvHi%J0 8wTtQBZA$FnN6'
Sep 27, 2024 06:10:49.013780117 CEST	1115	IN	Data Raw: e9 ae c0 e3 0e d9 38 0e e4 00 37 f5 12 6f 51 70 3a cb 19 5c 54 8e c3 72 40 0c f4 75 61 b7 b0 4e d3 42 06 8f 53 06 6b 63 bb 90 a0 26 a3 00 42 c1 d3 e9 89 6e 58 50 b7 a3 2c c5 07 e4 85 b2 5b 6f dc a9 e1 6c 92 40 b7 5c 78 f7 b4 dc d4 0f 7c d0 f4 af Data Ascii: 87oQp:\Tr@uaNBSkc&BnXP,[ol@\x\|ZfbKXQX`hm}@{Y\|jsQ;fV!-2'"VRi:6je-Tm^UW,Qm2tI^MQ*
Sep 27, 2024 06:10:49.023076057 CEST	382	OUT	GET /images/logo.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.279162884 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:49 GMT Content-Type: image/jpeg Content-Length: 16953 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 51 00 00 ff e1 03 77 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyQwhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:4E33DCFCCE2911E88B78F26CC718825F" xmpMM:InstanceID="xmp.iid:4E33DCFBCE2911E88B78F26CC718825F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFA5AFB318CEE811B04EAF18D249C4AD" stRef:documentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed [TRUNCATED]
Sep 27, 2024 06:10:49.279184103 CEST	1236	IN	Data Raw: 0e 0f 0f 0c 0c 0c 0c 0c 0f 0f 0c 0c 0c 0c 0c 0c 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 67 00 fb 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 00 07 01 01 01 01 01 00 00 00 00 00 Data Ascii: gs!1AQa"q2B#R3b$r%C4Scs5D'6Tdt&EFVU(eufv
Sep 27, 2024 06:10:49.279200077 CEST	1236	IN	Data Raw: 98 22 43 62 0e c4 21 32 f6 a4 df 41 f2 fe b7 e6 9d 5a cb 41 f2 e6 95 75 ad eb 3a 8b fa 76 5a 6d 9c 6d 2c b2 35 2a 68 a8 0e c0 0a 92 76 03 73 b6 60 6b 75 b8 34 58 65 9b 3c c4 31 c7 73 29 1a 03 f1 d3 bf 90 72 b4 fa 6c 9a 8c 83 1e 28 99 4c f2 03 72 Data Ascii: "Cb!2AZAu:vZmm,5*hvs`ku4Xe<1s)rl(Lr=k^N2IwH;C c<4xeGm)}ANXj2~@q\|{d4"[r6(O}OO>#?6Vg/CP
Sep 27, 2024 06:10:49.445249081 CEST	388	OUT	GET /images/wangzhi_22.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.694118977 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:49 GMT Content-Type: image/png Content-Length: 12793 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 13 00 00 00 3b 08 06 00 00 00 58 21 6e 57 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 34 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 30 2d 63 30 30 31 20 37 39 2e 63 30 32 30 34 62 32 2c 20 32 30 32 33 2f 30 32 2f 30 39 2d 30 36 3a 32 36 3a 31 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 [TRUNCATED] Data Ascii: PNGIHDR;X!nWpHYs4iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2, 2023/02/09-06:26:14 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmp:CreateDate="2024-06-30T12:39:38+08:00" xmp:ModifyDate="2024-07-03T07:33:57+08:00" xmp:MetadataDate="2024-07-03T07:33:57+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:89e40740-c159-224e-a3fc-ecc221e952e3" xmpMM:DocumentID="adobe:docid:photoshop:0c21d51e-c753-8d4f-8e04-b84c38bae71c" xmpMM:OriginalDocumentID="xmp.did:9003e440-4aae-1f45 [TRUNCATED]
Sep 27, 2024 06:10:49.926517010 CEST	386	OUT	GET /images/remen_01.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.175198078 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 12655 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 2f 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta> [TRUNCATED]
Sep 27, 2024 06:10:50.287072897 CEST	386	OUT	GET /images/remen_05.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.536931038 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 12841 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 e2 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 07 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 62 00 00 00 1b 01 05 00 01 00 00 00 6a 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1e 00 00 00 72 00 00 00 32 01 02 00 1a 00 00 00 90 00 00 00 69 87 04 00 01 00 00 00 aa 00 00 00 00 00 00 00 80 fc 0a 00 10 27 00 00 80 fc 0a 00 10 27 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 00 32 30 31 39 2d 30 31 2d 31 34 54 31 33 3a 31 30 3a 35 38 2b 30 38 3a 30 30 00 03 00 00 90 07 00 04 00 00 00 30 32 32 30 02 a0 04 00 01 00 00 00 a1 00 00 00 03 a0 04 00 01 00 00 00 53 00 00 00 00 00 00 00 53 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 [TRUNCATED] Data Ascii: ExifII*bj(1r2i''Adobe Photoshop CS6 (Windows)2019-01-14T13:10:58+08:000220SSDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:C752D7CD17BA11E9AB5DD54A0C43CFD1" xmpMM:InstanceID="xmp.iid:C752 [TRUNCATED]
Sep 27, 2024 06:10:50.627676964 CEST	395	OUT	GET /images/dbbg.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/css/style.css Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.877953053 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/png Content-Length: 47830 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 f8 00 00 01 10 08 06 00 00 00 04 53 df 51 00 00 ba 9d 49 44 41 54 78 da ec bd 75 b3 6c 4b f3 26 94 27 82 2f 82 4b e0 ce 00 13 b8 c3 e0 ee 2e 81 8c fe 46 81 61 5c 18 06 0f 5c 07 b7 c1 21 70 19 dc 5d 3f 09 11 9b 7e 2f ef be f4 ad 93 f9 48 56 ad ee de fb e4 f3 cf 3d 7b ad aa ac cc a7 b2 b2 32 6b 55 c7 fd 12 22 de de de d4 a6 83 c1 60 30 18 0c 06 83 c1 60 30 18 0c 36 f0 e5 cb 17 bf 8f da 70 0a fc c1 60 30 18 0c 06 83 c1 60 30 18 0c 1e 83 29 f0 07 83 c1 60 30 18 0c 06 83 c1 60 30 f8 04 98 02 7f 30 18 0c 06 83 c1 60 30 18 0c 06 83 4f 80 29 f0 07 83 c1 60 30 18 0c 06 83 c1 60 30 f8 04 98 02 7f 30 18 0c 06 83 c1 60 30 18 0c 06 83 4f 80 4b 0b fc df e8 a7 fc a4 5f 01 5e bf 15 b2 de 9f b3 f7 8a ac 57 80 aa db 7d bb ab ec e9 ca 5d fb 55 7f bf 9f e8 7c 49 9e 3f 73 7e d0 f8 99 8e 8e ef 31 f9 8f b4 eb b4 1e 88 13 65 ac 2b f5 db 91 b5 fa e9 b3 71 6a 5d de 3f db e5 ba 92 e3 c6 b3 67 c4 b2 47 f9 99 eb 47 af e6 77 c8 de 2a a6 3b fc 38 e3 39 32 77 d6 8b 63 8b 3b [TRUNCATED] Data Ascii: PNGIHDRSQIDATxulK&'/K.Fa\\!p]?~/HV={2kU"`0`06p`0`0)`0`00`0O)`0`00`0OK_^W}]U\|I?s~1e+qj]?gGGw;892wc;jv[m>or'ON<Sw}L};vr4_~6Me}Wm>Uw=::c:)OGtdhNs%2'Yc>n?w>OSv:Ow#cTet[Fwwm?gO/\|AQY?Yu,.W.:'[3;ms>'kk@[k Tmq)Muqv{$#'NbtNo=b;-JillCm3=ZU6(d*\|}bIM:U-e"{\|;M9YmdUL}J6D=~`&mjWsELG5@?l\s;s]{JD+="j?r({75aQJ3ov_s%t[X?.`0`0\)V\a/)o<^cp:8Z/q<W([5 [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:48.764625072 CEST	328	OUT	GET /js/jquery-1.9.1.min.js HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.021162033 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:48 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dc bd ed 76 1b 47 b2 2d f8 9b b3 d6 bc 03 88 f6 69 83 a2 08 49 fe e8 7b 9a b2 a4 2b c9 72 db e7 d8 96 db 92 8f dd 07 a4 bc 40 a2 48 c2 02 01 1a 1f 92 68 d3 fd 62 f3 63 1e 69 5e 61 f6 de 11 91 99 55 28 50 b2 6f cf ac 59 d3 bd 2c a2 aa b2 b2 32 23 23 e3 3b 22 7b 27 ab e9 f1 72 3c 9b f6 aa 9b 9d e5 4e e7 d7 ff fd 7f db 7a 35 9c 77 a6 37 3b f3 9b 9d 71 e7 5e 67 79 79 51 cd 4e 3a cb 9b 78 b2 35 c3 8d aa 3f 9a 1d af ce ab a9 dd 1a ea d6 64 76 3c 64 37 6a b5 d0 ad 9f fe be aa e6 97 ba b1 d2 8d f7 f4 7b 82 df bf fe a6 9f c7 f8 39 38 d4 cf 0b fc ec de e9 ff b5 7f a7 ab eb 13 5c 1f f7 8f 67 53 74 ab 1b 23 dd b8 58 2d ce 74 79 a6 cb c5 64 7c 5c e9 fa 54 d7 e3 e9 a8 7a f3 f4 44 77 ce 71 67 d2 5f ce 9e 2d e7 e3 e9 a9 6e 5d ea d6 d9 70 f1 f4 f5 f4 9b f9 ec a2 9a 2f 6d 7c af f0 e0 a2 8f 86 e7 6a 77 84 cb 16 b8 6c 6d cd ab e5 6a 3e ed 4c ab d7 9d a3 fe c9 14 df 1b 2f 05 38 40 6b 87 6f da bc de e0 fd 5b 83 dd bd c3 07 bd 07 fb 07 a3 1b 07 fd ab 9d 83 d1 2e 2e 06 d5 93 [TRUNCATED] Data Ascii: 6000vG-iI{+r@Hhbci^aU(PoY,2##;"{'r<Nz5w7;q^gyyQN:x5?dv<d7j{98\gSt#X-tyd\|\TzDwqg_-n]p/m\|jwlmj>L/8@ko[..C=b^glybps{~Vdp;o\{7vv<VOzww7n=>9upU4z<oGWW7w8!0q>8\|yx{'>;v\|;xrNEu5]M&W{03/lzW9}J. ]UXk/+VU;G{r<_Leefy5]>[N~vo-_~xUURKuov>VohjGrx\|{T]pgi.):p`RGl9@@?L"ra/\|s[b5$iTovtzoxt3W#hj&]XFqpo^Zu><_7qD!oO`7nw' mxpV$4=;NwG:Gj~Z=.ETWFFs^c\|
Sep 27, 2024 06:10:49.021197081 CEST	224	IN	Data Raw: 40 23 47 5f 33 cc ef f6 0e 66 f9 b8 bf ac 16 4b 1f 09 5e 3e ea 8f 17 df 4c 86 e3 e9 d3 a3 9f aa e3 25 c6 bd d3 39 99 cd 31 56 8c 8a 40 60 83 cf 82 1d 71 1c 83 31 e6 f0 40 33 c6 cf de 54 d7 0e 81 e1 72 39 ef 61 e9 75 d3 27 1e f4 99 2f d8 ba fe 96 Data Ascii: @#G_3fK^>L%91V@`q1@3Tr9au'/\|j?O&/Frx5X?u7j5Eke/u-p6?j0&vK/T\YQ6(BmLAgHh@8hT0]t
Sep 27, 2024 06:10:49.021213055 CEST	1236	IN	Data Raw: dc f9 f0 65 f5 70 3e 1f 5e 8a 5d a2 97 92 e0 45 87 fb 9d ae 71 7f 03 e2 7e e7 b6 48 c0 62 fc 4b 55 90 80 58 9b 12 8a f6 02 1b 1b 07 5e ce f4 b1 cd 6f 9d f5 8f 87 93 89 e6 53 50 5e 60 47 49 6b 1a 5f e2 4e 26 f5 20 f2 0b 10 fe 95 1e e1 75 bb 73 3f Data Ascii: ep>^]Eq~HbKUX^oSP^`GIk_N& us?=(a"Epm_$]#NIx +[xhxGRII9m9d!>N+A1w$anhbrcO%d<_8 ywxm&H
Sep 27, 2024 06:10:49.021275997 CEST	1236	IN	Data Raw: 00 b2 81 a8 48 9f bf cc 3e 40 be 5a 5c 12 dd 60 4c 30 35 89 d6 06 18 09 b8 b5 d7 2d 2f 9a bd b3 7d 9a 5d f1 a6 9b 18 5e 9a d5 80 14 fd 62 32 3c ae 7a cf 80 ee ff 13 64 3a ae 1f e2 fa b0 b8 7e 82 6b ec 00 f2 f8 64 3c 00 6d 97 a1 b6 0b ea 32 dd 91 Data Ascii: H>@Z\`L05-/}]^b2<zd:~kd<m2~&#tuNI]@~6xhQk[8al4i]'cSA>tS\wXA1M=%K7n}Wn`~5>eA]y..17~8BdD@Dv$BG
Sep 27, 2024 06:10:49.021292925 CEST	1236	IN	Data Raw: 81 0a 3b f0 bb 36 c3 26 de 12 a3 b0 de bc 16 a0 20 00 eb 8b 86 9d e8 7f f9 6e b1 0a 8d 76 29 56 c1 96 2c 34 f6 16 2b 0e 09 45 92 a4 fa 27 73 c8 e6 85 b2 83 60 09 77 83 fb 4d 63 ce 61 86 01 42 ff ea 9c 9a a8 4c 7d 09 5a c7 0c f6 f5 3f ff 59 2d 63 Data Ascii: ;6& nv)V,4+E's`wMcaBL}Z?Y-c:C(H,uNb/;Yb~lV$Llm#S4@4~gOo[}d:&%c&P"r;/e7[cx&\| RLd),0&8S[1@<Tvq
Sep 27, 2024 06:10:49.021437883 CEST	1236	IN	Data Raw: 17 41 bf a4 57 cb 73 84 ff 39 2b 0e aa 4c fb 8e 44 e4 dc cd bc 7f 31 56 68 fa bc 4f 74 4b 9a 0c 88 73 c9 6d 33 62 64 a4 f8 20 21 05 11 62 36 f8 30 96 7e 6e cb 4e fc a4 12 4c 48 61 81 f5 bb 0d 15 b8 27 23 76 59 72 62 e7 05 e2 47 11 76 1c 02 1b 6f Data Ascii: AWs9+LD1VhOtKsm3bd !b60~nNLHa'#vYrbGvo~&6Ukc<b)\?;tL\W913V-9IA`EYbbYplGbs/"D5&AJS\|jnEwH=X.X-l@nSE;
Sep 27, 2024 06:10:49.021452904 CEST	1236	IN	Data Raw: dd 17 83 e3 43 58 a9 b5 dd dd ac ab 41 ba 7a 82 2f 89 6b d1 18 7e 3a 9f ad c0 11 27 63 65 bc 2b 5d 6e ba dc c3 66 05 70 9a 13 de f4 16 b9 1a 60 53 0d e7 5a b2 67 ec bc d9 9b b3 ab b6 2e a0 d7 ac ab 1e 94 79 b2 c0 c3 de 2e a0 a2 80 7c ec df be 7b Data Ascii: CXAz/k~:'ce+]nfp`SZg.y.\|{.GLi?"E7{HcbBwgpf^WG/x0G2)NgK0l.<`#}}"4x]R+"[@#tMQo97~}It0
Sep 27, 2024 06:10:49.021467924 CEST	1236	IN	Data Raw: 7d b5 42 f0 18 8c 42 a1 d7 59 c4 17 ba 3e 9e 2c 10 3f fc e9 07 ff e3 f1 a7 8f fe f2 64 ef e1 93 bf 7c ba 77 e7 ce f1 c9 de 5f ff f2 e8 df f7 3e fa e8 a3 8f 3f fe f0 e3 8f 6e e3 7f ae 4c b0 5e 04 eb 7b b8 02 a8 4f 21 50 c1 be 95 8d fa 81 6c ae bb Data Ascii: }BBY>,?d\|w_>?nL^{O!PlQU[q":(hgF{~\|I&xR"Y&+5nN3}RXuwo3.[[,h{k0&4sGIZ\|XO4V>RDsMJDw3SNJH$,`i9Z',
Sep 27, 2024 06:10:49.021480083 CEST	776	IN	Data Raw: 4e 46 4c 92 04 26 23 e6 17 37 3b bf dc ec fc 80 ef df 1a 1c 2c 55 7a d9 2b 32 7f c7 7b 07 73 bf fa 2f 5e b1 a6 b4 bc e2 57 16 86 71 c5 62 23 a8 8c 3a bc 42 20 d3 72 36 bd 32 15 1c 96 4f ab b1 fc 8f 78 69 78 c5 56 e9 fe 7f c4 7d f7 13 7b 77 d5 e8 Data Ascii: NFL,Uz+2{s/^Wqb#:B r62OxixV}{wjZ/:TC-FLGGWWwOXk6\+0Fi4Z04WYk!1(3u}C%^{E~/tqc)Ti'Ebg6{m\|wM70^?
Sep 27, 2024 06:10:49.021497965 CEST	1236	IN	Data Raw: c4 05 c0 21 7d eb 5a ca 69 d4 2e 09 8b 54 51 2a a9 5e 30 ae 96 89 92 f9 bc 4f 86 e1 66 61 26 27 fa 36 65 b6 64 00 33 e3 52 71 a0 41 14 3c df b8 db 4a 94 f7 9d e7 54 65 2b 83 a7 0e 1b a2 b2 b2 55 4a 9e 4f 4b 30 83 55 2d ed 9b ba b5 3b 91 69 8f e6 Data Ascii: !}Zi.TQ*^0Ofa&'6ed3RqA<JTe+UJOK0U-;iVou=tW+D_X0r_f\|O]Y0(n)'ES@A{U;WnWhLspx{B(`waZM:v41-sA25\L1ByRr/pGh3fmJk&~
Sep 27, 2024 06:10:49.026073933 CEST	1236	IN	Data Raw: 0e 1d 93 64 f4 8f f5 bb e8 b1 ea 33 5d 16 14 88 a5 de ea 82 ac e6 8a 7f 28 74 ff 02 b8 89 f8 34 04 6a 89 0e 46 95 c2 79 57 70 5c cf ac 55 65 de 36 eb 8e 54 9e 35 06 e6 a2 92 a4 db 96 53 86 c8 be fe 93 2f 8a 6e 1a 0f 05 a3 d8 ff 3d 04 1b d6 92 6d Data Ascii: d3](t4jFyWp\Ue6T5S/n=mS \e}M4Dmu\)ka;!wMqU!kiC0WjLsofp"yvLNqS`,k/[HY(X1Y,%_eQ/:}
Sep 27, 2024 06:10:49.619276047 CEST	316	OUT	GET /js/move.js HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.873431921 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:49 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 34 63 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 98 cb 52 1b 57 10 86 f7 a9 ca 3b a4 bc 71 a2 45 ac 99 33 67 2e 15 e2 07 c8 3a 59 a4 ca 1b 85 11 d6 60 5d 30 97 c8 62 65 20 42 18 09 30 e5 98 40 24 93 d8 e0 24 26 58 82 44 18 61 b0 78 19 9d b9 ac f2 0a e9 23 34 4a a5 72 d2 c8 d5 55 da a9 ab fa 9b ee bf fb 74 f7 5f e7 97 6e 61 7c 2e 97 ce cf 7e 5a 9c f6 66 d3 d9 fc c7 37 c6 b2 de ed 31 d7 fb f6 a3 f1 6c 6a 66 e6 f3 3b 37 3d f7 ce cd db 59 2f 91 48 98 dc 1e bb 05 7f fd fb ff 7c 2a 97 06 8b 70 f5 18 7e a2 7c 28 5e 3f 56 58 e5 0a f9 74 09 cc 34 4d 37 f5 a4 28 2f 0d 6c 6e 81 bb 1b 9f 7c f6 e1 07 a3 92 cc 67 0a 73 c0 92 99 f3 14 5e 06 2c c1 1f dd 60 e1 24 b8 2c 87 cb 0f 15 56 43 16 a6 eb 49 83 c0 f2 c5 57 5f 03 8a 65 9a 0a 27 03 94 e8 c9 9b f0 79 2d 58 59 0e 7e 6e 2b ac 62 14 8b 03 0b 81 c4 4d e7 21 3f 18 48 af f3 5a d4 df f9 5b 47 e2 0c 05 61 3c 49 49 cf a4 07 20 09 d7 55 7c eb 20 22 bd 4e c3 df 3a 0b db 2f 44 ab a6 b0 8a 23 e2 98 3a 63 84 88 8c 67 d2 00 92 c4 52 73 be ee 6f af 07 3f 7e 17 3d 7b 21 6a 65 84 [TRUNCATED] Data Ascii: 4c2RW;qE3g.:Y`]0be B0@$$&XDax#4JrUt_na\|.~Zf71ljf;7=Y/H\|p~\|(^?VXt4M7(/ln\|gs^,`$,VCIW_e'y-XY~n+bM!?HZ[Ga<II U\| "N:/D#:cgRso?~={!jeEKBz4LAF%HVoWfrDJ)Mk:uYHH8H# dpX\|Ib Q^Lb}2n0J5M#(FzUa2`(3s4a;q/smh)bn:6!'i_CNh>SX96 2)sm:uo.# 6H>pcw^OCgqR1qR4 LhqUN)+3H5lGQvFTwB#0dX.FzesY)\uXmZU,q?@WxNAPk#cpc5yj+^VK2fHGhfE9)s;"aVn[,$=WZAuQA<t(i`G5<GsT;@!FPM-YLN$LlWomK"ti!rDdB<<4c*%_]H]9! q+3fRq"-l/JJRR@1W@qRkbY[:ID"K~I; 68m
Sep 27, 2024 06:10:49.925570011 CEST	391	OUT	GET /images/saved_resource(2) HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.187912941 CEST	700	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 552 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 27, 2024 06:10:50.252402067 CEST	386	OUT	GET /images/remen_04.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.507222891 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 13294 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 64 00 64 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a [TRUNCATED] Data Ascii: JFIFddDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:18D7289A17DF11E9AE33D32F7AFB87CB" xmpMM:InstanceID="xmp.iid:18D7289917DF11E9AE33D32F7AFB87CB" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2018-11-09T14:08:44+08:00" xmp:ModifyDate="2019-01-14T17:30:57+08:00" xmp:MetadataDate="2019-01-14T17:30:57+08:00" d [TRUNCATED]
Sep 27, 2024 06:10:50.627309084 CEST	384	OUT	GET /images/yonghu.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.881210089 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/png Content-Length: 15209 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 af 00 00 00 d6 08 06 00 00 00 66 31 0d bc 00 00 20 00 49 44 41 54 78 9c ed 9d 31 74 dc 46 96 ae 3f ed 3a 1c 9e c3 cd 56 4c 5e 4f 30 74 b8 9c a1 73 c1 b9 38 a3 cd 46 da 60 a8 c0 f2 66 6b cb ce 49 e6 b6 24 67 cf 52 60 3a 18 69 b2 91 4d e5 86 72 d3 4b 87 e2 06 d3 93 50 e1 72 0f 9d ee d1 0b 0a f7 a1 ba ba aa 50 00 0a dd 8d e6 fd ce e9 43 36 1a 5d a8 06 0a f7 af 7b eb 56 01 14 45 51 14 45 51 14 45 51 94 61 b9 f1 bf ff fd 2f cb ae 83 a2 28 eb c5 26 70 b9 ec 4a 28 eb c5 3f fe d3 cf 33 ef df cb 54 ee 04 d8 01 4a b4 d1 2a dd 38 88 7c f6 1d 70 b6 a8 8a 0c c4 84 f5 bf 47 f6 81 ff c0 fc be 0f 97 5b 95 ff 4f 81 11 d3 97 4b ae 07 c0 0f 98 ba 94 c0 b7 c4 db 74 51 ed 2b de c5 0e 75 a7 e0 5f 07 ab e1 88 c8 e5 79 1d 00 87 d5 ff 67 98 8b f3 9a f5 b9 51 df 05 b6 1f 03 f7 ad f7 8f 69 6e 94 39 8e 3b 34 87 c0 d1 82 8f 19 fb ad 25 cb 35 86 05 70 0b f8 3b 30 c5 d4 a7 2d fb c0 37 d5 ff f6 3d 32 84 51 dd 07 fe 8f 67 fb 57 b4 bf 1f 0b 8c d1 75 79 02 7c 6a 1d ef 00 23 d0 [TRUNCATED] Data Ascii: PNGIHDRf1 IDATx1tF?:VL^O0ts8F`fkI$gR`:iMrKPrPC6]{VEQEQEQa/(&pJ(?3TJ8\|pG[OKtQ+u_ygQin9;4%5p;0-7=2QgWuy\|j#}:->?g5w'3AXMLc+0C)dZW{=r~UO"H;6<oVwq8#<9"zSd<}GXN&x;ZG0aXN}'mqZ`D?Q8e?&~71Ek^Swgd8sWl9pUOo\~?!c&WO[i{noIiq}KX/2CFNv6{]Te%F/7C.PRo,\|uP{`,SE23%WD>;_]s=OV{>a.fCiMw!>eo}L=qU4PL{}'l13<BjOV`%&?`S,[ [$,bxtMGc^1\a5(2q]1\Rs}JtF.6r+R^mt [TRUNCATED]
Sep 27, 2024 06:10:50.884632111 CEST	383	OUT	GET /images/jietu.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:51.138837099 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/png Content-Length: 150187 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 58 00 00 01 58 08 06 00 00 00 16 6c e4 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e5 01 01 03 02 24 03 f2 56 4e 00 00 80 00 49 44 41 54 78 da ec fd 77 9c 5d d9 75 df 89 7e f7 39 37 e7 ca 39 a0 0a 40 21 c7 46 03 e8 80 66 27 76 60 b3 29 46 05 2a 50 b2 64 69 82 25 db 63 cf 8c 47 9e 67 f9 f9 d9 63 cf 8c 66 64 8d 64 49 56 b2 28 51 62 6e 36 c9 6e b2 c9 ce dd 40 23 34 72 2e a0 10 2a e7 ba 75 73 38 e7 ec f7 c7 0d 75 ee b9 e7 56 40 a3 49 d1 83 f5 f9 00 75 cf ce f1 b7 d7 5e 6b ed bd 45 32 95 96 14 29 91 cf 72 64 6e 84 d1 54 8c 3f b9 f1 3e 17 a2 53 80 e0 1e dd a3 7b 74 8f ee 91 1d 49 b6 45 5a f8 ef 36 ee 67 5b a4 85 fd 8d 9d 38 14 15 21 0a b8 29 92 a9 b4 74 aa 2a 97 c7 87 f9 fd d7 be c5 6b 13 d7 99 ce 24 c9 1a 1a ba 21 3f 60 e6 f7 e8 1e [TRUNCATED] Data Ascii: PNGIHDRXXl@gAMAa cHRMz&u0`:pQ<bKGDtIME$VNIDATxw]u~979@!Ff'v`)FPdi%cGgcfddIV(Qbn6n@#4r.us8uV@Iu^kE2)rdnT?>S{tIEZ6g[8!)tk$!?`{_78xm=O39z=Gk'>Op$Y~oUQ~%GP Gqdn&\=Gni3ht&.=GWC8(xs=GPc(S;l$:dr0"p(,R\:VwU`OR}k7QPqh{<;,bVJt8i%WJS+o.i9\_[GKO":aI61?^B>Sd<u !Ok9/<QZZc)Z\|vGH2,>3Q9I} O\|ScYq?!p=4pc %E3!ix[:hk1!kdy^?^l.Rc[w36?K6hFsoKd&](ao'%D{=H!h4v:kb<~<KC{~DBs=q3 [TRUNCATED]
Sep 27, 2024 06:10:52.400484085 CEST	458	OUT	GET /images/zhongjiang.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1
Sep 27, 2024 06:10:52.654882908 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:52 GMT Content-Type: image/jpeg Content-Length: 7324 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 51 00 00 ff e1 03 77 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyQwhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:24E89967CE3211E8B4DDA4073724961D" xmpMM:InstanceID="xmp.iid:24E89966CE3211E8B4DDA4073724961D" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D0A5AFB318CEE811B04EAF18D249C4AD" stRef:documentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:48.770172119 CEST	314	OUT	GET /js/js.js HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.523308992 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:49 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 66 32 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 5a dd 8f 1b 57 15 7f af d4 ff c1 3b 2a db b9 f6 9d f1 47 ba b4 d8 3b 6b 25 bb 09 dd 36 69 76 f3 d1 14 aa b6 9a 2f db b3 6b cf 4c ec f1 6e b6 bb fe 63 68 24 e0 a1 88 b6 4a 68 a1 22 15 14 54 d2 a6 a4 22 10 0a 0f 08 fa 80 10 15 12 a2 a8 e5 05 89 df fd 98 f1 1d db eb dd 42 5e 78 b0 3d 73 ef b9 e7 9e ef 73 ee b9 2e 17 17 1e 7e a8 50 2c 5c 1c c6 7e ff 62 37 f0 fc c2 4e cd ac 9a d5 02 1f 7e ef 4f 1f dc fe f1 27 b7 3e ff f0 5f bf b9 75 e3 b3 37 de 79 f3 fe 9d 8f 3f fa ce 6f 7e f8 fe ad 5f be 7f e7 13 0e 72 f7 af b7 be f5 d1 cf ef be f2 de a7 ef dc f8 e1 ef 3e fc d7 f5 1f 75 92 24 ae 97 cb bb bb bb e6 18 6d cd 74 a3 5e 99 ad e0 ab 56 a3 78 af 1f b4 3b 49 a1 56 a9 56 0d 7c 9d a0 85 1b 9f bd fd da fd 2f ee 7e 3f 83 7a ef d3 df fe fd fe c7 bf fe de 8d 1b d7 5f 7d fd fa 4f fe f9 e1 9b 6f bc f3 da 9f 7f f1 5d 8e e2 d7 bf 67 43 ec f5 e6 cf de 7b ed ce 9f ee fe f4 9d db f7 be 7d ef dd 7b bf 7f eb f3 5f 7c f0 f6 3f 6e df f9 d5 cd 7b ef 7e 78 eb e1 87 38 b8 60 eb fa 8f [TRUNCATED] Data Ascii: f2bZW;G;k%6iv/kLnch$Jh"T"B^x=ss.~P,\~b7N~O'>_u7y?o~_r>u$mt^Vx;IVV\|/~?z_}Oo]gC{}{_\|?n{~x8`>[7n~{o}>&or/-{MIo}}oL[a&A6Vh0l!sa<kJk?ho\|7k-${\|<\z~}RA}Vc9:dv@=;i4m_n7EWzpG;~_E\|pkBBIq;G;S]Qs(S .~@N:9!&;dx;.&b)4![BuDN00}n/m'-SPuPrMhkm>Jt*.6aA6e}.K&{Vt;ANR%I#230b?Us#j~J-}u<3`P)vLL4QW#$t 3Y=\2cUAajO.^W{EOB"8eD.8.\V]4>g:3NnIyJ<3[x5S+=M=gQ~>c<>Vo6+V+Izu~+9g
Sep 27, 2024 06:10:49.523329020 CEST	1236	IN	Data Raw: f7 af 0e 7d a6 46 48 5c 83 67 2a 03 cd 85 0a 0b 0b 17 c7 a1 95 05 dc 60 00 ef 17 01 18 56 2b 23 03 59 5c 1c bf e8 31 dd a6 1e 9d f0 8b 2e 8d 68 8b b6 c9 88 5e 9a 83 50 04 17 8e 4e 3c 1e 85 ec b2 8a 6c cb ec fb 3d c4 4f 1e 28 f5 a7 09 3d b9 b8 b8 Data Ascii: }FH\g`V+#Y\1.h^PN<l=O(=eWgi{^:<j-]/D saQZKik9d\"uk',DD%b[v:4>wmx#cM%uBAa_b=NUuz4oo7rP(F#~9:V"
Sep 27, 2024 06:10:49.523344994 CEST	448	IN	Data Raw: 33 db 98 a9 60 46 4c 6c 23 a3 13 ca ea 77 76 f0 5b b0 c2 c5 c5 97 74 b5 0a 22 34 82 bd 01 c9 a6 15 89 63 88 0a 19 11 aa 54 ec 38 c1 35 f5 c8 0c a3 44 df 44 67 01 82 49 0f 00 5c 91 97 63 fd 2a a1 38 19 a4 25 be ce ca 7f a5 4c ef 62 a7 83 83 4b 3a Data Ascii: 3`FLl#wv[t"4cT85DDgI\c8%LbK:Djk9HqF>Xy<YpkDkEsTZ\j[i`~>pwu.[c/hN:xI1p`&733wQ]RJtf</SckpZ<U"aDMK.G~
Sep 27, 2024 06:10:49.523359060 CEST	1204	IN	Data Raw: 40 4b e4 0d 0a ef 15 b1 cc 23 13 0b cb 32 f4 32 41 07 6a 4e 30 bc cc 3b 95 23 7a a2 52 49 0f d5 4e 3e b7 3e c9 7a 30 e8 75 fb fd 1d bb ab 76 c6 76 9b b1 61 d4 e3 52 09 d9 18 c1 82 da 4d bb de c7 af 3b 6f bd ed 64 70 9e 02 47 f6 5f 86 f6 78 2b 28 Data Ascii: @K#22AjN0;#zRIN>>z0uvvaRM;odpG_x+(I@~RTb^88xkEFsS\hLLK~\|<j^BV4/48eqhai-`l=#4kjq10;@tcs6c/40+v^}
Sep 27, 2024 06:10:49.618159056 CEST	380	OUT	GET /images/jt.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.866667032 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:49 GMT Content-Type: image/png Content-Length: 3137 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 21 00 00 00 19 08 06 00 00 00 bf cd 47 af 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDR!GpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]
Sep 27, 2024 06:10:49.866691113 CEST	1236	IN	Data Raw: 9e d4 08 aa 88 3a 9f 5a 49 6d a0 76 50 2f 53 87 a9 13 34 75 9a 25 cd 9b 16 43 cb a4 2d a3 d5 d0 9a 69 67 69 f7 68 2f e9 74 ba 09 dd 83 1e 45 97 d0 97 d2 6b e8 07 e9 e7 e9 83 f4 77 0c 0d 86 0d 83 c7 48 62 28 19 6b 19 7b 19 a7 18 b7 19 2f 99 4c a6 Data Ascii: :ZImvP/S4u%C-igih/tEkwHb(k{/LT02goUX**\|:V~TUsU?yTU^V}FUPU6RwRPQ__cFHTc!2eXBrV,kMb[Lvv/{LSCsfffq9J!
Sep 27, 2024 06:10:49.866700888 CEST	368	IN	Data Raw: f3 0e 83 1d 15 3b de ef 94 ec bc b5 2b 78 57 6b bd 45 7d f5 6e d2 ee 82 dd 8f 1a 62 1b ba bf e6 7e dd b8 47 77 4f c5 9e 8f 7b a5 7b 07 f6 45 ef eb 6a 74 6f 6c dc af bf bf b2 09 6d 52 36 8d 1e 48 3a 70 e5 9b 80 6f da 9b ed 9a 77 b5 70 5a 2a 0e c2 Data Ascii: ;+xWkE}nb~GwO{{EjtolmR6H:powpZ*A'\|{PHy+:u-m=^G~1cu5W(=dN?=yLk]Q]gC?tL_]p"b%K==G~pH[oeW<tM;js.
Sep 27, 2024 06:10:49.953077078 CEST	490	IN	Data Raw: ab a9 af 3a c7 23 c7 1f bc ce 79 3d f1 a6 fc ad ce db 7d ef b8 ef ba df c7 bd 1f 99 28 fc 40 fe 50 f3 d1 fa 63 c7 a7 d0 4f f7 3e e7 7c fe fc 2f f7 84 f3 fb 25 d2 9f 33 00 00 00 20 63 48 52 4d 00 00 7a 25 00 00 80 83 00 00 f9 ff 00 00 80 e9 00 00 Data Ascii: :#y=}(@PcO>\|/%3 cHRMz%u0`:o_FnIDATxjTA&.H@K?`EH"oB.uiP@XFrl{u~p97s"B3%1"Q4NpT?$Z
Sep 27, 2024 06:10:49.963978052 CEST	386	OUT	GET /images/remen_02.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.212621927 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 12630 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 2f 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta> [TRUNCATED]
Sep 27, 2024 06:10:50.212658882 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
Sep 27, 2024 06:10:50.212671041 CEST	1236	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: <?xpacket end="w"?>,Photoshop 3.08BIM%B~
Sep 27, 2024 06:10:50.212745905 CEST	1236	IN	Data Raw: 91 a9 a3 9e 3c 3c f6 61 27 bc b8 fd b8 62 dd e0 c2 e3 4b b5 e1 4c 1d 57 a4 62 39 1c 3b 96 66 d3 25 b3 22 e3 1a 24 a4 71 dd 5d 09 0c b4 22 0d ae b2 73 c1 29 d4 a2 c0 56 24 7e 08 ab d2 74 8c 01 a6 1d 5e dd b8 f2 35 cd 75 0f 4e 74 1b da d0 e9 eb 75 Data Ascii: <<a'bKLWb9;f%"$q]"s)V$~t^5uNtuqY-RoF~n,Wg0fp\|bKq7r1Ibn>#UH&[2TE:NJ[ wjwxQ);$ww@\&K.]
Sep 27, 2024 06:10:50.212830067 CEST	1236	IN	Data Raw: 51 a5 24 d0 a7 4e e2 98 84 59 a0 47 01 01 f5 6e e3 d1 4f cf 59 c2 45 e1 13 69 b3 20 2d 01 e6 b6 2a 3e 32 36 ab 70 c9 48 e3 3f 0e 7f 3f 95 5f 5c d0 96 5b ed d2 eb 67 bf b1 22 2e bb 72 f4 50 59 71 b5 46 9b 6e 04 39 bd 52 63 2d 5e 19 65 18 49 57 84 Data Ascii: Q$NYGnOYEi -*>26pH??_\[g".rPYqFn9Rc-^eIWaIl)+R'+s(HJ9EHG919DJ.@=Yl\6,r{<g/Mm\|Kj>;5mKz2^,x}wy?T#g((0CC:v
Sep 27, 2024 06:10:50.377202988 CEST	386	OUT	GET /images/remen_06.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.625418901 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 14701 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 e2 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 07 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 62 00 00 00 1b 01 05 00 01 00 00 00 6a 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1e 00 00 00 72 00 00 00 32 01 02 00 1a 00 00 00 90 00 00 00 69 87 04 00 01 00 00 00 aa 00 00 00 00 00 00 00 80 fc 0a 00 10 27 00 00 80 fc 0a 00 10 27 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 00 32 30 31 39 2d 30 31 2d 31 34 54 31 33 3a 30 32 3a 35 33 2b 30 38 3a 30 30 00 03 00 00 90 07 00 04 00 00 00 30 32 32 30 02 a0 04 00 01 00 00 00 a2 00 00 00 03 a0 04 00 01 00 00 00 4e 00 00 00 00 00 00 00 4e 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 [TRUNCATED] Data Ascii: ExifII*bj(1r2i''Adobe Photoshop CS6 (Windows)2019-01-14T13:02:53+08:000220NNDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:A628494D17B911E9BB61EFC8C5F1E722" xmpMM:InstanceID="xmp.iid:A628 [TRUNCATED]
Sep 27, 2024 06:10:50.725661039 CEST	384	OUT	GET /images/xiazai.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.975380898 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/png Content-Length: 10279 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 1f 00 00 00 46 08 06 00 00 00 f5 a1 90 c6 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDRFpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://c.vip3656jun27.cc/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Windows Analysis Report
http://c.vip3656jun27.cc/

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:49.027833939 CEST	388	OUT	GET /images/wangzhi_11.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:49.801101923 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:49 GMT Content-Type: image/png Content-Length: 6067 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 13 00 00 00 3b 08 06 00 00 00 58 21 6e 57 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 1b 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 37 61 37 61 32 33 36 2c 20 32 30 32 31 2f 30 38 2f 31 32 2d 30 30 3a 32 35 3a 32 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 [TRUNCATED] Data Ascii: PNGIHDR;X!nWpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.7a7a236, 2021/08/12-00:25:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmp:CreateDate="2024-06-30T12:39:38+08:00" xmp:ModifyDate="2024-06-30T13:29+08:00" xmp:MetadataDate="2024-06-30T13:29+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9f0f2733-d911-f449-8d3e-d6acdbc51a6d" xmpMM:DocumentID="adobe:docid:photoshop:86c16bb2-211c-4c4d-aa05-fd4b6a2cbdf1" xmpMM:OriginalDoc [TRUNCATED]
Sep 27, 2024 06:10:49.801126957 CEST	1236	IN	Data Raw: 31 61 34 31 2d 39 64 33 33 2d 34 30 30 64 38 63 39 37 31 30 63 39 22 3e 20 3c 70 68 6f 74 6f 73 68 6f 70 3a 54 65 78 74 4c 61 79 65 72 73 3e 20 3c 72 64 66 3a 42 61 67 3e 20 3c 72 64 66 3a 6c 69 20 70 68 6f 74 6f 73 68 6f 70 3a 4c 61 79 65 72 4e Data Ascii: 1a41-9d33-400d8c9710c9"> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:LayerName="" photoshop:LayerText=""/> </rdf:Bag> </photoshop:TextLayers> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>adobe:docid:photoshop:
Sep 27, 2024 06:10:49.801141024 CEST	1236	IN	Data Raw: c6 7b 61 10 0d c3 20 1a 26 69 4c 18 44 0f af 50 ee 2c 2e 61 54 c5 08 2b cf 0d c7 1b 60 6f 2e 5d cc f0 45 69 02 5d d7 50 64 4d d4 70 db 30 aa cc d0 a4 8a 92 a4 f1 f3 49 1a 17 11 a2 9e 2d e1 35 93 72 b0 b6 61 8e 12 06 51 37 49 63 5b 70 1c 02 7b 8b Data Ascii: {a &iLDP,.aT+`o.]Ei]PdMp0I-5raQ7Ic[p{,&]0~5i_p1cSVD]J&[&5p5X"WIw0C;@UF=<If\k~<+.}=[0#gV\|G<@dk(R>a
Sep 27, 2024 06:10:49.801290035 CEST	1236	IN	Data Raw: bf 5f 64 08 23 69 e6 3a 8c f8 21 4d 29 e8 01 ef b8 85 f1 76 fb af 2d 17 e6 9e 22 ab 51 e4 f0 1f 18 61 73 27 db 73 cb 70 65 df 8e 4f 32 83 21 93 da 49 93 62 33 24 4e 96 59 d3 23 c2 f2 3a 3c 3c 27 f0 5a c9 b5 f1 2c f0 78 20 bd db b5 bf 68 8f 47 d9 Data Ascii: _d#i:!M)v-"Qas'speO2!Ib3$NY#:<<'Z,x hGz%/H=[7'^x<uT0RU.mx<!26y<;K)ITDm b%BdSg/Y#>9^^c-"J:[3.s
Sep 27, 2024 06:10:49.801301956 CEST	736	IN	Data Raw: 0f 83 a8 23 c3 a9 ae 0c 65 fb 8c 87 7c 13 88 20 a9 93 d9 fa c3 85 25 68 a7 d2 49 b9 6c 5b d9 bc 00 dd 3d a6 85 31 39 d7 f4 70 0b e9 4d d7 e5 95 a8 60 e6 88 5f b9 ed 82 dc 70 d4 1e e2 6a 78 ce a9 62 69 7c 7d a4 31 27 e3 b8 ad 3a 1c a9 59 3d 75 43 Data Ascii: #e\| %hIl[=19pM`_pjxbi\|}1':Y=uCzPmlhyHcpaj@s<"3@IsttNg)0Lq-44o;+55i#\Q/uy-i&OZ#W5E.j0V.hUn(BI
Sep 27, 2024 06:10:49.891410112 CEST	580	IN	Data Raw: 30 f6 9d d0 05 7c 6a af 98 9a 51 91 77 d3 c1 34 d6 0b c6 fe 16 f6 3e c9 5a c6 03 b9 5f db 4a 5b c7 4c f9 da cf 55 b5 b4 6c 94 ff 96 fc be 76 5e 3a b9 a7 d6 1f ed 48 74 d9 c3 44 94 7f f9 ae 5e d3 17 98 4e e9 50 8e ed 67 9e 97 b3 4c 42 5e e7 38 eb Data Ascii: 0\|jQw4>Z_J[LUlv^:HtD^NPgLB^8$i1rP[[(1m<CV$."\!Tkspm=5E]Es/v<;!L`JZz<%g+vFB&OXZ=u[):3A=]
Sep 27, 2024 06:10:49.926126003 CEST	391	OUT	GET /images/saved_resource(3) HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.187447071 CEST	700	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 552 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 27, 2024 06:10:50.228976011 CEST	386	OUT	GET /images/remen_03.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.481132030 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 13483 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 e2 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 07 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 62 00 00 00 1b 01 05 00 01 00 00 00 6a 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1e 00 00 00 72 00 00 00 32 01 02 00 1a 00 00 00 90 00 00 00 69 87 04 00 01 00 00 00 aa 00 00 00 00 00 00 00 80 fc 0a 00 10 27 00 00 80 fc 0a 00 10 27 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 00 32 30 31 39 2d 30 31 2d 31 34 54 31 33 3a 30 32 3a 31 32 2b 30 38 3a 30 30 00 03 00 00 90 07 00 04 00 00 00 30 32 32 30 02 a0 04 00 01 00 00 00 a2 00 00 00 03 a0 04 00 01 00 00 00 4e 00 00 00 00 00 00 00 4e 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 [TRUNCATED] Data Ascii: ExifII*bj(1r2i''Adobe Photoshop CS6 (Windows)2019-01-14T13:02:12+08:000220NNDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:8DFA96B917B911E9B70BB4D82CAA5ECB" xmpMM:InstanceID="xmp.iid:8DFA [TRUNCATED]
Sep 27, 2024 06:10:50.481188059 CEST	1236	IN	Data Raw: 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 31 38 2d 31 31 2d 30 39 54 31 34 3a 30 38 3a Data Ascii: xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2018-11-09T14:08:44+08:00" xmp:ModifyDate="2019-01-14T13:02:12+08:00" xmp:MetadataDate="2019-01-14T13:02:12+08:00" dc:format="image/jpeg" photoshop:LegacyIPTCDigest="FDAFC2F03E4E
Sep 27, 2024 06:10:50.481198072 CEST	1236	IN	Data Raw: 34 3a 30 35 3a 33 36 2b 30 38 3a 30 30 22 20 73 74 45 76 74 3a 73 6f 66 74 77 61 72 65 41 67 65 6e 74 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 22 20 73 74 45 76 74 3a 63 68 61 6e 67 65 64 3d 22 Data Ascii: 4:05:36+08:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="co
Sep 27, 2024 06:10:50.481347084 CEST	1236	IN	Data Raw: 68 3e ff 00 85 37 0d 29 a0 fb fe 14 df 4a 68 3e ff 00 85 37 d2 9a 7e 7f 85 37 fb 7d 83 4a 69 f9 fe 15 90 1d be 3b 7e 1a 54 15 d7 ed f8 7f 6d 67 bc df ef 36 df 76 e3 a5 46 c1 f9 2f f6 d6 37 df e3 a5 4e 9f 66 bf 0a c6 fa 53 43 e6 2b 3a 54 53 4a 53 Data Ascii: h>7)Jh>7~7}Ji;~Tmg6vF/7NfSC+:TSJSJSJSJSJSJSJSJSO67j)Gu_w?n~hi<Q5>MJa~_J}o~:S_
Sep 27, 2024 06:10:50.481357098 CEST	736	IN	Data Raw: c1 c3 73 0a 6b 22 43 90 e1 a2 4c c5 58 0d 37 28 d4 0f cb fb 6a cf c9 bb 75 16 33 39 8d 58 2d b2 d6 98 4c 85 dc 30 bf d5 c1 b5 a1 92 47 2a c9 1c 9d 16 63 b4 17 56 da 9f 28 d7 4d 75 a9 5f 28 71 3b 86 98 c3 26 64 ec 66 38 73 dd 92 fa 6c 5d 91 af 78 Data Ascii: sk"CLX7(ju39X-L0GcV(Mu_(q;&df8sl]xak3G\BVrGJz70(%Tn&V.tc[nG)6tvGe=BBI$PATfx^ynRBw'aV6EG#3ygx cb`Q\JmYrW[c
Sep 27, 2024 06:10:50.481538057 CEST	1236	IN	Data Raw: 77 df bb d0 2d cc df 3d 3b c9 db be 1d 6f 7f 8c 8c e9 f5 33 42 91 44 e7 50 08 88 00 a7 50 48 d4 33 31 6f 3d b5 e2 58 f0 b3 e3 2d 51 79 3f 21 b8 b7 bd 93 4f 92 37 1a 26 be 7a 92 db c7 de 02 8f bf c2 bb 7a c5 bd 09 b7 8f 62 64 60 bf 6f 4e 30 22 4e Data Ascii: w-=;o3BDPPH31o=X-Qy?!O7&zzbd`oN0"N`bsUL] 6URvPq--q\|R}68PdPX1Y^#,oBY$0'nBEV[4,t\|{1QEM$cvwn:ynm'!Q
Sep 27, 2024 06:10:50.627589941 CEST	392	OUT	GET /images/long_qr_240818.gif HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.879266977 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/gif Content-Length: 913034 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 96 00 02 02 f7 00 00 00 00 00 00 00 00 09 09 09 02 0b 07 14 14 15 1c 1c 1c 0c 0b 12 33 0a 15 04 26 1c 23 21 1e 0a 33 2b 22 22 22 2c 2c 2c 32 32 32 3c 3c 3c 2d 34 32 06 15 38 4e 2f 17 02 51 37 12 46 36 2a 4a 3a 5e 4a 20 5b 44 3d 25 2f 64 52 34 42 0a 6b 50 06 6a 51 0b 7d 5d 12 76 5b 0d 68 4f 3f 45 7a 13 7e 61 23 5a 4b 42 42 42 4b 4b 4b 55 55 55 5c 5c 5c 57 51 4f 75 4f 44 77 69 45 66 65 66 6b 6b 6b 76 76 76 7c 7c 7c 72 6e 6e 54 68 68 98 0d 00 ae 0e 00 af 29 09 84 0c 29 9e 26 26 cd 17 00 ff 00 00 d3 2d 05 f9 2f 00 fe 22 23 cf 34 23 9e 67 1b b8 7d 1d b3 2b 4a ce 35 56 8d 55 41 b9 4a 44 92 68 51 b1 6b 54 b3 76 68 98 63 6b cc 49 43 fe 4a 48 cf 62 59 da 45 64 d0 72 6c fc 6c 6c f0 5d 5d ff 67 08 2c 84 5e 10 86 66 16 8a 6c 13 94 73 33 8c 73 12 a0 7b 2e ab 77 50 95 61 44 8e 7a 63 b1 57 64 c1 65 9d 80 30 b0 8a 30 93 ac 39 8d ad 31 b8 ba 2c cb 88 1d f8 96 02 fb aa 12 ca 97 29 d4 ae 32 fc b9 27 e0 a9 22 f4 9a 23 a2 c9 37 ff ce 18 e8 dd 16 fe e8 0f fd c7 34 ff ce 3e e2 dc 24 dd d4 26 9d 98 48 b8 [TRUNCATED] Data Ascii: GIF89a3&#!3+""",,,222<<<-428N/Q7F6*J:^J [D=%/dR4BkPjQ}]v[hO?Ez~a#ZKBBBKKKUUU\\\WQOuODwiEfefkkkvvv\|\|\|rnnThh))&&-/"#4#g}+J5VUAJDhQkTvhckICJHbYEdrlll]]g,^fls3s{.wPaDzcWde0091,)2'"#74>$&HDMrt{jAOr~fXKRNYwgeq{oZI8"O4}Zfhwu+cgpzt!NETSCAPE2.0!!xmp dataxmp?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "><rdf:RDF xmlns:rdf="http://w [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:49.633687973 CEST	388	OUT	GET /images/saved_resource HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.381793976 CEST	700	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 552 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 27, 2024 06:10:50.617821932 CEST	394	OUT	GET /images/nav.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/css/style.css Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.867650986 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/png Content-Length: 5535 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 00 00 00 01 84 08 06 00 00 00 a8 04 52 ea 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDRRpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]
Sep 27, 2024 06:10:50.867665052 CEST	224	IN	Data Raw: 9e d4 08 aa 88 3a 9f 5a 49 6d a0 76 50 2f 53 87 a9 13 34 75 9a 25 cd 9b 16 43 cb a4 2d a3 d5 d0 9a 69 67 69 f7 68 2f e9 74 ba 09 dd 83 1e 45 97 d0 97 d2 6b e8 07 e9 e7 e9 83 f4 77 0c 0d 86 0d 83 c7 48 62 28 19 6b 19 7b 19 a7 18 b7 19 2f 99 4c a6 Data Ascii: :ZImvP/S4u%C-igih/tEkwHb(k{/LT02goUX**\|:V~TUsU?yTU^V}FUPU6RwRPQ__cFHTc!2eXBrV,kMb[Lvv/{LSCsfff
Sep 27, 2024 06:10:50.867676020 CEST	1236	IN	Data Raw: 9d e6 71 cd 01 0e c6 b1 e0 f0 39 d9 9c 4a ce 21 ce 0d ce 7b 2d 03 2d 3f 2d b1 d6 6a ad 66 ad 7e ad 37 da 7a da be da 62 ed 72 ed 16 ed eb da ef 75 70 9d 40 9d 2c 9d f5 3a 6d 3a f7 75 09 ba 36 ba 51 ba 85 ba db 75 cf ea 3e d3 63 eb 79 e9 09 f5 ca Data Ascii: q9J!{--?-jf~7zbrup@,:m:u6Qu>cyGm7046l18cckihhI'&g5x>fob4ek<abi2)kft,9kaEJ6\|MV>VyVVI\,m
Sep 27, 2024 06:10:50.867686987 CEST	1236	IN	Data Raw: ae 74 f4 4d eb 3b d1 ef d3 7f fa 6a c0 d5 73 d7 f8 d7 2e 5d 9f 79 bd ef c6 ec 1b b7 6e 26 dd 1c b8 25 ba f5 f8 76 f6 ed 17 77 0a ee 4c dc 5d 7a 8f 78 af fc be da fd ea 07 fa 0f ea 7f b4 fe b1 65 c0 6d e0 f8 60 c0 60 cf c3 59 0f ef 0e 09 87 9e fe Data Ascii: tM;js.]yn&%vwL]zxem``YGG#F#d~VysKXyr:#y=}(@PcO>\|/%3 cHRMz%u0`:o_
Sep 27, 2024 06:10:50.867698908 CEST	1236	IN	Data Raw: cb 8f 86 e0 33 9d 53 2d 11 c5 4a 2b 00 00 00 00 30 af 92 23 55 0f b5 13 00 00 00 00 98 78 8b cd d7 d3 7f 04 00 00 00 00 26 e5 71 7f 02 00 00 00 00 96 7f 04 00 00 00 00 f6 be ff 37 8f fb 13 00 00 00 00 98 7b f9 3f b5 88 6c f9 17 00 00 00 00 98 77 Data Ascii: 3S-J+0#Ux&q7{?lwo5"[]UKD) 0#jnL*YCwp.@@@@
Sep 27, 2024 06:10:50.867710114 CEST	512	IN	Data Raw: 00 00 00 04 00 00 00 00 40 00 00 00 00 00 04 00 00 00 00 10 00 00 00 00 00 01 00 00 00 00 10 00 00 00 00 00 01 00 00 00 00 10 00 00 00 00 00 01 00 00 00 00 10 00 00 00 00 00 01 00 00 00 00 04 00 00 00 00 40 00 00 00 00 00 04 00 00 00 00 40 00 00 Data Ascii: @@@@@@@@@
Sep 27, 2024 06:10:50.953562975 CEST	48	IN	Data Raw: 00 00 20 00 00 00 00 00 02 00 00 00 00 20 00 00 00 00 00 2b f9 0b 00 00 ff ff 03 00 fd 56 e5 f7 2e 3a c8 29 00 00 00 00 49 45 4e 44 ae 42 60 82 Data Ascii: +V.:)IENDB`
Sep 27, 2024 06:10:50.954370022 CEST	393	OUT	GET /images/kongtou4_240216.gif HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:51.204090118 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/gif Content-Length: 502876 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 8c 00 72 01 f7 ff 00 a2 6c 55 fd d1 71 f1 b8 ad 45 88 35 fd 8c 06 f2 ba 95 55 91 48 77 b5 6a ff f2 8d 60 68 5c ff ce 2d d6 97 74 cd cd cd a0 d9 e5 02 a9 d1 66 92 48 d1 70 0e b2 00 06 d6 23 2b 00 ce b5 44 77 34 19 56 fb fe fb af dd 98 23 33 68 22 1f 0e 02 da ba b2 f8 ba 4f 62 95 a7 ac bb 4c db d8 54 ff bb ca fa d6 88 01 ac b9 60 ca ab db 88 13 d7 cc b4 62 a7 db 2e 98 63 f9 4e 51 b5 b5 b4 b5 4c 02 b8 87 70 fd 95 92 de ab 74 d8 98 89 fb ba 69 fa 98 1a fd b7 00 2d 66 45 af 8d 28 9b b7 d7 bb cc 4f 24 d3 98 02 55 33 d7 f3 f3 92 01 01 96 aa 50 cf 8b 53 f8 6d 6e 8a b4 6d d7 b2 4a cd 4e 4d dc db 67 b6 70 36 67 cc e9 b1 ad 96 b9 90 4c b4 99 89 90 51 34 e2 33 3b 6b 70 8b d6 6d 69 8f 91 8f d0 11 22 ab db 98 93 29 01 70 8d 71 87 cc 79 d1 51 01 ff ee 32 43 22 11 6e 02 00 cc 0c 11 ac 2e 01 87 98 44 8f 85 70 25 b8 8e 01 ab 99 1f 4c 2f d7 aa 2d fe ff 01 af ae 69 a4 69 8a 44 02 00 c8 71 52 99 cc 88 67 aa 5a 6c 4a 35 fd 96 46 b5 29 29 53 88 65 fa 22 2c ff 00 00 72 2e 0c 94 b2 8e cf 73 28 b7 cd b7 aa [TRUNCATED] Data Ascii: GIF89arlUqE5UHwj`h\-tfHp#+Dw4V#3h"ObLT`b.cNQLpti-fE(O$U3PSmnmJNMgp6gLQ43;kpmi")pqyQ2C"n.Dp%L/-iiDqRgZlJ5F))Se",r.s(eiL"fh#oRG7.gpu6Tf/G3&M85]i2CuFpNJM,OrHs(t.UwgR8W'&n/%3x#S/vF33N&N/WT7 9uUZDP3 8p\|nf <*AgDwUDAU3! UD5D\!f3!7f^U=@b{f@}w!NETSCAPE2.0!XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3. [TRUNCATED]
Sep 27, 2024 06:10:51.204159021 CEST	224	IN	Data Raw: 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a 78 6d 70 4d 4d 3d 22 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 6d 6d 2f 22 20 78 6d 6c Data Ascii: "> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0F804E9B2
Sep 27, 2024 06:10:51.204210043 CEST	1236	IN	Data Raw: 37 36 37 45 44 31 31 42 45 37 44 42 43 41 43 46 32 41 44 45 30 32 30 22 20 78 6d 70 4d 4d 3a 44 6f 63 75 6d 65 6e 74 49 44 3d 22 78 6d 70 2e 64 69 64 3a 36 33 37 31 32 45 39 30 43 43 37 32 31 31 45 45 42 39 32 34 46 35 31 31 42 39 43 34 35 32 35 Data Ascii: 767ED11BE7DBCACF2ADE020" xmpMM:DocumentID="xmp.did:63712E90CC7211EEB924F511B9C4525C" xmpMM:InstanceID="xmp.iid:63712E8FCC7211EEB924F511B9C4525C" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:7F30
Sep 27, 2024 06:10:51.204286098 CEST	1236	IN	Data Raw: 40 4a 0b 00 4d ae 92 44 1a 57 94 41 2b 54 3e ca 73 ab b4 55 d9 90 6d a4 91 12 5b 69 11 94 24 20 48 0d 57 84 bb 8a 1e 27 b4 c0 8b 00 2b c8 c2 1d ba 44 7d 82 6a 16 36 40 8a ed b0 26 94 51 a9 20 82 98 40 cb 01 4c d1 7a 99 1e c7 00 5c 55 a4 be 0e 3b Data Ascii: @JMDWA+T>sUm[i$ HW'+D}j6@&Q @Lz\U;l`BqaqUZ&\a1F3<@\|C?CY\Zix,->E;;@76^W8I#47q5$<3lL7 (82LS8XNuf[
Sep 27, 2024 06:10:51.204297066 CEST	1236	IN	Data Raw: a9 80 86 37 5c 00 ba 15 3a c6 39 b5 00 8c 21 ba b6 94 23 48 44 8c df 98 82 27 68 d5 18 c0 48 73 3b 81 11 0d 8c 8e 83 bc 39 ee 2d 99 7b 3b 61 0b 70 d6 b3 df 3b 9f 1a 34 fc 05 78 18 b9 9a 12 d4 02 9e c7 23 8e 6a c0 8e ba da bd 80 01 cd a7 55 60 60 Data Ascii: 7\:9!#HD'hHs;9-{;ap;4x#jU``A6^C:zhF"qj@\|v\|GMmqi:1APZF?\)1`-C56\|}>j^{ch}w3

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:49.636223078 CEST	391	OUT	GET /images/saved_resource(1) HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.410300970 CEST	700	IN	HTTP/1.1 404 Not Found Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 552 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6f 70 65 6e 72 65 73 74 79 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>openresty</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Sep 27, 2024 06:10:50.616925955 CEST	393	OUT	GET /images/bg.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/css/style.css Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.872610092 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 155437 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 09 06 07 08 07 06 09 08 08 08 0a 0a 09 0b 0e 17 0f 0e 0d 0d 0e 1c 14 15 11 17 22 1e 23 23 21 1e 20 20 25 2a 35 2d 25 27 32 28 20 20 2e 3f 2f 32 37 39 3c 3c 3c 24 2d 42 46 41 3a 46 35 3b 3c 39 ff db 00 43 01 0a 0a 0a 0e 0c 0e 1b 0f 0f 1b 39 26 20 26 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 ff c2 00 11 08 04 52 07 80 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff c4 00 1a 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f8 6d 7e 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC"##! %*5-%'2( .?/279<<<$-BFA:F5;<9C9& &99999999999999999999999999999999999999999999999999Rm~x [TRUNCATED]
Sep 27, 2024 06:10:50.872921944 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 06:10:50.872932911 CEST	1236	IN	Data Raw: 12 00 20 12 01 25 89 4b 16 04 a4 a8 92 41 60 5c 96 7a 0f a0 e3 d7 9b 59 f0 ba e2 b2 f8 57 18 c4 63 45 5c e9 b9 d9 37 de 75 97 2c b9 a7 31 89 99 73 55 d1 3a 17 42 08 2a 99 ae 35 81 40 01 2b 20 92 f5 91 20 cc ce 10 6b 38 c9 98 28 44 4c d4 cb 54 a9 Data Ascii: %KA`\zYWcE\7u,1sU:B*5@+ k8(DLT$us3IlzU/5sy?Y19$kmgXYq$g4RYIZR5twrgF5kw,Yk><,&TdlBeE`b5)mYr\n/t.
Sep 27, 2024 06:10:50.872945070 CEST	1236	IN	Data Raw: fa 1f 3f 6f 17 ae 3e 47 58 e7 e7 d2 c5 25 bd 85 59 62 d7 3e a6 f1 f6 7c 3b 79 5d 79 7a 58 e9 e1 ef 1f 2d 65 31 bc f3 ab 10 44 40 2d d3 9f 77 4c 7a 73 5c 55 db 1e 5d cf 1c 47 3e 85 94 58 b1 be 7d 53 a7 72 fa 0a 28 98 9c 87 1d cc 17 3a 26 bb 97 73 Data Ascii: ?o>GX%Yb>\|;y]yzX-e1D@-wLzs\U]G>X}Sr(:&sbDE.EIK B,!l*TDFi]s37i7i[En}y55;pNTk9@" J+!d5{o_/+q}gYts.\|b4F
Sep 27, 2024 06:10:50.872956038 CEST	736	IN	Data Raw: 74 12 aa 35 8d 9a ed 6b b1 46 85 0f 39 39 d8 ce 5d 65 ca cb d9 d4 df 4a f7 27 42 90 bc e9 c2 71 a4 9d 2b d0 74 2e a6 84 99 98 14 4a 2d 8b 96 34 4a ad 81 8d 62 66 0c cc d6 48 02 14 59 11 65 c8 f5 26 bb 0f 1d 31 4d 23 69 ac 4e 76 4b d1 9d 71 a7 6d Data Ascii: t5kF99]eJ'Bq+t.J-4JbfHYe&1M#iNvKqm\yEn-XNH9&R A Uc:%YdQ-RK0I"YVk-5$$rKUwxpV\b=,,dVhlG921lIMrE3bX:o=
Sep 27, 2024 06:10:50.873086929 CEST	1236	IN	Data Raw: 80 b2 4a a2 09 14 81 2a 24 13 44 b1 15 62 52 45 49 21 2d 64 a4 d5 aa 75 9d f5 3d cc 6f ce de 3b da d6 e7 e7 ba f2 d5 d3 b6 bd 0d 67 a3 a7 9e 35 30 cf 6d ee 3a 66 f5 c7 79 58 35 aa 33 ee e3 58 ef 3c ba ce d2 45 cc 93 94 53 2c 62 b1 81 d9 cf 5e 45 Data Ascii: J$DbREI!-du=o;g50m:fyX53X<ES,b^E@LjU.i%!LG=nz6^ 9O5cJyu/i+')kM[Yp+5kNH0<rc:c}h2I]Sk;$RUJMAPenebh(s:Uck8S74\|vmn{
Sep 27, 2024 06:10:50.873101950 CEST	224	IN	Data Raw: 6a d1 37 d6 3a ef 3d f5 8b a5 64 bd 99 72 ef 8e 75 d3 9d 70 49 68 ce 4c cd 33 49 7c de 72 f1 53 1b 9e 89 64 8b 2b 2e 09 9a f2 a7 90 c4 72 e9 e9 74 9c d9 d6 57 9e da 7a 6d 74 1d 05 97 13 13 9c e2 4e 7c 32 ce ac 69 d3 9f 5d d7 a2 bd 44 a4 cb 5a e0 Data Ascii: j7:=drupIhL3I\|rSd+.rtWzmtN\|2i]DZ9[QC8\:J.P8\|&z6.X)R, XeB5w{\XuYY%D,$T`K{$RUVX b @.Ue.hU+d$
Sep 27, 2024 06:10:50.873111963 CEST	1236	IN	Data Raw: 8b 2d 0a 92 e8 34 94 54 04 5b b4 b8 d9 74 a9 5b 77 97 6c eb 8f 78 de 5d 65 e5 d6 2c bd 19 d7 2e b1 dd 37 99 a1 a5 5c a5 cd 8f 62 6f 23 0b 9c ae 79 ab 16 68 5e a6 c8 22 a6 ad 5a a6 35 1a cb 7c ad b6 8e 9a 69 ab 7a 97 2f 56 b2 cc e9 9b 6d 3d 2c 6f Data Ascii: -4T[t[wlx]e,.7\bo#yh^"Z5\|iz/Vm=,o;}g\+Vvf=\{c/v2[f KSD33xV9zgjN2^3#\|5M{up$&5'n3\N$eYykgg)tPI4[$fL:H*>yd
Sep 27, 2024 06:10:50.873123884 CEST	1236	IN	Data Raw: ae 2f 9d bc e3 65 65 b9 75 a2 4d 33 ad 0e b6 fc d6 20 56 71 a5 68 65 1d 73 58 dc c3 54 66 b6 6d 2e 69 5b 34 9a a5 c6 69 26 cb 05 a5 d5 73 25 32 3b 26 b0 b3 b6 6b cf b9 ea cf 6e 4d f0 de 6f bb 3d 31 b9 c6 e7 1d 62 73 bd ae 61 36 74 ee 88 6b 0b 9e Data Ascii: /eeuM3 VqhesXTfm.i[4i&s%2;&knMo=1bsa6tk{v+=VKvzcYg]7^e]mfnxVw.}Lnz%K7IYDV""Dk*3EBPu3s\jW6]M`%ecV:MPZMs\[5/FvAK\w8egJ5].v4&k~].o
Sep 27, 2024 06:10:50.873136044 CEST	1236	IN	Data Raw: 74 e7 73 af 3d d3 3b be a5 ba 72 ea 74 d8 d4 b9 53 13 8d 9c 58 73 eb 5c ea db e7 6d e3 a1 d7 a1 75 05 0c 4c 53 9f 38 a7 3e d1 9b 6d e3 ab a6 3a db eb 8d 2b a0 e3 ae 53 14 e3 63 3e 7d 19 b3 d3 96 fa d7 4a ee 68 49 62 0a 95 28 b0 10 40 20 15 08 04 Data Ascii: ts=;rtSXs\muLS8>m:+Sc>}JhIb(@ ,,ArfHN\|eVE:,[MasOGzUL!=}<r#5y\|6x\|mcjk=9fo[Yty\|sI+&kyG>lN?wy
Sep 27, 2024 06:10:50.873146057 CEST	512	IN	Data Raw: bc 9a e5 13 a2 e2 ab f4 b9 e9 f3 09 e9 47 9d 9b 7a cf 1b f6 22 d1 e2 dc cc d7 24 ef dd 78 7b 8d fc fb 3d f6 fd 06 a7 ca 6b 1d 5e 5f a1 f6 5d fc 7e 36 3b f9 b3 9f bb 75 46 63 73 e6 33 7d 7f 17 d4 f1 3d ff 00 27 d3 ce fb e6 be 3e f3 f6 1a c7 9f 4d Data Ascii: Gz"$x{=k^_]~6;uFcs3}='>My\|No:.}m.v[gyz\8G!U1&FzI :17O=HPK:=V[YNno/3w]sK8_\
Sep 27, 2024 06:10:52.400953054 CEST	454	OUT	GET /images/dblogo.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1
Sep 27, 2024 06:10:52.654256105 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:52 GMT Content-Type: image/png Content-Length: 5000 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 e3 00 00 00 3a 08 06 00 00 00 42 bf ee ab 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDR:BpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]
Sep 27, 2024 06:10:54.551487923 CEST	585	OUT	GET /images/favicon.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:54.805243969 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:54 GMT Content-Type: image/png Content-Length: 4704 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 02 00 00 00 25 0b e6 89 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 12 02 49 44 41 54 78 da d4 5a 09 70 5c c5 99 ee 7e f7 9c 9a 43 f7 65 cb b6 64 61 f9 c6 06 db 2c d8 c0 72 1a 03 4b 80 02 03 49 08 10 c3 16 29 60 6b a9 ad 4a 81 61 13 92 90 82 4d a0 bc 09 84 84 10 52 14 64 9d 10 13 d6 26 36 97 31 f8 c0 27 d8 60 59 b2 2d c9 96 64 4b 23 69 34 f7 f5 ae de bf df 93 46 23 cd 1b 8d 9c 4a c1 a6 6b 6a f4 34 af bb df ff 77 ff ff ff 7d ff df 0f 97 3e f9 4d f4 8f dc 18 f4 0f de b8 ec d5 9e 07 9f ae 71 fb f3 7b 7c d2 d5 7a c7 1b 3f ff da 05 65 31 83 31 d6 74 9d 20 62 ad 80 cf e6 b4 f1 42 fe 48 a7 20 21 4d 47 0c 83 f0 d7 26 3d 46 f8 a2 e9 cd 7e 87 7b 6b fb a1 94 22 5b 2b 10 4c c4 7c 76 57 fe e0 a1 68 98 28 2a e6 39 c4 7e 0d f6 e6 b7 bb fe 65 ee 85 b7 2e f8 a7 99 fe ca fe 68 e8 93 ce a3 29 59 ce 5d ca 31 05 18 6c 2d 1f 8b 30 81 1d e0 c8 57 b9 01 65 8e 92 3b 16 5f b2 72 [TRUNCATED] Data Ascii: PNGIHDR@@%tEXtSoftwareAdobe ImageReadyqe<IDATxZp\~Ceda,rKI)`kJaMRd&61'`Y-dK#i4F#Jkj4w}>Mq{\|z?e11t bBH !MG&=F~{k"[+L\|vWh(9~e.h)Y]1l-0We;_rFZhXg?F1$OUo/,VHQa51Z@F]Zo11>Lx7gpjeXD!C):6JX.kj$g=71T5^={QgwxFU&0~NE]T J?PnJzFl.~Y.Kx6:1\\x.?5-K]-}\'^Ksn\zGrwi;W7/+o1cN~/T]Yv/Y'Env%n]:k^sy=6p&7ZU8=}d~If[v5_ajc;&"-`#qbk,gU:T?N f{\lmQD)T:J LFW4wMJJc}>\Q9jdjab/<\+@:vqL3~4\O{+mK]B16Cww,<lQwjK\|eC'5Mu{?Xww4[^_9wI$%v32+Wx [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:49.708409071 CEST	292	OUT	GET /js/jquery-1.9.1.min.js HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.473897934 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 36 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 dc bd ed 76 1b 47 b2 2d f8 9b b3 d6 bc 03 88 f6 69 83 a2 08 49 fe e8 7b 9a b2 a4 2b c9 72 db e7 d8 96 db 92 8f dd 07 a4 bc 40 a2 48 c2 02 01 1a 1f 92 68 d3 fd 62 f3 63 1e 69 5e 61 f6 de 11 91 99 55 28 50 b2 6f cf ac 59 d3 bd 2c a2 aa b2 b2 32 23 23 e3 3b 22 7b 27 ab e9 f1 72 3c 9b f6 aa 9b 9d e5 4e e7 d7 ff fd 7f db 7a 35 9c 77 a6 37 3b f3 9b 9d 71 e7 5e 67 79 79 51 cd 4e 3a cb 9b 78 b2 35 c3 8d aa 3f 9a 1d af ce ab a9 dd 1a ea d6 64 76 3c 64 37 6a b5 d0 ad 9f fe be aa e6 97 ba b1 d2 8d f7 f4 7b 82 df bf fe a6 9f c7 f8 39 38 d4 cf 0b fc ec de e9 ff b5 7f a7 ab eb 13 5c 1f f7 8f 67 53 74 ab 1b 23 dd b8 58 2d ce 74 79 a6 cb c5 64 7c 5c e9 fa 54 d7 e3 e9 a8 7a f3 f4 44 77 ce 71 67 d2 5f ce 9e 2d e7 e3 e9 a9 6e 5d ea d6 d9 70 f1 f4 f5 f4 9b f9 ec a2 9a 2f 6d 7c af f0 e0 a2 8f 86 e7 6a 77 84 cb 16 b8 6c 6d cd ab e5 6a 3e ed 4c ab d7 9d a3 fe c9 14 df 1b 2f 05 38 40 6b 87 6f da bc de e0 fd 5b 83 dd bd c3 07 bd 07 fb 07 a3 1b 07 fd ab 9d 83 d1 2e 2e 06 d5 93 [TRUNCATED] Data Ascii: 6000vG-iI{+r@Hhbci^aU(PoY,2##;"{'r<Nz5w7;q^gyyQN:x5?dv<d7j{98\gSt#X-tyd\|\TzDwqg_-n]p/m\|jwlmj>L/8@ko[..C=b^glybps{~Vdp;o\{7vv<VOzww7n=>9upU4z<oGWW7w8!0q>8\|yx{'>;v\|;xrNEu5]M&W{03/lzW9}J. ]UXk/+VU;G{r<_Leefy5]>[N~vo-_~xUURKuov>VohjGrx\|{T]pgi.):p`RGl9@@?L"ra/\|s[b5$iTovtzoxt3W#hj&]XFqpo^Zu><_7qD!oO`7nw' mxpV$4=;NwG:Gj~Z=.ETWFFs^c\|
Sep 27, 2024 06:10:50.473911047 CEST	1236	IN	Data Raw: 40 23 47 5f 33 cc ef f6 0e 66 f9 b8 bf ac 16 4b 1f 09 5e 3e ea 8f 17 df 4c 86 e3 e9 d3 a3 9f aa e3 25 c6 bd d3 39 99 cd 31 56 8c 8a 40 60 83 cf 82 1d 71 1c 83 31 e6 f0 40 33 c6 cf de 54 d7 0e 81 e1 72 39 ef 61 e9 75 d3 27 1e f4 99 2f d8 ba fe 96 Data Ascii: @#G_3fK^>L%91V@`q1@3Tr9au'/\|j?O&/Frx5X?u7j5Eke/u-p6?j0&vK/T\YQ6(BmLAgHh@8hT0]tep>^]E
Sep 27, 2024 06:10:50.474030972 CEST	1236	IN	Data Raw: 2d 3f 6f 08 dc 81 d9 ec f8 0c 1b a3 c9 c8 b7 ef 64 0c 97 a1 6f 6e da 8b 78 12 74 e9 69 53 ac 04 49 17 4d c4 8c f3 90 4b 63 d7 78 f1 e4 fc 62 79 69 82 67 1b 68 25 0a 15 5f 59 da 57 9a 10 0b 00 de ce ab 56 cd e7 34 04 ac ef 8f e5 d9 7c f6 ba f3 84 Data Ascii: -?odonxtiSIMKcxbyigh%_YWV4\|k,)KDS,tc:GmmXY.P3{SIhhZK\]iYS!Bg)Towc%Saf~w\|wdA?=ZB$H>@Z\`L05
Sep 27, 2024 06:10:50.474199057 CEST	1236	IN	Data Raw: 7b 9a b2 5f f0 04 d7 fe 88 43 85 02 9e f4 5e 9a c5 5c fe 23 50 b7 9d 14 18 13 5f 91 3a 61 fb 1f f5 6d 80 f4 ec 80 e2 ae 30 b2 c1 0a c0 a7 e9 86 96 d3 10 29 85 57 fc d2 b8 30 b3 59 b7 8d a5 01 00 00 10 19 28 61 92 ba d9 39 96 b4 b6 a0 94 3c 4d 62 Data Ascii: {_C^\#P_:am0)W0Y(a9<Mb5W)k^v/3f<Dp)0aI91@QD1HMgxcs^7#4=uB_OZ(`x6PYi`kOH:f;6&
Sep 27, 2024 06:10:50.474210978 CEST	1236	IN	Data Raw: 06 39 ca 0c 60 4b b1 be ad 2b 95 64 3f 83 82 6b 2d e8 7a 38 79 3d bc 2c f7 7e c1 28 7c 77 8c 2d fe 2b 13 d4 3e a7 5d 23 b0 99 a0 e4 9e 97 67 d5 b4 7d 2c 5c 12 4a 13 a9 c7 44 fc 92 c8 96 b4 9b 44 34 b3 7d 1a a3 6e 67 48 d9 f7 41 a6 c3 af 28 84 94 Data Ascii: 9`K+d?k-z8y=,~(\|w-+>]#g},\JDD4}ngHA(v4x3pnibCp[V,ep$xf]@0kkpPw:R&j#J^!IhHya32+yRi(AWs9+LD
Sep 27, 2024 06:10:50.474220991 CEST	1236	IN	Data Raw: 12 49 86 05 48 d9 9d 0d 9a cd 2d b3 ab 41 5c 9c 6a 80 b4 34 e8 b0 b0 8e 34 98 54 6a 09 12 4c 52 0a f2 6b 6b 39 6c 6c 21 6b 4d 0a 65 e8 ca 96 d4 d5 9a bd 12 41 d9 e9 1c 84 63 66 3d eb e7 7f f1 6b f6 92 70 25 b0 7e ad 03 07 64 62 0e cd 0f 4c 4b ce Data Ascii: IH-A\j44TjLRkk9ll!kMeAcf=kp%~dbLKA;^ q@vU#CM4Hq,pZl>y\3E_ZQ~%vGZ0_brI6+[\c0X}$n}::g\|5Q',vTVH\0xeG#\|3jCXAz/k
Sep 27, 2024 06:10:50.474231958 CEST	1236	IN	Data Raw: b0 e8 45 e4 63 bc c8 3f 86 66 d9 c2 4a cb a2 d9 1e e1 63 84 57 12 6f a8 c4 01 e3 2e 3d 99 9d 56 fb 04 59 01 47 09 67 0c c3 93 5b 13 26 4a 04 0b f2 67 09 c8 25 09 34 7b 8b b6 d6 0e 6e cf 14 85 94 42 10 52 94 37 54 64 55 c8 72 f3 2d d2 19 60 42 9d Data Ascii: Ec?fJcWo.=VYGg[&Jg%4{nBR7TdUr-`B&Jckr0?L v[q=A Dw@r^OPD{n&(-V}2I%bHW\4F+J>L%Lw>'5;Rn\|Qt97}BBY>,?
Sep 27, 2024 06:10:50.474370956 CEST	1236	IN	Data Raw: 61 90 ec 40 32 89 77 35 7c a5 d0 b6 84 18 65 72 5f 20 79 83 85 8b 32 6a fb b4 6c d8 df c5 fa de e1 03 74 8d b4 e6 ac 04 5d 26 c4 b1 b0 6f 00 35 fe 81 96 49 cf af e7 3d 98 81 c6 d5 51 27 1d c0 21 82 d5 17 60 53 e4 bc a4 4b 74 5d 24 69 41 8f 88 bc Data Ascii: a@2w5\|er_ y2jlt]&o5I=Q'!`SKt]$iA-:@f4P ss\|M?'nAP,SW(B!%cWYZi#gZyZ&Z1bq6-F-=Ab{J+fK_)=t<7o Fm\5WQNFL
Sep 27, 2024 06:10:50.474381924 CEST	1236	IN	Data Raw: 6b 26 7e f4 1d fa 91 d0 14 90 e7 63 41 3e 6a db 88 c3 e0 1f 73 57 95 c5 ab 63 6e e1 6e b5 a4 8c b8 62 ce 44 1b 0d b0 7c 45 3a cc 51 09 29 79 88 6c c0 81 b4 b1 d3 cc b5 46 13 c7 f1 f8 64 8c e0 72 e2 ab 2d 00 50 03 86 f0 37 56 57 32 ac 0d 46 d9 4d Data Ascii: k&~cA>jsWcnnbD\|E:Q)ylFdr-P7VW2FM\|q@`V(jJC>G\|JSq sW-k)VKzRV\|cDP5Tn6;)(}\|UrHP_eTE(D9
Sep 27, 2024 06:10:50.474395990 CEST	236	IN	Data Raw: 9c 0b 3a 1b df 7d db bc 1d 5c 16 0a d4 45 10 a7 70 c7 32 05 94 57 5b 5c 1f cf c0 1a 16 71 47 6a b4 64 be 04 ad 02 8a 94 33 7f 3f 18 b9 cf b9 a1 5b 06 1c 25 98 1d d2 32 25 d6 25 04 ed 30 7b bb 76 fa a6 d7 56 c8 42 91 45 2c 25 9c 9b d2 03 c2 54 3d Data Ascii: :}\Ep2W[\qGjd3?[%2%%0{vVBE,%T=78hg(>2Ute$Je3km5tRTrm'/4'4Qd=74b[<On@Fc}!=ruK/v6G,+B4?^cQ~L:]lupz
Sep 27, 2024 06:10:50.480113983 CEST	1236	IN	Data Raw: 44 4e 42 f5 c8 02 16 cb 29 73 c6 32 fa 0f ba e5 a4 1a 0b 16 5e 4c a3 bf 6e 0a 54 ea 0f 91 a7 c9 2a 93 50 9d 44 e7 92 fb b3 3a cc 47 ee 77 c8 b4 a5 06 7a 25 8e 39 c4 33 26 db dd 76 aa 1c 9f 4c 5f ac e7 9f 62 f1 ae a3 9d cd d8 7c 60 4e a3 78 89 e2 Data Ascii: DNB)s2^LnT*PD:Gwz%93&vL_b\|`NxLR1'YnH1\|-B9l#4, f=CKnO^^Ra=fG1;QT<NHfj2D5_]}H&2P]Sk!-?:%k4Sm5"}ioA3HU
Sep 27, 2024 06:10:51.274938107 CEST	289	OUT	GET /images/remen_02.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:51.525566101 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/jpeg Content-Length: 12630 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 2f 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta> [TRUNCATED]
Sep 27, 2024 06:10:54.624452114 CEST	487	OUT	GET /images/yonghu.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:54.875050068 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:54 GMT Content-Type: image/png Content-Length: 15209 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 af 00 00 00 d6 08 06 00 00 00 66 31 0d bc 00 00 20 00 49 44 41 54 78 9c ed 9d 31 74 dc 46 96 ae 3f ed 3a 1c 9e c3 cd 56 4c 5e 4f 30 74 b8 9c a1 73 c1 b9 38 a3 cd 46 da 60 a8 c0 f2 66 6b cb ce 49 e6 b6 24 67 cf 52 60 3a 18 69 b2 91 4d e5 86 72 d3 4b 87 e2 06 d3 93 50 e1 72 0f 9d ee d1 0b 0a f7 a1 ba ba aa 50 00 0a dd 8d e6 fd ce e9 43 36 1a 5d a8 06 0a f7 af 7b eb 56 01 14 45 51 14 45 51 14 45 51 94 61 b9 f1 bf ff fd 2f cb ae 83 a2 28 eb c5 26 70 b9 ec 4a 28 eb c5 3f fe d3 cf 33 ef df cb 54 ee 04 d8 01 4a b4 d1 2a dd 38 88 7c f6 1d 70 b6 a8 8a 0c c4 84 f5 bf 47 f6 81 ff c0 fc be 0f 97 5b 95 ff 4f 81 11 d3 97 4b ae 07 c0 0f 98 ba 94 c0 b7 c4 db 74 51 ed 2b de c5 0e 75 a7 e0 5f 07 ab e1 88 c8 e5 79 1d 00 87 d5 ff 67 98 8b f3 9a f5 b9 51 df 05 b6 1f 03 f7 ad f7 8f 69 6e 94 39 8e 3b 34 87 c0 d1 82 8f 19 fb ad 25 cb 35 86 05 70 0b f8 3b 30 c5 d4 a7 2d fb c0 37 d5 ff f6 3d 32 84 51 dd 07 fe 8f 67 fb 57 b4 bf 1f 0b 8c d1 75 79 02 7c 6a 1d ef 00 23 d0 [TRUNCATED] Data Ascii: PNGIHDRf1 IDATx1tF?:VL^O0ts8F`fkI$gR`:iMrKPrPC6]{VEQEQEQa/(&pJ(?3TJ8\|pG[OKtQ+u_ygQin9;4%5p;0-7=2QgWuy\|j#}:->?g5w'3AXMLc+0C)dZW{=r~UO"H;6<oVwq8#<9"zSd<}GXN&x;ZG0aXN}'mqZ`D?Q8e?&~71Ek^Swgd8sWl9pUOo\~?!c&WO[i{noIiq}KX/2CFNv6{]Te%F/7C.PRo,\|uP{`,SE23%WD>;_]s=OV{>a.fCiMw!>eo}L=qU4PL{}'l13<BjOV`%&?`S,[ [$,bxtMGc^1\a5(2q]1\Rs}JtF.6r+R^mt [TRUNCATED]
Sep 27, 2024 06:10:55.036566973 CEST	491	OUT	GET /images/zhongjiang.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:55.286737919 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:55 GMT Content-Type: image/jpeg Content-Length: 7324 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 51 00 00 ff e1 03 77 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyQwhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:24E89967CE3211E8B4DDA4073724961D" xmpMM:InstanceID="xmp.iid:24E89966CE3211E8B4DDA4073724961D" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D0A5AFB318CEE811B04EAF18D249C4AD" stRef:documentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:49.708503962 CEST	285	OUT	GET /images/logo.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.464462042 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/jpeg Content-Length: 16953 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 51 00 00 ff e1 03 77 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 [TRUNCATED] Data Ascii: ExifII*DuckyQwhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:4E33DCFCCE2911E88B78F26CC718825F" xmpMM:InstanceID="xmp.iid:4E33DCFBCE2911E88B78F26CC718825F" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CFA5AFB318CEE811B04EAF18D249C4AD" stRef:documentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>Adobed [TRUNCATED]
Sep 27, 2024 06:10:50.464474916 CEST	1236	IN	Data Raw: 0e 0f 0f 0c 0c 0c 0c 0c 0f 0f 0c 0c 0c 0c 0c 0c 0f 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 00 67 00 fb 03 01 11 00 02 11 01 03 11 01 ff c4 01 a2 00 00 00 07 01 01 01 01 01 00 00 00 00 00 Data Ascii: gs!1AQa"q2B#R3b$r%C4Scs5D'6Tdt&EFVU(eufv
Sep 27, 2024 06:10:50.464487076 CEST	1236	IN	Data Raw: 98 22 43 62 0e c4 21 32 f6 a4 df 41 f2 fe b7 e6 9d 5a cb 41 f2 e6 95 75 ad eb 3a 8b fa 76 5a 6d 9c 6d 2c b2 35 2a 68 a8 0e c0 0a 92 76 03 73 b6 60 6b 75 b8 34 58 65 9b 3c c4 31 c7 73 29 1a 03 f1 d3 bf 90 72 b4 fa 6c 9a 8c 83 1e 28 99 4c f2 03 72 Data Ascii: "Cb!2AZAu:vZmm,5*hvs`ku4Xe<1s)rl(Lr=k^N2IwH;C c<4xeGm)}ANXj2~@q\|{d4"[r6(O}OO>#?6Vg/CP
Sep 27, 2024 06:10:50.464493036 CEST	672	IN	Data Raw: e4 f2 07 e4 ed cf e6 2e a3 e7 bd 5a 5d 39 35 6b 6d 36 2d 2a da 0b 69 ee 65 b8 78 64 b8 69 02 88 55 82 f1 0c 37 72 a3 7e b9 f3 bf fc 15 7d 95 ed 0e df 8e 97 1e 8e 02 5c 06 66 44 91 11 10 44 6b 99 f2 e9 65 f4 3f 62 7b 6f 4b d9 67 34 b5 12 ae 21 1a Data Ascii: .Z]95km6-iexdiU7r~}\fDDke?b{oKg4!I5}]+;/)MO_)<K^Qs?FN<{?>%vMRa$$$F# ~3+=FDw8cp>D+{K'"Q#
Sep 27, 2024 06:10:50.464503050 CEST	1236	IN	Data Raw: e2 04 e3 9e 1c 9e 42 44 1f f6 51 03 fd 92 30 7f c1 13 b3 a6 6a 71 c9 0f 78 04 7d 84 9f b1 f9 63 f9 c7 e6 0d 23 cd 7f 9a bf 98 3e 65 d0 6e be bd a2 eb ba ed ed ee 97 78 63 92 2f 52 09 a6 2e 8d c2 65 57 5a 83 d1 80 39 f6 af b2 ba 1c da 1e c9 d3 69 Data Ascii: BDQ0jqx}c#>enxc/R.eWZ9i27X?zzvlS$[&oG"h/UOd?{o/>_O3];G;]x@!}vHd2Dv{C>v/9r's
Sep 27, 2024 06:10:50.464512110 CEST	64	IN	Data Raw: 44 59 34 03 f1 bb fe 73 57 f3 d7 41 fc cf f3 16 89 e4 ff 00 27 5d a6 a7 e5 cf 26 3c f2 5d eb 71 1a c3 79 7f 30 58 db d0 23 66 8a 14 5a 07 1b 31 66 a5 54 2b 1f bf ff 00 e0 4b ec 6e a3 b1 b4 d9 Data Ascii: DY4sWA']&<]qy0X#fZ1fT+Kn
Sep 27, 2024 06:10:50.464597940 CEST	1236	IN	Data Raw: 35 5a a8 f0 e6 cd 40 44 f3 84 06 fe ae e9 48 9b 31 e8 00 bd ec 0f 97 7d ba f6 83 17 68 65 8e 1c 07 8b 1e 3b b9 74 94 8f 77 90 ef eb 67 a5 17 8d 7f ce 2e f9 66 1f 36 7e 7d fe 5b 69 77 50 89 ad 6d f5 26 d4 ee 11 d4 b2 53 4c b7 93 50 50 e0 03 b1 78 Data Ascii: 5Z@DH1}he;twg.f6~}[iwPm&SLPPxUwz{BZdp%Oj`/?~5m<\|jhieI$QYtD3,=xYc@NT8a!}94ODd^{N
Sep 27, 2024 06:10:50.464778900 CEST	1236	IN	Data Raw: fb 8b f9 60 cc 87 e6 e7 62 af d5 ef ca 8f f9 cd 2f c9 ff 00 25 fe 5a 79 1b ca 5a c5 b7 98 5b 55 f2 ee 8b 69 a7 ea 0d 6f 65 03 c4 65 82 10 8f c1 9a e1 49 5a 8d 89 03 3e 20 f6 97 fe 04 dd b1 da 3d a7 a8 d5 62 38 b8 32 64 94 85 c8 83 44 d8 bf 49 7e Data Ascii: `b/%ZyZ[UioeeIZ> =b82dDI~n{?Ib\|P/W:y]7']+@Y$BFxWv?P((}''#jJ9g~ngO8hvq4adu!fRg;[W}.C >
Sep 27, 2024 06:10:50.464791059 CEST	1236	IN	Data Raw: a1 22 84 6b 9b 89 e6 7b ab 99 8a 02 dc 7d 49 a5 76 0b 53 c4 1a 54 d3 22 4d bd 3e 87 49 1d 26 08 e2 8e e2 23 f6 9f b5 e9 98 1d 8b f1 b3 cb df 9f fa 25 8f fc fc 77 cd 5a cc d7 d0 c7 e5 7f 31 16 fc bb 3a 97 35 31 2b 41 0d b4 11 bf 32 78 f0 7b fb 45 Data Ascii: "k{}IvST"M>I&#%wZ1:51+A2x{E:[>Q}\|yS,qO6yb+-"ghJdF;hkDqP7,t~fN^w7?VCjvYA.,1?2_
Sep 27, 2024 06:10:50.464801073 CEST	1236	IN	Data Raw: b0 07 09 3b 1e b7 5b 3f 5c 73 e1 57 e9 57 e7 3f fc fc 2f ce f6 16 fe 52 f2 6f e5 e4 33 ab ea da a6 a7 fa 72 f6 05 20 b4 56 96 90 cb 6d 1f 31 d4 09 64 98 f1 f1 f4 db 3e b1 ff 00 80 77 64 64 9e af 3e b8 8f dd c2 1e 18 3d f2 91 12 35 fd 58 c7 7f eb Data Ascii: ;[?\sWW?/Ro3r Vm1d>wdd>=5Xpco8\|(y6{>m}q F 1*3#WP\|cY[W}#Ci%s7tR"(}syiyG1
Sep 27, 2024 06:10:50.471415043 CEST	1236	IN	Data Raw: b7 e5 cf e5 05 bf 9d f4 ef 3f 6a 77 3a 47 f8 8a e2 c2 6b 0b d8 ed 27 ba 84 2d ba 4c af ea 7d 59 64 90 1f de 0a 51 0e 7c d9 ff 00 05 7f 63 7b 4b b7 a5 a7 c9 a2 80 9f 86 26 08 32 11 3e a3 1a ae 2a 1d 3b d3 ec 47 b4 1a 4e cc 19 63 a8 91 8f 19 8d 1a Data Ascii: ?jw:Gk'-L}YdQ\|c{K&2>*;GNc$m}z?Gt}aQ?5\|E^>J>SX}+Y6F4n?k)l_ne44Y8@9`,1$K93{[Akc
Sep 27, 2024 06:10:50.725016117 CEST	280	OUT	GET /js/move.js HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.975610971 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 34 63 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 a5 98 cb 52 1b 57 10 86 f7 a9 ca 3b a4 bc 71 a2 45 ac 99 33 67 2e 15 e2 07 c8 3a 59 a4 ca 1b 85 11 d6 60 5d 30 97 c8 62 65 20 42 18 09 30 e5 98 40 24 93 d8 e0 24 26 58 82 44 18 61 b0 78 19 9d b9 ac f2 0a e9 23 34 4a a5 72 d2 c8 d5 55 da a9 ab fa 9b ee bf fb 74 f7 5f e7 97 6e 61 7c 2e 97 ce cf 7e 5a 9c f6 66 d3 d9 fc c7 37 c6 b2 de ed 31 d7 fb f6 a3 f1 6c 6a 66 e6 f3 3b 37 3d f7 ce cd db 59 2f 91 48 98 dc 1e bb 05 7f fd fb ff 7c 2a 97 06 8b 70 f5 18 7e a2 7c 28 5e 3f 56 58 e5 0a f9 74 09 cc 34 4d 37 f5 a4 28 2f 0d 6c 6e 81 bb 1b 9f 7c f6 e1 07 a3 92 cc 67 0a 73 c0 92 99 f3 14 5e 06 2c c1 1f dd 60 e1 24 b8 2c 87 cb 0f 15 56 43 16 a6 eb 49 83 c0 f2 c5 57 5f 03 8a 65 9a 0a 27 03 94 e8 c9 9b f0 79 2d 58 59 0e 7e 6e 2b ac 62 14 8b 03 0b 81 c4 4d e7 21 3f 18 48 af f3 5a d4 df f9 5b 47 e2 0c 05 61 3c 49 49 cf a4 07 20 09 d7 55 7c eb 20 22 bd 4e c3 df 3a 0b db 2f 44 ab a6 b0 8a 23 e2 98 3a 63 84 88 8c 67 d2 00 92 c4 52 73 be ee 6f af 07 3f 7e 17 3d 7b 21 6a 65 84 [TRUNCATED] Data Ascii: 4c2RW;qE3g.:Y`]0be B0@$$&XDax#4JrUt_na\|.~Zf71ljf;7=Y/H\|p~\|(^?VXt4M7(/ln\|gs^,`$,VCIW_e'y-XY~n+bM!?HZ[Ga<II U\| "N:/D#:cgRso?~={!jeEKBz4LAF%HVoWfrDJ)Mk:uYHH8H# dpX\|Ib Q^Lb}2n0J5M#(FzUa2`(3s4a;q/smh)bn:6!'i_CNh>SX96 2)sm:uo.# 6H>pcw^OCgqR1qR4 LhqUN)+3H5lGQvFTwB#0dX.FzesY)\uXmZU,q?@WxNAPk#cpc5yj+^VK2fHGhfE9)s;"aVn[,$=WZAuQA<t(i`G5<GsT;@!FPM-YLN$LlWomK"ti!rDdB<<4c*%_]H]9! q+3fRq"-l/JJRR@1W@qRkbY[:ID"K~I; 68m
Sep 27, 2024 06:10:51.274931908 CEST	289	OUT	GET /images/remen_01.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:51.523935080 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/jpeg Content-Length: 12655 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 09 50 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 2f 3e 20 3c 2f 72 64 66 3a 52 44 46 3e 20 3c 2f 78 3a 78 6d 70 6d 65 74 61 3e 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 [TRUNCATED] Data Ascii: Phttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta> [TRUNCATED]
Sep 27, 2024 06:10:54.620728970 CEST	485	OUT	GET /images/dbbg.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:54.869388103 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:54 GMT Content-Type: image/png Content-Length: 47830 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 03 f8 00 00 01 10 08 06 00 00 00 04 53 df 51 00 00 ba 9d 49 44 41 54 78 da ec bd 75 b3 6c 4b f3 26 94 27 82 2f 82 4b e0 ce 00 13 b8 c3 e0 ee 2e 81 8c fe 46 81 61 5c 18 06 0f 5c 07 b7 c1 21 70 19 dc 5d 3f 09 11 9b 7e 2f ef be f4 ad 93 f9 48 56 ad ee de fb e4 f3 cf 3d 7b ad aa ac cc a7 b2 b2 32 6b 55 c7 fd 12 22 de de de d4 a6 83 c1 60 30 18 0c 06 83 c1 60 30 18 0c 36 f0 e5 cb 17 bf 8f da 70 0a fc c1 60 30 18 0c 06 83 c1 60 30 18 0c 1e 83 29 f0 07 83 c1 60 30 18 0c 06 83 c1 60 30 f8 04 98 02 7f 30 18 0c 06 83 c1 60 30 18 0c 06 83 4f 80 29 f0 07 83 c1 60 30 18 0c 06 83 c1 60 30 f8 04 98 02 7f 30 18 0c 06 83 c1 60 30 18 0c 06 83 4f 80 4b 0b fc df e8 a7 fc a4 5f 01 5e bf 15 b2 de 9f b3 f7 8a ac 57 80 aa db 7d bb ab ec e9 ca 5d fb 55 7f bf 9f e8 7c 49 9e 3f 73 7e d0 f8 99 8e 8e ef 31 f9 8f b4 eb b4 1e 88 13 65 ac 2b f5 db 91 b5 fa e9 b3 71 6a 5d de 3f db e5 ba 92 e3 c6 b3 67 c4 b2 47 f9 99 eb 47 af e6 77 c8 de 2a a6 3b fc 38 e3 39 32 77 d6 8b 63 8b 3b [TRUNCATED] Data Ascii: PNGIHDRSQIDATxulK&'/K.Fa\\!p]?~/HV={2kU"`0`06p`0`0)`0`00`0O)`0`00`0OK_^W}]U\|I?s~1e+qj]?gGGw;892wc;jv[m>or'ON<Sw}L};vr4_~6Me}Wm>Uw=::c:)OGtdhNs%2'Yc>n?w>OSv:Ow#cTet[Fwwm?gO/\|AQY?Yu,.W.:'[3;ms>'kk@[k Tmq)Muqv{$#'NbtNo=b;-JillCm3=ZU6(d*\|}bIM:U-e"{\|;M9YmdUL}J6D=~`&mjWsELG5@?l\s;s]{JD+="j?r({75aQJ3ov_s%t[X?.`0`0\)V\a/)o<^cp:8Z/q<W([5 [TRUNCATED]
Sep 27, 2024 06:10:55.183919907 CEST	487	OUT	GET /images/dblogo.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:55.434372902 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:55 GMT Content-Type: image/png Content-Length: 5000 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 e3 00 00 00 3a 08 06 00 00 00 42 bf ee ab 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDR:BpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:49.708543062 CEST	278	OUT	GET /js/js.js HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.465116024 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Content-Encoding: gzip Data Raw: 66 32 62 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 5a dd 8f 1b 57 15 7f af d4 ff c1 3b 2a db b9 f6 9d f1 47 ba b4 d8 3b 6b 25 bb 09 dd 36 69 76 f3 d1 14 aa b6 9a 2f db b3 6b cf 4c ec f1 6e b6 bb fe 63 68 24 e0 a1 88 b6 4a 68 a1 22 15 14 54 d2 a6 a4 22 10 0a 0f 08 fa 80 10 15 12 a2 a8 e5 05 89 df fd 98 f1 1d db eb dd 42 5e 78 b0 3d 73 ef b9 e7 9e ef 73 ee b9 2e 17 17 1e 7e a8 50 2c 5c 1c c6 7e ff 62 37 f0 fc c2 4e cd ac 9a d5 02 1f 7e ef 4f 1f dc fe f1 27 b7 3e ff f0 5f bf b9 75 e3 b3 37 de 79 f3 fe 9d 8f 3f fa ce 6f 7e f8 fe ad 5f be 7f e7 13 0e 72 f7 af b7 be f5 d1 cf ef be f2 de a7 ef dc f8 e1 ef 3e fc d7 f5 1f 75 92 24 ae 97 cb bb bb bb e6 18 6d cd 74 a3 5e 99 ad e0 ab 56 a3 78 af 1f b4 3b 49 a1 56 a9 56 0d 7c 9d a0 85 1b 9f bd fd da fd 2f ee 7e 3f 83 7a ef d3 df fe fd fe c7 bf fe de 8d 1b d7 5f 7d fd fa 4f fe f9 e1 9b 6f bc f3 da 9f 7f f1 5d 8e e2 d7 bf 67 43 ec f5 e6 cf de 7b ed ce 9f ee fe f4 9d db f7 be 7d ef dd 7b bf 7f eb f3 5f 7c f0 f6 3f 6e df f9 d5 cd 7b ef 7e 78 eb e1 87 38 b8 60 eb fa 8f [TRUNCATED] Data Ascii: f2bZW;G;k%6iv/kLnch$Jh"T"B^x=ss.~P,\~b7N~O'>_u7y?o~_r>u$mt^Vx;IVV\|/~?z_}Oo]gC{}{_\|?n{~x8`>[7n~{o}>&or/-{MIo}}oL[a&A6Vh0l!sa<kJk?ho\|7k-${\|<\z~}RA}Vc9:dv@=;i4m_n7EWzpG;~_E\|pkBBIq;G;S]Qs(S .~@N:9!&;dx;.&b)4![BuDN00}n/m'-SPuPrMhkm>Jt*.6aA6e}.K&{Vt;ANR%I#230b?Us#j~J-}u<3`P)vLL4QW#$t 3Y=\2cUAajO.^W{EOB"8eD.8.\V]4>g:3NnIyJ<3[x5S+=M=gQ~>c<>Vo6+V+Izu~+9g
Sep 27, 2024 06:10:50.465464115 CEST	224	IN	Data Raw: f7 af 0e 7d a6 46 48 5c 83 67 2a 03 cd 85 0a 0b 0b 17 c7 a1 95 05 dc 60 00 ef 17 01 18 56 2b 23 03 59 5c 1c bf e8 31 dd a6 1e 9d f0 8b 2e 8d 68 8b b6 c9 88 5e 9a 83 50 04 17 8e 4e 3c 1e 85 ec b2 8a 6c cb ec fb 3d c4 4f 1e 28 f5 a7 09 3d b9 b8 b8 Data Ascii: }FH\g`V+#Y\1.h^PN<l=O(=eWgi{^:<j-]/D saQZKik9d\"uk',DD%b[v:4>wmx#cM%uBAa_b=NUuz4oo7rP
Sep 27, 2024 06:10:50.465473890 CEST	1236	IN	Data Raw: 1d 9f 95 12 13 28 46 23 0a 7e c7 39 11 3a 56 22 b6 e4 c6 ed fa 36 4f a1 8c d9 f5 69 92 a7 c9 ec b0 14 cd c9 3c 9c c8 6c 55 4a 98 b2 68 34 22 f4 d4 e2 a2 37 ad ac 1c 2d 4f e5 c9 7d 4a 55 ca 65 7a 95 00 cb 4e 14 78 85 0a b3 1a 04 b8 ed c5 45 7d db Data Ascii: (F#~9:V"6Oi<lUJh4"7-O}JUezNxE}z?F10b~27mI7+/)Ui<=kac(o-'7IC05MXK2>*k1FZQ_g[?gU+5+-w?W\fo!dQ=Q>
Sep 27, 2024 06:10:50.465483904 CEST	1236	IN	Data Raw: 94 6b 70 a2 5a 3c 16 55 22 61 a5 44 4d 4b 2e 47 14 93 7e 9e a6 d5 09 9a 04 c4 46 71 75 06 49 b9 52 47 a4 a9 f9 91 aa 81 23 63 0c 81 64 1a e6 22 2c 95 dc 11 ad e4 fc 8f 97 ac 87 c5 bb 15 ab 32 29 32 14 82 10 17 ec 28 8f d9 30 be 1c e6 65 cb 40 91 Data Ascii: kpZ<U"aDMK.G~FquIRG#cd",2)2(0e@t9>&Il:OT*y9Ce\77wA\FcdmgXY0X\l)Ae2FdT+<cyFet@'v(('@K#22Aj
Sep 27, 2024 06:10:50.465495110 CEST	192	IN	Data Raw: 7b 09 d8 27 ca 9a ff 7a 8b 89 50 8b 20 03 26 f4 56 11 b1 61 a9 b6 c4 f6 91 dc 4c 94 40 53 40 8c 28 b5 80 38 15 e1 7f 3d f3 d2 6c c1 33 f2 a5 ae ac 52 c5 42 d4 bc be e1 a0 a7 c5 0a 65 25 e7 1e 89 56 04 ab e5 6a b9 66 3e be d4 f4 8a 8f 9b 4b 5f ad Data Ascii: {'zP &VaL@S@(8=l3RBe%Vjf>K_-Gamvb.V.TMM<fb1=Kw\|POcsLH(3!1?6Hm)<Y5O,0
Sep 27, 2024 06:10:50.724771023 CEST	291	OUT	GET /images/wangzhi_11.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.974642992 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/png Content-Length: 6067 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 13 00 00 00 3b 08 06 00 00 00 58 21 6e 57 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 1b 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 37 2e 31 2d 63 30 30 30 20 37 39 2e 37 61 37 61 32 33 36 2c 20 32 30 32 31 2f 30 38 2f 31 32 2d 30 30 3a 32 35 3a 32 30 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 [TRUNCATED] Data Ascii: PNGIHDR;X!nWpHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 7.1-c000 79.7a7a236, 2021/08/12-00:25:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmp:CreateDate="2024-06-30T12:39:38+08:00" xmp:ModifyDate="2024-06-30T13:29+08:00" xmp:MetadataDate="2024-06-30T13:29+08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:9f0f2733-d911-f449-8d3e-d6acdbc51a6d" xmpMM:DocumentID="adobe:docid:photoshop:86c16bb2-211c-4c4d-aa05-fd4b6a2cbdf1" xmpMM:OriginalDoc [TRUNCATED]
Sep 27, 2024 06:10:50.974663973 CEST	224	IN	Data Raw: 31 61 34 31 2d 39 64 33 33 2d 34 30 30 64 38 63 39 37 31 30 63 39 22 3e 20 3c 70 68 6f 74 6f 73 68 6f 70 3a 54 65 78 74 4c 61 79 65 72 73 3e 20 3c 72 64 66 3a 42 61 67 3e 20 3c 72 64 66 3a 6c 69 20 70 68 6f 74 6f 73 68 6f 70 3a 4c 61 79 65 72 4e Data Ascii: 1a41-9d33-400d8c9710c9"> <photoshop:TextLayers> <rdf:Bag> <rdf:li photoshop:LayerName="" photoshop:LayerText=""/> </rdf:Bag> </photoshop:TextLayers> <photoshop:DocumentAncestors> <rdf:Bag> <rdf:li>ado
Sep 27, 2024 06:10:50.974673986 CEST	1236	IN	Data Raw: 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 35 39 34 35 35 63 30 2d 33 65 64 36 2d 65 63 34 63 2d 39 34 31 34 2d 64 63 62 61 36 65 37 34 31 39 36 32 3c 2f 72 64 66 3a 6c 69 3e 20 3c 2f 72 64 66 3a 42 61 67 3e 20 3c 2f 70 68 6f 74 Data Ascii: be:docid:photoshop:b59455c0-3ed6-ec4c-9414-dcba6e741962</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:cff789dc-b483-1a41-9d33-400d8c9710c9" stEvt:when="202
Sep 27, 2024 06:10:50.974755049 CEST	1236	IN	Data Raw: fa 1f 03 bf 0a fc 9f eb 64 85 db 6b 28 52 3e 61 10 05 f6 77 99 ee ad aa ed 24 8b a5 01 b8 e8 cd 6a d4 61 10 f5 54 a0 60 d9 45 c2 20 6a 89 10 3b 03 9c f7 5d 13 8d 2b 2e b3 e5 3f a8 70 bb 07 90 a9 db df 04 1e 5b 20 ef 2b 72 de e1 06 f8 21 70 1d de Data Ascii: dk(R>aw$jaT`E j;]+.?p[ +r!p//I?:Ri&Q?3Mb6<-)r6j[,@R{o^A}/utTCNkoN_^sb&\| Fx5P
Sep 27, 2024 06:10:50.974766970 CEST	1236	IN	Data Raw: c1 e8 fc d7 4a c9 3a ae 97 80 5b a5 33 c0 2e ea 73 b0 a8 07 64 92 c6 d5 24 8d 8f a5 22 66 cf b5 a5 e2 6d 0c b9 6f 7b 46 92 23 36 e4 89 ba 2d 44 78 5e 60 dc e3 db 98 d5 cb e7 22 38 5d e9 8f 25 fd 11 66 95 f4 85 0a e0 0c e7 92 ce f5 39 b2 d2 a9 30 Data Ascii: J:[3.sd$"fmo{F#6-Dx^`"8]%f90d{`imgjQSqND1iO<h1NNHZ{rttFiv-G(?nQ4HC;J.Ta}eWV1kbaLRKU`urmxv;/1
Sep 27, 2024 06:10:50.974772930 CEST	512	IN	Data Raw: fd ce 86 8c 87 56 2e ad 68 55 6e ac a0 28 42 a9 84 49 d9 08 83 c8 76 af 9d 1a a7 5a 82 62 56 ef 3c cb 49 4d 8d b2 79 d1 dc f5 b8 fa 5f d8 02 49 87 2b ba 39 78 b6 0c ab 5c ab 8d 5c 1b 7a 2f f3 f7 50 ce 39 dd dc 15 b1 93 9c 27 e3 ad 49 e7 a1 06 60 Data Ascii: V.hUn(BIvZbV<IMy_I+9x\\z/P9'I`u0w49a#fis8_PBar5}mz)*;37n$=!Nj:\H:(=L!T]"Fe\|I:S3S:KB1fc:uMi{3c
Sep 27, 2024 06:10:51.061429977 CEST	580	IN	Data Raw: 30 f6 9d d0 05 7c 6a af 98 9a 51 91 77 d3 c1 34 d6 0b c6 fe 16 f6 3e c9 5a c6 03 b9 5f db 4a 5b c7 4c f9 da cf 55 b5 b4 6c 94 ff 96 fc be 76 5e 3a b9 a7 d6 1f ed 48 74 d9 c3 44 94 7f f9 ae 5e d3 17 98 4e e9 50 8e ed 67 9e 97 b3 4c 42 5e e7 38 eb Data Ascii: 0\|jQw4>Z_J[LUlv^:HtD^NPgLB^8$i1rP[[(1m<CV$."\!Tkspm=5E]Es/v<;!L`JZz<%g+vFB&OXZ=u[):3A=]
Sep 27, 2024 06:10:51.270768881 CEST	283	OUT	GET /images/jt.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:51.520591974 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/png Content-Length: 3137 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 21 00 00 00 19 08 06 00 00 00 bf cd 47 af 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDR!GpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]
Sep 27, 2024 06:10:54.631994009 CEST	483	OUT	GET /images/bg.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:54.880882978 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:54 GMT Content-Type: image/jpeg Content-Length: 155437 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 09 06 07 08 07 06 09 08 08 08 0a 0a 09 0b 0e 17 0f 0e 0d 0d 0e 1c 14 15 11 17 22 1e 23 23 21 1e 20 20 25 2a 35 2d 25 27 32 28 20 20 2e 3f 2f 32 37 39 3c 3c 3c 24 2d 42 46 41 3a 46 35 3b 3c 39 ff db 00 43 01 0a 0a 0a 0e 0c 0e 1b 0f 0f 1b 39 26 20 26 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 39 ff c2 00 11 08 04 52 07 80 03 01 11 00 02 11 01 03 11 01 ff c4 00 1b 00 01 00 03 01 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 ff c4 00 1a 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 01 02 03 04 05 06 ff da 00 0c 03 01 00 02 10 03 10 00 00 00 f8 6d 7e 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: JFIFC"##! %*5-%'2( .?/279<<<$-BFA:F5;<9C9& &99999999999999999999999999999999999999999999999999Rm~x [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:49.710655928 CEST	291	OUT	GET /images/wangzhi_22.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:50.495488882 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: image/png Content-Length: 12793 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 13 00 00 00 3b 08 06 00 00 00 58 21 6e 57 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 07 34 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 39 2e 30 2d 63 30 30 31 20 37 39 2e 63 30 32 30 34 62 32 2c 20 32 30 32 33 2f 30 32 2f 30 39 2d 30 36 3a 32 36 3a 31 34 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 [TRUNCATED] Data Ascii: PNGIHDR;X!nWpHYs4iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 9.0-c001 79.c0204b2, 2023/02/09-06:26:14 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 22.5 (Windows)" xmp:CreateDate="2024-06-30T12:39:38+08:00" xmp:ModifyDate="2024-07-03T07:33:57+08:00" xmp:MetadataDate="2024-07-03T07:33:57+08:00" dc:format="image/png" photoshop:ColorMode="3" xmpMM:InstanceID="xmp.iid:89e40740-c159-224e-a3fc-ecc221e952e3" xmpMM:DocumentID="adobe:docid:photoshop:0c21d51e-c753-8d4f-8e04-b84c38bae71c" xmpMM:OriginalDocumentID="xmp.did:9003e440-4aae-1f45 [TRUNCATED]
Sep 27, 2024 06:10:50.495510101 CEST	1236	IN	Data Raw: 70 3a 44 6f 63 75 6d 65 6e 74 41 6e 63 65 73 74 6f 72 73 3e 20 3c 72 64 66 3a 42 61 67 3e 20 3c 72 64 66 3a 6c 69 3e 61 64 6f 62 65 3a 64 6f 63 69 64 3a 70 68 6f 74 6f 73 68 6f 70 3a 62 35 39 34 35 35 63 30 2d 33 65 64 36 2d 65 63 34 63 2d 39 34 Data Ascii: p:DocumentAncestors> <rdf:Bag> <rdf:li>adobe:docid:photoshop:b59455c0-3ed6-ec4c-9414-dcba6e741962</rdf:li> </rdf:Bag> </photoshop:DocumentAncestors> <xmpMM:History> <rdf:Seq> <rdf:li stEvt:action="created" stEvt:instanceID="xmp.iid:9003e440-4a
Sep 27, 2024 06:10:50.495521069 CEST	1236	IN	Data Raw: 01 b9 70 86 74 c7 0d f6 5a 43 ee 2c 47 78 5d 66 00 ad 82 b1 3b 1b 14 27 1d 25 37 47 d2 fa b7 5e 19 18 42 6d 70 3f 56 44 4a 31 95 b9 aa aa 89 5b 37 05 4a 51 57 9a 9a d2 d4 94 a2 ae a6 40 35 71 6b 15 53 aa 81 1b 94 32 d5 74 bf a1 1f a3 12 d7 60 bd Data Ascii: ptZC,Gx]f;'%7G^Bmp?VDJ1[7JQW@5qkS2t`wXCNu.em,,baLlWZd #c;w6mJ_34Szfj_n [&}Y^%zW<xBLkS;\^RIr-cL&;
Sep 27, 2024 06:10:50.495656013 CEST	1236	IN	Data Raw: 48 97 85 83 0a 8f c6 31 11 eb 7a 66 f2 13 09 c9 1d c8 f3 38 30 0c 50 ed f3 78 4f 77 ac 81 19 14 67 52 b9 9b 81 e7 00 97 02 37 67 c2 5e 04 fc df 99 12 9f 89 4c 1e 46 7a e8 21 e0 54 44 7b b6 8c 79 c0 93 10 89 ef f8 55 e1 8e f5 ac 7f 67 1e f7 87 0e Data Ascii: H1zf80PxOwgR7g^LFz!TD{yUgGP!;\|<v?q{qRu9'KhP"bUc/RVjZpLr+e;+-txTYaQf3}ay vpS3wWo",4j
Sep 27, 2024 06:10:50.495666981 CEST	736	IN	Data Raw: 99 46 ad 05 f5 50 66 4d de 6b 99 93 d9 9b 53 01 2c 1a 8b c6 13 20 46 ee 22 74 90 8a 8a 6b c9 b7 af 04 dd c4 9c de 93 75 02 5c 06 20 15 f1 bb 20 3d e5 6f 81 cb 9f d4 e2 cc 13 1a c5 78 dc 15 3a 57 c7 33 41 66 ef ee 38 4b ec 02 7c 08 f4 0b 0d b5 d5 Data Ascii: FPfMkS, F"tku\ =ox:W3Af8K\|s<-~Le6Slfa=\% 6T&bDN"(I<p(2;@G}9^C$V$LJ:y?Qln!N6<,ftYJL
Sep 27, 2024 06:10:50.495677948 CEST	1236	IN	Data Raw: 1d 26 d9 dd 42 06 f6 24 f5 7b 36 fa 32 18 18 a1 9d b6 fe 9c 82 2a 8c fe 5b d2 be f1 40 be 5f 33 b5 49 b3 e7 e5 1e bd 1b 34 45 39 64 6d a3 a5 3c 11 ef 4f 9a 8c f7 1c bf af 04 f1 9e 25 26 41 13 62 de 29 bf 15 3c 14 2c 94 0f 9e 81 7a 83 07 23 a4 e2 Data Ascii: &B${62*[@_3I4E9dm<O%&Ab)<,z#q}mbOT;EO69touJudLH7(3$WLM1tOl:&QLdq<q'h3{8(w)z4W]dYD#
Sep 27, 2024 06:10:50.495862961 CEST	1236	IN	Data Raw: 4c 57 94 ce 17 1a da 67 a9 40 f7 ab 40 03 7c 87 62 52 be 79 0d 3e 00 bd aa 33 1d 00 9f 39 79 ce 29 64 e7 63 31 9b a6 c7 e1 a8 7c 19 1a 0d 4f 61 a4 c1 fa 3f 07 57 e8 f4 cf c9 d6 e7 d1 88 5e a4 b2 3f 26 95 05 a3 80 a5 93 4c 16 78 59 33 18 37 5b cd Data Ascii: LWg@@\|bRy>39y)dc1\|Oa?W^?&LxY37[$Uh1G^"kB/X.@wt:'Ju,$\|&{VOJ^N%+'j$9MYWyN\|n2'^I)YOtm4iab[rM0v'
Sep 27, 2024 06:10:50.495874882 CEST	1236	IN	Data Raw: df 45 d9 eb be 27 cf 71 2c 10 fc 96 23 ba b7 1a ef 44 9e 6e 85 4a 7c 64 a2 d5 00 25 1a 85 ee 41 29 5e 2d e6 77 40 8f 78 29 4b 18 90 6b 0c e2 f7 83 3f 2e 3b 61 24 f1 1c b5 2b 57 c6 ef ed 81 82 83 c6 d4 16 ec 5b 6b 68 1a 6d 67 44 8e f1 f8 1f 45 34 Data Ascii: E'q,#DnJ\|d%A)^-w@x)Kk?.;a$+W[khmgDE4K~&r\|ERArD?iRPC;suC0#o`fr8j.wj1ML+CaR9kUCi@YQS{>:Xp?KVz{+x<h^aj
Sep 27, 2024 06:10:50.495887041 CEST	1236	IN	Data Raw: f0 63 e0 c7 58 0a 97 82 c3 50 7f 3d 6d 92 c9 d6 d1 c9 c0 06 1c ea 65 1e 4f 40 e1 66 49 27 e9 79 b9 a6 c2 dd ee 21 18 a4 d1 e1 b1 a2 89 fe 43 ce d0 dd 8f 58 08 dd 9d 12 62 be 7e 3b 35 64 09 45 ec 1b e4 36 1c fe 52 a5 bf 77 f3 7c f0 94 24 13 85 72 Data Ascii: cXP=meO@fI'y!CXb~;5dE6Rw\|$rdZ6KUX9$9# Eb\s+"Y,v8:whtp6Ge+Qc5\|ZkK8}Td<XjQ"0b(n\|(`CxXg
Sep 27, 2024 06:10:50.495898008 CEST	736	IN	Data Raw: d1 ae d3 a0 f1 b6 88 16 0e b3 bd ce 23 a7 82 19 72 b8 ef 04 38 2c ee ed 42 5e 16 4f ed eb e7 93 fb 1f 8e 20 6c f1 c0 89 25 c2 6f 68 cc 6a 87 bd 56 74 14 07 89 87 c7 40 d2 2f 64 49 d2 b8 05 4a a3 e7 53 7a d5 1d ec 64 02 77 b3 c1 fc 48 a3 de e0 50 Data Ascii: #r8,B^O l%ohjVt@/dIJSzdwHPUO7%LQ{s -vnyT?.%aE X.v9 3'rL&D:Zo*ZiHq:Iqd/BLATbYO0!.F#T4f
Sep 27, 2024 06:10:50.500391960 CEST	1236	IN	Data Raw: f5 9c 76 7b 8d f2 30 c3 b4 02 30 03 53 94 0e 95 d8 c3 18 c7 30 c4 a4 02 ef 65 22 6e 21 66 cd e9 38 c8 fd ac 8a 07 fe 08 da af e4 99 c0 0f 80 8b 11 ab 5a 1e 18 35 a0 2c 38 75 10 ed 57 71 12 f0 28 b2 dd 21 f1 48 56 c1 38 53 45 50 13 b2 cc 51 40 75 Data Ascii: v{00S0e"n!f8Z5,8uWq(!HV8SEPQ@u.GQpaWN,3A!3\Ay$/Hs<h2Hil4I[TI*T?bIE&@\|W'K:ie_FGix2Icuyh#4Dq1VP4_b
Sep 27, 2024 06:10:51.275145054 CEST	289	OUT	GET /images/remen_04.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:51.527890921 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/jpeg Content-Length: 13294 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 00 00 64 00 64 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 32 20 37 39 2e 31 36 30 39 32 34 2c 20 32 30 31 37 2f 30 37 2f 31 33 2d 30 31 3a 30 36 3a 33 39 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 3e 20 3c 72 64 66 3a 44 65 73 63 72 69 70 74 69 6f 6e 20 72 64 66 3a 61 62 6f 75 74 3d 22 22 20 78 6d 6c 6e 73 3a [TRUNCATED] Data Ascii: JFIFddDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:18D7289A17DF11E9AE33D32F7AFB87CB" xmpMM:InstanceID="xmp.iid:18D7289917DF11E9AE33D32F7AFB87CB" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2018-11-09T14:08:44+08:00" xmp:ModifyDate="2019-01-14T17:30:57+08:00" xmp:MetadataDate="2019-01-14T17:30:57+08:00" d [TRUNCATED]
Sep 27, 2024 06:10:54.628032923 CEST	487	OUT	GET /images/xiazai.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:54.880835056 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:54 GMT Content-Type: image/png Content-Length: 10279 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 1f 00 00 00 46 08 06 00 00 00 f5 a1 90 c6 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDRFpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]
Sep 27, 2024 06:10:54.884062052 CEST	486	OUT	GET /images/jietu.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:55.136740923 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:55 GMT Content-Type: image/png Content-Length: 150187 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 58 00 00 01 58 08 06 00 00 00 16 6c e4 40 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 07 74 49 4d 45 07 e5 01 01 03 02 24 03 f2 56 4e 00 00 80 00 49 44 41 54 78 da ec fd 77 9c 5d d9 75 df 89 7e f7 39 37 e7 ca 39 a0 0a 40 21 c7 46 03 e8 80 66 27 76 60 b3 29 46 05 2a 50 b2 64 69 82 25 db 63 cf 8c 47 9e 67 f9 f9 d9 63 cf 8c 66 64 8d 64 49 56 b2 28 51 62 6e 36 c9 6e b2 c9 ce dd 40 23 34 72 2e a0 10 2a e7 ba 75 73 38 e7 ec f7 c7 0d 75 ee b9 e7 56 40 a3 49 d1 83 f5 f9 00 75 cf ce f1 b7 d7 5e 6b ed bd 45 32 95 96 14 29 91 cf 72 64 6e 84 d1 54 8c 3f b9 f1 3e 17 a2 53 80 e0 1e dd a3 7b 74 8f ee 91 1d 49 b6 45 5a f8 ef 36 ee 67 5b a4 85 fd 8d 9d 38 14 15 21 0a b8 29 92 a9 b4 74 aa 2a 97 c7 87 f9 fd d7 be c5 6b 13 d7 99 ce 24 c9 1a 1a ba 21 3f 60 e6 f7 e8 1e [TRUNCATED] Data Ascii: PNGIHDRXXl@gAMAa cHRMz&u0`:pQ<bKGDtIME$VNIDATxw]u~979@!Ff'v`)FPdi%cGgcfddIV(Qbn6n@#4r.us8uV@Iu^kE2)rdnT?>S{tIEZ6g[8!)tk$!?`{_78xm=O39z=Gk'>Op$Y~oUQ~%GP Gqdn&\=Gni3ht&.=GWC8(xs=GPc(S;l$:dr0"p(,R\:VwU`OR}k7QPqh{<;,bVJt8i%WJS+o.i9\_[GKO":aI61?^B>Sd<u !Ok9/<QZZc)Z\|vGH2,>3Q9I} O\|ScYq?!p=4pc %E3!ix[:hk1!kdy^?^l.Rc[w36?K6hFsoKd&](ao'%D{=H!h4v:kb<~<KC{~DBs=q3 [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:50.218547106 CEST	312	OUT	GET /matomo.js HTTP/1.1 Host: 3656.tstdmn.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:51.054564953 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.20.1 Date: Fri, 27 Sep 2024 04:10:50 GMT Content-Type: application/javascript Content-Length: 67460 Last-Modified: Tue, 03 Sep 2024 22:31:04 GMT Connection: keep-alive ETag: "66d78e28-10784" Accept-Ranges: bytes Data Raw: 2f 2a 21 21 0a 20 2a 20 4d 61 74 6f 6d 6f 20 2d 20 66 72 65 65 2f 6c 69 62 72 65 20 61 6e 61 6c 79 74 69 63 73 20 70 6c 61 74 66 6f 72 6d 0a 20 2a 0a 20 2a 20 4a 61 76 61 53 63 72 69 70 74 20 74 72 61 63 6b 69 6e 67 20 63 6c 69 65 6e 74 0a 20 2a 0a 20 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 70 69 77 69 6b 2e 6f 72 67 0a 20 2a 20 40 73 6f 75 72 63 65 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 6f 6d 6f 2d 6f 72 67 2f 6d 61 74 6f 6d 6f 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 6a 73 2f 70 69 77 69 6b 2e 6a 73 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 68 74 74 70 73 3a 2f 2f 70 69 77 69 6b 2e 6f 72 67 2f 66 72 65 65 2d 73 6f 66 74 77 61 72 65 2f 62 73 64 2f 20 42 53 44 2d 33 20 43 6c 61 75 73 65 20 28 61 6c 73 6f 20 69 6e 20 6a 73 2f 4c 49 43 45 4e 53 45 2e 74 78 74 29 0a 20 2a 20 40 6c 69 63 65 6e 73 65 20 6d 61 67 6e 65 74 3a 3f 78 74 3d 75 72 6e 3a 62 74 69 68 3a 63 38 30 64 35 30 61 66 37 64 33 64 62 39 62 65 36 36 61 34 64 30 61 38 36 64 62 30 32 38 36 65 34 66 64 33 33 [TRUNCATED] Data Ascii: /!! Matomo - free/libre analytics platform * * JavaScript tracking client * * @link https://piwik.org * @source https://github.com/matomo-org/matomo/blob/master/js/piwik.js * @license https://piwik.org/free-software/bsd/ BSD-3 Clause (also in js/LICENSE.txt) * @license magnet:?xt=urn:btih:c80d50af7d3db9be66a4d0a86db0286e4fd33292&dn=bsd-3-clause.txt BSD-3-Clause */;if(typeof _paq!=="object"){_paq=[]}if(typeof window.Matomo!=="object"){window.Matomo=window.Piwik=(function(){var s,b={},A={},K=document,g=navigator,ac=screen,X=window,h=X.performance\|\|X.mozPerformance\|\|X.msPerformance\|\|X.webkitPerformance,u=X.encodeURIComponent,W=X.decodeURIComponent,k=unescape,M=[],I,v,am=[],z=0,ag=0,Y=0,m=false,q="";function p(au){try{return W(au)}catch(av){return unescape(au)}}function N(av){var au=typeof av;return au!=="undefined"}function D(au){return typeof au==="function"}function aa(au){return typeof au==="object"}function y(au){return typeof au==="string"\|\|au instance
Sep 27, 2024 06:10:51.054687023 CEST	224	IN	Data Raw: 6f 66 20 53 74 72 69 6e 67 7d 66 75 6e 63 74 69 6f 6e 20 61 6c 28 61 75 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 75 3d 3d 3d 22 6e 75 6d 62 65 72 22 7c 7c 61 75 20 69 6e 73 74 61 6e 63 65 6f 66 20 4e 75 6d 62 65 72 0a 7d 66 75 6e 63 74 Data Ascii: of String}function al(au){return typeof au==="number"\|\|au instanceof Number}function ad(au){return N(au)&&(al(au)\|\|(y(au)&&au.length))}function E(av){if(!av){return true}var au;for(au in av){if(Object.prototype.hasOwnProper
Sep 27, 2024 06:10:51.054697037 CEST	1236	IN	Data Raw: 74 79 2e 63 61 6c 6c 28 61 76 2c 61 75 29 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 7d 7d 72 65 74 75 72 6e 20 74 72 75 65 7d 66 75 6e 63 74 69 6f 6e 20 61 70 28 61 75 29 7b 76 61 72 20 61 76 3d 74 79 70 65 6f 66 20 63 6f 6e 73 6f 6c 65 3b 69 66 Data Ascii: ty.call(av,au)){return false}}return true}function ap(au){var av=typeof console;if(av!=="undefined"&&console&&console.error){console.error(au)}}function ak(){var az,ay,aB,av,au;for(az=0;az<arguments.length;az+=1){au=null;if(arguments[az]&&argu
Sep 27, 2024 06:10:51.054739952 CEST	1236	IN	Data Raw: 6e 20 6e 28 61 75 29 7b 69 66 28 4b 2e 72 65 61 64 79 53 74 61 74 65 3d 3d 3d 22 63 6f 6d 70 6c 65 74 65 22 29 7b 61 75 28 29 7d 65 6c 73 65 7b 69 66 28 58 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 29 7b 58 2e 61 64 64 45 76 65 6e 74 4c Data Ascii: n n(au){if(K.readyState==="complete"){au()}else{if(X.addEventListener){X.addEventListener("load",au,false)}else{if(X.attachEvent){X.attachEvent("onload",au)}}}}function r(ax){var au=false;if(K.attachEvent){au=K.readyState==="complete"}else{au=
Sep 27, 2024 06:10:51.054752111 CEST	1236	IN	Data Raw: 72 69 70 74 22 29 3b 61 75 2e 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3b 61 75 2e 73 72 63 3d 61 77 3b 69 66 28 61 75 2e 72 65 61 64 79 53 74 61 74 65 29 7b 61 75 2e 6f 6e 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 Data Ascii: ript");au.type="text/javascript";au.src=aw;if(au.readyState){au.onreadystatechange=function(){var ax=this.readyState;if(ax==="loaded"\|\|ax==="complete"){au.onreadystatechange=null;av()}}}else{au.onload=av}K.getElementsByTagName("head")[0].appen
Sep 27, 2024 06:10:51.054871082 CEST	1236	IN	Data Raw: 64 65 78 4f 66 28 61 75 2c 61 76 2e 6c 65 6e 67 74 68 2d 61 75 2e 6c 65 6e 67 74 68 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 42 28 61 76 2c 61 75 29 7b 61 76 3d 53 74 72 69 6e 67 28 61 76 29 3b 72 65 74 75 72 6e 20 61 76 2e 69 6e 64 65 78 Data Ascii: dexOf(au,av.length-au.length)!==-1}function B(av,au){av=String(av);return av.indexOf(au)!==-1}function f(av,au){av=String(av);return av.substr(0,av.length-au)}function J(ax,aw,az){ax=String(ax);if(!az){az=""}var au=ax.indexOf("#");var aA=ax.le
Sep 27, 2024 06:10:51.054883003 CEST	1236	IN	Data Raw: 29 7b 72 65 74 75 72 6e 20 61 75 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 73 2b 7c 5c 73 2b 24 2f 67 2c 22 22 29 0a 7d 72 65 74 75 72 6e 20 61 75 7d 66 75 6e 63 74 69 6f 6e 20 47 28 61 75 29 7b 72 65 74 75 72 6e 20 75 6e 65 73 63 61 70 65 28 75 28 61 Data Ascii: ){return au.replace(/^\s+\|\s+$/g,"")}return au}function G(au){return unescape(u(au))}function ar(aJ){var aw=function(aP,aO){return(aP<<aO)\|(aP>>>(32-aO))},aK=function(aR){var aP="",aQ,aO;for(aQ=7;aQ>=0;aQ--){aO=(aR>>>(aQ*4))&15;aP+=aO.toStrin
Sep 27, 2024 06:10:51.054893017 CEST	1236	IN	Data Raw: 36 37 32 39 35 3b 61 45 3d 61 46 3b 61 46 3d 61 47 3b 61 47 3d 61 77 28 61 48 2c 33 30 29 3b 61 48 3d 61 49 3b 61 49 3d 61 4e 7d 66 6f 72 28 61 4d 3d 34 30 3b 61 4d 3c 3d 35 39 3b 61 4d 2b 2b 29 7b 61 4e 3d 28 61 77 28 61 49 2c 35 29 2b 28 28 61 Data Ascii: 67295;aE=aF;aF=aG;aG=aw(aH,30);aH=aI;aI=aN}for(aM=40;aM<=59;aM++){aN=(aw(aI,5)+((aH&aG)\|(aH&aF)\|(aG&aF))+aE+av[aM]+2400959708)&4294967295;aE=aF;aF=aG;aG=aw(aH,30);aH=aI;aI=aN}for(aM=60;aM<=79;aM++){aN=(aw(aI,5)+(aH^aG^aF)+aE+av[aM]+3395469782)
Sep 27, 2024 06:10:51.055046082 CEST	1236	IN	Data Raw: 28 61 76 2e 63 6f 6e 74 61 69 6e 73 29 7b 72 65 74 75 72 6e 20 61 76 2e 63 6f 6e 74 61 69 6e 73 28 61 75 29 7d 69 66 28 61 76 3d 3d 3d 61 75 29 7b 72 65 74 75 72 6e 20 74 72 75 65 7d 69 66 28 61 76 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 Data Ascii: (av.contains){return av.contains(au)}if(av===au){return true}if(av.compareDocumentPosition){return !!(av.compareDocumentPosition(au)&16)}return false}function Q(aw,ax){if(aw&&aw.indexOf){return aw.indexOf(ax)}if(!N(aw)\|\|aw===null){return -1}if
Sep 27, 2024 06:10:51.055057049 CEST	1236	IN	Data Raw: 7a 2e 6f 66 66 73 65 74 48 65 69 67 68 74 2b 61 7a 2e 73 63 72 6f 6c 6c 54 6f 70 7c 7c 61 47 2b 61 43 2d 61 46 3c 61 7a 2e 73 63 72 6f 6c 6c 54 6f 70 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 7d 7d 69 66 28 61 41 2e 6f 66 66 73 65 74 50 61 72 65 Data Ascii: z.offsetHeight+az.scrollTop\|\|aG+aC-aF<az.scrollTop){return false}}if(aA.offsetParent===az){aB+=az.offsetLeft;aG+=az.offsetTop}return av(az,aG,ay,aD,aB,aE,aC)}return true}return av(aw)}var aj={htmlCollectionToArray:function(aw){var au=[],av;if(
Sep 27, 2024 06:10:51.059648991 CEST	1236	IN	Data Raw: 61 79 2e 67 65 74 41 74 74 72 69 62 75 74 65 29 7b 72 65 74 75 72 6e 20 61 79 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 61 77 29 7d 69 66 28 21 61 79 7c 7c 21 61 79 2e 61 74 74 72 69 62 75 74 65 73 29 7b 72 65 74 75 72 6e 7d 76 61 72 20 61 78 3d Data Ascii: ay.getAttribute){return ay.getAttribute(aw)}if(!ay\|\|!ay.attributes){return}var ax=(typeof ay.attributes[aw]);if("undefined"===ax){return}if(ay.attributes[aw].value){return ay.attributes[aw].value}if(ay.attributes[aw].nodeValue){return ay.attr
Sep 27, 2024 06:10:52.448317051 CEST	797	OUT	POST /matomo.php?action_name=bet365%E9%9B%86%E5%9B%A2%20365%E4%BD%93%E8%82%B2%E5%9C%A8%E7%BA%BF-%E4%B8%8A%E7%BD%91%E5%AF%BC%E8%88%AA&idsite=3&rec=1&r=295781&h=0&m=10&s=52&url=http%3A%2F%2Fc.vip3656jun27.cc%2F&_id=b081036b5f3ec0ac&_idn=1&send_image=0&_refts=0&pv_id=1eQIMW&pf_net=435&pf_srv=756&pf_tfr=2&uadata=%7B%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024 HTTP/1.1 Host: 3656.tstdmn.cc Connection: keep-alive Content-Length: 0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=utf-8 Accept: / Origin: http://c.vip3656jun27.cc Referer: http://c.vip3656jun27.cc/ Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:52.881092072 CEST	272	IN	HTTP/1.1 204 No Response Server: nginx/1.20.1 Date: Fri, 27 Sep 2024 04:10:52 GMT Content-Type: text/html; charset=UTF-8 Connection: keep-alive X-Powered-By: PHP/8.1.29 Access-Control-Allow-Origin: http://c.vip3656jun27.cc Access-Control-Allow-Credentials: true

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:51.290355921 CEST	289	OUT	GET /images/remen_03.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:52.050904036 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/jpeg Content-Length: 13483 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 e2 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 07 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 62 00 00 00 1b 01 05 00 01 00 00 00 6a 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1e 00 00 00 72 00 00 00 32 01 02 00 1a 00 00 00 90 00 00 00 69 87 04 00 01 00 00 00 aa 00 00 00 00 00 00 00 80 fc 0a 00 10 27 00 00 80 fc 0a 00 10 27 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 00 32 30 31 39 2d 30 31 2d 31 34 54 31 33 3a 30 32 3a 31 32 2b 30 38 3a 30 30 00 03 00 00 90 07 00 04 00 00 00 30 32 32 30 02 a0 04 00 01 00 00 00 a2 00 00 00 03 a0 04 00 01 00 00 00 4e 00 00 00 00 00 00 00 4e 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 [TRUNCATED] Data Ascii: ExifII*bj(1r2i''Adobe Photoshop CS6 (Windows)2019-01-14T13:02:12+08:000220NNDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:8DFA96B917B911E9B70BB4D82CAA5ECB" xmpMM:InstanceID="xmp.iid:8DFA [TRUNCATED]
Sep 27, 2024 06:10:52.050925970 CEST	1236	IN	Data Raw: 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 31 38 2d 31 31 2d 30 39 54 31 34 3a 30 38 3a Data Ascii: xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2018-11-09T14:08:44+08:00" xmp:ModifyDate="2019-01-14T13:02:12+08:00" xmp:MetadataDate="2019-01-14T13:02:12+08:00" dc:format="image/jpeg" photoshop:LegacyIPTCDigest="FDAFC2F03E4E
Sep 27, 2024 06:10:52.050937891 CEST	1236	IN	Data Raw: 34 3a 30 35 3a 33 36 2b 30 38 3a 30 30 22 20 73 74 45 76 74 3a 73 6f 66 74 77 61 72 65 41 67 65 6e 74 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 22 20 73 74 45 76 74 3a 63 68 61 6e 67 65 64 3d 22 Data Ascii: 4:05:36+08:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="co
Sep 27, 2024 06:10:52.050950050 CEST	1236	IN	Data Raw: 68 3e ff 00 85 37 0d 29 a0 fb fe 14 df 4a 68 3e ff 00 85 37 d2 9a 7e 7f 85 37 fb 7d 83 4a 69 f9 fe 15 90 1d be 3b 7e 1a 54 15 d7 ed f8 7f 6d 67 bc df ef 36 df 76 e3 a5 46 c1 f9 2f f6 d6 37 df e3 a5 4e 9f 66 bf 0a c6 fa 53 43 e6 2b 3a 54 53 4a 53 Data Ascii: h>7)Jh>7~7}Ji;~Tmg6vF/7NfSC+:TSJSJSJSJSJSJSJSJSO67j)Gu_w?n~hi<Q5>MJa~_J}o~:S_
Sep 27, 2024 06:10:52.050961971 CEST	736	IN	Data Raw: c1 c3 73 0a 6b 22 43 90 e1 a2 4c c5 58 0d 37 28 d4 0f cb fb 6a cf c9 bb 75 16 33 39 8d 58 2d b2 d6 98 4c 85 dc 30 bf d5 c1 b5 a1 92 47 2a c9 1c 9d 16 63 b4 17 56 da 9f 28 d7 4d 75 a9 5f 28 71 3b 86 98 c3 26 64 ec 66 38 73 dd 92 fa 6c 5d 91 af 78 Data Ascii: sk"CLX7(ju39X-L0GcV(Mu_(q;&df8sl]xak3G\BVrGJz70(%Tn&V.tc[nG)6tvGe=BBI$PATfx^ynRBw'aV6EG#3ygx cb`Q\JmYrW[c
Sep 27, 2024 06:10:52.052715063 CEST	1236	IN	Data Raw: 77 df bb d0 2d cc df 3d 3b c9 db be 1d 6f 7f 8c 8c e9 f5 33 42 91 44 e7 50 08 88 00 a7 50 48 d4 33 31 6f 3d b5 e2 58 f0 b3 e3 2d 51 79 3f 21 b8 b7 bd 93 4f 92 37 1a 26 be 7a 92 db c7 de 02 8f bf c2 bb 7a c5 bd 09 b7 8f 62 64 60 bf 6f 4e 30 22 4e Data Ascii: w-=;o3BDPPH31o=X-Qy?!O7&zzbd`oN0"N`bsUL] 6URvPq--q\|R}68PdPX1Y^#,oBY$0'nBEV[4,t\|{1QEM$cvwn:ynm'!Q
Sep 27, 2024 06:10:52.052778006 CEST	224	IN	Data Raw: 3c 44 a3 79 43 19 42 26 90 26 bf 9a 61 12 86 e2 03 1e 9a 7a 5b 8a 8d 6a ec dc e3 94 0e e9 35 9d 96 4e fc 61 9f 90 b0 58 d6 79 3d 33 1c b7 c7 45 55 0c 17 d3 2a 58 6d d0 0d 3e ea 8d 3d c1 39 39 c9 65 f9 7b cd 8c 6e b7 21 f3 72 98 e8 bc 95 e4 5d 40 Data Ascii: <DyCB&&az[j5NaXy=3EU*Xm>=99e{n!r]@2u.H2ZIZ^8[@XUUg1%\|q__y?Q"d+mUh^lke44mth\HTNB~-(PwX-dsNVYI
Sep 27, 2024 06:10:52.052788973 CEST	1236	IN	Data Raw: f2 52 b1 6a 0f e6 2d e1 f6 d6 c7 ec ff 00 11 97 9f f7 5b 8e 70 98 50 c8 72 d9 ab 1b 52 a3 40 4a cd 73 1c 6c 46 bd 3f 09 6d 7c 80 f1 f1 af 4c 72 de 51 8f c6 75 92 98 14 4d c4 eb e4 92 46 35 98 aa 54 cc 75 d6 ed 02 a8 73 98 40 c8 a5 d4 7b cf d0 c9 Data Ascii: Rj-[pPrR@JslF?m\|LrQuMF5Tus@{$P!fW'%"6Kyr-OfS1_kK\UtkhowW{@a(FeHItYoR=/k;x L7
Sep 27, 2024 06:10:52.052798986 CEST	1236	IN	Data Raw: f2 5c a5 ca ad 33 c5 8b 91 f1 64 a4 40 e4 ab 3c 5d ee 1e 48 b5 aa 3c 1d 6e 9c 93 1c 93 8e 67 b1 5d b0 b1 94 c8 54 58 c2 c6 ac fa a5 65 79 f3 a6 5e ef 5a b0 b9 11 32 bb ef 49 8c 14 f4 cf e1 ae da f3 2c b4 7c 9a 4e 5b 02 5b c7 96 97 d4 07 6c 6a b1 Data Ascii: \3d@<]H<ng]TXey^Z2I,\|N[[lj,c]wbOM~'/#jAJeI26CD3HdhT+ujjMYcDWX$"2#P<M9W9$es6&EYKPI$mT_52BI**l d}9l1
Sep 27, 2024 06:10:52.052809954 CEST	1236	IN	Data Raw: 74 20 68 70 d8 b8 9f 38 cb 72 7b 5c c7 24 45 6b 44 b8 46 3a ba 14 11 ab ee 28 aa a7 41 f7 68 00 fd 15 53 77 0f c3 ee f8 ec 1d 47 6d c7 c7 ae bc 5f a7 4d 3c 47 9d 6f aa c6 a6 95 77 70 d7 04 32 97 20 28 d8 ca eb 89 ad 78 ee c0 5b e5 f6 d5 8e ac 30 Data Ascii: t hp8r{\$EkDF:(AhSwGm_M<Gowp2 (x[0Hb%~ZLAt*)wCo{/sOl5NaM^Y7X\E3<RoQ#W6eF{9cIc:);g24hBNq2`GRBQVw
Sep 27, 2024 06:10:52.059396029 CEST	1236	IN	Data Raw: 0a c2 71 66 13 75 dc 9b 92 38 84 90 80 cc f2 a2 9d 0b 59 c5 6a da 69 4a 69 4a 69 4a 69 4a ec 62 a6 25 e0 dc 19 dc 2c ac 9c 33 b3 a4 64 14 75 13 22 f2 39 c1 91 39 d3 50 c9 19 66 6b 22 a1 d2 31 d2 28 89 0c 22 51 12 80 ed be ba 57 d8 dc 6e 52 01 6f Data Ascii: qfu8YjiJiJiJiJb%,3du"99Pfk"1("QWnRopw4hr]<^6KdoYk#BJDbD$F z;mpbj1z.?A_i(OO*{Tt\|\?^mux@7C
Sep 27, 2024 06:10:54.615432978 CEST	489	OUT	GET /images/remen_06.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:54.868138075 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:54 GMT Content-Type: image/jpeg Content-Length: 14701 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 e2 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 07 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 62 00 00 00 1b 01 05 00 01 00 00 00 6a 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1e 00 00 00 72 00 00 00 32 01 02 00 1a 00 00 00 90 00 00 00 69 87 04 00 01 00 00 00 aa 00 00 00 00 00 00 00 80 fc 0a 00 10 27 00 00 80 fc 0a 00 10 27 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 00 32 30 31 39 2d 30 31 2d 31 34 54 31 33 3a 30 32 3a 35 33 2b 30 38 3a 30 30 00 03 00 00 90 07 00 04 00 00 00 30 32 32 30 02 a0 04 00 01 00 00 00 a2 00 00 00 03 a0 04 00 01 00 00 00 4e 00 00 00 00 00 00 00 4e 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 [TRUNCATED] Data Ascii: ExifII*bj(1r2i''Adobe Photoshop CS6 (Windows)2019-01-14T13:02:53+08:000220NNDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:A628494D17B911E9BB61EFC8C5F1E722" xmpMM:InstanceID="xmp.iid:A628 [TRUNCATED]
Sep 27, 2024 06:10:55.027443886 CEST	495	OUT	GET /images/long_qr_240818.gif HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:55.282730103 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:55 GMT Content-Type: image/gif Content-Length: 913034 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 96 00 02 02 f7 00 00 00 00 00 00 00 00 09 09 09 02 0b 07 14 14 15 1c 1c 1c 0c 0b 12 33 0a 15 04 26 1c 23 21 1e 0a 33 2b 22 22 22 2c 2c 2c 32 32 32 3c 3c 3c 2d 34 32 06 15 38 4e 2f 17 02 51 37 12 46 36 2a 4a 3a 5e 4a 20 5b 44 3d 25 2f 64 52 34 42 0a 6b 50 06 6a 51 0b 7d 5d 12 76 5b 0d 68 4f 3f 45 7a 13 7e 61 23 5a 4b 42 42 42 4b 4b 4b 55 55 55 5c 5c 5c 57 51 4f 75 4f 44 77 69 45 66 65 66 6b 6b 6b 76 76 76 7c 7c 7c 72 6e 6e 54 68 68 98 0d 00 ae 0e 00 af 29 09 84 0c 29 9e 26 26 cd 17 00 ff 00 00 d3 2d 05 f9 2f 00 fe 22 23 cf 34 23 9e 67 1b b8 7d 1d b3 2b 4a ce 35 56 8d 55 41 b9 4a 44 92 68 51 b1 6b 54 b3 76 68 98 63 6b cc 49 43 fe 4a 48 cf 62 59 da 45 64 d0 72 6c fc 6c 6c f0 5d 5d ff 67 08 2c 84 5e 10 86 66 16 8a 6c 13 94 73 33 8c 73 12 a0 7b 2e ab 77 50 95 61 44 8e 7a 63 b1 57 64 c1 65 9d 80 30 b0 8a 30 93 ac 39 8d ad 31 b8 ba 2c cb 88 1d f8 96 02 fb aa 12 ca 97 29 d4 ae 32 fc b9 27 e0 a9 22 f4 9a 23 a2 c9 37 ff ce 18 e8 dd 16 fe e8 0f fd c7 34 ff ce 3e e2 dc 24 dd d4 26 9d 98 48 b8 [TRUNCATED] Data Ascii: GIF89a3&#!3+""",,,222<<<-428N/Q7F6*J:^J [D=%/dR4BkPjQ}]v[hO?Ez~a#ZKBBBKKKUUU\\\WQOuODwiEfefkkkvvv\|\|\|rnnThh))&&-/"#4#g}+J5VUAJDhQkTvhckICJHbYEdrlll]]g,^fls3s{.wPaDzcWde0091,)2'"#74>$&HDMrt{jAOr~fXKRNYwgeq{oZI8"O4}Zfhwu+cgpzt!NETSCAPE2.0!!xmp dataxmp?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "><rdf:RDF xmlns:rdf="http://w [TRUNCATED]
Sep 27, 2024 06:10:56.570487976 CEST	488	OUT	GET /images/favicon.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:56.827254057 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:56 GMT Content-Type: image/png Content-Length: 4704 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 02 00 00 00 25 0b e6 89 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 12 02 49 44 41 54 78 da d4 5a 09 70 5c c5 99 ee 7e f7 9c 9a 43 f7 65 cb b6 64 61 f9 c6 06 db 2c d8 c0 72 1a 03 4b 80 02 03 49 08 10 c3 16 29 60 6b a9 ad 4a 81 61 13 92 90 82 4d a0 bc 09 84 84 10 52 14 64 9d 10 13 d6 26 36 97 31 f8 c0 27 d8 60 59 b2 2d c9 96 64 4b 23 69 34 f7 f5 ae de bf df 93 46 23 cd 1b 8d 9c 4a c1 a6 6b 6a f4 34 af bb df ff 77 ff ff ff 7d ff df 0f 97 3e f9 4d f4 8f dc 18 f4 0f de b8 ec d5 9e 07 9f ae 71 fb f3 7b 7c d2 d5 7a c7 1b 3f ff da 05 65 31 83 31 d6 74 9d 20 62 ad 80 cf e6 b4 f1 42 fe 48 a7 20 21 4d 47 0c 83 f0 d7 26 3d 46 f8 a2 e9 cd 7e 87 7b 6b fb a1 94 22 5b 2b 10 4c c4 7c 76 57 fe e0 a1 68 98 28 2a e6 39 c4 7e 0d f6 e6 b7 bb fe 65 ee 85 b7 2e f8 a7 99 fe ca fe 68 e8 93 ce a3 29 59 ce 5d ca 31 05 18 6c 2d 1f 8b 30 81 1d e0 c8 57 b9 01 65 8e 92 3b 16 5f b2 72 [TRUNCATED] Data Ascii: PNGIHDR@@%tEXtSoftwareAdobe ImageReadyqe<IDATxZp\~Ceda,rKI)`kJaMRd&61'`Y-dK#i4F#Jkj4w}>Mq{\|z?e11t bBH !MG&=F~{k"[+L\|vWh(9~e.h)Y]1l-0We;_rFZhXg?F1$OUo/,VHQa51Z@F]Zo11>Lx7gpjeXD!C):6JX.kj$g=71T5^={QgwxFU&0~NE]T J?PnJzFl.~Y.Kx6:1\\x.?5-K]-}\'^Ksn\zGrwi;W7/+o1cN~/T]Yv/Y'Env%n]:k^sy=6p&7ZU8=}d~If[v5_ajc;&"-`#qbk,gU:T?N f{\lmQD)T:J LFW4wMJJc}>\Q9jdjab/<\+@:vqL3~4\O{+mK]B16Cww,<lQwjK\|eC'5Mu{?Xww4[^_9wI$%v32+Wx [TRUNCATED]

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 06:10:51.290662050 CEST	289	OUT	GET /images/remen_05.jpg HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 27, 2024 06:10:52.035304070 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:51 GMT Content-Type: image/jpeg Content-Length: 12841 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: ff d8 ff e1 00 e2 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 07 00 12 01 03 00 01 00 00 00 01 00 00 00 1a 01 05 00 01 00 00 00 62 00 00 00 1b 01 05 00 01 00 00 00 6a 00 00 00 28 01 03 00 01 00 00 00 02 00 00 00 31 01 02 00 1e 00 00 00 72 00 00 00 32 01 02 00 1a 00 00 00 90 00 00 00 69 87 04 00 01 00 00 00 aa 00 00 00 00 00 00 00 80 fc 0a 00 10 27 00 00 80 fc 0a 00 10 27 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 00 32 30 31 39 2d 30 31 2d 31 34 54 31 33 3a 31 30 3a 35 38 2b 30 38 3a 30 30 00 03 00 00 90 07 00 04 00 00 00 30 32 32 30 02 a0 04 00 01 00 00 00 a1 00 00 00 03 a0 04 00 01 00 00 00 53 00 00 00 00 00 00 00 53 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 0b 05 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 [TRUNCATED] Data Ascii: ExifII*bj(1r2i''Adobe Photoshop CS6 (Windows)2019-01-14T13:10:58+08:000220SSDuckydhttp://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmpMM:OriginalDocumentID="xmp.did:0d382fae-ffc6-e54f-a71c-9d3468fe6186" xmpMM:DocumentID="xmp.did:C752D7CD17BA11E9AB5DD54A0C43CFD1" xmpMM:InstanceID="xmp.iid:C752 [TRUNCATED]
Sep 27, 2024 06:10:52.035444021 CEST	1236	IN	Data Raw: 20 78 6d 70 3a 43 72 65 61 74 6f 72 54 6f 6f 6c 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 22 20 78 6d 70 3a 43 72 65 61 74 65 44 61 74 65 3d 22 32 30 31 38 2d 31 31 2d 30 39 54 31 34 3a 30 38 3a Data Ascii: xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2018-11-09T14:08:44+08:00" xmp:ModifyDate="2019-01-14T13:10:58+08:00" xmp:MetadataDate="2019-01-14T13:10:58+08:00" dc:format="image/jpeg" photoshop:LegacyIPTCDigest="FDAFC2F03E4E
Sep 27, 2024 06:10:52.035595894 CEST	1236	IN	Data Raw: 34 3a 30 35 3a 33 36 2b 30 38 3a 30 30 22 20 73 74 45 76 74 3a 73 6f 66 74 77 61 72 65 41 67 65 6e 74 3d 22 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 43 53 36 20 28 57 69 6e 64 6f 77 73 29 22 20 73 74 45 76 74 3a 63 68 61 6e 67 65 64 3d 22 Data Ascii: 4:05:36+08:00" stEvt:softwareAgent="Adobe Photoshop CS6 (Windows)" stEvt:changed="/"/> <rdf:li stEvt:action="converted" stEvt:parameters="from application/vnd.adobe.photoshop to image/jpeg"/> <rdf:li stEvt:action="derived" stEvt:parameters="co
Sep 27, 2024 06:10:52.035609007 CEST	1236	IN	Data Raw: 7a 69 0d c7 9f 6f 64 36 f4 d2 1b 8f 3e de c8 6d e9 a4 37 1e 7d bd 90 db d3 48 6e 3c fb 7b 21 b7 a6 90 dc 79 f6 f6 43 6f 4d 21 b8 f3 ed ec 86 de 9a 43 71 e7 db d9 0d bd 34 86 e3 cf b7 b2 1b 7a 69 0d c7 9f 6f 64 36 f4 d2 1b 8f 3e de c8 69 10 49 3d Data Ascii: ziod6>m7}Hn<{!yCoM!Cq4ziod6>iI=}B#G(+=zva:EDv7_E&ZNO\|S~u=n@K&CqP?{l1z
Sep 27, 2024 06:10:52.035621881 CEST	1236	IN	Data Raw: d5 dd 2c 45 13 2d 5e 28 ef 2b ba 06 e4 e2 9b 75 90 82 b0 4c d4 99 eb b6 44 09 1e 46 27 55 b3 8a 1f 6f 0a 9f 13 67 b9 23 90 20 79 47 82 64 2e 10 b2 ec f8 cf 8f f2 4d b6 9e f2 f7 9a 2c 27 8a 5c 62 2c f1 54 e8 83 2f 27 1f 8c a2 a5 95 6e a3 b9 47 a5 Data Ascii: ,E-^(+uLDF'Uog# yGd.M,'\b,T/'nGnqeJ*3dJAy52jRv(64D0Lh17_s~=J/rkv-"!!!!#U&&$D:)` <JQP!q:v?O:
Sep 27, 2024 06:10:52.035634041 CEST	1236	IN	Data Raw: 52 06 c3 c9 e6 df 29 80 a9 8e 7c 01 1c fe bf aa 51 8e f2 16 aa 5c c0 ea 2d f5 ad d9 aa 1e 4d 73 4f 96 2d 85 b4 95 d3 b6 db be a2 97 e9 89 82 26 3c d2 3b 66 7b a3 5f 70 39 c3 ed be e6 5e 05 14 f8 1d 93 01 77 32 d0 48 95 c1 f9 2a f1 54 3d e5 9f b3 Data Ascii: R)\|Q\-MsO-&<;f{_p9^w2H*T=DVneO)C\|;kWnR!5S}<5 DG9}>1G8!W-!+etenvm&`\MdoL_TptfT=MesE3{u1K
Sep 27, 2024 06:10:52.035645008 CEST	1236	IN	Data Raw: d3 d4 d3 b8 d3 ad b8 a5 00 e3 6e a4 a5 60 a9 3e 60 af 32 a6 ae f9 98 91 f0 1c eb c2 b8 9e 0f 24 1f 8e 1c 1e a1 61 5c 95 90 71 5d bb 0f 13 28 9f 31 5e f2 14 9d 62 a3 7c 6a de 3a da 68 38 09 c8 48 e8 e1 92 95 87 40 5b 7d 41 d4 03 a4 45 44 c5 f9 0f Data Ascii: n`>`2$a\q](1^b\|j:h8H@[}AEDiJ4#F.hV[M2C.$e)_J`,[{KsQrBlM5xTu4a# M8(@@uZQ]JCH0nyuy]]KRaE$() HOC-^
Sep 27, 2024 06:10:52.035768986 CEST	1236	IN	Data Raw: ea 38 d3 8a 13 65 b5 3a 00 e1 ff 00 20 4e de 3c 48 d3 84 61 f6 b8 be fe f6 bc 8d bd 0a 94 d1 29 2b 64 14 b1 81 6e 8f 19 ac ca ae 8d d5 75 ca 92 70 6e e7 1c 91 26 4c 5c 94 a6 03 aa 2a 1b 64 48 06 03 08 09 44 35 93 6a b3 ac 42 9a f6 bc 5d cb 95 1f Data Ascii: 8e: N<Ha)+dnupn&L\dHD5jB]b,JBLzmi&F'.\JSzJ\|s=Ho7\ChmhiIw`-LykITI-&#l8?3gQrL/z#7FnL,6EC!
Sep 27, 2024 06:10:52.035780907 CEST	1236	IN	Data Raw: 22 0e ea e4 8c af 1c 4c 51 31 4c 50 30 90 4c 51 28 1c 3b 94 44 36 f2 0f 52 f7 d5 49 50 4a 82 88 98 06 72 e7 e1 13 1f a5 7e 10 1a a7 13 81 b0 c7 32 21 31 2c 65 22 ad 89 2a fc b5 65 99 eb 18 fd d4 d1 d2 ca 72 30 34 ca ae 3e c7 aa 7e 89 20 bb a6 0f Data Ascii: "LQ1LP0LQ(;D6RIPJr~2!1,e"er04>~ )YQM;x\|'$u+Yd\9-rSqCT\gm(q}TYmnOHLcuBOuS)V-Rq$=Nusg1Zc)2l-V>K/yV)X?Uh
Sep 27, 2024 06:10:52.035787106 CEST	1236	IN	Data Raw: b4 b4 df e9 0d d9 ad f5 4e a5 d6 eb 09 3e b8 b9 5d 56 5f b8 3e f2 01 6d 15 4f 37 4f 32 9f 76 0c 00 ee 00 3f 30 01 fe 3a dd 32 24 65 1f 2f d2 77 24 2b 98 8a e9 13 0d 21 0d 21 0d 21 0d 21 0d f7 ef fb 7f 86 86 47 e8 3c 7c 47 23 e1 12 4c e2 67 61 8e Data Ascii: N>]V_>mO7O2v?0:2$e/w$+!!!!G<\|G#LgafK/j2p[G61U-(}joU>Sl}6K*tnyGR 'I2g/(n'Y'V\|QOt}qRx#1: p:93O;4U"2uXy
Sep 27, 2024 06:10:52.040606022 CEST	676	IN	Data Raw: 2f 12 f1 92 f1 6d a5 51 5d 43 1d 17 09 24 55 10 df 62 18 35 ea 64 9f 2f fd 1b cb 6c 16 7c 63 24 b1 53 3d 63 b1 53 a5 8a 14 6e 75 0e 53 30 94 fa 7f 0e 87 5b 50 79 54 eb 40 93 cd 29 65 0e e8 16 95 01 1e a6 3b d7 9e ae 62 57 fb 96 47 61 bc bf 4b 7a Data Ascii: /mQ]C$Ub5d/l\|c$S=cSnuS0[PyT@)e;bWGaKzUq:TUzn!M!4H>R%+TvG\M4t$]*:H:@X1EPn^K}4gqhu$$%EIf6m3I/T4ui]]H
Sep 27, 2024 06:10:54.617804050 CEST	484	OUT	GET /images/nav.png HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:54.866067886 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:54 GMT Content-Type: image/png Content-Length: 5535 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 00 00 00 01 84 08 06 00 00 00 a8 04 52 ea 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 0a 4d 69 43 43 50 50 68 6f 74 6f 73 68 6f 70 20 49 43 43 20 70 72 6f 66 69 6c 65 00 00 78 da 9d 53 77 58 93 f7 16 3e df f7 65 0f 56 42 d8 f0 b1 97 6c 81 00 22 23 ac 08 c8 10 59 a2 10 92 00 61 84 10 12 40 c5 85 88 0a 56 14 15 11 9c 48 55 c4 82 d5 0a 48 9d 88 e2 a0 28 b8 67 41 8a 88 5a 8b 55 5c 38 ee 1f dc a7 b5 7d 7a ef ed ed fb d7 fb bc e7 9c e7 fc ce 79 cf 0f 80 11 12 26 91 e6 a2 6a 00 39 52 85 3c 3a d8 1f 8f 4f 48 c4 c9 bd 80 02 15 48 e0 04 20 10 e6 cb c2 67 05 c5 00 00 f0 03 79 78 7e 74 b0 3f fc 01 af 6f 00 02 00 70 d5 2e 24 12 c7 e1 ff 83 ba 50 26 57 00 20 91 00 e0 22 12 e7 0b 01 90 52 00 c8 2e 54 c8 14 00 c8 18 00 b0 53 b3 64 0a 00 94 00 00 6c 79 7c 42 22 00 aa 0d 00 ec f4 49 3e 05 00 d8 a9 93 dc 17 00 d8 a2 1c a9 08 00 8d 01 00 99 28 47 24 02 40 bb 00 60 55 81 52 2c 02 c0 c2 00 a0 ac 40 22 2e 04 c0 ae 01 80 59 b6 32 47 02 80 bd [TRUNCATED] Data Ascii: PNGIHDRRpHYsMiCCPPhotoshop ICC profilexSwX>eVBl"#Ya@VHUH(gAZU\8}zy&j9R<:OHH gyx~t?op.$P&W "R.TSdly\|B"I>(G$@`UR,@".Y2GvX@`B, 8C L0_pHK3w!lBa)f"#HL8?flko">!N_puk[Vh]3Zzy8@P<%b0>3o~@zq@qanvRB1n#)4\,XP"MyRD!2wONl~Xv@~-g42y@+\LD*AaD@$<BAT:18\p`Aa!:b""aH4 Q"rBj]H#-r9\@ 2G1Qu@st4]k=Kut}c1fa\E`X&cX5V5cX7va$^lGXLXC%#W1'"O%zxb:XF&!!%^'_H$N!%2IIkHH-S>iL&m O [TRUNCATED]
Sep 27, 2024 06:10:54.957459927 CEST	496	OUT	GET /images/kongtou4_240216.gif HTTP/1.1 Host: c.vip3656jun27.cc Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 Cookie: _pk_id.3.589b=b081036b5f3ec0ac.1727410252.; _pk_ses.3.589b=1; UM_distinctid=19231aca93422f-0cc443f971c4e3-26031e51-140000-19231aca936da; CNZZDATA1275613349=801000927-1727410252-%7C1727410252
Sep 27, 2024 06:10:55.205867052 CEST	1236	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 04:10:55 GMT Content-Type: image/gif Content-Length: 502876 Connection: keep-alive X-Frame-Options: deny X-XSS-Protection: 1 Accept-Ranges: bytes Data Raw: 47 49 46 38 39 61 8c 00 72 01 f7 ff 00 a2 6c 55 fd d1 71 f1 b8 ad 45 88 35 fd 8c 06 f2 ba 95 55 91 48 77 b5 6a ff f2 8d 60 68 5c ff ce 2d d6 97 74 cd cd cd a0 d9 e5 02 a9 d1 66 92 48 d1 70 0e b2 00 06 d6 23 2b 00 ce b5 44 77 34 19 56 fb fe fb af dd 98 23 33 68 22 1f 0e 02 da ba b2 f8 ba 4f 62 95 a7 ac bb 4c db d8 54 ff bb ca fa d6 88 01 ac b9 60 ca ab db 88 13 d7 cc b4 62 a7 db 2e 98 63 f9 4e 51 b5 b5 b4 b5 4c 02 b8 87 70 fd 95 92 de ab 74 d8 98 89 fb ba 69 fa 98 1a fd b7 00 2d 66 45 af 8d 28 9b b7 d7 bb cc 4f 24 d3 98 02 55 33 d7 f3 f3 92 01 01 96 aa 50 cf 8b 53 f8 6d 6e 8a b4 6d d7 b2 4a cd 4e 4d dc db 67 b6 70 36 67 cc e9 b1 ad 96 b9 90 4c b4 99 89 90 51 34 e2 33 3b 6b 70 8b d6 6d 69 8f 91 8f d0 11 22 ab db 98 93 29 01 70 8d 71 87 cc 79 d1 51 01 ff ee 32 43 22 11 6e 02 00 cc 0c 11 ac 2e 01 87 98 44 8f 85 70 25 b8 8e 01 ab 99 1f 4c 2f d7 aa 2d fe ff 01 af ae 69 a4 69 8a 44 02 00 c8 71 52 99 cc 88 67 aa 5a 6c 4a 35 fd 96 46 b5 29 29 53 88 65 fa 22 2c ff 00 00 72 2e 0c 94 b2 8e cf 73 28 b7 cd b7 aa [TRUNCATED] Data Ascii: GIF89arlUqE5UHwj`h\-tfHp#+Dw4V#3h"ObLT`b.cNQLpti-fE(O$U3PSmnmJNMgp6gLQ43;kpmi")pqyQ2C"n.Dp%L/-iiDqRgZlJ5F))Se",r.s(eiL"fh#oRG7.gpu6Tf/G3&M85]i2CuFpNJM,OrHs(t.UwgR8W'&n/%3x#S/vF33N&N/WT7 9uUZDP3 8p\|nf <*AgDwUDAU3! UD5D\!f3!7f^U=@b{f@}w!NETSCAPE2.0!XMP DataXMP<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3. [TRUNCATED]