Windows Analysis Report
http://www.telegramrm.com/

Overview

General Information

Sample URL:	http://www.telegramrm.com/
Analysis ID:	1520819
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected ZipBomb

Classification

Signatures

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49794 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js HTTP/1.1Host: sdk.51.laConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /skin/css/style.css HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/css/skin.css HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telegramrm.com/skin/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/jquery-2.2.4.min.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/navright1.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js HTTP/1.1Host: sdk.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /static/images/navright.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/logo.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session3.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/navright.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/navright1.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/window.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/logo.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session3.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/custom.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/side.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/window.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/hc-sticky.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/custom.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/side.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/hc-sticky.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session2left.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session2left.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session2right.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/section4i9.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/section4i8.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i7.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i6.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i5.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /skin/js/jquery-2.2.4.min.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/session2right.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i4.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /matomo.js HTTP/1.1Host: web.dcobxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/images/section4i3.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /matomo.js HTTP/1.1Host: web.dcobxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/images/section4i2.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i1.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231217/1702817607573664.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231216/1702728345765756.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i8.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i5.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i6.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /Spider/?url=/ HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/session2i.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/skin/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i9.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i7.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i4.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231216/1702728345765756.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231217/1702817607573664.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/session2i.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i3.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i2.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /TiGysceotsetup-m66.zip HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.telegramrm.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: sdk.51.la
Source: global traffic	DNS traffic detected: DNS query: collect-v6.51.la
Source: global traffic	DNS traffic detected: DNS query: web.dcobxs.com

Source: unknown

HTTP traffic detected: POST /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveContent-Length: 407sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.telegramrm.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 22:15:33 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "65f1ef30-8a"

Source: chromecache_108.2.dr, chromecache_91.2.dr	String found in binary or memory: http://www.SuperSlide2.com/
Source: chromecache_90.2.dr	String found in binary or memory: https://apps.apple.com/app/telegram-messenger/id686449807
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/api
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/mtproto
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://github.com/matomo-org/matomo/blob/master/js/piwik.js
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://piwik.org
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://piwik.org/free-software/bsd/
Source: chromecache_90.2.dr	String found in binary or memory: https://twitter.com/telegram
Source: chromecache_90.2.dr	String found in binary or memory: https://web.dcobxs.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49794 version: TLS 1.2

Source: classification engine

Classification label: mal48.evad.win@18/76@20/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramrm.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected ZipBomb

Source: Yara match

File source: C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp, type: DROPPED

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
90.84.161.25	unknown	France	5511	OPENTRANSITFR	false
104.21.72.253	web.dcobxs.com	United States	13335	CLOUDFLARENETUS	false
47.242.228.6	www.telegramrm.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
90.84.164.17	hcdnwsa120.v5.cdnhwczoy106.cn	France	5511	OPENTRANSITFR	false
148.153.240.75	unknown	United States	63199	CDSC-AS1US	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.6

Contacted Domains

Name	IP	Active
hcdnwsa120.v5.cdnhwczoy106.cn	90.84.164.17	true
www.google.com	216.58.206.36	true
www.telegramrm.com	47.242.228.6	true
web.dcobxs.com	104.21.72.253	true
fp2e7a.wpc.phicdn.net	192.229.221.95	true
collect-v6.51.la	unknown	unknown
sdk.51.la	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://sdk.51.la/js-sdk-pro.min.js	false	unknown
https://www.telegramrm.com/static/images/session2right.jpg	false	unknown
https://www.telegramrm.com/static/images/window.jpg	false	unknown
https://www.telegramrm.com/static/images/section4i8.gif	false	unknown
https://web.dcobxs.com/matomo.js	false	unknown
https://www.telegramrm.com/static/images/section4i2.gif	false	unknown
https://www.telegramrm.com/static/images/session3.jpg	false	unknown
https://www.telegramrm.com/static/upload/image/20231216/1702728345765756.png	false	unknown
https://www.telegramrm.com/static/images/session2left.jpg	false	unknown
https://www.telegramrm.com/static/images/section4i4.gif	false	unknown
https://www.telegramrm.com/static/images/section4i1.gif	false	unknown
https://www.telegramrm.com/Spider/?url=/	false	unknown
https://www.telegramrm.com/skin/css/skin.css	false	unknown
https://www.telegramrm.com/static/images/session2i.png	false	unknown
https://www.telegramrm.com/static/images/section4i9.gif	false	unknown
https://collect-v6.51.la/v6/collect?dt=4	false	unknown
https://www.telegramrm.com/skin/js/hc-sticky.js	false	unknown
https://www.telegramrm.com/static/images/section4i5.gif	false	unknown
https://www.telegramrm.com/skin/css/style.css	false	unknown
https://www.telegramrm.com/TiGysceotsetup-m66.zip	false	unknown
https://www.telegramrm.com/static/images/logo.png	false	unknown
https://www.telegramrm.com/skin/js/custom.js	false	unknown
https://www.telegramrm.com/skin/js/side.js	false	unknown
https://www.telegramrm.com/skin/js/jquery-2.2.4.min.js	false	unknown
https://www.telegramrm.com/	false	unknown
https://www.telegramrm.com/static/upload/image/20231217/1702817607573664.jpg	false	unknown
https://www.telegramrm.com/static/images/navright1.png	false	unknown
https://www.telegramrm.com/static/images/section4i6.gif	false	unknown
https://web.dcobxs.com/matomo.php?action_name=Telegram%E5%AE%98%E7%BD%91-Telegram%E4%B8%AD%E6%96%87%E6%B1%89%E5%8C%96%E7%89%88-Telegram%E4%B8%8B%E8%BD%BD-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%AD%E6%96%87%E7%89%88-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%8B%E8%BD%BD&idsite=19&rec=1&r=124021&h=18&m=15&s=28&url=https%3A%2F%2Fwww.telegramrm.com%2F&_id=6eab26ea7524a273&_idn=1&send_image=0&_refts=0&pv_id=gmB1pt&pf_net=1488&pf_srv=596&pf_tfr=278&pf_dm1=16395&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.134%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.134%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024	false	unknown
https://www.telegramrm.com/static/images/section4i3.gif	false	unknown
https://www.telegramrm.com/static/images/navright.png	false	unknown
https://www.telegramrm.com/static/images/section4i7.gif	false	unknown
http://www.telegramrm.com/	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\Downloads\TiGysceotsetup-m66.zip.crdownload	Zip archive data, at least v2.0 to extract, compression method=deflate	DE9BB39EFCB571691793AD1ABE0A92D9	FEB50163000193D7386AB931927A2C1673D14DB7	2ED9099AAFB50A05B35D4BA95C841304D3203D289F9B07A9FEB5FEEC5536D5AB
C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp	Zip archive data, at least v2.0 to extract, compression method=deflate	1E35302C99EA92EA207C6A2DE3835684	95E9C7E92DE4FBC9F41BF56DB1AFB6EC157F1468	2F6A81BD03A3C95B3ECB6003D84E498FF98084E57690984B7841F7208395551A
Chrome Cache Entry: 100	GIF image data, version 89a, 512 x 512	21528F532493017CA7A8CDFA73BA1F09	798073FD3B30C0688787EDAC94667D6025B027AE	3DA30018745EE9D2032BB71F2907A2FA3647D1660D402200D35F161854B0EF48
Chrome Cache Entry: 101	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 442x270, components 3	89486A05599A1CFD549F8FB2D70E7D73	24867697525DF19B88E79D75FF32384EBA57B321	5A2C666B6E4F30FF921353CD9A3ECCC09B9314C5C5AB11E1A3928936E497B2DC
Chrome Cache Entry: 102	PNG image data, 21 x 120, 8-bit/color RGBA, non-interlaced	CBA400C638C2081CE8798E24F95EAB6A	DAEE39E625008D0D8C3E13B23660391DC4D47E67	389EB664948DDA8C5AFDD43719DDFCEE49D1332A1306DD717C8505755482CF51
Chrome Cache Entry: 103	HTML document, ASCII text	7389D931C86B3D7BB6B8AF46D8C4172B	8D2A4760AA0B47984D11CD1A66448719177FB791	301BD9F16F94FEEDFAE7A946A14BAC38CB73C43EFE6117BC5586835AF03D7D6F
Chrome Cache Entry: 104	GIF image data, version 89a, 512 x 512	6A88BBD5858B7D9234FB7D0C6C5059A6	C3412D69DFA2CE6B208D52E6842EA7807CFF42D3	F8152A8D500807F824571C3256320BBF578CDCE88D45D0FD048A6422F71C272B
Chrome Cache Entry: 105	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced	1ED9BF7633F4F449C8D2DF94EA0EB35F	2902BA9C2B127C74C2550298A0578D7D8DA941C2	E7D23B06A4FFD600558E5443D1E32DAAAF13A27CF7BB8B7CC163A92B4054AAF2
Chrome Cache Entry: 106	ASCII text, with very long lines (32065), with CRLF line terminators	710458DD559C957714AC4A8E95357EB5	F694238D616F579A0690001F37984AF430C19963	B409C14A10B4CAAD6B54844AA63A5FAF748B83EECC2DD0D4FB1D913F8DE55365
Chrome Cache Entry: 107	GIF image data, version 89a, 512 x 512	21528F532493017CA7A8CDFA73BA1F09	798073FD3B30C0688787EDAC94667D6025B027AE	3DA30018745EE9D2032BB71F2907A2FA3647D1660D402200D35F161854B0EF48
Chrome Cache Entry: 108	Unicode text, UTF-8 text, with very long lines (12011)	2D08332CFB55E5798A843B05B93C4970	568C9D9CD578419034BF31169AD405ECB707A5B4	C72C14610C3488168B0BAB5B6E17D30566DC49A701883402C3C63421DF22CFDF
Chrome Cache Entry: 109	GIF image data, version 89a, 512 x 512	E60746B12F4E6CCA778727472F415218	4E3B517A1911D891D018BC63B66E1B69837A3E15	B285715D34361C4FED5058A10EB830BF2DD61126518477DED340DD7F95221417
Chrome Cache Entry: 110	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	2C84BE4C4DEC401D09A64498CBBD382D	1C7053B083D5E59ED5CB4912C5500F39BEAF765E	88AFE4CAAD9D3EF9D7B4A5301D1B2B4378B54D233038079F0145E2F387F4EED9
Chrome Cache Entry: 111	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 442x270, components 3	89486A05599A1CFD549F8FB2D70E7D73	24867697525DF19B88E79D75FF32384EBA57B321	5A2C666B6E4F30FF921353CD9A3ECCC09B9314C5C5AB11E1A3928936E497B2DC
Chrome Cache Entry: 112	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 320x156, components 3	74B079C3A756314C88BA10A40D4F85C8	E4C933296056EC3C0CCC5F12BA00EE4017BAC8BB	C443C78239489B2EE75618B26460DAE55A87A132B74807780CEAB30130EB7A68
Chrome Cache Entry: 113	ASCII text, with very long lines (65136)	E47E304E0CD0315E6D6DB1FF5A473C11	EFA7EB2D9ECD230A9883F2C779A84247CD64EF62	BE0D7AF2971BAF50358DD1560C353CF6795D0D4E6B85388023A5719B12C9EE35
Chrome Cache Entry: 114	GIF image data, version 89a, 512 x 512	5433CF6CF6DAA107F38CC2F2B221ADC5	84156830CC0E51264342C37F2043C441562B137F	321FB7936DADA76CE957347F61CD05BE88581C5C3532D5CF87D346BA677474F6
Chrome Cache Entry: 68	GIF image data, version 89a, 512 x 512	E60746B12F4E6CCA778727472F415218	4E3B517A1911D891D018BC63B66E1B69837A3E15	B285715D34361C4FED5058A10EB830BF2DD61126518477DED340DD7F95221417
Chrome Cache Entry: 69	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 1000x562, components 3	34C117B53D6D2CBC4F6C53CF56BCB14F	CB3F9B0F95F323AFBA57F81316476600E82C8021	7CAB1A8C0BA5E1798FD79316B091CC501E5BC949C1295949DABD2BCA39C0FD41
Chrome Cache Entry: 70	PNG image data, 300 x 168, 8-bit colormap, non-interlaced	3FF8E2FD524C2EAACF6A4731353B4677	67FCB895FB22D4B4C8425A9A87F9B984AEC0068D	D073776F8E9D360A5FC91B86723D2AC626A2DE15EA487611CDC3505FBA01DB78
Chrome Cache Entry: 71	ASCII text, with very long lines (65136)	E47E304E0CD0315E6D6DB1FF5A473C11	EFA7EB2D9ECD230A9883F2C779A84247CD64EF62	BE0D7AF2971BAF50358DD1560C353CF6795D0D4E6B85388023A5719B12C9EE35
Chrome Cache Entry: 72	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 1000x562, components 3	34C117B53D6D2CBC4F6C53CF56BCB14F	CB3F9B0F95F323AFBA57F81316476600E82C8021	7CAB1A8C0BA5E1798FD79316B091CC501E5BC949C1295949DABD2BCA39C0FD41
Chrome Cache Entry: 73	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90", baseline, precision 8, 1000x208, components 3	AD0F44F79330E0AF7CB064C4A9FD9B11	A3519070EF768B9CA163B6D8CFE7012DDBBCF4BD	F123A86B52BC881B75B0AFE9201A8CF1ED563C59E44B84C2C21F58E80CE3B44B
Chrome Cache Entry: 74	GIF image data, version 89a, 512 x 512	3CA4222D4871D2C299E44DBBD14EBB46	19EE2E1C0D6DA440C08076DC1A657C8E58AA0662	E21CCEB8262A91F878FE4E5202139793E9CD3A02DA2DD08D2DC4180CD29AC402
Chrome Cache Entry: 75	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced	2C84BE4C4DEC401D09A64498CBBD382D	1C7053B083D5E59ED5CB4912C5500F39BEAF765E	88AFE4CAAD9D3EF9D7B4A5301D1B2B4378B54D233038079F0145E2F387F4EED9
Chrome Cache Entry: 76	PNG image data, 300 x 168, 8-bit colormap, non-interlaced	3FF8E2FD524C2EAACF6A4731353B4677	67FCB895FB22D4B4C8425A9A87F9B984AEC0068D	D073776F8E9D360A5FC91B86723D2AC626A2DE15EA487611CDC3505FBA01DB78
Chrome Cache Entry: 77	GIF image data, version 89a, 512 x 512	6A88BBD5858B7D9234FB7D0C6C5059A6	C3412D69DFA2CE6B208D52E6842EA7807CFF42D3	F8152A8D500807F824571C3256320BBF578CDCE88D45D0FD048A6422F71C272B
Chrome Cache Entry: 78	GIF image data, version 89a, 512 x 512	999CCB074C15D6377F97302832038C14	C08B94482AD5540F68A896F30CC890474C058E1D	15D01829FAC9057A922B9168D68D9EA940D7612B0128AE9B67FE69A1DD10E62D
Chrome Cache Entry: 79	HTML document, ASCII text, with very long lines (6093), with no line terminators	502D407625A03C5151CF7F0B7F1D2E5A	99C26FEDA1569A28C4ED050056CB12EA38BD3172	CB3FDAE01E5EDFB32565C5F7B592BC7CA850CBA92565FF12F020DF68570481E8
Chrome Cache Entry: 80	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2023:05:26 07:24:20], baseline, precision 8, 510x532, components 3	1E30B429BA212FFF35F3DD29E131543B	656A10C84247B023BCB2651712C961FBE036A8E6	5D0C4939A51A164A3067D43C5071F3B9B468C4B73FA9D27C811FDBCAC2CA431E
Chrome Cache Entry: 81	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 320x156, components 3	74B079C3A756314C88BA10A40D4F85C8	E4C933296056EC3C0CCC5F12BA00EE4017BAC8BB	C443C78239489B2EE75618B26460DAE55A87A132B74807780CEAB30130EB7A68
Chrome Cache Entry: 82	GIF image data, version 89a, 512 x 512	9F6CB1E0D2A29541764755E05B484DE7	D443F92ED7059A30DB98857F6C5C290589EBFE24	ABDBFC359A2954FADB7D335A20C2AE29CC5B00DBD538E88B03D612F978654E45
Chrome Cache Entry: 83	ASCII text, with very long lines (32065), with CRLF line terminators	710458DD559C957714AC4A8E95357EB5	F694238D616F579A0690001F37984AF430C19963	B409C14A10B4CAAD6B54844AA63A5FAF748B83EECC2DD0D4FB1D913F8DE55365
Chrome Cache Entry: 84	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced	B104BB1FFCD608612E85386C65AE8532	B87D86B8C5C2AA5154578C925CC982333459BEE6	33D6BE96B9CEED78DC9B32BB3FCDF2814836635D2D376D746F42728C35538F9E
Chrome Cache Entry: 85	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced	1ED9BF7633F4F449C8D2DF94EA0EB35F	2902BA9C2B127C74C2550298A0578D7D8DA941C2	E7D23B06A4FFD600558E5443D1E32DAAAF13A27CF7BB8B7CC163A92B4054AAF2
Chrome Cache Entry: 86	Unicode text, UTF-8 text, with very long lines (44903), with no line terminators	E6BC2935FEDC92213B430027E059C3C8	8D79C246B1D2E16AD7ED60FA5CE35E23B6C1FE9B	9FDFF231D46F09B29510EF4ADC80A4DBAE646C9D3DA770DFE3C7A9672F48269A
Chrome Cache Entry: 87	Unicode text, UTF-8 text, with very long lines (1523)	94E9F897C976369D1CD8552E2BAEE1C2	9E539A9612A6C9D9B440D2BE65BEA956BCA49217	6B3920CE320CE5F08BB1A40C8566D0B24BD8F19B8C5703B425D145FD43BACC17
Chrome Cache Entry: 88	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2023:05:26 07:24:20], baseline, precision 8, 510x532, components 3	1E30B429BA212FFF35F3DD29E131543B	656A10C84247B023BCB2651712C961FBE036A8E6	5D0C4939A51A164A3067D43C5071F3B9B468C4B73FA9D27C811FDBCAC2CA431E
Chrome Cache Entry: 89	GIF image data, version 89a, 512 x 512	999CCB074C15D6377F97302832038C14	C08B94482AD5540F68A896F30CC890474C058E1D	15D01829FAC9057A922B9168D68D9EA940D7612B0128AE9B67FE69A1DD10E62D
Chrome Cache Entry: 90	HTML document, Unicode text, UTF-8 text	937F2CB42D37154AE98254F4417B869A	6B9C44CB0D5BCBCA0414E57959DB23ADE75DCD28	15DD728B740013EE0BD2C5875AFF8EAFDB90CA1680E816C2986B10D8A3733C8E
Chrome Cache Entry: 91	Unicode text, UTF-8 text, with very long lines (12011)	2D08332CFB55E5798A843B05B93C4970	568C9D9CD578419034BF31169AD405ECB707A5B4	C72C14610C3488168B0BAB5B6E17D30566DC49A701883402C3C63421DF22CFDF
Chrome Cache Entry: 92	Unicode text, UTF-8 text, with very long lines (1523)	94E9F897C976369D1CD8552E2BAEE1C2	9E539A9612A6C9D9B440D2BE65BEA956BCA49217	6B3920CE320CE5F08BB1A40C8566D0B24BD8F19B8C5703B425D145FD43BACC17
Chrome Cache Entry: 93	ASCII text, with very long lines (2432), with no line terminators	629821CEBC555B2F14B3D73DECDA2380	377E14F8A7E06FF3D8B0328A4858719F744323F3	F13817D661DF7C13714830DD2781BAF013D8FC89CF64AD84BCF88168B9874658
Chrome Cache Entry: 94	HTML document, ASCII text, with very long lines (6093), with no line terminators	502D407625A03C5151CF7F0B7F1D2E5A	99C26FEDA1569A28C4ED050056CB12EA38BD3172	CB3FDAE01E5EDFB32565C5F7B592BC7CA850CBA92565FF12F020DF68570481E8
Chrome Cache Entry: 95	PNG image data, 21 x 120, 8-bit/color RGBA, non-interlaced	CBA400C638C2081CE8798E24F95EAB6A	DAEE39E625008D0D8C3E13B23660391DC4D47E67	389EB664948DDA8C5AFDD43719DDFCEE49D1332A1306DD717C8505755482CF51
Chrome Cache Entry: 96	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced	B104BB1FFCD608612E85386C65AE8532	B87D86B8C5C2AA5154578C925CC982333459BEE6	33D6BE96B9CEED78DC9B32BB3FCDF2814836635D2D376D746F42728C35538F9E
Chrome Cache Entry: 97	GIF image data, version 89a, 512 x 512	14C0A01070573BC00E0F462023E8162F	8D8725F9BDBE99060B86E0A03434BB5C4E3BE8AF	116029BD091EC390064879DF7DAD05E601E284413F53B9D51978875B85DC7471
Chrome Cache Entry: 98	GIF image data, version 89a, 512 x 512	3CA4222D4871D2C299E44DBBD14EBB46	19EE2E1C0D6DA440C08076DC1A657C8E58AA0662	E21CCEB8262A91F878FE4E5202139793E9CD3A02DA2DD08D2DC4180CD29AC402
Chrome Cache Entry: 99	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90", baseline, precision 8, 1000x208, components 3	AD0F44F79330E0AF7CB064C4A9FD9B11	A3519070EF768B9CA163B6D8CFE7012DDBBCF4BD	F123A86B52BC881B75B0AFE9201A8CF1ED563C59E44B84C2C21F58E80CE3B44B

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49794 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js HTTP/1.1Host: sdk.51.laConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /skin/css/style.css HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/css/skin.css HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://www.telegramrm.com/skin/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/jquery-2.2.4.min.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/navright1.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /js-sdk-pro.min.js HTTP/1.1Host: sdk.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /static/images/navright.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/logo.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session3.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/navright.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/navright1.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/window.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/logo.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session3.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/custom.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/side.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/window.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/hc-sticky.js HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/custom.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/side.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /skin/js/hc-sticky.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session2left.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session2left.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/session2right.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/section4i9.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
Source: global traffic	HTTP traffic detected: GET /static/images/section4i8.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i7.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i6.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i5.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /skin/js/jquery-2.2.4.min.js HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/session2right.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /static/images/section4i4.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
Source: global traffic	HTTP traffic detected: GET /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /matomo.js HTTP/1.1Host: web.dcobxs.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/images/section4i3.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /matomo.js HTTP/1.1Host: web.dcobxs.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/images/section4i2.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i1.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231217/1702817607573664.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231216/1702728345765756.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i8.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i5.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i6.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /Spider/?url=/ HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/session2i.png HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://www.telegramrm.com/skin/css/style.cssAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i9.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i7.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i4.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231216/1702728345765756.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/upload/image/20231217/1702817607573664.jpg HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/session2i.png HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i3.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /static/images/section4i2.gif HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET /TiGysceotsetup-m66.zip HTTP/1.1Host: www.telegramrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: www.telegramrm.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.telegramrm.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: sdk.51.la
Source: global traffic	DNS traffic detected: DNS query: collect-v6.51.la
Source: global traffic	DNS traffic detected: DNS query: web.dcobxs.com

Source: unknown

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 22:15:33 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "65f1ef30-8a"

Source: chromecache_108.2.dr, chromecache_91.2.dr	String found in binary or memory: http://www.SuperSlide2.com/
Source: chromecache_90.2.dr	String found in binary or memory: https://apps.apple.com/app/telegram-messenger/id686449807
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/api
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/mtproto
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://github.com/matomo-org/matomo/blob/master/js/piwik.js
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://piwik.org
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://piwik.org/free-software/bsd/
Source: chromecache_90.2.dr	String found in binary or memory: https://twitter.com/telegram
Source: chromecache_90.2.dr	String found in binary or memory: https://web.dcobxs.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49794 version: TLS 1.2

Source: classification engine

Classification label: mal48.evad.win@18/76@20/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramrm.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected ZipBomb

Source: Yara match

File source: C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp, type: DROPPED

ID:	1520819
Product:	CloudBasic
Start time:	00:14:11
Start date:	28.09.2024
Cookbook:	browseurl.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
http://www.telegramrm.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report http://www.telegramrm.com/

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
http://www.telegramrm.com/