Edit tour

Windows Analysis Report
http://www.telegramrm.com/

Overview

General Information

Sample URL:	http://www.telegramrm.com/
Analysis ID:	1520819
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected ZipBomb

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5064 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 6336 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2612 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramrm.com/" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp	JoeSecurity_ZipBomb	Yara detected ZipBomb	Joe Security

HTTP traffic detected: POST /v6/collect?dt=4 HTTP/1.1Host: collect-v6.51.laConnection: keep-aliveContent-Length: 407sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: */*Origin: https://www.telegramrm.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.telegramrm.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Fri, 27 Sep 2024 22:15:33 GMTContent-Type: text/htmlContent-Length: 138Connection: closeETag: "65f1ef30-8a"

Source: chromecache_108.2.dr, chromecache_91.2.dr	String found in binary or memory: http://www.SuperSlide2.com/
Source: chromecache_90.2.dr	String found in binary or memory: https://apps.apple.com/app/telegram-messenger/id686449807
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/api
Source: chromecache_90.2.dr	String found in binary or memory: https://core.telegram.org/mtproto
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://github.com/matomo-org/matomo/blob/master/js/piwik.js
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://piwik.org
Source: chromecache_71.2.dr, chromecache_113.2.dr	String found in binary or memory: https://piwik.org/free-software/bsd/
Source: chromecache_90.2.dr	String found in binary or memory: https://twitter.com/telegram
Source: chromecache_90.2.dr	String found in binary or memory: https://web.dcobxs.com/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.115.3.253:443 -> 192.168.2.6:49794 version: TLS 1.2

Source: classification engine

Classification label: mal48.evad.win@18/76@20/9

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramrm.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Malware Analysis System Evasion

Yara detected ZipBomb

Source: Yara match

File source: C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Virtualization/Sandbox Evasion	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Virtualization/Sandbox Evasion	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
hcdnwsa120.v5.cdnhwczoy106.cn	90.84.164.17	true	false	unknown
www.google.com	216.58.206.36	true	false	unknown
www.telegramrm.com	47.242.228.6	true	false	unknown
web.dcobxs.com	104.21.72.253	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.221.95	true	false	unknown
collect-v6.51.la	unknown	unknown	false	unknown
sdk.51.la	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://sdk.51.la/js-sdk-pro.min.js	false	unknown
https://www.telegramrm.com/static/images/session2right.jpg	false	unknown
https://www.telegramrm.com/static/images/window.jpg	false	unknown
https://www.telegramrm.com/static/images/section4i8.gif	false	unknown
https://web.dcobxs.com/matomo.js	false	unknown
https://www.telegramrm.com/static/images/section4i2.gif	false	unknown
https://www.telegramrm.com/static/images/session3.jpg	false	unknown
https://www.telegramrm.com/static/upload/image/20231216/1702728345765756.png	false	unknown
https://www.telegramrm.com/static/images/session2left.jpg	false	unknown
https://www.telegramrm.com/static/images/section4i4.gif	false	unknown
https://www.telegramrm.com/static/images/section4i1.gif	false	unknown
https://www.telegramrm.com/Spider/?url=/	false	unknown
https://www.telegramrm.com/skin/css/skin.css	false	unknown
https://www.telegramrm.com/static/images/session2i.png	false	unknown
https://www.telegramrm.com/static/images/section4i9.gif	false	unknown
https://collect-v6.51.la/v6/collect?dt=4	false	unknown
https://www.telegramrm.com/skin/js/hc-sticky.js	false	unknown
https://www.telegramrm.com/static/images/section4i5.gif	false	unknown
https://www.telegramrm.com/skin/css/style.css	false	unknown
https://www.telegramrm.com/TiGysceotsetup-m66.zip	false	unknown
https://www.telegramrm.com/static/images/logo.png	false	unknown
https://www.telegramrm.com/skin/js/custom.js	false	unknown
https://www.telegramrm.com/skin/js/side.js	false	unknown
https://www.telegramrm.com/skin/js/jquery-2.2.4.min.js	false	unknown
https://www.telegramrm.com/	false	unknown
https://www.telegramrm.com/static/upload/image/20231217/1702817607573664.jpg	false	unknown
https://www.telegramrm.com/static/images/navright1.png	false	unknown
https://www.telegramrm.com/static/images/section4i6.gif	false	unknown
https://web.dcobxs.com/matomo.php?action_name=Telegram%E5%AE%98%E7%BD%91-Telegram%E4%B8%AD%E6%96%87%E6%B1%89%E5%8C%96%E7%89%88-Telegram%E4%B8%8B%E8%BD%BD-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%AD%E6%96%87%E7%89%88-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%8B%E8%BD%BD&idsite=19&rec=1&r=124021&h=18&m=15&s=28&url=https%3A%2F%2Fwww.telegramrm.com%2F&_id=6eab26ea7524a273&_idn=1&send_image=0&_refts=0&pv_id=gmB1pt&pf_net=1488&pf_srv=596&pf_tfr=278&pf_dm1=16395&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.134%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.134%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024	false	unknown
https://www.telegramrm.com/static/images/section4i3.gif	false	unknown
https://www.telegramrm.com/static/images/navright.png	false	unknown
https://www.telegramrm.com/static/images/section4i7.gif	false	unknown
http://www.telegramrm.com/	false	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://core.telegram.org/api	chromecache_90.2.dr	false	unknown
https://twitter.com/telegram	chromecache_90.2.dr	false	unknown
https://piwik.org/free-software/bsd/	chromecache_71.2.dr, chromecache_113.2.dr	false	unknown
https://piwik.org	chromecache_71.2.dr, chromecache_113.2.dr	false	unknown
https://core.telegram.org/mtproto	chromecache_90.2.dr	false	unknown
http://www.SuperSlide2.com/	chromecache_108.2.dr, chromecache_91.2.dr	false	unknown
https://core.telegram.org/	chromecache_90.2.dr	false	unknown
https://github.com/matomo-org/matomo/blob/master/js/piwik.js	chromecache_71.2.dr, chromecache_113.2.dr	false	unknown
https://web.dcobxs.com/	chromecache_90.2.dr	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
90.84.161.25	unknown	France	5511	OPENTRANSITFR	false
104.21.72.253	web.dcobxs.com	United States	13335	CLOUDFLARENETUS	false
47.242.228.6	www.telegramrm.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
90.84.164.17	hcdnwsa120.v5.cdnhwczoy106.cn	France	5511	OPENTRANSITFR	false
148.153.240.75	unknown	United States	63199	CDSC-AS1US	false
216.58.206.36	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520819
Start date and time:	2024-09-28 00:14:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.telegramrm.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.evad.win@18/76@20/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.telegramrm.com/TiGysceotsetup-m66.zip

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.67, 172.217.18.14, 142.251.173.84, 34.104.35.123, 13.85.23.86, 192.229.221.95, 40.69.42.241, 93.184.221.240, 13.95.31.18, 2.16.100.168, 88.221.110.91, 142.250.185.131
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, wu.azureedge.net, clients2.google.com, ocsp.digicert.com, ocsp.edge.digicert.com, glb.cws.prod.dcat.dsp.trafficmanager.net, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, client.wns.windows.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, wu.ec.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtSetInformationFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: http://www.telegramrm.com/

Input	Output
URL: https://www.telegramrm.com/ Model: jbxai	{ "brand":["Telegram"], "contains_trigger_text":true, "trigger_text":"Telegram", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.telegramrm.com/ Model: jbxai

{
"brand":["Telegram"],
"contains_trigger_text":true,
"trigger_text":"Telegram",
"prominent_button_name":"unknown",
"text_input_field_labels":"unknown",
"pdf_icon_visible":false,
"has_visible_captcha":false,
"has_urgent_text":false,
"has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	47300322
Entropy (8bit):	7.936762428190398
Encrypted:	false
SSDEEP:	786432:OVAWN3MpOTnBJ6bVmBaCyBYGHSpggOnysOP/XD1b27JnUlt7j7f:aAqMwLOcBaCymggAOP/X5qJUlt7j7f
MD5:	DE9BB39EFCB571691793AD1ABE0A92D9
SHA1:	FEB50163000193D7386AB931927A2C1673D14DB7
SHA-256:	2ED9099AAFB50A05B35D4BA95C841304D3203D289F9B07A9FEB5FEEC5536D5AB
SHA-512:	3E16FDF11A46553C951114ABF7032646ABD62162663BA7A40F437C77C055E4DC7465F3177564F9D7AD0D417FE04F846C4F4F9A02C5B0002294C831BC995E06A0
Malicious:	false
Reputation:	low
Preview:	PK..........<Y.ob..Ei..di.....TiGysceotsetup-m66.exe..gT.O.>....B......Ej.%....C.......J..=...`....H..4).........((.68.....g...\|;{.Y{.=.}.k..{..'.R....@.k{{.@.......m..5..]....X....X.q$........C.....c.C...X.X..a7bL\X........A.....`....../^.@......2.?...@....T....R......@......=.............._....s0`...?..V............/A.........O..j.?.W.......O+!1!.....\...y...'._O...?.... .[........`.3....`.2.....?.k 8..z.vj.>.....T1.wz..8......G/....n~:.....\.<q...;/Vw.`...s...N.9.1...)...9...r...P.)....Pi.:...@.zdR..0....n..?.H..u......t.S.]7x..ko~.............O....V..o.N.5.h...L....D..kX.9=7p:...y.?...T..^...#..o"!89...^..H.?w..V..P..K..{W~..Oi..6..{...."+.W...!.3}.u9.CQ.X....K.4....,.........RF&'.O...O.^.s.g...'.!2.B..?.U.HX..4&....3p.f.}..~L...?...@.DX...U}... ./k....c.1@:...t"...N...IS...T\|.^.^...w-.\|...u.?..6..;....@...^..t4............b..%.J.IW.2.WW._ND..a...Q..n{4B`......O...\.tO.%....&bovw.P....6"w...0.u..0.........Y.{g....y......c...4........e..^_XZ.

C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	32482
Entropy (8bit):	7.9918861097369485
Encrypted:	true
SSDEEP:	768:DH5MQSNY70z9LqxCqH3hcZP6VlichT2OKa6PZBk:MYEFC33hOyVlLLKRPE
MD5:	1E35302C99EA92EA207C6A2DE3835684
SHA1:	95E9C7E92DE4FBC9F41BF56DB1AFB6EC157F1468
SHA-256:	2F6A81BD03A3C95B3ECB6003D84E498FF98084E57690984B7841F7208395551A
SHA-512:	E44D815CBE0A963855ED98A33996BFEA0F599E38B83555138AAEB55AEBBC9B985260F807F7A55C4B2B9F140651C5323B2FDD41A0A1B34DD1EB105FC93D85EB55
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ZipBomb, Description: Yara detected ZipBomb, Source: C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp, Author: Joe Security
Reputation:	low
Preview:	PK..........<Y.ob..Ei..di.....TiGysceotsetup-m66.exe..gT.O.>....B......Ej.%....C.......J..=...`....H..4).........((.68.....g...\|;{.Y{.=.}.k..{..'.R....@.k{{.@.......m..5..]....X....X.q$........C.....c.C...X.X..a7bL\X........A.....`....../^.@......2.?...@....T....R......@......=.............._....s0`...?..V............/A.........O..j.?.W.......O+!1!.....\...y...'._O...?.... .[........`.3....`.2.....?.k 8..z.vj.>.....T1.wz..8......G/....n~:.....\.<q...;/Vw.`...s...N.9.1...)...9...r...P.)....Pi.:...@.zdR..0....n..?.H..u......t.S.]7x..ko~.............O....V..o.N.5.h...L....D..kX.9=7p:...y.?...T..^...#..o"!89...^..H.?w..V..P..K..{W~..Oi..6..{...."+.W...!.3}.u9.CQ.X....K.4....,.........RF&'.O...O.^.s.g...'.!2.B..?.U.HX..4&....3p.f.}..~L...?...@.DX...U}... ./k....c.1@:...t"...N...IS...T\|.^.^...w-.\|...u.?..6..;....@...^..t4............b..%.J.IW.2.WW._ND..a...Q..n{4B`......O...\.tO.%....&bovw.P....6"w...0.u..0.........Y.{g....y......c...4........e..^_XZ.

Chrome Cache Entry: 100

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	2700330
Entropy (8bit):	7.966932248745433
Encrypted:	false
SSDEEP:	49152:Ppp0RYYGh/a/0XHz/qBu6AKHloz7uR40Yjf0S/+AUhfgbsuPO7lQRqVUVI:Bp0hs/DDb61Foz7ky3+AkesuOBd
MD5:	21528F532493017CA7A8CDFA73BA1F09
SHA1:	798073FD3B30C0688787EDAC94667D6025B027AE
SHA-256:	3DA30018745EE9D2032BB71F2907A2FA3647D1660D402200D35F161854B0EF48
SHA-512:	D95F338D7FF896C524ED4BEBD1855E2A73A41C809AA44F86DDE0576EB6702B2A7BFBB8ECC4E744641A12E1E8322A96C4A9DFCC4060EB46A45BCEBB30DD07565E
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i8.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,.............!.5........`......'.....r}...]...q........r.....&..q.. .....q..$.."..%.............`...&........$..v............#.. ..#.....&.`...........!............................".......{............%.."..........$..!...."....<.........%....s.....&.G?;..f...........x...B..{4^MD.&!.....b.X..J..\|...x ....n..........f..s.........5....=3...........r......v..`..7....w..n..`...9.zg\.J..R...$.S.......}..sg..E.o...#..!.J..P~i...@3..iX.?.#..E....g]V.l......2.......v2".....r........l..Q......$..k...L.V.....3.!.....p..h.`..#...m....u.......B.....b.XA3.....P9..p5yM..yJ..j.wc.F....p.G..-....+._O....g;.///.m+.J....oVH...U..Q....\|.."...v.........T......t.2..;....rpo.9...RQPWD9....`..-..h,..}....b%...................H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]...p..K...x.v<...?...K A0`.z.+.+!....#K.LY....<

Chrome Cache Entry: 101

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 442x270, components 3
Category:	downloaded
Size (bytes):	31305
Entropy (8bit):	7.8603716620080535
Encrypted:	false
SSDEEP:	768:3OqzWWjlwuxS+TRqYXz7xlPcuYq8KkTwWq7Pku4kz2R:3nr5zdPn8QSkz2R
MD5:	89486A05599A1CFD549F8FB2D70E7D73
SHA1:	24867697525DF19B88E79D75FF32384EBA57B321
SHA-256:	5A2C666B6E4F30FF921353CD9A3ECCC09B9314C5C5AB11E1A3928936E497B2DC
SHA-512:	BF59EA2F4CDC21464BCE9ABA5401C5DF0522769F998B432DBC79E7863737B87521E0FAA7501DBCE72115B256A181B6DA2C4F2FDBCDFF3E1ABBD4F73AC3177714
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/session2right.jpg
Preview:	......JFIF.....H.H.....@Exif..MM........i...............................................8Photoshop 3.0.8BIM........8BIM.%..................B~..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................................................................C....................................................................C...................................................................................?.....(...(...(...(.........I'..._......._.....9.-.Isv....m.7Www. ..@.(=...3.+.......\|3..<c..../...M.E.a..........t-;....T.[..\.......3..........X;.J..3.....3..j1>g_....).F..x.[6R...N..~.Cs....a..d......_......G...q.........\|S...;X..V..b;..

Chrome Cache Entry: 102

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 120, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1959
Entropy (8bit):	7.824034911157267
Encrypted:	false
SSDEEP:	48:nZ3ycuxIH68nvjKOxhC5GC2vlfWjq6whuwWsmaDBahRm/:nZa6H6wPHC21WW6HwzDB0u
MD5:	CBA400C638C2081CE8798E24F95EAB6A
SHA1:	DAEE39E625008D0D8C3E13B23660391DC4D47E67
SHA-256:	389EB664948DDA8C5AFDD43719DDFCEE49D1332A1306DD717C8505755482CF51
SHA-512:	B318E91869F23F243FCA5E6C461A5EFC82A215D1E0CF51FCAA3D0598E1F4D436F77EF05D74950D7D4D9333639B7A7583A640628D3D8ACDA69D0F279DDAFB24D4
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/session2i.png
Preview:	.PNG........IHDR.......x......}......gAMA......a....8eXIfMM........i.......................................x....Jq......IDATh..Zkl.U.....[[h.....<JW.........Q.........E~.%..D,U............Q1.m...g.",.Q@+..R.twg...v:;...hb.If....s.=s.K".kj..;...B...\...!....m.r.K.-..{=Iq>H..bf.m.>-.o....$?... f..z[t.p\..^.n'....D....l..+S.@..E.. @...Sf.3.b...G.6....[V......)A.c..wDo.....U,h. ...>.tnl.;.c..y...R....#...\..~).......I...=..[!.........<UR....E..\|...x.G"?..%K........p.4P.b.>..,...r...21..8)@.K..4..%\x.......o....Cjn..wI....\.e.G...I.U...'..'.S.^F>4F.........M.2.....e;...X...I...2/?...xZ.....t.B...u...Z.q..?......L.j....q*...+x....S!:o.........@...xu$......]P..ls.....+t]4....]Z'..F..........S}g\p.!!.....H.$+w./M\...,....w....V..2......1.]....s.lz......U.@.....<P.......G.CR..p.....C..GwWl.....z`z...8.}.y..L.a[.F.U.....=<..CKW,Z..l?p ...(.B..L.s.M?.....w.[..A...G..@.S.^...;.TCc...q..ul&^.w.-..9W.+..\|u1m.;.%......k....eX..E....W>.#'.U.\|\|~.......c?

Chrome Cache Entry: 103

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	138
Entropy (8bit):	4.358940110517655
Encrypted:	false
SSDEEP:	3:qVvzLURObOb0qHXbvxL4AqWrKb0GklITULLP61IWKBc4NGb:qFzLIkObRHXLx0AqWObtklIgLP8IWKqj
MD5:	7389D931C86B3D7BB6B8AF46D8C4172B
SHA1:	8D2A4760AA0B47984D11CD1A66448719177FB791
SHA-256:	301BD9F16F94FEEDFAE7A946A14BAC38CB73C43EFE6117BC5586835AF03D7D6F
SHA-512:	DD6D1511E4FCD5BC09D821FFE091FB5946AC9654C48664AED504E479E9AC20C1CAD44B6DF90F42190D47E28F5F96BFB09D24056DF6B950243D68EE8100A9A889
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/Spider/?url=/
Preview:	<html>.<head><title>404 Not Found</title></head>.<body>.<center><h1>404 Not Found</h1></center>.<hr><center>nginx</center>.</body>.</html>

Chrome Cache Entry: 104

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	dropped
Size (bytes):	2002471
Entropy (8bit):	7.980025595488585
Encrypted:	false
SSDEEP:	49152:Q9I1skJEpF7xMJjZb/lII8XKTb9dZpmKcFItbP:V1s8Epm/n8aVpkyFP
MD5:	6A88BBD5858B7D9234FB7D0C6C5059A6
SHA1:	C3412D69DFA2CE6B208D52E6842EA7807CFF42D3
SHA-256:	F8152A8D500807F824571C3256320BBF578CDCE88D45D0FD048A6422F71C272B
SHA-512:	F7AE19293C681636C1D32F7D4391633B1E0BE4AADADE5E874A9D7D48AA1880A02F39F8794E02AA35C61987D25B2D18A0AE28099D202502E6413474E4D445C7F2
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,......................5.......;KK..'SEV....].....W......w........)......!RDU:JJ......r..M^^...>PP{.....HYY\ll\N^i{{_ppw..9KK..vtdv...CSSa`K..#WIXewwUggm.....Qbc.y...!....................M.l^n.T..............O..=..4.....`........V..q..Z.....J.............\|m~.D...&....9.Vii=MM....:..........u..........`sr....?.............bTeFVV....W.....5...$.a.........\|....o...............$..fXilxx..?5.....j........."..............y...........\|.................!....QG-......#A..4_v0&.{s^MNC.B.Vaa.3..Q.....\.........B.._O..k0..uqo...Gy..@ ...x=...md\.w.p...F$..k.f.........^o....gg........aX..o]..-....x......G.~,eC9&&&.....p..A.....R@..[_....t..;...u..;..._......AA@.Z...93...H0......@.......[(...n.....[..{8B8...^..JNYx...3...`U@..y..>...P@P.R......r.b}.]..Y.........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+^....#K.L.....-.

Chrome Cache Entry: 105

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1272
Entropy (8bit):	6.759893244400297
Encrypted:	false
SSDEEP:	24:ay1he91Wwjx82lY2T3ouVMgK5iyJ3V6pKzLXGLfarUZdR+p0tN:awqQNn2xCJ3xKjZD+p0z
MD5:	1ED9BF7633F4F449C8D2DF94EA0EB35F
SHA1:	2902BA9C2B127C74C2550298A0578D7D8DA941C2
SHA-256:	E7D23B06A4FFD600558E5443D1E32DAAAF13A27CF7BB8B7CC163A92B4054AAF2
SHA-512:	51DD36178DD85F062FEE20903A4F0981CA34EB24A7E7245191EF43D493CD47F756389E548A731109F1C0463BA3BD1D3D4F7C4C623639B9514EB2FB9619124F07
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/navright.png
Preview:	.PNG........IHDR.............2......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:BD511DF2556611E48F9585596B882309" xmpMM:DocumentID="xmp.did:BD511DF3556611E48F9585596B882309"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BD511DF0556611E48F9585596B882309" stRef:documentID="xmp.did:BD511DF1556611E48F9585596B882309"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.."...lIDATx..O(.a....19P....up...r...XI.M.."G.*)g.....f..p.h.....Rh/.. ..O=S.3..z..........5.it....L2+...i6g..

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065), with CRLF line terminators
Category:	dropped
Size (bytes):	85582
Entropy (8bit):	5.36654419285893
Encrypted:	false
SSDEEP:	1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98N:u4J+rlfOhWpgCW6G9a98Hrp
MD5:	710458DD559C957714AC4A8E95357EB5
SHA1:	F694238D616F579A0690001F37984AF430C19963
SHA-256:	B409C14A10B4CAAD6B54844AA63A5FAF748B83EECC2DD0D4FB1D913F8DE55365
SHA-512:	282D65828A43BFE50FE0F9AEA8BCA3838AC1B5250E7C7C359C066E0428AA723F001D31C2463681B2AD6816A49A8571BF9F3AE29B2DC53ADF1BBD7D5C4471322B
Malicious:	false
Reputation:	low
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.cal

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	dropped
Size (bytes):	2700330
Entropy (8bit):	7.966932248745433
Encrypted:	false
SSDEEP:	49152:Ppp0RYYGh/a/0XHz/qBu6AKHloz7uR40Yjf0S/+AUhfgbsuPO7lQRqVUVI:Bp0hs/DDb61Foz7ky3+AkesuOBd
MD5:	21528F532493017CA7A8CDFA73BA1F09
SHA1:	798073FD3B30C0688787EDAC94667D6025B027AE
SHA-256:	3DA30018745EE9D2032BB71F2907A2FA3647D1660D402200D35F161854B0EF48
SHA-512:	D95F338D7FF896C524ED4BEBD1855E2A73A41C809AA44F86DDE0576EB6702B2A7BFBB8ECC4E744641A12E1E8322A96C4A9DFCC4060EB46A45BCEBB30DD07565E
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,.............!.5........`......'.....r}...]...q........r.....&..q.. .....q..$.."..%.............`...&........$..v............#.. ..#.....&.`...........!............................".......{............%.."..........$..!...."....<.........%....s.....&.G?;..f...........x...B..{4^MD.&!.....b.X..J..\|...x ....n..........f..s.........5....=3...........r......v..`..7....w..n..`...9.zg\.J..R...$.S.......}..sg..E.o...#..!.J..P~i...@3..iX.?.#..E....g]V.l......2.......v2".....r........l..Q......$..k...L.V.....3.!.....p..h.`..#...m....u.......B.....b.XA3.....P9..p5yM..yJ..j.wc.F....p.G..-....+._O....g;.///.m+.J....oVH...U..Q....\|.."...v.........T......t.2..;....rpo.9...RQPWD9....`..-..h,..}....b%...................H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.]...P.J.J...X.j....`..K...h.]...p..K...x.v<...?...K A0`.z.+.+!....#K.LY....<

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (12011)
Category:	downloaded
Size (bytes):	12465
Entropy (8bit):	5.679610433104963
Encrypted:	false
SSDEEP:	384:loHUjLINgyiQolPJZQsGnuD+qjFREwca0rmm:ly9gyaiGjSd
MD5:	2D08332CFB55E5798A843B05B93C4970
SHA1:	568C9D9CD578419034BF31169AD405ECB707A5B4
SHA-256:	C72C14610C3488168B0BAB5B6E17D30566DC49A701883402C3C63421DF22CFDF
SHA-512:	60504B35F8E8835500988FA85D239EF43149F1ACE17E6D287EC944004A9C826EDF4D4F12F98F442D44FDCAF61566EF48766130F652E71C329B56D1133F60EED6
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/skin/js/side.js
Preview:	/!. SuperSlide v2.1.3.* ................* .........http://www.SuperSlide2.com/.. Copyright 2011-.., ...... .............* .....................* v2.1.3...Jquery.....API........Jquery....jquery3.3.1................jquery..... 305491515@qq.com.*/!function(a){a.fn.slide=function(g){return a.fn.slide.defaults={type:"slide",effect:"fade",autoPlay:!1,delayTime:500,interTime:2500,triggerTime:150,defaultIndex:0,titCell:".hd li",mainCell:".bd",targetCell:null,trigger:"mouseover",scroll:1,vis:1,titOnClassName:"on",autoPage:!1,prevCell:".prev",nextCell:".next",pageStateCell:".pageState",opp:!1,pnLoop:!0,easing:"swing",startFun:null,endFun:null,switchLoad:null,playStateCell:".playState",mouseOverStop:!0,defaultPlay:!0,returnDefault:!1},this.each(function(){var aG,c,gg,ga,e,h,cf,O,f,D,eJ,ab

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	3422486
Entropy (8bit):	7.978761675756364
Encrypted:	false
SSDEEP:	49152:UMnCaXRGlcMKTAIS5pTziQgIeU7nc67hMcgJ3NJLsqgFJelJn/FfDWF5zRW:UMCaINkAb7rfLc6buNmwpdfstW
MD5:	E60746B12F4E6CCA778727472F415218
SHA1:	4E3B517A1911D891D018BC63B66E1B69837A3E15
SHA-256:	B285715D34361C4FED5058A10EB830BF2DD61126518477DED340DD7F95221417
SHA-512:	5DB7FC6C0E1EC272C02EC741FA278D162EDAF2ACF9AC0421729585B1C1CE2CF13BAB0204C0F5B425D02989F34B1DB592C65B500B6E6EDD909E8ED138C59E2D18
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i4.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,........... z...]. ......{...!......`.._.........5...D.i7..y......}....q..!.........`..y.......................\|..................?........y..9....................S..O............>>>5.....Y...i..X....C...K........J.....r..3..r9...........,.@...;..[..?.C..$....`.....&........F.N....(......m.....(...V.j.._ZW....J.......3.r...........O....c...........\|<a&%.. ........bjh`}z..B...........`.`......G.]./........ S......7......P..f)....5...b.~E..`65.U.E.2..........b...o...,..z...aGE.B@..X..ld.........s._....Jk.......^._....).p6..x......e.A.......\|..>@@@...`......%..O..,t.-...`....#w4..U....dW..!.\|.....'j.f..".ee../..l... ..W........#....(.....g.^5.@.."r..7{1z...~kY...X..%.....r..\.F=@._.....9{R~~~......F...e....,.;....}%%.w..v1.q...^x+.........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x.^......h....a..........#K.L....3k

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11449
Entropy (8bit):	7.9656940108488605
Encrypted:	false
SSDEEP:	192:5UyKfZZ5JFHS1q5YLEusGFByfrNG9dOvER63Wya7wBXXool4FdoqU8qYyClRehi4:GySn5J81q59usG6DNsduY8BnVA+8qYyH
MD5:	2C84BE4C4DEC401D09A64498CBBD382D
SHA1:	1C7053B083D5E59ED5CB4912C5500F39BEAF765E
SHA-256:	88AFE4CAAD9D3EF9D7B4A5301D1B2B4378B54D233038079F0145E2F387F4EED9
SHA-512:	F0BDEBD3923D8DCEAC9218DF93808A0476AEDF1A6CCD4274B7D9FDD429CBAE2C8F1E36B244B169B9AD6BF3A17EB5AC2A92A0DF3304799ACDA742955AE03F5BB0
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/logo.png
Preview:	.PNG........IHDR..............>a.....gAMA......a....8eXIfMM........i............................................kF&M..,,IDATx..}{...y.s....z......,J..68 ..HbVB0o..x.iZ....V....r.Wj.8n.:....$....`..h`9..FHB...z?A...3...o.3{..s...+..3.7{....{..3....#l..W...+....i..pikY..l.:.nV.$..'..~..C...4=.<.:w.%.-I.n.h565.Z.^...........v[.H:...\5.._.\r..B...y.4#.(.OnxuX.$...M..a .X...3./J.w.........U.Z.>..6.8.Z.#o.#..IS.2....4G.VJ/.0..........h..Z.....[.V.~v..d...+.<?..=........i..9.+.[.\|.%..W.Q..,...PCo....%{!..../]5..J....v...f.Z..X.....l<=..fv1AQ>..%....n......A.B.V.0....$$.`..R.=...v.>...........V..l.@.3.-Y>.Y....i.S...^/..L.u....E_.[.[...^.z.......x...G...v....r..>..f3aE.....V..g4..(p....e.g...9..$....5s...7.}.E.......%...VkUq......Jl.'.V.%.]B....(f.v...-./.L4,V.'I..h\|.k.\|....=bO.U...~.EC.G..0_..8......KR.c..'.n...(.?K.._.\hO./.W......w.KW.{#.._..R..~?m....pu.....gx1.q.....%+..2}\RQ.#.....\X1b..wz..$_.?..]O]..E{~...8.}.$...X/W....-.<..q.b.x...+.C...

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=1], baseline, precision 8, 442x270, components 3
Category:	dropped
Size (bytes):	31305
Entropy (8bit):	7.8603716620080535
Encrypted:	false
SSDEEP:	768:3OqzWWjlwuxS+TRqYXz7xlPcuYq8KkTwWq7Pku4kz2R:3nr5zdPn8QSkz2R
MD5:	89486A05599A1CFD549F8FB2D70E7D73
SHA1:	24867697525DF19B88E79D75FF32384EBA57B321
SHA-256:	5A2C666B6E4F30FF921353CD9A3ECCC09B9314C5C5AB11E1A3928936E497B2DC
SHA-512:	BF59EA2F4CDC21464BCE9ABA5401C5DF0522769F998B432DBC79E7863737B87521E0FAA7501DBCE72115B256A181B6DA2C4F2FDBCDFF3E1ABBD4F73AC3177714
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H.....@Exif..MM........i...............................................8Photoshop 3.0.8BIM........8BIM.%..................B~..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz...........................................................................C....................................................................C...................................................................................?.....(...(...(...(.........I'..._......._.....9.-.Isv....m.7Www. ..@.(=...3.+.......\|3..<c..../...M.E.a..........t-;....T.[..\.......3..........X;.J..3.....3..j1>g_....).F..x.[6R...N..~.Cs....a..d......_......G...q.........\|S...;X..V..b;..

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 320x156, components 3
Category:	dropped
Size (bytes):	31391
Entropy (8bit):	7.963966387313214
Encrypted:	false
SSDEEP:	768:bJais3CSvmnzUBl7g06FkewP2j6NBy8s6DW43Dp0jiA+:bJajySizUL96F4P2j6NvR3gG
MD5:	74B079C3A756314C88BA10A40D4F85C8
SHA1:	E4C933296056EC3C0CCC5F12BA00EE4017BAC8BB
SHA-256:	C443C78239489B2EE75618B26460DAE55A87A132B74807780CEAB30130EB7A68
SHA-512:	C36C7C5D6E84BD7CDF78AF2B339FA60A5DAF1C0B45BB912B8BD33230F6631A9850299B4C68D1A400BBB599EF17F6F3AB804B8E6A7676676B48B043FACA251258
Malicious:	false
Reputation:	low
Preview:	......Exif..II*.................Ducky.......d.....1http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:41DF7D7081CA11E991809FEABB4E64F3" xmpMM:DocumentID="xmp.did:41DF7D7181CA11E991809FEABB4E64F3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2B6008097FB611E991809FEABB4E64F3" stRef:documentID="xmp.did:2B60080A7FB611E991809FEABB4E64F3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................................................................................................

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65136)
Category:	downloaded
Size (bytes):	67371
Entropy (8bit):	5.514889684824493
Encrypted:	false
SSDEEP:	1536:IpgnplATrFVqe7EKxFXHuveM2V1Oy6fu1K0MNdda8iNDAGoT4ITzxfYQKFJo:Ip+jmhuWZ1Oy6fvNdda8iNDAGQXxfN1
MD5:	E47E304E0CD0315E6D6DB1FF5A473C11
SHA1:	EFA7EB2D9ECD230A9883F2C779A84247CD64EF62
SHA-256:	BE0D7AF2971BAF50358DD1560C353CF6795D0D4E6B85388023A5719B12C9EE35
SHA-512:	0DD548C5F8B833A0EDD4FDC76D173674384278E086B3AE6613EEB7B34A9A2FCD7BAB38C328A11011738D76A0C899DBA966BBEE2A98FC55326C27D701C7FEEBA6
Malicious:	false
Reputation:	low
URL:	https://web.dcobxs.com/matomo.js
Preview:	/!!. Matomo - free/libre analytics platform.. JavaScript tracking client.. @link https://piwik.org.* @source https://github.com/matomo-org/matomo/blob/master/js/piwik.js.* @license https://piwik.org/free-software/bsd/ BSD-3 Clause (also in js/LICENSE.txt).* @license magnet:?xt=urn:btih:c80d50af7d3db9be66a4d0a86db0286e4fd33292&dn=bsd-3-clause.txt BSD-3-Clause.*/;if(typeof _paq!=="object"){_paq=[]}if(typeof window.Matomo!=="object"){window.Matomo=window.Piwik=(function(){var s,b={},A={},K=document,g=navigator,ac=screen,X=window,h=X.performance\|\|X.mozPerformance\|\|X.msPerformance\|\|X.webkitPerformance,u=X.encodeURIComponent,W=X.decodeURIComponent,k=unescape,M=[],I,v,am=[],z=0,ag=0,Y=0,m=false,q="";function p(au){try{return W(au)}catch(av){return unescape(au)}}function N(av){var au=typeof av;return au!=="undefined"}function D(au){return typeof au==="function"}function aa(au){return typeof au==="object"}function y(au){return typeof au==="string"\|\|au instanceof String}function al(au){ret

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	3145277
Entropy (8bit):	7.953143514728729
Encrypted:	false
SSDEEP:	49152:CemZo1qgcCRvd01jW8Ww32uqinShq264q6PfzRhmpt5ZcB6Ioo9hl:CVoQ4MjW8ouqiiq264qiz3ouoo9n
MD5:	5433CF6CF6DAA107F38CC2F2B221ADC5
SHA1:	84156830CC0E51264342C37F2043C441562B137F
SHA-256:	321FB7936DADA76CE957347F61CD05BE88581C5C3532D5CF87D346BA677474F6
SHA-512:	DE25BD62C56F7529C96968B557D048F65F5B0E0427C94768D56D42EFE2E6B09F07A4EB0AC560BB05CD76A7C955BDC7EB8752BAA523764829F049791FE82F6F63
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i9.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,.........[%....z..."n.....!.<..o....[$..M..... .Z$..n..k.[%..n..`.....g..\.Z"..m..!m....U.[#..b.d(..I..h..R..^.`&..Y.z..}4.g..f..S.[$..6..b.....m..?.m,..j..K.x2.b'.j,..?..L..k..P..Y..W..D..;.o..u0..o..h..e..:.r/..>.]&.._..R..F..I..d..7..B..8..U..[..O....<..r..x%.@..A..V..E..{.z2..N..........N..[..............i.......H....O......n.......H....D...C.B..o.>...i........v...P.b..E......]).........9..%.......................1.D..U........}7......}..^....N..R.........l> .....V:...).....jT...-..............n.vI,.V..].....\......\.......P.._GP!...\|. l...f...z.x...l7..i......{ic...x..d........<..............k.....g6.zG........=.............```......I.U.?....555...r\.....K..s>..w2.......\.{E.. PPP.pA.W&^....c..J.x...l0....p.r"..i...ppp..L.........H......\....#J.H....3j.... C..I...(S.\...0c.L8._..^........3...J...F3..B...P.N.....X.j.9..S.`......h.n..-X.j..K....n...J........@.b'......$.....&D.zuB

Chrome Cache Entry: 68

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	dropped
Size (bytes):	3422486
Entropy (8bit):	7.978761675756364
Encrypted:	false
SSDEEP:	49152:UMnCaXRGlcMKTAIS5pTziQgIeU7nc67hMcgJ3NJLsqgFJelJn/FfDWF5zRW:UMCaINkAb7rfLc6buNmwpdfstW
MD5:	E60746B12F4E6CCA778727472F415218
SHA1:	4E3B517A1911D891D018BC63B66E1B69837A3E15
SHA-256:	B285715D34361C4FED5058A10EB830BF2DD61126518477DED340DD7F95221417
SHA-512:	5DB7FC6C0E1EC272C02EC741FA278D162EDAF2ACF9AC0421729585B1C1CE2CF13BAB0204C0F5B425D02989F34B1DB592C65B500B6E6EDD909E8ED138C59E2D18
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,........... z...]. ......{...!......`.._.........5...D.i7..y......}....q..!.........`..y.......................\|..................?........y..9....................S..O............>>>5.....Y...i..X....C...K........J.....r..3..r9...........,.@...;..[..?.C..$....`.....&........F.N....(......m.....(...V.j.._ZW....J.......3.r...........O....c...........\|<a&%.. ........bjh`}z..B...........`.`......G.]./........ S......7......P..f)....5...b.~E..`65.U.E.2..........b...o...,..z...aGE.B@..X..ld.........s._....Jk.......^._....).p6..x......e.A.......\|..>@@@...`......%..O..,t.-...`....#w4..U....dW..!.\|.....'j.f..".ee../..l... ..W........#....(.....g.^5.@.."r..7{1z...~kY...X..%.....r..\.F=@._.....9{R~~~......F...e....,.;....}%%.w..v1.q...^x+.........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x.^......h....a..........#K.L....3k

Chrome Cache Entry: 69

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 1000x562, components 3
Category:	dropped
Size (bytes):	100018
Entropy (8bit):	7.960158664506742
Encrypted:	false
SSDEEP:	3072:ZZtwuAZGylTdQ2ZZv+eDEUEV0O6RfZAsuKets7MaT:ZkdMgddDEU71ZAZqMO
MD5:	34C117B53D6D2CBC4F6C53CF56BCB14F
SHA1:	CB3F9B0F95F323AFBA57F81316476600E82C8021
SHA-256:	7CAB1A8C0BA5E1798FD79316B091CC501E5BC949C1295949DABD2BCA39C0FD41
SHA-512:	5201FF8225B489BCD586EA3CE5611A46E2838A86AB4BBA45527758135473EE0C4A4433F43E681400340BB67705E10AF0645A7E053AF47C21FC6806ED260E9013
Malicious:	false
Reputation:	low
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90....C....................................................................C.......................................................................2...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..B.nw..'..r.84.O..y /J.L..2.....N}i.pNF).c.s.I....(.H.s.}). .'.\|.X...t..D,.q....x$.......p..2zR.f....4\.nf;@..H...S.v.w<..L2.(;;.$b....i..x...Nb.....3..G w.B....p.}(T.89......`.6.z.%.f..G..DP(.fX....<.}..{..b..kw.Z.........JUB.9.....1Myx.............=.Vl..........rxaL...N...U"[...!}E=!.B...].

Chrome Cache Entry: 70

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 300 x 168, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	3393
Entropy (8bit):	7.904545142573163
Encrypted:	false
SSDEEP:	96:zsmB/hbD9DQfAX8TZ+Qexw56ALsrmaO/V2/7:QmBDelxgv7
MD5:	3FF8E2FD524C2EAACF6A4731353B4677
SHA1:	67FCB895FB22D4B4C8425A9A87F9B984AEC0068D
SHA-256:	D073776F8E9D360A5FC91B86723D2AC626A2DE15EA487611CDC3505FBA01DB78
SHA-512:	247A20AF51A5320BEC3FF75FA4ADF859658F28D3851F1E0E73F90B8FA2F5BE63915531018263F36819B528082F993EC33B1501DE21D299CFA9C5614DB71AFF07
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/upload/image/20231216/1702728345765756.png
Preview:	.PNG........IHDR...,.........m.#=....PLTE.........K..F..H..L..I..F..H..M.......J..I..............................................`..C....m..3.......:.......}..k..U....~.........^..v..........}..x........\........5....EIDATx..{C.L....5v.!m3oe(ij........w...2\.A..c....9.....4j.Q.F...hAX.... ...ih%...K.@.+^P..PUpU..T].^]...!.e.K..............1,.T...#...3..yY.9.tEH.$.t.XV...%.1.....M.J..z.V...RI.W6..y=..}....<..T...v......$.wk<..{.$..CR.....U..C..xj.G.T6...i...~wk<.....Au.......48.....:@o0..Xu..i...X.?.C.g...@..XU...>..J..:{...;.T..}.0....y...>b....%..W]g5.Z}./]3]......hO......f.......O.....j>_-..!._..9p..B..pZ.o.~...../.G.k.a......w..t. .~..@[.....M......;...#.N....8U*..?.'.E...8..cQ..~....E..E.....D.\|`.oG.K.!1..T.(...%[h.x.f.q.{..4Z...B..x......B._....._.C+GX...Bo..a.....G.B..(.....SP.+Lk^wZ.e+.Bi=....oW...RcZ..<TD.X[Z.Y..B...Z...\|V''......"`.1Q.YB...w.J.8..n%....q#.p......$M..M.....E..'.C..kH... z,.Vn..v...he_z.."a.T...t.s.....,....y...

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65136)
Category:	dropped
Size (bytes):	67371
Entropy (8bit):	5.514889684824493
Encrypted:	false
SSDEEP:	1536:IpgnplATrFVqe7EKxFXHuveM2V1Oy6fu1K0MNdda8iNDAGoT4ITzxfYQKFJo:Ip+jmhuWZ1Oy6fvNdda8iNDAGQXxfN1
MD5:	E47E304E0CD0315E6D6DB1FF5A473C11
SHA1:	EFA7EB2D9ECD230A9883F2C779A84247CD64EF62
SHA-256:	BE0D7AF2971BAF50358DD1560C353CF6795D0D4E6B85388023A5719B12C9EE35
SHA-512:	0DD548C5F8B833A0EDD4FDC76D173674384278E086B3AE6613EEB7B34A9A2FCD7BAB38C328A11011738D76A0C899DBA966BBEE2A98FC55326C27D701C7FEEBA6
Malicious:	false
Reputation:	low
Preview:	/!!. Matomo - free/libre analytics platform.. JavaScript tracking client.. @link https://piwik.org.* @source https://github.com/matomo-org/matomo/blob/master/js/piwik.js.* @license https://piwik.org/free-software/bsd/ BSD-3 Clause (also in js/LICENSE.txt).* @license magnet:?xt=urn:btih:c80d50af7d3db9be66a4d0a86db0286e4fd33292&dn=bsd-3-clause.txt BSD-3-Clause.*/;if(typeof _paq!=="object"){_paq=[]}if(typeof window.Matomo!=="object"){window.Matomo=window.Piwik=(function(){var s,b={},A={},K=document,g=navigator,ac=screen,X=window,h=X.performance\|\|X.mozPerformance\|\|X.msPerformance\|\|X.webkitPerformance,u=X.encodeURIComponent,W=X.decodeURIComponent,k=unescape,M=[],I,v,am=[],z=0,ag=0,Y=0,m=false,q="";function p(au){try{return W(au)}catch(av){return unescape(au)}}function N(av){var au=typeof av;return au!=="undefined"}function D(au){return typeof au==="function"}function aa(au){return typeof au==="object"}function y(au){return typeof au==="string"\|\|au instanceof String}function al(au){ret

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90", baseline, precision 8, 1000x562, components 3
Category:	downloaded
Size (bytes):	100018
Entropy (8bit):	7.960158664506742
Encrypted:	false
SSDEEP:	3072:ZZtwuAZGylTdQ2ZZv+eDEUEV0O6RfZAsuKets7MaT:ZkdMgddDEU71ZAZqMO
MD5:	34C117B53D6D2CBC4F6C53CF56BCB14F
SHA1:	CB3F9B0F95F323AFBA57F81316476600E82C8021
SHA-256:	7CAB1A8C0BA5E1798FD79316B091CC501E5BC949C1295949DABD2BCA39C0FD41
SHA-512:	5201FF8225B489BCD586EA3CE5611A46E2838A86AB4BBA45527758135473EE0C4A4433F43E681400340BB67705E10AF0645A7E053AF47C21FC6806ED260E9013
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/upload/image/20231217/1702817607573664.jpg
Preview:	......JFIF.............;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90....C....................................................................C.......................................................................2...."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..B.nw..'..r.84.O..y /J.L..2.....N}i.pNF).c.s.I....(.H.s.}). .'.\|.X...t..D,.q....x$.......p..2zR.f....4\.nf;@..H...S.v.w<..L2.(;;.$b....i..x...Nb.....3..G w.B....p.}(T.89......`.6.z.%.f..G..DP(.fX....<.}..{..b..kw.Z.........JUB.9.....1Myx.............=.Vl..........rxaL...N...U"[...!}E=!.B...].

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90", baseline, precision 8, 1000x208, components 3
Category:	dropped
Size (bytes):	27725
Entropy (8bit):	7.8320130907167975
Encrypted:	false
SSDEEP:	768:GWUwS7XZehV3LDhXiF4X1T9IySBPltGMMFUHH:GlwMXYV3ZXA4X1pIyWPltGMMFUHH
MD5:	AD0F44F79330E0AF7CB064C4A9FD9B11
SHA1:	A3519070EF768B9CA163B6D8CFE7012DDBBCF4BD
SHA-256:	F123A86B52BC881B75B0AFE9201A8CF1ED563C59E44B84C2C21F58E80CE3B44B
SHA-512:	90BF5B202E8A97B16CDFC3A165F5BC5BE6B61D0ADDB0C6BC80D38DC85EFDFC29111704B3C921A3A21C10F470DF8E473EB3C76675F092AFCE243F875F769A09FE
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.....mo.&...B..........KX^.....o..#..M....-..s..~e..h......g..li...3?.X?...<3.`;f......?....?.Z./..^...]\|..]..}..}.%.0.`.>......../..........t.6.U.X..f.....".3...}C..p..*.-/..._.......&...7..#.......Z./..^..]...?...,...../....kN.

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	dropped
Size (bytes):	3327196
Entropy (8bit):	7.960651343982663
Encrypted:	false
SSDEEP:	49152:IeR3w2GydSueIfKAwIkgMgOgGGXL/nUQlf5tXAS3mTvYIIjrLo8U659kP:IeR30yd91frwIyCGGLnUatXZ0comq
MD5:	3CA4222D4871D2C299E44DBBD14EBB46
SHA1:	19EE2E1C0D6DA440C08076DC1A657C8E58AA0662
SHA-256:	E21CCEB8262A91F878FE4E5202139793E9CD3A02DA2DD08D2DC4180CD29AC402
SHA-512:	4D54E6AF4755363DA902D0AFAA0160AB2847506EAF67E3C34B6B627650EC4FF8FC0719F50B59AB8A1723F4A216031156979C39294AAACC080104B61447ACCE87
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,.............5..2R.. .......]...'....X...!.......X..VTV..}......W........W......&....................%.....&........%........&..#........".j.........$.m...... .....!..".....!....]...#..#................Cm....[........T..s..`...".y...$.v..c..p...........{...7.=...$..C.Y./'..f...'.G...".N.....F.....Ix.7..>....~..Z..6Y..@5... ^N..<c.[.....%....S.....Q....R.......$..OB..M...Q..jC.....].(...j.o\......%.....".g...6...........l...]....J...L.....6....'....x...%........!.R......w.....!.OM.. "f...........{.....<;..{......3.....0!?K.%&xd..>..FE.!.Y.L...T..r...G...I.L}o..Y.q...O./.<...Y.2pz.)....d..<[.i..T...f.e...eT...A.".'....r.`.p).6..A..u;yF... ..bBxt..0....#B"...o....9?,.U.O.<dp.xIdm].h/..3`9..}>?IBlJ6.7P....}`3aV9\|tS...Q.MN>^...........e...."?...-.........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@.....Q.D.*]..S.G.>.J...(.Fe....`...U..h..$.U..p.d+U..x...kT...........I..F..c...>.L.r..3k

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11449
Entropy (8bit):	7.9656940108488605
Encrypted:	false
SSDEEP:	192:5UyKfZZ5JFHS1q5YLEusGFByfrNG9dOvER63Wya7wBXXool4FdoqU8qYyClRehi4:GySn5J81q59usG6DNsduY8BnVA+8qYyH
MD5:	2C84BE4C4DEC401D09A64498CBBD382D
SHA1:	1C7053B083D5E59ED5CB4912C5500F39BEAF765E
SHA-256:	88AFE4CAAD9D3EF9D7B4A5301D1B2B4378B54D233038079F0145E2F387F4EED9
SHA-512:	F0BDEBD3923D8DCEAC9218DF93808A0476AEDF1A6CCD4274B7D9FDD429CBAE2C8F1E36B244B169B9AD6BF3A17EB5AC2A92A0DF3304799ACDA742955AE03F5BB0
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............>a.....gAMA......a....8eXIfMM........i............................................kF&M..,,IDATx..}{...y.s....z......,J..68 ..HbVB0o..x.iZ....V....r.Wj.8n.:....$....`..h`9..FHB...z?A...3...o.3{..s...+..3.7{....{..3....#l..W...+....i..pikY..l.:.nV.$..'..~..C...4=.<.:w.%.-I.n.h565.Z.^...........v[.H:...\5.._.\r..B...y.4#.(.OnxuX.$...M..a .X...3./J.w.........U.Z.>..6.8.Z.#o.#..IS.2....4G.VJ/.0..........h..Z.....[.V.~v..d...+.<?..=........i..9.+.[.\|.%..W.Q..,...PCo....%{!..../]5..J....v...f.Z..X.....l<=..fv1AQ>..%....n......A.B.V.0....$$.`..R.=...v.>...........V..l.@.3.-Y>.Y....i.S...^/..L.u....E_.[.[...^.z.......x...G...v....r..>..f3aE.....V..g4..(p....e.g...9..$....5s...7.}.E.......%...VkUq......Jl.'.V.%.]B....(f.v...-./.L4,V.'I..h\|.k.\|....=bO.U...~.EC.G..0_..8......KR.c..'.n...(.?K.._.\hO./.W......w.KW.{#.._..R..~?m....pu.....gx1.q.....%+..2}\RQ.#.....\X1b..wz..$_.?..]O]..E{~...8.}.$...X/W....-.<..q.b.x...+.C...

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 300 x 168, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3393
Entropy (8bit):	7.904545142573163
Encrypted:	false
SSDEEP:	96:zsmB/hbD9DQfAX8TZ+Qexw56ALsrmaO/V2/7:QmBDelxgv7
MD5:	3FF8E2FD524C2EAACF6A4731353B4677
SHA1:	67FCB895FB22D4B4C8425A9A87F9B984AEC0068D
SHA-256:	D073776F8E9D360A5FC91B86723D2AC626A2DE15EA487611CDC3505FBA01DB78
SHA-512:	247A20AF51A5320BEC3FF75FA4ADF859658F28D3851F1E0E73F90B8FA2F5BE63915531018263F36819B528082F993EC33B1501DE21D299CFA9C5614DB71AFF07
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...,.........m.#=....PLTE.........K..F..H..L..I..F..H..M.......J..I..............................................`..C....m..3.......:.......}..k..U....~.........^..v..........}..x........\........5....EIDATx..{C.L....5v.!m3oe(ij........w...2\.A..c....9.....4j.Q.F...hAX.... ...ih%...K.@.+^P..PUpU..T].^]...!.e.K..............1,.T...#...3..yY.9.tEH.$.t.XV...%.1.....M.J..z.V...RI.W6..y=..}....<..T...v......$.wk<..{.$..CR.....U..C..xj.G.T6...i...~wk<.....Au.......48.....:@o0..Xu..i...X.?.C.g...@..XU...>..J..:{...;.T..}.0....y...>b....%..W]g5.Z}./]3]......hO......f.......O.....j>_-..!._..9p..B..pZ.o.~...../.G.k.a......w..t. .~..@[.....M......;...#.N....8U*..?.'.E...8..cQ..~....E..E.....D.\|`.oG.K.!1..T.(...%[h.x.f.q.{..4Z...B..x......B._....._.C+GX...Bo..a.....G.B..(.....SP.+Lk^wZ.e+.Bi=....oW...RcZ..<TD.X[Z.Y..B...Z...\|V''......"`.1Q.YB...w.J.8..n%....q#.p......$M..M.....E..'.C..kH... z,.Vn..v...he_z.."a.T...t.s.....,....y...

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	2002471
Entropy (8bit):	7.980025595488585
Encrypted:	false
SSDEEP:	49152:Q9I1skJEpF7xMJjZb/lII8XKTb9dZpmKcFItbP:V1s8Epm/n8aVpkyFP
MD5:	6A88BBD5858B7D9234FB7D0C6C5059A6
SHA1:	C3412D69DFA2CE6B208D52E6842EA7807CFF42D3
SHA-256:	F8152A8D500807F824571C3256320BBF578CDCE88D45D0FD048A6422F71C272B
SHA-512:	F7AE19293C681636C1D32F7D4391633B1E0BE4AADADE5E874A9D7D48AA1880A02F39F8794E02AA35C61987D25B2D18A0AE28099D202502E6413474E4D445C7F2
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i5.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,......................5.......;KK..'SEV....].....W......w........)......!RDU:JJ......r..M^^...>PP{.....HYY\ll\N^i{{_ppw..9KK..vtdv...CSSa`K..#WIXewwUggm.....Qbc.y...!....................M.l^n.T..............O..=..4.....`........V..q..Z.....J.............\|m~.D...&....9.Vii=MM....:..........u..........`sr....?.............bTeFVV....W.....5...$.a.........\|....o...............$..fXilxx..?5.....j........."..............y...........\|.................!....QG-......#A..4_v0&.{s^MNC.B.Vaa.3..Q.....\.........B.._O..k0..uqo...Gy..@ ...x=...md\.w.p...F$..k.f.........^o....gg........aX..o]..-....x......G.~,eC9&&&.....p..A.....R@..[_....t..;...u..;..._......AA@.Z...93...H0......@.......[(...n.....[..{8B8...^..JNYx...3...`U@..y..>...P@P.R......r.b}.]..Y.........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+^....#K.L.....-.

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	dropped
Size (bytes):	2254846
Entropy (8bit):	7.954275198982014
Encrypted:	false
SSDEEP:	49152:yQZjB1p5xW9tkpszhhGc+zHLfzWXJO/FGS33KVCxjb846id5Xv:yQ5enfGc+zHLfz4AN53eCGUd5v
MD5:	999CCB074C15D6377F97302832038C14
SHA1:	C08B94482AD5540F68A896F30CC890474C058E1D
SHA-256:	15D01829FAC9057A922B9168D68D9EA940D7612B0128AE9B67FE69A1DD10E62D
SHA-512:	A3F571FFD449803E6FBC583CF15FAD48A5A6F17AA1BA1D11AACD0A9A94DDAEFFC96283D86918AC4DA046C3544313860174DE46E44AEA2541B0DABEF5228B7DBA
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,...........!.....!...r....6....]..5....}................\.. ..... q.... .......R... .Z... .I..>...........N..7..W... ....U.r...?...........9... ....3........\... .<.....F..q... ...T.....H.....D........3...........0..!}...d(.. t....x....'../.\|....A.....h...............>6......-.H...=...z....$.....)..........Y.....F....... ..d.)...L...._Q..l... ..t........Y.....>.$.........cMD......v..X.\|G...5..:..N..?...O..8.m3..../..O.p;...C...5..U.......!...5......C...................'''..:...c.o^.....r8............n.. .......s...]]]....N.S....E..}.b........B.....h..R...u@!..y...$...t.........j.........z.....5.@6.~......x..b...............o...2...Ug..].ez...w....T.]...1.........@@@..o........u..]...ppp.....8..... ....s.M.......w.......f9.................H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x....._..&.&.a.&.(^\|.....K..e..%K

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6093), with no line terminators
Category:	dropped
Size (bytes):	6093
Entropy (8bit):	5.204108693261149
Encrypted:	false
SSDEEP:	96:Sfpf3Cl4aR2PxanBesYx4sbAQTu+hb5tOVvLT:dBR2JoKAQp55EVv/
MD5:	502D407625A03C5151CF7F0B7F1D2E5A
SHA1:	99C26FEDA1569A28C4ED050056CB12EA38BD3172
SHA-256:	CB3FDAE01E5EDFB32565C5F7B592BC7CA850CBA92565FF12F020DF68570481E8
SHA-512:	1427461A7B1763B100CCCAAF85EB9BF8A6A7EB87C6E1A35D286CB7630F918FC2DF7E3A9E29CEC9D39FA355215189148869E91908F51443C14C5AC7E917BEDC81
Malicious:	false
Reputation:	low
Preview:	!function(cOe){cOe.fn.theiaStickySidebar=function(egc){function aEb(egc,aEb){var gGf=QaP(egc,aEb);gGf\|\|(console.log("TSS: Body width smaller than options.minWidth. Init is delayed."),cOe(document).on("scroll."+egc.namespace,function(egc,aEb){return function(gGf){var hdX=QaP(egc,aEb);hdX&&cOe(this).unbind(gGf)}}(egc,aEb)),cOe(window).on("resize."+egc.namespace,function(egc,aEb){return function(gGf){var hdX=QaP(egc,aEb);hdX&&cOe(this).unbind(gGf)}}(egc,aEb)))}function QaP(egc,aEb){return egc.initialized===!0\|\|!(cOe("body").width()<egc.minWidth)&&(gGf(egc,aEb),!0)}function gGf(egc,aEb){egc.initialized=!0;var QaP=cOe("#theia-sticky-sidebar-stylesheet-"+egc.namespace);0===QaP.length&&cOe("head").append(cOe('<style id="theia-sticky-sidebar-stylesheet-'+egc.namespace+'">.theiaStickySidebar:after {content: ""; display: table; clear: both;}</style>')),aEb.each(function(){function aEb(){gGf.fixedScrollTop=0,gGf.sidebar.css({"min-height":"1px"}),gGf.stickySidebar.css({position:"static",width:"",t

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2023:05:26 07:24:20], baseline, precision 8, 510x532, components 3
Category:	dropped
Size (bytes):	148298
Entropy (8bit):	7.717903549068619
Encrypted:	false
SSDEEP:	1536:hzoZhzoZEW21lDlmHFLPaIGLj2RYh+9RTC7uxtgZmCpXoHmEWv3FTcdc0drpE8v3:hM11qPrG29RTDoq6/F0XZp5xpSKDms
MD5:	1E30B429BA212FFF35F3DD29E131543B
SHA1:	656A10C84247B023BCB2651712C961FBE036A8E6
SHA-256:	5D0C4939A51A164A3067D43C5071F3B9B468C4B73FA9D27C811FDBCAC2CA431E
SHA-512:	185F54F93EA81489483D3F53C9B6922B49FF362D7ED0EB641FED10C9B7C936E514FCEA38A98CCCF30D6BFC490CE616CC18F0AA41B96F10F932DE84565B224005
Malicious:	false
Reputation:	low
Preview:	......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2023:05:26 07:24:20......................................................................................(.....................&...........\.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T...0p...;h...F.5.......O........R......+..}b.oW......'\<aCr-ug../}....n..m\........vh~.n.1..H.O...m.&6......X].H..O.q.M...._.~.

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 320x156, components 3
Category:	downloaded
Size (bytes):	31391
Entropy (8bit):	7.963966387313214
Encrypted:	false
SSDEEP:	768:bJais3CSvmnzUBl7g06FkewP2j6NBy8s6DW43Dp0jiA+:bJajySizUL96F4P2j6NvR3gG
MD5:	74B079C3A756314C88BA10A40D4F85C8
SHA1:	E4C933296056EC3C0CCC5F12BA00EE4017BAC8BB
SHA-256:	C443C78239489B2EE75618B26460DAE55A87A132B74807780CEAB30130EB7A68
SHA-512:	C36C7C5D6E84BD7CDF78AF2B339FA60A5DAF1C0B45BB912B8BD33230F6631A9850299B4C68D1A400BBB599EF17F6F3AB804B8E6A7676676B48B043FACA251258
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/window.jpg
Preview:	......Exif..II*.................Ducky.......d.....1http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Macintosh)" xmpMM:InstanceID="xmp.iid:41DF7D7081CA11E991809FEABB4E64F3" xmpMM:DocumentID="xmp.did:41DF7D7181CA11E991809FEABB4E64F3"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:2B6008097FB611E991809FEABB4E64F3" stRef:documentID="xmp.did:2B60080A7FB611E991809FEABB4E64F3"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d...........................................................................................................................

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	2202471
Entropy (8bit):	7.979052935208376
Encrypted:	false
SSDEEP:	49152:6vlOdSROHsszcNNbDPEZbaseHhV0G80Y/Ren4gzGJI:6vlklMszgNbewHT8fRXdK
MD5:	9F6CB1E0D2A29541764755E05B484DE7
SHA1:	D443F92ED7059A30DB98857F6C5C290589EBFE24
SHA-256:	ABDBFC359A2954FADB7D335A20C2AE29CC5B00DBD538E88B03D612F978654E45
SHA-512:	8C5C6FA02B9B16D781C40FB0E124FC3E7B5C16A67FF131AAC73D00A2D1A453B8E56145F9639896F4A3F33DE3150DDF128B9474FB3BD65EBF14FD1AA1F9E728D8
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i2.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,..........~h.]... ..q>9-....vb..'.......5...\|3+....NMM...5/ .....!}.....c[J50!...=8,2........333...=8-..&.}g..........{e.xb........ GA3....."..%....ydnfS...B</QK<......$..yp\........!ZTE.T.iaOLF8....>...$..$VO@......}t_..#..qvmY..m.I..."...rjVZYY..... ...f^M_XG..z.E..va$...Y....-.0'......C..vgff.&.....O...9..........{.uiB.K...+$.../..y....:7+.x...MLL......_^^OF,...i[+...s...RQP..).m....:.XN+..,....Y....i.......5...5..4.vf+.......E...'..{.1..v....T....2zR.......\|{{....l...X..K.>.---...O>...c.u........b`T+..(..-.U4/..d'.#....sss..0.....\E..]..~........B7..-.-...]........gF..&.......n2.~>g.....3....J....B.Y=5&.....B.1.^.3.'N...%..d.c.>4..g...g[>....'kkk....4..[.tG...@..A,.....q.}P.....h.v;.........C..]Z.......S....Lv$...L.;.........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x..........L.....+^....#K.L....3k

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065), with CRLF line terminators
Category:	downloaded
Size (bytes):	85582
Entropy (8bit):	5.36654419285893
Encrypted:	false
SSDEEP:	1536:fYE1JVoiB9JqZdXXe2pD3PgoIiulrUn6Z6a4tfOR7WpfWBZPBJda4w9W3qG9a98N:u4J+rlfOhWpgCW6G9a98Hrp
MD5:	710458DD559C957714AC4A8E95357EB5
SHA1:	F694238D616F579A0690001F37984AF430C19963
SHA-256:	B409C14A10B4CAAD6B54844AA63A5FAF748B83EECC2DD0D4FB1D913F8DE55365
SHA-512:	282D65828A43BFE50FE0F9AEA8BCA3838AC1B5250E7C7C359C066E0428AA723F001D31C2463681B2AD6816A49A8571BF9F3AE29B2DC53ADF1BBD7D5C4471322B
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/skin/js/jquery-2.2.4.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /..!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.cal

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	6.873587839048703
Encrypted:	false
SSDEEP:	48:c/61MYLNnwknA9Wpi5CpG8HbY+/cHJ3l3ZzbHi3G8gbHcCjRRknpY7Tr:cSyYRwknmWpiTWbf/IfHtxHcyRkSb
MD5:	B104BB1FFCD608612E85386C65AE8532
SHA1:	B87D86B8C5C2AA5154578C925CC982333459BEE6
SHA-256:	33D6BE96B9CEED78DC9B32BB3FCDF2814836635D2D376D746F42728C35538F9E
SHA-512:	605466E630FFF43F083D9FCA3F9EC47D829F435B0D13A6211D07AA2F7F49F1E76B999BE5F3B41E6C69E8063301F3E9CB8851536A44B5127BC8AE9083C9693C64
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............2......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2023-05-16T14:28:53+08:00" xmp:ModifyDate="2023-05-16T15:10:52+08:00" xmp:MetadataDate="2023-05-16T15:10:52+08:00" xmpMM:InstanceID="xmp.iid:76e97cf9-2dc7-dd41-9cdf-08fc51c581ae" xmpMM:DocumentID="adobe:docid:photoshop:5adeef5d-5dd6-284f-a4b2-8a997a223048" xmpMM:OriginalDocumentID="x

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1272
Entropy (8bit):	6.759893244400297
Encrypted:	false
SSDEEP:	24:ay1he91Wwjx82lY2T3ouVMgK5iyJ3V6pKzLXGLfarUZdR+p0tN:awqQNn2xCJ3xKjZD+p0z
MD5:	1ED9BF7633F4F449C8D2DF94EA0EB35F
SHA1:	2902BA9C2B127C74C2550298A0578D7D8DA941C2
SHA-256:	E7D23B06A4FFD600558E5443D1E32DAAAF13A27CF7BB8B7CC163A92B4054AAF2
SHA-512:	51DD36178DD85F062FEE20903A4F0981CA34EB24A7E7245191EF43D493CD47F756389E548A731109F1C0463BA3BD1D3D4F7C4C623639B9514EB2FB9619124F07
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............2......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmpMM:InstanceID="xmp.iid:BD511DF2556611E48F9585596B882309" xmpMM:DocumentID="xmp.did:BD511DF3556611E48F9585596B882309"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:BD511DF0556611E48F9585596B882309" stRef:documentID="xmp.did:BD511DF1556611E48F9585596B882309"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.."...lIDATx..O(.a....19P....up...r...XI.M.."G.*)g.....f..p.h.....Rh/.. ..O=S.3..z..........5.it....L2+...i6g..

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (44903), with no line terminators
Category:	downloaded
Size (bytes):	44907
Entropy (8bit):	5.123228313000693
Encrypted:	false
SSDEEP:	768:ZndSYTRsiJRZ5hgHTiEfJOp4UkuvzrJj65d:rj6iE69RjY
MD5:	E6BC2935FEDC92213B430027E059C3C8
SHA1:	8D79C246B1D2E16AD7ED60FA5CE35E23B6C1FE9B
SHA-256:	9FDFF231D46F09B29510EF4ADC80A4DBAE646C9D3DA770DFE3C7A9672F48269A
SHA-512:	E61E364092E77A24C55A015E5BF3766C2998D37C807CC6ED005C4002CCAD45D12EB05736374D595C6130FA9AA93B897122E49CB390A79C49BA357CD6241D0A52
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/skin/css/style.css
Preview:	@import "skin.css";{margin:0;padding:0}{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}body{font-family:zhengkai;..font-size:15px;color:#555;line-height:1.5;word-break:break-all}div,h1,h2,h3,h4,h5,p,form,ul,label,input,textarea,img,span,dl,dt,dd{margin:0;padding:0;outline:0}img{border:0;display:block;max-width:100%;max-height:100%}ul,li{list-style:none}ol li{margin-left:20px;list-style:decimal;padding-left:3px}a{color:#08c;text-decoration:none;-webkit-transition:background-color .15s linear,color .15s linear;-moz-transition:background-color .15s linear,color .15s linear;-o-transition:background-color .15s linear,color .15s linear;-ms-transition:background-color .15s linear,color .15s linear;transition:background-color .15s linear,color .15s linear}button{transition:color .15s ease-in-out,background-color .15s ease-in-out,border-color .15s ease-in-out,box-s

Chrome Cache Entry: 87

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1523)
Category:	dropped
Size (bytes):	2663
Entropy (8bit):	5.145884826771296
Encrypted:	false
SSDEEP:	48:GEvsb/5gX95hxUwLGn/p8VqTcTagzbhACutwCbn+Cu:GEvXfoh8Vqg9bZm+Cu
MD5:	94E9F897C976369D1CD8552E2BAEE1C2
SHA1:	9E539A9612A6C9D9B440D2BE65BEA956BCA49217
SHA-256:	6B3920CE320CE5F08BB1A40C8566D0B24BD8F19B8C5703B425D145FD43BACC17
SHA-512:	446EE62ADEDF7C9190032419C427310940EA3418F79FF77E3597527F0F3E536F688910CB9C068BC28726A37EC773F61DDA4C244211AC6609266F179CFFB5DBE8
Malicious:	false
Reputation:	low
Preview:	$(function(){var surl=location.href;var surl2=$(".sitemap a:eq(1)").attr("href");$("#starlist li a").each(function(){if($(this).attr("href")==surl\|\|$(this).attr("href")==surl2)$(this).parent().addClass("selected")});$('#starlist .sub-nav').before('<em class="dot"><i class="wordicon-arrow-down"></i></em>');$('.dot').click(function(){if($('#starlist').hasClass('active')){$(this).next().slideToggle();}});$('.mobile-menu').click(function(){$("#starlist").toggleClass("active");$(".fademask").toggleClass("active");});$('#starlist li').hover(function(){$(this).addClass('on');},function(){$(this).removeClass('on');});$(document).bind("click",function(e){if($('.mobile-menu').is(":visible")&&!$(e.target).closest(".mobile-menu").length&&!$(e.target).closest("#starlist").length){$("#starlist").removeClass("active");$(".fademask").removeClass("active");}});$('.search-btn').click(function(){$(".b-nav-search_wrap").toggleClass("active");});$(document).bind("click",function(e){if($('.search-btn').is("

Chrome Cache Entry: 88

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.02, resolution (DPI), density 72x72, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop 7.0, datetime=2023:05:26 07:24:20], baseline, precision 8, 510x532, components 3
Category:	downloaded
Size (bytes):	148298
Entropy (8bit):	7.717903549068619
Encrypted:	false
SSDEEP:	1536:hzoZhzoZEW21lDlmHFLPaIGLj2RYh+9RTC7uxtgZmCpXoHmEWv3FTcdc0drpE8v3:hM11qPrG29RTDoq6/F0XZp5xpSKDms
MD5:	1E30B429BA212FFF35F3DD29E131543B
SHA1:	656A10C84247B023BCB2651712C961FBE036A8E6
SHA-256:	5D0C4939A51A164A3067D43C5071F3B9B468C4B73FA9D27C811FDBCAC2CA431E
SHA-512:	185F54F93EA81489483D3F53C9B6922B49FF362D7ED0EB641FED10C9B7C936E514FCEA38A98CCCF30D6BFC490CE616CC18F0AA41B96F10F932DE84565B224005
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/session2left.jpg
Preview:	......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i.................H.......H....Adobe Photoshop 7.0.2023:05:26 07:24:20......................................................................................(.....................&...........\.......H.......H..........JFIF.....H.H......Adobe_CM......Adobe.d...................................................................................................................................................{.."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?..T...0p...;h...F.5.......O........R......+..}b.oW......'\<aCr-ug../}....n..m\........vh~.n.1..H.O...m.&6......X].H..O.q.M...._.~.

Chrome Cache Entry: 89

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	2254846
Entropy (8bit):	7.954275198982014
Encrypted:	false
SSDEEP:	49152:yQZjB1p5xW9tkpszhhGc+zHLfzWXJO/FGS33KVCxjb846id5Xv:yQ5enfGc+zHLfz4AN53eCGUd5v
MD5:	999CCB074C15D6377F97302832038C14
SHA1:	C08B94482AD5540F68A896F30CC890474C058E1D
SHA-256:	15D01829FAC9057A922B9168D68D9EA940D7612B0128AE9B67FE69A1DD10E62D
SHA-512:	A3F571FFD449803E6FBC583CF15FAD48A5A6F17AA1BA1D11AACD0A9A94DDAEFFC96283D86918AC4DA046C3544313860174DE46E44AEA2541B0DABEF5228B7DBA
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i3.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,...........!.....!...r....6....]..5....}................\.. ..... q.... .......R... .Z... .I..>...........N..7..W... ....U.r...?...........9... ....3........\... .<.....F..q... ...T.....H.....D........3...........0..!}...d(.. t....x....'../.\|....A.....h...............>6......-.H...=...z....$.....)..........Y.....F....... ..d.)...L...._Q..l... ..t........Y.....>.$.........cMD......v..X.\|G...5..:..N..?...O..8.m3..../..O.p;...C...5..U.......!...5......C...................'''..:...c.o^.....r8............n.. .......s...]]]....N.S....E..}.b........B.....h..R...u@!..y...$...t.........j.........z.....5.@6.~......x..b...............o...2...Ug..].ez...w....T.]...1.........@@@..o........u..]...ppp.....8..... ....s.M.......w.......f9.................H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J...H.*]...P.J.J...X.j....`..K...h.]...p..K...x....._..&.&.a.&.(^\|.....K..e..%K

Chrome Cache Entry: 90

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text
Category:	downloaded
Size (bytes):	9841
Entropy (8bit):	5.922513096226604
Encrypted:	false
SSDEEP:	192:Srakf2FjDzHzOzy5hJk863LHLSLvLMLO09L7LRhLhFL4NW9KZUyDY0RukCGRmk:ca82hDzHzOzy5hP6vDKNDY0RukCGRmk
MD5:	937F2CB42D37154AE98254F4417B869A
SHA1:	6B9C44CB0D5BCBCA0414E57959DB23ADE75DCD28
SHA-256:	15DD728B740013EE0BD2C5875AFF8EAFDB90CA1680E816C2986B10D8A3733C8E
SHA-512:	AF2DC1677D30635D8EC4D3A636B229CB1F65466BF3B9B4CFB5A49642551DD3EF8C4908F2A271725037AAE5CB68161187B3D1E6DBF0DF69A4C5933D758C9925D6
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/
Preview:	<!DOCTYPE html>.<html lang="zh-CN">.<head>.<title>Telegram..-Telegram.....-Telegram..-......-.....</title>.<meta name="keywords" content="telegram,telegram..,telegram..,telegram...,telegram..,telegram.....,telegram ios...,telegram...mac,....,......,.....,.....">.<meta name="description" content="....Telegram..........telegram IOS.... telegram Android................................................................Telegram...................TELEGRAM....telegram IOS....telegram ........">.<link rel="canonical" href="/" />.<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<meta name="viewport" content="width=device-width,min

Chrome Cache Entry: 91

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (12011)
Category:	dropped
Size (bytes):	12465
Entropy (8bit):	5.679610433104963
Encrypted:	false
SSDEEP:	384:loHUjLINgyiQolPJZQsGnuD+qjFREwca0rmm:ly9gyaiGjSd
MD5:	2D08332CFB55E5798A843B05B93C4970
SHA1:	568C9D9CD578419034BF31169AD405ECB707A5B4
SHA-256:	C72C14610C3488168B0BAB5B6E17D30566DC49A701883402C3C63421DF22CFDF
SHA-512:	60504B35F8E8835500988FA85D239EF43149F1ACE17E6D287EC944004A9C826EDF4D4F12F98F442D44FDCAF61566EF48766130F652E71C329B56D1133F60EED6
Malicious:	false
Reputation:	low
Preview:	/!. SuperSlide v2.1.3.* ................* .........http://www.SuperSlide2.com/.. Copyright 2011-.., ...... .............* .....................* v2.1.3...Jquery.....API........Jquery....jquery3.3.1................jquery..... 305491515@qq.com.*/!function(a){a.fn.slide=function(g){return a.fn.slide.defaults={type:"slide",effect:"fade",autoPlay:!1,delayTime:500,interTime:2500,triggerTime:150,defaultIndex:0,titCell:".hd li",mainCell:".bd",targetCell:null,trigger:"mouseover",scroll:1,vis:1,titOnClassName:"on",autoPage:!1,prevCell:".prev",nextCell:".next",pageStateCell:".pageState",opp:!1,pnLoop:!0,easing:"swing",startFun:null,endFun:null,switchLoad:null,playStateCell:".playState",mouseOverStop:!0,defaultPlay:!0,returnDefault:!1},this.each(function(){var aG,c,gg,ga,e,h,cf,O,f,D,eJ,ab

Chrome Cache Entry: 92

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (1523)
Category:	downloaded
Size (bytes):	2663
Entropy (8bit):	5.145884826771296
Encrypted:	false
SSDEEP:	48:GEvsb/5gX95hxUwLGn/p8VqTcTagzbhACutwCbn+Cu:GEvXfoh8Vqg9bZm+Cu
MD5:	94E9F897C976369D1CD8552E2BAEE1C2
SHA1:	9E539A9612A6C9D9B440D2BE65BEA956BCA49217
SHA-256:	6B3920CE320CE5F08BB1A40C8566D0B24BD8F19B8C5703B425D145FD43BACC17
SHA-512:	446EE62ADEDF7C9190032419C427310940EA3418F79FF77E3597527F0F3E536F688910CB9C068BC28726A37EC773F61DDA4C244211AC6609266F179CFFB5DBE8
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/skin/js/custom.js
Preview:	$(function(){var surl=location.href;var surl2=$(".sitemap a:eq(1)").attr("href");$("#starlist li a").each(function(){if($(this).attr("href")==surl\|\|$(this).attr("href")==surl2)$(this).parent().addClass("selected")});$('#starlist .sub-nav').before('<em class="dot"><i class="wordicon-arrow-down"></i></em>');$('.dot').click(function(){if($('#starlist').hasClass('active')){$(this).next().slideToggle();}});$('.mobile-menu').click(function(){$("#starlist").toggleClass("active");$(".fademask").toggleClass("active");});$('#starlist li').hover(function(){$(this).addClass('on');},function(){$(this).removeClass('on');});$(document).bind("click",function(e){if($('.mobile-menu').is(":visible")&&!$(e.target).closest(".mobile-menu").length&&!$(e.target).closest("#starlist").length){$("#starlist").removeClass("active");$(".fademask").removeClass("active");}});$('.search-btn').click(function(){$(".b-nav-search_wrap").toggleClass("active");});$(document).bind("click",function(e){if($('.search-btn').is("

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2432), with no line terminators
Category:	downloaded
Size (bytes):	2432
Entropy (8bit):	4.731365363808042
Encrypted:	false
SSDEEP:	48:suGKXGDOsAmcX2qNTEpdp9UlMSbCkLUSUhZUsQ1G:ZG0rmugwCpdhGsz
MD5:	629821CEBC555B2F14B3D73DECDA2380
SHA1:	377E14F8A7E06FF3D8B0328A4858719F744323F3
SHA-256:	F13817D661DF7C13714830DD2781BAF013D8FC89CF64AD84BCF88168B9874658
SHA-512:	1F45E4FD4783219144F015A35D5414FE0C829D355D4F7B54BD7AA12F3B3655296447CB4249CF410075146D5AD31F912ED21209AC66A4356AE4AA26482573E72B
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/skin/css/skin.css
Preview:	@font-face{font-family:icomoon;src:url(../font/icomoon.eot);src:url(../font/icomoon.eot) format('embedded-opentype'),url(../font/icomoon.ttf) format('truetype'),url(../font/icomoon.woff) format('woff');font-weight:400;font-style:normal;font-display:block}[class^=wordicon-],[class*=" wordicon-"]{font-family:icomoon!important;speak:never;font-style:normal;font-weight:400;font-variant:normal;text-transform:none;line-height:1;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.wordicon-laba:before{content:"\e901"}.wordicon-home:before{content:"\e63a"}.wordicon-store:before{content:"\e640"}.wordicon-chat:before{content:"\e67c"}.wordicon-message:before{content:"\e683"}.wordicon-article:before{content:"\e688"}.wordicon-archive-drawer:before{content:"\e69b"}.wordicon-mail-line:before{content:"\e6a8"}.wordicon-edit-box:before{content:"\e6d0"}.wordicon-t-box:before{content:"\e6e1"}.wordicon-dvd:before{content:"\e6fc"}.wordicon-image-line:before{content:"\e702"}.wordicon-movie:b

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (6093), with no line terminators
Category:	downloaded
Size (bytes):	6093
Entropy (8bit):	5.204108693261149
Encrypted:	false
SSDEEP:	96:Sfpf3Cl4aR2PxanBesYx4sbAQTu+hb5tOVvLT:dBR2JoKAQp55EVv/
MD5:	502D407625A03C5151CF7F0B7F1D2E5A
SHA1:	99C26FEDA1569A28C4ED050056CB12EA38BD3172
SHA-256:	CB3FDAE01E5EDFB32565C5F7B592BC7CA850CBA92565FF12F020DF68570481E8
SHA-512:	1427461A7B1763B100CCCAAF85EB9BF8A6A7EB87C6E1A35D286CB7630F918FC2DF7E3A9E29CEC9D39FA355215189148869E91908F51443C14C5AC7E917BEDC81
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/skin/js/hc-sticky.js
Preview:	!function(cOe){cOe.fn.theiaStickySidebar=function(egc){function aEb(egc,aEb){var gGf=QaP(egc,aEb);gGf\|\|(console.log("TSS: Body width smaller than options.minWidth. Init is delayed."),cOe(document).on("scroll."+egc.namespace,function(egc,aEb){return function(gGf){var hdX=QaP(egc,aEb);hdX&&cOe(this).unbind(gGf)}}(egc,aEb)),cOe(window).on("resize."+egc.namespace,function(egc,aEb){return function(gGf){var hdX=QaP(egc,aEb);hdX&&cOe(this).unbind(gGf)}}(egc,aEb)))}function QaP(egc,aEb){return egc.initialized===!0\|\|!(cOe("body").width()<egc.minWidth)&&(gGf(egc,aEb),!0)}function gGf(egc,aEb){egc.initialized=!0;var QaP=cOe("#theia-sticky-sidebar-stylesheet-"+egc.namespace);0===QaP.length&&cOe("head").append(cOe('<style id="theia-sticky-sidebar-stylesheet-'+egc.namespace+'">.theiaStickySidebar:after {content: ""; display: table; clear: both;}</style>')),aEb.each(function(){function aEb(){gGf.fixedScrollTop=0,gGf.sidebar.css({"min-height":"1px"}),gGf.stickySidebar.css({position:"static",width:"",t

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 120, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1959
Entropy (8bit):	7.824034911157267
Encrypted:	false
SSDEEP:	48:nZ3ycuxIH68nvjKOxhC5GC2vlfWjq6whuwWsmaDBahRm/:nZa6H6wPHC21WW6HwzDB0u
MD5:	CBA400C638C2081CE8798E24F95EAB6A
SHA1:	DAEE39E625008D0D8C3E13B23660391DC4D47E67
SHA-256:	389EB664948DDA8C5AFDD43719DDFCEE49D1332A1306DD717C8505755482CF51
SHA-512:	B318E91869F23F243FCA5E6C461A5EFC82A215D1E0CF51FCAA3D0598E1F4D436F77EF05D74950D7D4D9333639B7A7583A640628D3D8ACDA69D0F279DDAFB24D4
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.......x......}......gAMA......a....8eXIfMM........i.......................................x....Jq......IDATh..Zkl.U.....[[h.....<JW.........Q.........E~.%..D,U............Q1.m...g.",.Q@+..R.twg...v:;...hb.If....s.=s.K".kj..;...B...\...!....m.r.K.-..{=Iq>H..bf.m.>-.o....$?... f..z[t.p\..^.n'....D....l..+S.@..E.. @...Sf.3.b...G.6....[V......)A.c..wDo.....U,h. ...>.tnl.;.c..y...R....#...\..~).......I...=..[!.........<UR....E..\|...x.G"?..%K........p.4P.b.>..,...r...21..8)@.K..4..%\x.......o....Cjn..wI....\.e.G...I.U...'..'.S.^F>4F.........M.2.....e;...X...I...2/?...xZ.....t.B...u...Z.q..?......L.j....q*...+x....S!:o.........@...xu$......]P..ls.....+t]4....]Z'..F..........S}g\p.!!.....H.$+w./M\...,....w....V..2......1.]....s.lz......U.@.....<P.......G.CR..p.....C..GwWl.....z`z...8.}.y..L.a[.F.U.....=<..CKW,Z..l?p ...(.B..L.s.M?.....w.[..A...G..@.S.^...;.TCc...q..ul&^.w.-..9W.+..\|u1m.;.%......k....eX..E....W>.#'.U.\|\|~.......c?

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 21 x 17, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2677
Entropy (8bit):	6.873587839048703
Encrypted:	false
SSDEEP:	48:c/61MYLNnwknA9Wpi5CpG8HbY+/cHJ3l3ZzbHi3G8gbHcCjRRknpY7Tr:cSyYRwknmWpiTWbf/IfHtxHcyRkSb
MD5:	B104BB1FFCD608612E85386C65AE8532
SHA1:	B87D86B8C5C2AA5154578C925CC982333459BEE6
SHA-256:	33D6BE96B9CEED78DC9B32BB3FCDF2814836635D2D376D746F42728C35538F9E
SHA-512:	605466E630FFF43F083D9FCA3F9EC47D829F435B0D13A6211D07AA2F7F49F1E76B999BE5F3B41E6C69E8063301F3E9CB8851536A44B5127BC8AE9083C9693C64
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/navright1.png
Preview:	.PNG........IHDR.............2......pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)" xmp:CreateDate="2023-05-16T14:28:53+08:00" xmp:ModifyDate="2023-05-16T15:10:52+08:00" xmp:MetadataDate="2023-05-16T15:10:52+08:00" xmpMM:InstanceID="xmp.iid:76e97cf9-2dc7-dd41-9cdf-08fc51c581ae" xmpMM:DocumentID="adobe:docid:photoshop:5adeef5d-5dd6-284f-a4b2-8a997a223048" xmpMM:OriginalDocumentID="x

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	2424803
Entropy (8bit):	7.9715202133811625
Encrypted:	false
SSDEEP:	49152:aTLwT3cNXxZJp0FNysSNAYJDS9EIpWiX3UELUT0/wbeIdo:kcT3cn6NyspYH81Ui4pu
MD5:	14C0A01070573BC00E0F462023E8162F
SHA1:	8D8725F9BDBE99060B86E0A03434BB5C4E3BE8AF
SHA-256:	116029BD091EC390064879DF7DAD05E601E284413F53B9D51978875B85DC7471
SHA-512:	C8A6C5BCC48EE2D4F0A365886AC97407E8FBEF6E04502A68423F055730DC32BB91E9576A7ACE7557BA3597999E2545B1865033F8BB7E2F33FB7B392614B5B410
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i6.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,...........555.....!.].....5...!....w.}...T...fff.c..>....444.......)... ..... .)..............J..'..M.....O.....W..P.@@@.. ..... .U..[..G... ....Y... .. MMM.T...........C........E..H..'............ ..... .K... .. ....R... ..........7..............)..............B.....].....=... ..... .......9..G.....C.....U.....y..l..S.....S..@..O..Z..l.....8./......%..G.......&.......d'.....1.... ......6..6......y....q..i...[..2...W.[....J...........-..D....a....B./(..r...@.W.......(..6....?6...}.......P...........z...aaa...X..........N.t..}C....,..h..%......O....9.......H..=.......o^.......~~~.;..o..i..#..p5..s...OC..._.M..<._Q.....A..D......000HHH..g...qqq.F........4........y....<:9....>.....K....@6.YYY... .....UUUfS/TE0.... ..,..W..^....n"..(.h#..O.s..........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@...J.......v...P....T..X.j...U.`..{......].mM.^..K...p.............[.'%.....A...L...g'_

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 512 x 512
Category:	downloaded
Size (bytes):	3327196
Entropy (8bit):	7.960651343982663
Encrypted:	false
SSDEEP:	49152:IeR3w2GydSueIfKAwIkgMgOgGGXL/nUQlf5tXAS3mTvYIIjrLo8U659kP:IeR30yd91frwIyCGGLnUatXZ0comq
MD5:	3CA4222D4871D2C299E44DBBD14EBB46
SHA1:	19EE2E1C0D6DA440C08076DC1A657C8E58AA0662
SHA-256:	E21CCEB8262A91F878FE4E5202139793E9CD3A02DA2DD08D2DC4180CD29AC402
SHA-512:	4D54E6AF4755363DA902D0AFAA0160AB2847506EAF67E3C34B6B627650EC4FF8FC0719F50B59AB8A1723F4A216031156979C39294AAACC080104B61447ACCE87
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/section4i7.gif
Preview:	GIF89a.............!..NETSCAPE2.0.....!.......,.............5..2R.. .......]...'....X...!.......X..VTV..}......W........W......&....................%.....&........%........&..#........".j.........$.m...... .....!..".....!....]...#..#................Cm....[........T..s..`...".y...$.v..c..p...........{...7.=...$..C.Y./'..f...'.G...".N.....F.....Ix.7..>....~..Z..6Y..@5... ^N..<c.[.....%....S.....Q....R.......$..OB..M...Q..jC.....].(...j.o\......%.....".g...6...........l...]....J...L.....6....'....x...%........!.R......w.....!.OM.. "f...........{.....<;..{......3.....0!?K.%&xd..>..FE.!.Y.L...T..r...G...I.L}o..Y.q...O./.<...Y.2pz.)....d..<[.i..T...f.e...eT...A.".'....r.`.p).6..A..u;yF... ..bBxt..0....#B"...o....9?,.U.O.<dp.xIdm].h/..3`9..}>?IBlJ6.7P....}`3aV9\|tS...Q.MN>^...........e...."?...-.........H......\....#J.H....3j.... C..I...(S.\...0c.I...8s.....@.....Q.D.*]..S.G.>.J...(.Fe....`...U..h..$.U..p.d+U..x...kT...........I..F..c...>.L.r..3k

Chrome Cache Entry: 99

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, comment: "CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90", baseline, precision 8, 1000x208, components 3
Category:	downloaded
Size (bytes):	27725
Entropy (8bit):	7.8320130907167975
Encrypted:	false
SSDEEP:	768:GWUwS7XZehV3LDhXiF4X1T9IySBPltGMMFUHH:GlwMXYV3ZXA4X1pIyWPltGMMFUHH
MD5:	AD0F44F79330E0AF7CB064C4A9FD9B11
SHA1:	A3519070EF768B9CA163B6D8CFE7012DDBBCF4BD
SHA-256:	F123A86B52BC881B75B0AFE9201A8CF1ED563C59E44B84C2C21F58E80CE3B44B
SHA-512:	90BF5B202E8A97B16CDFC3A165F5BC5BE6B61D0ADDB0C6BC80D38DC85EFDFC29111704B3C921A3A21C10F470DF8E473EB3C76675F092AFCE243F875F769A09FE
Malicious:	false
Reputation:	low
URL:	https://www.telegramrm.com/static/images/session3.jpg
Preview:	......JFIF.....`.`.....;CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90....C....................................................................C............................................................................"............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..S..(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(.....mo.&...B..........KX^.....o..#..M....-..s..~e..h......g..li...3?.X?...<3.`;f......?....?.Z./..^...]\|..]..}..}.%.0.`.>......../..........t.6.U.X..f.....".3...}C..p..*.-/..._.......&...7..#.......Z./..^..]...?...,...../....kN.

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 28, 2024 00:15:05.960361958 CEST	192.168.2.6	1.1.1.1	0x2209	Standard query (0)	www.telegramrm.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:05.960572004 CEST	192.168.2.6	1.1.1.1	0xb491	Standard query (0)	www.telegramrm.com	65	IN (0x0001)	false
Sep 28, 2024 00:15:07.582098961 CEST	192.168.2.6	1.1.1.1	0x6d86	Standard query (0)	www.telegramrm.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:07.582451105 CEST	192.168.2.6	1.1.1.1	0x74e4	Standard query (0)	www.telegramrm.com	65	IN (0x0001)	false
Sep 28, 2024 00:15:09.344717026 CEST	192.168.2.6	1.1.1.1	0x1a90	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:09.348208904 CEST	192.168.2.6	1.1.1.1	0xa961	Standard query (0)	www.google.com	65	IN (0x0001)	false
Sep 28, 2024 00:15:09.940826893 CEST	192.168.2.6	1.1.1.1	0x4ff5	Standard query (0)	sdk.51.la	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:09.941034079 CEST	192.168.2.6	1.1.1.1	0xa315	Standard query (0)	sdk.51.la	65	IN (0x0001)	false
Sep 28, 2024 00:15:11.579302073 CEST	192.168.2.6	1.1.1.1	0x9ff3	Standard query (0)	sdk.51.la	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:11.579858065 CEST	192.168.2.6	1.1.1.1	0xede3	Standard query (0)	sdk.51.la	65	IN (0x0001)	false
Sep 28, 2024 00:15:13.493839025 CEST	192.168.2.6	1.1.1.1	0xed7b	Standard query (0)	www.telegramrm.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:13.494183064 CEST	192.168.2.6	1.1.1.1	0x92c6	Standard query (0)	www.telegramrm.com	65	IN (0x0001)	false
Sep 28, 2024 00:15:26.223299980 CEST	192.168.2.6	1.1.1.1	0x3b52	Standard query (0)	collect-v6.51.la	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:26.223670006 CEST	192.168.2.6	1.1.1.1	0xef9c	Standard query (0)	collect-v6.51.la	65	IN (0x0001)	false
Sep 28, 2024 00:15:27.661982059 CEST	192.168.2.6	1.1.1.1	0x89a2	Standard query (0)	web.dcobxs.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:27.662772894 CEST	192.168.2.6	1.1.1.1	0x813d	Standard query (0)	web.dcobxs.com	65	IN (0x0001)	false
Sep 28, 2024 00:15:27.666702986 CEST	192.168.2.6	1.1.1.1	0x81fc	Standard query (0)	collect-v6.51.la	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:27.667067051 CEST	192.168.2.6	1.1.1.1	0x7ab1	Standard query (0)	collect-v6.51.la	65	IN (0x0001)	false
Sep 28, 2024 00:15:30.200635910 CEST	192.168.2.6	1.1.1.1	0xd260	Standard query (0)	web.dcobxs.com	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:30.201004028 CEST	192.168.2.6	1.1.1.1	0x97f2	Standard query (0)	web.dcobxs.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 28, 2024 00:15:06.581146955 CEST	1.1.1.1	192.168.2.6	0x2209	No error (0)	www.telegramrm.com		47.242.228.6	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:08.084054947 CEST	1.1.1.1	192.168.2.6	0x6d86	No error (0)	www.telegramrm.com		47.242.228.6	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:09.351402998 CEST	1.1.1.1	192.168.2.6	0x1a90	No error (0)	www.google.com		216.58.206.36	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:09.357534885 CEST	1.1.1.1	192.168.2.6	0xa961	No error (0)	www.google.com			65	IN (0x0001)	false
Sep 28, 2024 00:15:09.948932886 CEST	1.1.1.1	192.168.2.6	0x4ff5	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:09.948932886 CEST	1.1.1.1	192.168.2.6	0x4ff5	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:09.948932886 CEST	1.1.1.1	192.168.2.6	0x4ff5	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.164.17	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:09.948932886 CEST	1.1.1.1	192.168.2.6	0x4ff5	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.164.13	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:09.948932886 CEST	1.1.1.1	192.168.2.6	0x4ff5	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		38.54.26.73	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:09.948932886 CEST	1.1.1.1	192.168.2.6	0x4ff5	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		38.54.26.75	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:10.389612913 CEST	1.1.1.1	192.168.2.6	0xa315	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:10.389612913 CEST	1.1.1.1	192.168.2.6	0xa315	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:11.588042974 CEST	1.1.1.1	192.168.2.6	0x9ff3	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:11.588042974 CEST	1.1.1.1	192.168.2.6	0x9ff3	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:11.588042974 CEST	1.1.1.1	192.168.2.6	0x9ff3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.75	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:11.588042974 CEST	1.1.1.1	192.168.2.6	0x9ff3	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.25	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:12.938682079 CEST	1.1.1.1	192.168.2.6	0xb491	Server failure (2)	www.telegramrm.com	none	none	65	IN (0x0001)	false
Sep 28, 2024 00:15:12.938896894 CEST	1.1.1.1	192.168.2.6	0xede3	No error (0)	sdk.51.la	sdk.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:12.938896894 CEST	1.1.1.1	192.168.2.6	0xede3	No error (0)	sdk.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:13.806624889 CEST	1.1.1.1	192.168.2.6	0x74e4	Server failure (2)	www.telegramrm.com	none	none	65	IN (0x0001)	false
Sep 28, 2024 00:15:14.063230038 CEST	1.1.1.1	192.168.2.6	0xed7b	No error (0)	www.telegramrm.com		47.242.228.6	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:18.891490936 CEST	1.1.1.1	192.168.2.6	0x1df1	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:18.891490936 CEST	1.1.1.1	192.168.2.6	0x1df1	No error (0)	fp2e7a.wpc.phicdn.net		192.229.221.95	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:19.744100094 CEST	1.1.1.1	192.168.2.6	0x92c6	Server failure (2)	www.telegramrm.com	none	none	65	IN (0x0001)	false
Sep 28, 2024 00:15:26.231985092 CEST	1.1.1.1	192.168.2.6	0xef9c	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:26.231985092 CEST	1.1.1.1	192.168.2.6	0xef9c	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:26.232017040 CEST	1.1.1.1	192.168.2.6	0x3b52	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:26.232017040 CEST	1.1.1.1	192.168.2.6	0x3b52	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:26.232017040 CEST	1.1.1.1	192.168.2.6	0x3b52	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.25	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:26.232017040 CEST	1.1.1.1	192.168.2.6	0x3b52	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.75	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:27.674561977 CEST	1.1.1.1	192.168.2.6	0x7ab1	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:27.674561977 CEST	1.1.1.1	192.168.2.6	0x7ab1	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:27.676158905 CEST	1.1.1.1	192.168.2.6	0x89a2	No error (0)	web.dcobxs.com		104.21.72.253	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:27.676158905 CEST	1.1.1.1	192.168.2.6	0x89a2	No error (0)	web.dcobxs.com		172.67.156.2	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:27.677275896 CEST	1.1.1.1	192.168.2.6	0x813d	No error (0)	web.dcobxs.com			65	IN (0x0001)	false
Sep 28, 2024 00:15:28.007452965 CEST	1.1.1.1	192.168.2.6	0x81fc	No error (0)	collect-v6.51.la	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:28.007452965 CEST	1.1.1.1	192.168.2.6	0x81fc	No error (0)	collect-v6.51.la.d183e8b1.cdnhwcgqa21.com	hcdnwsa120.v5.cdnhwczoy106.cn		CNAME (Canonical name)	IN (0x0001)	false
Sep 28, 2024 00:15:28.007452965 CEST	1.1.1.1	192.168.2.6	0x81fc	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		90.84.161.25	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:28.007452965 CEST	1.1.1.1	192.168.2.6	0x81fc	No error (0)	hcdnwsa120.v5.cdnhwczoy106.cn		148.153.240.75	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:30.236938953 CEST	1.1.1.1	192.168.2.6	0x97f2	No error (0)	web.dcobxs.com			65	IN (0x0001)	false
Sep 28, 2024 00:15:30.239316940 CEST	1.1.1.1	192.168.2.6	0xd260	No error (0)	web.dcobxs.com		104.21.72.253	A (IP address)	IN (0x0001)	false
Sep 28, 2024 00:15:30.239316940 CEST	1.1.1.1	192.168.2.6	0xd260	No error (0)	web.dcobxs.com		172.67.156.2	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49717	47.242.228.6	80	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 00:15:06.653048038 CEST	433	OUT	GET / HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Sep 28, 2024 00:15:07.573656082 CEST	402	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Fri, 27 Sep 2024 22:15:07 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://www.telegramrm.com/ Strict-Transport-Security: max-age=31536000 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>
Sep 28, 2024 00:15:52.579574108 CEST	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49716	47.242.228.6	80	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
Sep 28, 2024 00:15:51.656286955 CEST	6	OUT	Data Raw: 00 Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49715	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:07 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 45 79 33 6c 39 41 6a 38 4f 30 71 78 6a 2b 7a 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 36 34 36 34 64 39 32 36 38 38 31 62 39 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Ey3l9Aj8O0qxj+zS.1Context: 426464d926881b90
2024-09-27 22:15:07 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:15:07 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 45 79 33 6c 39 41 6a 38 4f 30 71 78 6a 2b 7a 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 36 34 36 34 64 39 32 36 38 38 31 62 39 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Ey3l9Aj8O0qxj+zS.2Context: 426464d926881b90<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-27 22:15:07 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 45 79 33 6c 39 41 6a 38 4f 30 71 78 6a 2b 7a 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 32 36 34 36 34 64 39 32 36 38 38 31 62 39 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Ey3l9Aj8O0qxj+zS.3Context: 426464d926881b90<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:15:07 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:15:07 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 65 4d 4d 30 65 73 74 4f 39 45 32 6d 59 55 56 2f 2b 54 65 6c 36 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: eMM0estO9E2mYUV/+Tel6A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49720	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:09 UTC	661	OUT	GET / HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:09 UTC	508	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Set-Cookie: think_language=en-US; expires=Fri, 27-Sep-2024 23:15:09 GMT; Max-Age=3600; path=/ Set-Cookie: PHPSESSID=gsofitdtf1ft3fjua791821hl4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache Cache-control: private X-Powered-By: ThinkPHP Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000
2024-09-27 22:15:09 UTC	9854	IN	Data Raw: 32 36 37 31 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 7a 68 2d 43 4e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d e5 ae 98 e7 bd 91 2d 54 65 6c 65 67 72 61 6d e4 b8 ad e6 96 87 e6 b1 89 e5 8c 96 e7 89 88 2d 54 65 6c 65 67 72 61 6d e4 b8 8b e8 bd bd 2d e7 ba b8 e9 a3 9e e6 9c ba e4 b8 ad e6 96 87 e7 89 88 2d e7 ba b8 e9 a3 9e e6 9c ba e4 b8 8b e8 bd bd 3c 2f 74 69 74 6c 65 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6b 65 79 77 6f 72 64 73 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 6c 65 67 72 61 6d 2c 74 65 6c 65 67 72 61 6d e5 ae 98 e7 bd 91 2c 74 65 6c 65 67 72 61 6d e6 b1 89 e5 8c 96 2c 74 65 6c 65 67 72 61 6d e4 b8 ad e6 96 87 e7 89 88 2c 74 65 6c 65 67 72 61 6d e4 b8 8b e8 bd bd Data Ascii: 2671<!DOCTYPE html><html lang="zh-CN"><head><title>Telegram-Telegram-Telegram--</title><meta name="keywords" content="telegram,telegram,telegram,telegram,telegram

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49724	90.84.164.17	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:10 UTC	528	OUT	GET /js-sdk-pro.min.js HTTP/1.1 Host: sdk.51.la Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:11 UTC	472	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:15:11 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: openresty Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true via: EU-ROU-bucharest-EDGE1-CACHE6[228],EU-ROU-bucharest-EDGE1-CACHE6[ovl,224],EU-GER-frankfurt-EDGE5-CACHE6[ovl,146],CHN-HElangfang-GLOBAL6-CACHE10[ovl,19] X-CCDN-REQ-ID-46B1: 4e9314cd8a831b302b96f484fc1c0139
2024-09-27 22:15:11 UTC	15912	IN	Data Raw: 66 39 66 0d 0a 2f 2a 21 0a 2a 20 35 31 4c 41 20 41 6e 61 6c 79 73 69 73 20 4a 61 76 61 73 63 72 69 70 74 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 20 4b 69 74 0a 2a 20 6a 73 2d 73 64 6b 2d 70 72 6f 20 76 31 2e 35 38 2e 33 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 36 2d 32 30 32 32 20 35 31 2e 6c 61 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 67 3d 65 5b 27 64 6f 63 75 6d 65 6e 74 27 5d 2c 68 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 69 3d 41 28 27 4f 62 6a 65 63 74 27 29 2c 6a 3d 41 28 27 4e 75 6d 62 65 72 27 29 2c 6b 3d 41 28 27 53 74 72 69 6e 67 27 29 2c 6d Data Ascii: f9f/! 51LA Analysis Javascript Software Development Kit* js-sdk-pro v1.58.3* Copyright 2016-2022 51.la All Rights Reserved*/(function(c){'use strict';var e=window,g=e['document'],h=encodeURIComponent,i=A('Object'),j=A('Number'),k=A('String'),m
2024-09-27 22:15:11 UTC	16384	IN	Data Raw: 78 4f 66 27 5d 28 27 54 72 69 64 65 6e 74 2f 27 29 3e 30 78 30 3f 28 66 68 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 72 76 3a 27 29 2c 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 68 2b 30 78 33 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 68 29 29 2c 30 78 61 29 29 3a 28 66 66 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 45 64 67 65 2f 27 29 29 3e 30 78 30 26 26 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 66 2b 30 78 35 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 66 29 29 2c 30 78 61 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 66 6a 28 66 6b 2c 66 6c 2c 66 6d 29 7b 76 61 72 20 66 6e 2c 66 6f 2c 66 70 2c 66 71 2c 66 72 2c 66 73 2c 66 74 2c 66 75 3d 5b 5d 2c Data Ascii: xOf']('Trident/')>0x0?(fh=fi['indexOf']('rv:'),parseInt(fi['substring'](fh+0x3,fi['indexOf']('.',fh)),0xa)):(ff=fi['indexOf']('Edge/'))>0x0&&parseInt(fi['substring'](ff+0x5,fi['indexOf']('.',ff)),0xa);}function fj(fk,fl,fm){var fn,fo,fp,fq,fr,fs,ft,fu=[],
2024-09-27 22:15:11 UTC	2091	IN	Data Raw: 30 5c 78 32 30 5c 78 32 30 27 29 5b 27 63 6f 6e 63 61 74 27 5d 28 69 45 5b 27 68 4a 64 59 51 6d 27 5d 28 67 72 29 2c 27 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 27 29 5b 27 63 6f 6e 63 61 74 27 5d 28 4d 61 74 68 5b 27 72 61 6e 64 6f 6d 27 5d 28 29 5b 27 74 6f 53 74 72 69 6e 67 27 5d 28 30 78 32 34 29 5b 27 73 75 62 73 74 72 27 5d 28 2d 30 78 38 29 2c 27 5c 78 30 61 5c 78 32 30 5c 78 32 30 27 29 2c 69 45 5b 27 4b 68 75 48 53 4f 27 5d 28 29 29 2c 6a 64 3d 6a 36 5b 27 68 72 65 66 27 5d 2c 67 53 3d 7b 27 69 64 27 3a 6a 37 5b 27 69 64 27 5d 2c 27 72 74 27 3a 6a 38 2c 27 74 74 27 3a 61 65 5b 27 5a 4e 4d 54 57 6a 27 5d 5b 27 74 74 27 5d 2c 27 6b 77 27 3a 61 65 5b 27 5a 4e 4d 54 57 6a 27 5d 5b 27 6b 77 27 5d 2c 27 64 73 27 3a 61 65 5b 27 5a 4e Data Ascii: 0\x20\x20')['concat'](iE['hJdYQm'](gr),'\x0a\x20\x20\x20\x20')['concat'](Math['random']()['toString'](0x24)['substr'](-0x8),'\x0a\x20\x20'),iE['KhuHSO']()),jd=j6['href'],gS={'id':j7['id'],'rt':j8,'tt':ae['ZNMTWj']['tt'],'kw':ae['ZNMTWj']['kw'],'ds':ae['ZN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49722	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:10 UTC	621	OUT	GET /skin/css/style.css HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:11 UTC	366	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:11 GMT Content-Type: text/css Content-Length: 44907 Last-Modified: Wed, 06 Mar 2024 15:30:23 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0f-af6b" Expires: Sat, 28 Sep 2024 10:15:11 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:11 UTC	16018	IN	Data Raw: 40 69 6d 70 6f 72 74 20 22 73 6b 69 6e 2e 63 73 73 22 3b 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 2a 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 3a 61 66 74 65 72 2c 3a 62 65 66 6f 72 65 7b 2d 77 65 62 6b 69 74 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 2d 6d 6f 7a 2d 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 3b 62 6f 78 2d 73 69 7a 69 6e 67 3a 62 6f 72 64 65 72 2d 62 6f 78 7d 62 6f 64 79 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 7a 68 65 6e 67 6b 61 69 3b e3 80 80 e3 80 80 66 6f 6e 74 2d 73 69 7a Data Ascii: @import "skin.css";{margin:0;padding:0}{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}body{font-family:zhengkai;font-siz
2024-09-27 22:15:11 UTC	16384	IN	Data Raw: 3a 34 30 70 78 7d 23 73 74 61 72 6c 69 73 74 2e 61 63 74 69 76 65 20 75 6c 2e 73 75 62 2d 6e 61 76 20 6c 69 20 61 7b 77 69 64 74 68 3a 61 75 74 6f 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 6c 65 66 74 3b 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 34 30 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 20 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 7d 23 73 74 61 72 6c 69 73 74 2e 61 63 74 69 76 65 20 75 6c 2e 73 75 62 2d 6e 61 76 20 6c 69 20 61 3a 68 6f 76 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 7d 23 73 74 61 72 6c 69 73 74 2e 61 63 74 69 76 65 20 6c 69 7b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 7d 23 73 74 61 72 6c 69 73 74 2e 61 63 74 69 76 65 20 75 6c 2e 73 75 62 2d 6e 61 76 7b 2d 77 65 62 6b 69 74 2d Data Ascii: :40px}#starlist.active ul.sub-nav li a{width:auto;text-align:left;margin-left:40px;padding:10px 0;font-size:14px}#starlist.active ul.sub-nav li a:hover{background-color:transparent}#starlist.active li{position:relative}#starlist.active ul.sub-nav{-webkit-
2024-09-27 22:15:11 UTC	12505	IN	Data Raw: 62 61 63 6b 67 72 6f 75 6e 64 3a 23 61 30 64 63 32 38 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 61 30 64 63 32 38 7d 2e 74 61 67 73 20 61 3a 6e 74 68 2d 63 68 69 6c 64 28 35 6e 2b 32 29 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 35 64 62 37 65 35 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 35 64 62 37 65 35 7d 2e 74 61 67 73 20 61 3a 6e 74 68 2d 63 68 69 6c 64 28 35 6e 2b 33 29 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 37 64 32 65 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 66 66 37 64 32 65 7d 2e 74 61 67 73 20 61 3a 6e 74 68 2d 63 68 69 6c 64 28 35 6e 2b 34 29 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 32 38 64 63 36 34 3b 62 6f 72 64 65 72 3a 31 70 78 20 73 6f 6c 69 64 20 23 32 38 64 63 36 34 7d 2e 74 61 67 73 20 61 Data Ascii: background:#a0dc28;border:1px solid #a0dc28}.tags a:nth-child(5n+2){background:#5db7e5;border:1px solid #5db7e5}.tags a:nth-child(5n+3){background:#ff7d2e;border:1px solid #ff7d2e}.tags a:nth-child(5n+4){background:#28dc64;border:1px solid #28dc64}.tags a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49725	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:11 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 22:15:11 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF67) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Cache-Control: public, max-age=239391 Date: Fri, 27 Sep 2024 22:15:11 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49727	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:12 UTC	638	OUT	GET /skin/css/skin.css HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: text/css,/;q=0.1 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Referer: https://www.telegramrm.com/skin/css/style.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:13 UTC	364	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:13 GMT Content-Type: text/css Content-Length: 2432 Last-Modified: Wed, 06 Mar 2024 15:30:22 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0e-980" Expires: Sat, 28 Sep 2024 10:15:13 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:13 UTC	2432	IN	Data Raw: 40 66 6f 6e 74 2d 66 61 63 65 7b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 69 63 6f 6d 6f 6f 6e 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 2f 69 63 6f 6d 6f 6f 6e 2e 65 6f 74 29 3b 73 72 63 3a 75 72 6c 28 2e 2e 2f 66 6f 6e 74 2f 69 63 6f 6d 6f 6f 6e 2e 65 6f 74 29 20 66 6f 72 6d 61 74 28 27 65 6d 62 65 64 64 65 64 2d 6f 70 65 6e 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 2f 69 63 6f 6d 6f 6f 6e 2e 74 74 66 29 20 66 6f 72 6d 61 74 28 27 74 72 75 65 74 79 70 65 27 29 2c 75 72 6c 28 2e 2e 2f 66 6f 6e 74 2f 69 63 6f 6d 6f 6f 6e 2e 77 6f 66 66 29 20 66 6f 72 6d 61 74 28 27 77 6f 66 66 27 29 3b 66 6f 6e 74 2d 77 65 69 67 68 74 3a 34 30 30 3b 66 6f 6e 74 2d 73 74 79 6c 65 3a 6e 6f 72 6d 61 6c 3b 66 6f 6e 74 2d 64 69 73 70 6c 61 79 3a 62 6c 6f 63 6b 7d Data Ascii: @font-face{font-family:icomoon;src:url(../font/icomoon.eot);src:url(../font/icomoon.eot) format('embedded-opentype'),url(../font/icomoon.ttf) format('truetype'),url(../font/icomoon.woff) format('woff');font-weight:400;font-style:normal;font-display:block}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49723	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:12 UTC	616	OUT	GET /skin/js/jquery-2.2.4.min.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:14 UTC	381	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:13 GMT Content-Type: application/javascript Content-Length: 85582 Last-Modified: Wed, 06 Mar 2024 15:30:22 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0e-14e4e" Expires: Sat, 28 Sep 2024 10:15:13 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:14 UTC	16003	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 32 2e 32 2e 34 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 69 74 68 20 61 20 64 6f 63 75 6d 65 Data Ascii: /! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a docume
2024-09-27 22:15:16 UTC	16384	IN	Data Raw: 6e 20 64 5b 75 5d 3f 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 65 29 7b 76 61 72 20 66 2c 67 3d 64 28 61 2c 6e 75 6c 6c 2c 65 2c 5b 5d 29 2c 68 3d 61 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 68 2d 2d 29 28 66 3d 67 5b 68 5d 29 26 26 28 61 5b 68 5d 3d 21 28 62 5b 68 5d 3d 66 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 66 29 7b 72 65 74 75 72 6e 20 62 5b 30 5d 3d 61 2c 64 28 62 2c 6e 75 6c 6c 2c 66 2c 63 29 2c 62 5b 30 5d 3d 6e 75 6c 6c 2c 21 63 2e 70 6f 70 28 29 7d 7d 29 2c 68 61 73 3a 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 66 61 28 61 2c 62 29 2e 6c 65 6e 67 74 68 3e 30 7d 7d 29 2c 63 6f 6e 74 61 69 6e 73 3a 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: n d[u]?ha(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),b[0]=null,!c.pop()}}),has:ha(function(a){return function(b){return fa(a,b).length>0}}),contains:ha(function(a)
2024-09-27 22:15:19 UTC	16384	IN	Data Raw: 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4e 2e 72 65 6d 6f 76 65 28 61 2c 62 29 7d 7d 29 2c 6e 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 64 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 74 68 69 73 5b 30 5d 2c 67 3d 66 26 26 66 2e 61 74 74 72 69 62 75 74 65 73 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 61 29 7b 69 66 28 74 68 69 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 4f 2e 67 65 74 28 66 29 2c 31 3d 3d 3d 66 2e 6e 6f 64 65 54 79 70 65 26 26 21 4e 2e 67 65 74 28 66 2c 22 68 61 73 44 61 74 61 41 74 74 72 73 22 29 29 29 7b 63 3d 67 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 63 2d 2d 29 67 5b 63 5d 26 26 28 64 3d 67 5b 63 5d 2e 6e 61 6d 65 2c 30 3d 3d 3d 64 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 22 29 26 26 28 64 Data Ascii: a:function(a,b){N.remove(a,b)}}),n.fn.extend({data:function(a,b){var c,d,e,f=this[0],g=f&&f.attributes;if(void 0===a){if(this.length&&(e=O.get(f),1===f.nodeType&&!N.get(f,"hasDataAttrs"))){c=g.length;while(c--)g[c]&&(d=g[c].name,0===d.indexOf("data-")&&(d
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: 7c 7c 28 63 3d 61 29 2c 63 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 62 29 7d 2c 44 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 2c 66 2c 67 3d 7b 7d 3b 66 6f 72 28 66 20 69 6e 20 62 29 67 5b 66 5d 3d 61 2e 73 74 79 6c 65 5b 66 5d 2c 61 2e 73 74 79 6c 65 5b 66 5d 3d 62 5b 66 5d 3b 65 3d 63 2e 61 70 70 6c 79 28 61 2c 64 7c 7c 5b 5d 29 3b 66 6f 72 28 66 20 69 6e 20 62 29 61 2e 73 74 79 6c 65 5b 66 5d 3d 67 5b 66 5d 3b 72 65 74 75 72 6e 20 65 7d 2c 45 61 3d 64 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 2c 63 2c 65 2c 66 2c 67 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 2c 68 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 Data Ascii: \|\|(c=a),c.getComputedStyle(b)},Da=function(a,b,c,d){var e,f,g={};for(f in b)g[f]=a.style[f],a.style[f]=b[f];e=c.apply(a,d\|\|[]);for(f in b)a.style[f]=g[f];return e},Ea=d.documentElement;!function(){var b,c,e,f,g=d.createElement("div"),h=d.createElement("di
2024-09-27 22:15:26 UTC	16384	IN	Data Raw: 66 28 65 3d 66 62 28 63 29 2c 64 3d 31 3d 3d 3d 63 2e 6e 6f 64 65 54 79 70 65 26 26 28 22 20 22 2b 65 2b 22 20 22 29 2e 72 65 70 6c 61 63 65 28 65 62 2c 22 20 22 29 29 7b 67 3d 30 3b 77 68 69 6c 65 28 66 3d 62 5b 67 2b 2b 5d 29 64 2e 69 6e 64 65 78 4f 66 28 22 20 22 2b 66 2b 22 20 22 29 3c 30 26 26 28 64 2b 3d 66 2b 22 20 22 29 3b 68 3d 6e 2e 74 72 69 6d 28 64 29 2c 65 21 3d 3d 68 26 26 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 2c 68 29 7d 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 72 65 6d 6f 76 65 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 3d 30 3b 69 66 28 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 61 29 29 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e Data Ascii: f(e=fb(c),d=1===c.nodeType&&(" "+e+" ").replace(eb," ")){g=0;while(f=b[g++])d.indexOf(" "+f+" ")<0&&(d+=f+" ");h=n.trim(d),e!==h&&c.setAttribute("class",h)}}return this},removeClass:function(a){var b,c,d,e,f,g,h,i=0;if(n.isFunction(a))return this.each(fun
2024-09-27 22:15:26 UTC	4043	IN	Data Raw: 2e 61 6c 77 61 79 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 6f 69 64 20 30 3d 3d 3d 66 3f 6e 28 61 29 2e 72 65 6d 6f 76 65 50 72 6f 70 28 65 29 3a 61 5b 65 5d 3d 66 2c 62 5b 65 5d 26 26 28 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3d 63 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 2c 4a 62 2e 70 75 73 68 28 65 29 29 2c 67 26 26 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 66 29 26 26 66 28 67 5b 30 5d 29 2c 67 3d 66 3d 76 6f 69 64 20 30 7d 29 2c 22 73 63 72 69 70 74 22 29 3a 76 6f 69 64 20 30 7d 29 2c 6e 2e 70 61 72 73 65 48 54 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 28 Data Ascii: .always(function(){void 0===f?n(a).removeProp(e):a[e]=f,b[e]&&(b.jsonpCallback=c.jsonpCallback,Jb.push(e)),g&&n.isFunction(f)&&f(g[0]),g=f=void 0}),"script"):void 0}),n.parseHTML=function(a,b,c){if(!a\|\|"string"!=typeof a)return null;"boolean"==typeof b&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49726	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:12 UTC	676	OUT	GET /static/images/navright1.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:13 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:13 GMT Content-Type: image/png Content-Length: 2677 Last-Modified: Wed, 06 Mar 2024 15:30:33 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c19-a75" Expires: Sun, 27 Oct 2024 22:15:13 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:13 UTC	2677	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 15 00 00 00 11 08 06 00 00 00 32 86 e7 80 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 06 cc 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDR2pHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49728	148.153.240.75	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:12 UTC	350	OUT	GET /js-sdk-pro.min.js HTTP/1.1 Host: sdk.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:13 UTC	472	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:15:13 GMT Content-Type: text/plain; charset=utf-8 Transfer-Encoding: chunked Connection: close Server: openresty Cache-Control: no-store Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE7-CACHE2[182],EU-GER-frankfurt-EDGE7-CACHE2[ovl,179],EU-GER-frankfurt-EDGE5-CACHE2[ovl,178],CHN-HElangfang-GLOBAL6-CACHE54[ovl,18] X-CCDN-REQ-ID-46B1: 5679bb6fce1b86fdb84d9bb0ec0d5864
2024-09-27 22:15:13 UTC	15912	IN	Data Raw: 66 39 66 0d 0a 2f 2a 21 0a 2a 20 35 31 4c 41 20 41 6e 61 6c 79 73 69 73 20 4a 61 76 61 73 63 72 69 70 74 20 53 6f 66 74 77 61 72 65 20 44 65 76 65 6c 6f 70 6d 65 6e 74 20 4b 69 74 0a 2a 20 6a 73 2d 73 64 6b 2d 70 72 6f 20 76 31 2e 35 38 2e 33 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 c2 a9 20 32 30 31 36 2d 32 30 32 32 20 35 31 2e 6c 61 20 41 6c 6c 20 52 69 67 68 74 73 20 52 65 73 65 72 76 65 64 0a 2a 2f 0a 28 66 75 6e 63 74 69 6f 6e 28 63 29 7b 27 75 73 65 20 73 74 72 69 63 74 27 3b 76 61 72 20 65 3d 77 69 6e 64 6f 77 2c 67 3d 65 5b 27 64 6f 63 75 6d 65 6e 74 27 5d 2c 68 3d 65 6e 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 69 3d 41 28 27 4f 62 6a 65 63 74 27 29 2c 6a 3d 41 28 27 4e 75 6d 62 65 72 27 29 2c 6b 3d 41 28 27 53 74 72 69 6e 67 27 29 2c 6d Data Ascii: f9f/! 51LA Analysis Javascript Software Development Kit* js-sdk-pro v1.58.3* Copyright 2016-2022 51.la All Rights Reserved*/(function(c){'use strict';var e=window,g=e['document'],h=encodeURIComponent,i=A('Object'),j=A('Number'),k=A('String'),m
2024-09-27 22:15:13 UTC	16384	IN	Data Raw: 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 54 72 69 64 65 6e 74 2f 27 29 3e 30 78 30 3f 28 66 68 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 72 76 3a 27 29 2c 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 68 2b 30 78 33 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 68 29 29 2c 30 78 61 29 29 3a 28 66 66 3d 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 45 64 67 65 2f 27 29 29 3e 30 78 30 26 26 70 61 72 73 65 49 6e 74 28 66 69 5b 27 73 75 62 73 74 72 69 6e 67 27 5d 28 66 66 2b 30 78 35 2c 66 69 5b 27 69 6e 64 65 78 4f 66 27 5d 28 27 2e 27 2c 66 66 29 29 2c 30 78 61 29 3b 7d 66 75 6e 63 74 69 6f 6e 20 66 6a 28 66 6b 2c 66 6c 2c 66 6d 29 7b 76 61 72 20 66 6e 2c 66 6f 2c 66 70 2c 66 71 2c 66 72 2c 66 73 2c 66 74 Data Ascii: i['indexOf']('Trident/')>0x0?(fh=fi['indexOf']('rv:'),parseInt(fi['substring'](fh+0x3,fi['indexOf']('.',fh)),0xa)):(ff=fi['indexOf']('Edge/'))>0x0&&parseInt(fi['substring'](ff+0x5,fi['indexOf']('.',ff)),0xa);}function fj(fk,fl,fm){var fn,fo,fp,fq,fr,fs,ft
2024-09-27 22:15:13 UTC	2112	IN	Data Raw: 28 6a 61 5b 30 78 31 5d 2c 27 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 27 29 5b 27 63 6f 6e 63 61 74 27 5d 28 69 45 5b 27 68 4a 64 59 51 6d 27 5d 28 67 72 29 2c 27 5c 78 30 61 5c 78 32 30 5c 78 32 30 5c 78 32 30 5c 78 32 30 27 29 5b 27 63 6f 6e 63 61 74 27 5d 28 4d 61 74 68 5b 27 72 61 6e 64 6f 6d 27 5d 28 29 5b 27 74 6f 53 74 72 69 6e 67 27 5d 28 30 78 32 34 29 5b 27 73 75 62 73 74 72 27 5d 28 2d 30 78 38 29 2c 27 5c 78 30 61 5c 78 32 30 5c 78 32 30 27 29 2c 69 45 5b 27 4b 68 75 48 53 4f 27 5d 28 29 29 2c 6a 64 3d 6a 36 5b 27 68 72 65 66 27 5d 2c 67 53 3d 7b 27 69 64 27 3a 6a 37 5b 27 69 64 27 5d 2c 27 72 74 27 3a 6a 38 2c 27 74 74 27 3a 61 65 5b 27 5a 4e 4d 54 57 6a 27 5d 5b 27 74 74 27 5d 2c 27 6b 77 27 3a 61 65 5b 27 5a 4e 4d 54 57 Data Ascii: (ja[0x1],'\x0a\x20\x20\x20\x20')['concat'](iE['hJdYQm'](gr),'\x0a\x20\x20\x20\x20')['concat'](Math['random']()['toString'](0x24)['substr'](-0x8),'\x0a\x20\x20'),iE['KhuHSO']()),jd=j6['href'],gS={'id':j7['id'],'rt':j8,'tt':ae['ZNMTWj']['tt'],'kw':ae['ZNMTW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49729	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:12 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-09-27 22:15:13 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=239419 Date: Fri, 27 Sep 2024 22:15:13 GMT Content-Length: 55 Connection: close X-CID: 2
2024-09-27 22:15:13 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49730	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:12 UTC	675	OUT	GET /static/images/navright.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:13 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:13 GMT Content-Type: image/png Content-Length: 1272 Last-Modified: Wed, 06 Mar 2024 15:30:33 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c19-4f8" Expires: Sun, 27 Oct 2024 22:15:13 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:13 UTC	1272	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 15 00 00 00 11 08 06 00 00 00 32 86 e7 80 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR2tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49731	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:14 UTC	671	OUT	GET /static/images/logo.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:14 UTC	369	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:14 GMT Content-Type: image/png Content-Length: 11449 Last-Modified: Wed, 06 Mar 2024 15:30:33 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c19-2cb9" Expires: Sun, 27 Oct 2024 22:15:14 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:14 UTC	11449	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 38 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 02 a0 02 00 04 00 00 00 01 00 00 00 80 a0 03 00 04 00 00 00 01 00 00 00 80 00 00 00 00 6b 46 26 4d 00 00 2c 2c 49 44 41 54 78 01 dd 7d 7b b4 1d d5 79 df 9e 73 8f de 12 12 7a 19 07 81 85 1e 08 2c 4a e2 c4 36 38 20 02 18 48 62 56 42 30 6f 1b 89 78 b9 69 5a ff d1 15 b2 56 dd ba d0 82 b3 f0 72 8d 57 6a d2 38 6e ea 3a e5 d9 c5 cb 24 95 a9 93 96 60 99 f2 68 60 39 b6 09 46 48 42 0f e4 82 c1 7a 3f 41 e8 ea de 33 fd fd be 6f 7f 33 7b f6 cc b9 73 ce bd f7 9c 2b b2 a5 33 df 37 7b 7f ef ef db 7b f6 99 33 e7 dc c4 fd 23 Data Ascii: PNGIHDR>agAMAa8eXIfMM*ikF&M,,IDATx}{ysz,J68 HbVB0oxiZVrWj8n:$`h`9FHBz?A3o3{s+37{{3#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49732	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:14 UTC	675	OUT	GET /static/images/session3.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:16 UTC	370	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:14 GMT Content-Type: image/jpeg Content-Length: 27725 Last-Modified: Wed, 06 Mar 2024 15:31:14 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c42-6c4d" Expires: Sun, 27 Oct 2024 22:15:14 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:16 UTC	16014	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 39 30 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 39 30 0a ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 d0 03 e8 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90CC"
2024-09-27 22:15:16 UTC	11711	IN	Data Raw: 82 75 f4 1b db 5d d1 da 72 cc 4b ff 00 c2 3c 81 55 72 85 02 8f 37 20 a1 12 10 49 3f eb 39 1f 2f 39 77 3a a7 88 86 a3 2d ad b7 86 fc 49 2c 69 e6 05 b9 9b 54 48 e3 72 aa c5 70 40 63 f3 10 a3 24 70 58 f5 c7 3a 7a 02 ea 3a c5 b9 96 f2 cf c4 ba 3b 1b b6 b7 58 ae 6f 90 b1 8c 28 3e 69 db 90 14 92 c0 0e bc 67 bd 4b 72 4a ec 6b 9d ec bf 21 c9 a2 5f 58 69 af 6d 73 ae 68 86 fa 0d 9b 2e 7f b1 15 04 43 6e 01 31 f9 bd 49 11 9c 82 07 c9 80 06 46 13 4b b0 d6 2d e7 63 6f e2 ed 24 c1 6f 29 92 f2 de 2d 1d 11 48 da aa 41 c4 b9 5c 14 73 9e 7a 8c e4 2e 0d eb eb 18 2c 1d c4 ba 8e bc fb 0a e0 ad ce 43 13 fd de 39 c5 11 da c4 eb 76 cd 7d e2 28 96 d8 6e 62 f3 1f 9c 64 8c ae 01 cf 43 59 ba 8f ba 30 75 5d ed a1 e2 3f b6 fe be 07 c1 6f 11 43 62 62 b8 b8 9a 0d 39 a0 dc 37 2b 6e d4 11 Data Ascii: u]rK<Ur7 I?9/9w:-I,iTHrp@c$pX:z:;Xo(>igKrJk!_Ximsh.Cn1IFK-co$o)-HA\sz.,C9v}(nbdCY0u]?oCbb97+n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49734	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:15 UTC	436	OUT	GET /static/images/navright.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:16 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:15 GMT Content-Type: image/png Content-Length: 1272 Last-Modified: Wed, 06 Mar 2024 15:30:33 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c19-4f8" Expires: Sun, 27 Oct 2024 22:15:15 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:16 UTC	1272	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 15 00 00 00 11 08 06 00 00 00 32 86 e7 80 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 22 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 33 2d 63 30 31 31 20 36 36 2e 31 34 35 36 36 31 2c 20 32 30 31 32 2f 30 32 2f 30 36 2d 31 34 3a 35 36 3a 32 37 20 20 Data Ascii: PNGIHDR2tEXtSoftwareAdobe ImageReadyqe<"iTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49733	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:15 UTC	437	OUT	GET /static/images/navright1.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:16 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:15 GMT Content-Type: image/png Content-Length: 2677 Last-Modified: Wed, 06 Mar 2024 15:30:33 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c19-a75" Expires: Sun, 27 Oct 2024 22:15:15 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:16 UTC	2677	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 15 00 00 00 11 08 06 00 00 00 32 86 e7 80 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 06 cc 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 Data Ascii: PNGIHDR2pHYsiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RD

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49736	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:16 UTC	673	OUT	GET /static/images/window.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:16 UTC	370	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:16 GMT Content-Type: image/jpeg Content-Length: 31391 Last-Modified: Wed, 06 Mar 2024 15:31:15 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c43-7a9f" Expires: Sun, 27 Oct 2024 22:15:16 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:16 UTC	16014	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 31 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckyd1http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xm
2024-09-27 22:15:16 UTC	15377	IN	Data Raw: 60 5d cf 54 55 09 21 98 31 88 1a 8a a8 78 bc ed 4b 32 aa 08 82 63 25 3d 22 83 54 fb dc 83 c3 10 4e b2 a0 92 69 eb 1e 05 28 64 01 c8 69 71 a0 da b8 24 0d aa 95 51 55 30 8f 29 f9 b6 4d 9d 2c 67 2f 69 a9 e5 d9 94 d1 f2 29 11 74 d0 8d 7c 2a 1d 37 0b 34 4d b8 e9 04 4c 39 6b cc 43 2c bb 43 3b 17 d1 3c 59 4c 48 c0 44 ef de 95 4e 76 93 94 1c 4a eb ee da 6c 0a 92 59 aa 61 c9 34 c4 00 78 88 80 90 3b 07 db c7 96 b8 64 b4 03 b6 8a cb dd 97 d6 c0 ad 4e 2a 27 2a 94 1b 83 85 8c 99 72 d0 90 aa 63 24 51 e2 23 a0 82 6d 25 1c 5d 00 86 50 ec 0a 2b a7 cc fc 80 93 d5 b9 52 5d 4b 19 3d 47 39 b2 10 0e 00 22 23 c7 2c 80 07 f9 71 7a 28 c8 20 ab 53 dd 88 b1 d8 06 de be a5 33 d8 ad d0 c3 35 4d c5 21 3e a8 42 2b 06 e1 36 4d ce e9 41 c9 cf 3d 40 21 01 33 08 e6 75 5c ae 61 12 94 a1 91 Data Ascii: `]TU!1xK2c%="TNi(diq$QU0)M,g/i)t\|74ML9kC,C;<YLHDNvJlYa4x;dN'*rc$Q#m%]P+R]K=G9"#,qz( S35M!>B+6MA=@!3u\a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49737	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:16 UTC	432	OUT	GET /static/images/logo.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:16 UTC	369	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:16 GMT Content-Type: image/png Content-Length: 11449 Last-Modified: Wed, 06 Mar 2024 15:30:33 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c19-2cb9" Expires: Sun, 27 Oct 2024 22:15:16 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:16 UTC	11449	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 38 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 02 a0 02 00 04 00 00 00 01 00 00 00 80 a0 03 00 04 00 00 00 01 00 00 00 80 00 00 00 00 6b 46 26 4d 00 00 2c 2c 49 44 41 54 78 01 dd 7d 7b b4 1d d5 79 df 9e 73 8f de 12 12 7a 19 07 81 85 1e 08 2c 4a e2 c4 36 38 20 02 18 48 62 56 42 30 6f 1b 89 78 b9 69 5a ff d1 15 b2 56 dd ba d0 82 b3 f0 72 8d 57 6a d2 38 6e ea 3a e5 d9 c5 cb 24 95 a9 93 96 60 99 f2 68 60 39 b6 09 46 48 42 0f e4 82 c1 7a 3f 41 e8 ea de 33 fd fd be 6f 7f 33 7b f6 cc b9 73 ce bd f7 9c 2b b2 a5 33 df 37 7b 7f ef ef db 7b f6 99 33 e7 dc c4 fd 23 Data Ascii: PNGIHDR>agAMAa8eXIfMM*ikF&M,,IDATx}{ysz,J68 HbVB0oxiZVrWj8n:$`h`9FHBz?A3o3{s+37{{3#

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49735	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 54 47 79 37 62 35 48 53 69 30 36 32 47 65 4b 37 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 66 62 31 64 35 66 39 63 39 66 65 39 34 38 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: TGy7b5HSi062GeK7.1Context: 71fb1d5f9c9fe948
2024-09-27 22:15:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:15:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 54 47 79 37 62 35 48 53 69 30 36 32 47 65 4b 37 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 66 62 31 64 35 66 39 63 39 66 65 39 34 38 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: TGy7b5HSi062GeK7.2Context: 71fb1d5f9c9fe948<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-27 22:15:16 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 54 47 79 37 62 35 48 53 69 30 36 32 47 65 4b 37 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 31 66 62 31 64 35 66 39 63 39 66 65 39 34 38 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: TGy7b5HSi062GeK7.3Context: 71fb1d5f9c9fe948<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:15:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:15:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 41 67 33 6a 31 78 7a 6b 42 45 4f 72 2f 64 6b 36 63 53 2f 6c 6d 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Ag3j1xzkBEOr/dk6cS/lmA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49739	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:16 UTC	436	OUT	GET /static/images/session3.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:17 UTC	370	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:17 GMT Content-Type: image/jpeg Content-Length: 27725 Last-Modified: Wed, 06 Mar 2024 15:31:14 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c42-6c4d" Expires: Sun, 27 Oct 2024 22:15:17 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:17 UTC	16014	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 39 30 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 39 30 0a ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 00 d0 03 e8 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF``;CREATOR: gd-jpeg v1.0 (using IJG JPEG v90), quality = 90CC"
2024-09-27 22:15:17 UTC	11711	IN	Data Raw: 82 75 f4 1b db 5d d1 da 72 cc 4b ff 00 c2 3c 81 55 72 85 02 8f 37 20 a1 12 10 49 3f eb 39 1f 2f 39 77 3a a7 88 86 a3 2d ad b7 86 fc 49 2c 69 e6 05 b9 9b 54 48 e3 72 aa c5 70 40 63 f3 10 a3 24 70 58 f5 c7 3a 7a 02 ea 3a c5 b9 96 f2 cf c4 ba 3b 1b b6 b7 58 ae 6f 90 b1 8c 28 3e 69 db 90 14 92 c0 0e bc 67 bd 4b 72 4a ec 6b 9d ec bf 21 c9 a2 5f 58 69 af 6d 73 ae 68 86 fa 0d 9b 2e 7f b1 15 04 43 6e 01 31 f9 bd 49 11 9c 82 07 c9 80 06 46 13 4b b0 d6 2d e7 63 6f e2 ed 24 c1 6f 29 92 f2 de 2d 1d 11 48 da aa 41 c4 b9 5c 14 73 9e 7a 8c e4 2e 0d eb eb 18 2c 1d c4 ba 8e bc fb 0a e0 ad ce 43 13 fd de 39 c5 11 da c4 eb 76 cd 7d e2 28 96 d8 6e 62 f3 1f 9c 64 8c ae 01 cf 43 59 ba 8f ba 30 75 5d ed a1 e2 3f b6 fe be 07 c1 6f 11 43 62 62 b8 b8 9a 0d 39 a0 dc 37 2b 6e d4 11 Data Ascii: u]rK<Ur7 I?9/9w:-I,iTHrp@c$pX:z:;Xo(>igKrJk!_Ximsh.Cn1IFK-co$o)-HA\sz.,C9v}(nbdCY0u]?oCbb97+n

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49738	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:17 UTC	606	OUT	GET /skin/js/custom.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:17 UTC	378	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:17 GMT Content-Type: application/javascript Content-Length: 2663 Last-Modified: Wed, 06 Mar 2024 15:30:21 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0d-a67" Expires: Sat, 28 Sep 2024 10:15:17 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:17 UTC	2663	IN	Data Raw: 24 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 75 72 6c 3d 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 76 61 72 20 73 75 72 6c 32 3d 24 28 22 2e 73 69 74 65 6d 61 70 20 61 3a 65 71 28 31 29 22 29 2e 61 74 74 72 28 22 68 72 65 66 22 29 3b 24 28 22 23 73 74 61 72 6c 69 73 74 20 6c 69 20 61 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 24 28 74 68 69 73 29 2e 61 74 74 72 28 22 68 72 65 66 22 29 3d 3d 73 75 72 6c 7c 7c 24 28 74 68 69 73 29 2e 61 74 74 72 28 22 68 72 65 66 22 29 3d 3d 73 75 72 6c 32 29 24 28 74 68 69 73 29 2e 70 61 72 65 6e 74 28 29 2e 61 64 64 43 6c 61 73 73 28 22 73 65 6c 65 63 74 65 64 22 29 7d 29 3b 24 28 27 23 73 74 61 72 6c 69 73 74 20 2e 73 75 62 2d 6e 61 76 27 29 2e 62 65 66 6f 72 65 28 27 3c 65 6d 20 63 6c 61 Data Ascii: $(function(){var surl=location.href;var surl2=$(".sitemap a:eq(1)").attr("href");$("#starlist li a").each(function(){if($(this).attr("href")==surl\|\|$(this).attr("href")==surl2)$(this).parent().addClass("selected")});$('#starlist .sub-nav').before('<em cla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	49741	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:17 UTC	604	OUT	GET /skin/js/side.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:18 UTC	380	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:18 GMT Content-Type: application/javascript Content-Length: 12465 Last-Modified: Wed, 06 Mar 2024 15:30:22 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0e-30b1" Expires: Sat, 28 Sep 2024 10:15:18 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:18 UTC	12465	IN	Data Raw: 2f 2a 21 0a 2a 20 53 75 70 65 72 53 6c 69 64 65 20 76 32 2e 31 2e 33 0a 2a 20 e8 bd bb e6 9d be e8 a7 a3 e5 86 b3 e7 bd 91 e7 ab 99 e5 a4 a7 e9 83 a8 e5 88 86 e7 89 b9 e6 95 88 e5 b1 95 e7 a4 ba e9 97 ae e9 a2 98 0a 2a 20 e8 af a6 e5 b0 bd e4 bf a1 e6 81 af e8 af b7 e7 9c 8b e5 ae 98 e7 bd 91 ef bc 9a 68 74 74 70 3a 2f 2f 77 77 77 2e 53 75 70 65 72 53 6c 69 64 65 32 2e 63 6f 6d 2f 0a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d e8 87 b3 e4 bb 8a 2c 20 e5 a4 a7 e8 af 9d e4 b8 bb e5 b8 ad 0a 2a 0a 2a 20 e8 af b7 e5 b0 8a e9 87 8d e5 8e 9f e5 88 9b ef bc 8c e4 bf 9d e7 95 99 e5 a4 b4 e9 83 a8 e7 89 88 e6 9d 83 0a 2a 20 e5 9c a8 e4 bf 9d e7 95 99 e7 89 88 e6 9d 83 e7 9a 84 e5 89 8d e6 8f 90 e4 b8 8b e5 8f af e5 ba 94 e7 94 a8 e4 ba 8e e4 b8 aa e4 Data Ascii: /! SuperSlide v2.1.3* * http://www.SuperSlide2.com/ Copyright 2011-, *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49742	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:18 UTC	434	OUT	GET /static/images/window.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:20 UTC	370	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:18 GMT Content-Type: image/jpeg Content-Length: 31391 Last-Modified: Wed, 06 Mar 2024 15:31:15 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c43-7a9f" Expires: Sun, 27 Oct 2024 22:15:18 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:20 UTC	16014	IN	Data Raw: ff d8 ff e1 00 18 45 78 69 66 00 00 49 49 2a 00 08 00 00 00 00 00 00 00 00 00 00 00 ff ec 00 11 44 75 63 6b 79 00 01 00 04 00 00 00 64 00 00 ff e1 03 31 68 74 74 70 3a 2f 2f 6e 73 2e 61 64 6f 62 65 2e 63 6f 6d 2f 78 61 70 2f 31 2e 30 2f 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 36 2d 63 31 34 35 20 37 39 2e 31 36 33 34 39 39 2c 20 32 30 31 38 2f 30 38 2f 31 33 2d 31 36 3a 34 30 3a 32 32 20 20 20 20 20 20 20 20 22 3e 20 3c 72 64 66 3a 52 44 46 20 78 6d Data Ascii: ExifII*Duckyd1http://ns.adobe.com/xap/1.0/<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xm
2024-09-27 22:15:21 UTC	15377	IN	Data Raw: 60 5d cf 54 55 09 21 98 31 88 1a 8a a8 78 bc ed 4b 32 aa 08 82 63 25 3d 22 83 54 fb dc 83 c3 10 4e b2 a0 92 69 eb 1e 05 28 64 01 c8 69 71 a0 da b8 24 0d aa 95 51 55 30 8f 29 f9 b6 4d 9d 2c 67 2f 69 a9 e5 d9 94 d1 f2 29 11 74 d0 8d 7c 2a 1d 37 0b 34 4d b8 e9 04 4c 39 6b cc 43 2c bb 43 3b 17 d1 3c 59 4c 48 c0 44 ef de 95 4e 76 93 94 1c 4a eb ee da 6c 0a 92 59 aa 61 c9 34 c4 00 78 88 80 90 3b 07 db c7 96 b8 64 b4 03 b6 8a cb dd 97 d6 c0 ad 4e 2a 27 2a 94 1b 83 85 8c 99 72 d0 90 aa 63 24 51 e2 23 a0 82 6d 25 1c 5d 00 86 50 ec 0a 2b a7 cc fc 80 93 d5 b9 52 5d 4b 19 3d 47 39 b2 10 0e 00 22 23 c7 2c 80 07 f9 71 7a 28 c8 20 ab 53 dd 88 b1 d8 06 de be a5 33 d8 ad d0 c3 35 4d c5 21 3e a8 42 2b 06 e1 36 4d ce e9 41 c9 cf 3d 40 21 01 33 08 e6 75 5c ae 61 12 94 a1 91 Data Ascii: `]TU!1xK2c%="TNi(diq$QU0)M,g/i)t\|74ML9kC,C;<YLHDNvJlYa4x;dN'*rc$Q#m%]P+R]K=G9"#,qz( S35M!>B+6MA=@!3u\a

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	49743	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:18 UTC	609	OUT	GET /skin/js/hc-sticky.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:19 UTC	379	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:18 GMT Content-Type: application/javascript Content-Length: 6093 Last-Modified: Wed, 06 Mar 2024 15:30:22 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0e-17cd" Expires: Sat, 28 Sep 2024 10:15:18 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:19 UTC	6093	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 63 4f 65 29 7b 63 4f 65 2e 66 6e 2e 74 68 65 69 61 53 74 69 63 6b 79 53 69 64 65 62 61 72 3d 66 75 6e 63 74 69 6f 6e 28 65 67 63 29 7b 66 75 6e 63 74 69 6f 6e 20 61 45 62 28 65 67 63 2c 61 45 62 29 7b 76 61 72 20 67 47 66 3d 51 61 50 28 65 67 63 2c 61 45 62 29 3b 67 47 66 7c 7c 28 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 54 53 53 3a 20 42 6f 64 79 20 77 69 64 74 68 20 73 6d 61 6c 6c 65 72 20 74 68 61 6e 20 6f 70 74 69 6f 6e 73 2e 6d 69 6e 57 69 64 74 68 2e 20 49 6e 69 74 20 69 73 20 64 65 6c 61 79 65 64 2e 22 29 2c 63 4f 65 28 64 6f 63 75 6d 65 6e 74 29 2e 6f 6e 28 22 73 63 72 6f 6c 6c 2e 22 2b 65 67 63 2e 6e 61 6d 65 73 70 61 63 65 2c 66 75 6e 63 74 69 6f 6e 28 65 67 63 2c 61 45 62 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 Data Ascii: !function(cOe){cOe.fn.theiaStickySidebar=function(egc){function aEb(egc,aEb){var gGf=QaP(egc,aEb);gGf\|\|(console.log("TSS: Body width smaller than options.minWidth. Init is delayed."),cOe(document).on("scroll."+egc.namespace,function(egc,aEb){return functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	49744	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:18 UTC	427	OUT	GET /skin/js/custom.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:19 UTC	378	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:18 GMT Content-Type: application/javascript Content-Length: 2663 Last-Modified: Wed, 06 Mar 2024 15:30:21 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0d-a67" Expires: Sat, 28 Sep 2024 10:15:18 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:19 UTC	2663	IN	Data Raw: 24 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 73 75 72 6c 3d 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3b 76 61 72 20 73 75 72 6c 32 3d 24 28 22 2e 73 69 74 65 6d 61 70 20 61 3a 65 71 28 31 29 22 29 2e 61 74 74 72 28 22 68 72 65 66 22 29 3b 24 28 22 23 73 74 61 72 6c 69 73 74 20 6c 69 20 61 22 29 2e 65 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 24 28 74 68 69 73 29 2e 61 74 74 72 28 22 68 72 65 66 22 29 3d 3d 73 75 72 6c 7c 7c 24 28 74 68 69 73 29 2e 61 74 74 72 28 22 68 72 65 66 22 29 3d 3d 73 75 72 6c 32 29 24 28 74 68 69 73 29 2e 70 61 72 65 6e 74 28 29 2e 61 64 64 43 6c 61 73 73 28 22 73 65 6c 65 63 74 65 64 22 29 7d 29 3b 24 28 27 23 73 74 61 72 6c 69 73 74 20 2e 73 75 62 2d 6e 61 76 27 29 2e 62 65 66 6f 72 65 28 27 3c 65 6d 20 63 6c 61 Data Ascii: $(function(){var surl=location.href;var surl2=$(".sitemap a:eq(1)").attr("href");$("#starlist li a").each(function(){if($(this).attr("href")==surl\|\|$(this).attr("href")==surl2)$(this).parent().addClass("selected")});$('#starlist .sub-nav').before('<em cla

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	49746	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:19 UTC	425	OUT	GET /skin/js/side.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:19 UTC	380	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:19 GMT Content-Type: application/javascript Content-Length: 12465 Last-Modified: Wed, 06 Mar 2024 15:30:22 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0e-30b1" Expires: Sat, 28 Sep 2024 10:15:19 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:19 UTC	12465	IN	Data Raw: 2f 2a 21 0a 2a 20 53 75 70 65 72 53 6c 69 64 65 20 76 32 2e 31 2e 33 0a 2a 20 e8 bd bb e6 9d be e8 a7 a3 e5 86 b3 e7 bd 91 e7 ab 99 e5 a4 a7 e9 83 a8 e5 88 86 e7 89 b9 e6 95 88 e5 b1 95 e7 a4 ba e9 97 ae e9 a2 98 0a 2a 20 e8 af a6 e5 b0 bd e4 bf a1 e6 81 af e8 af b7 e7 9c 8b e5 ae 98 e7 bd 91 ef bc 9a 68 74 74 70 3a 2f 2f 77 77 77 2e 53 75 70 65 72 53 6c 69 64 65 32 2e 63 6f 6d 2f 0a 2a 0a 2a 20 43 6f 70 79 72 69 67 68 74 20 32 30 31 31 2d e8 87 b3 e4 bb 8a 2c 20 e5 a4 a7 e8 af 9d e4 b8 bb e5 b8 ad 0a 2a 0a 2a 20 e8 af b7 e5 b0 8a e9 87 8d e5 8e 9f e5 88 9b ef bc 8c e4 bf 9d e7 95 99 e5 a4 b4 e9 83 a8 e7 89 88 e6 9d 83 0a 2a 20 e5 9c a8 e4 bf 9d e7 95 99 e7 89 88 e6 9d 83 e7 9a 84 e5 89 8d e6 8f 90 e4 b8 8b e5 8f af e5 ba 94 e7 94 a8 e4 ba 8e e4 b8 aa e4 Data Ascii: /! SuperSlide v2.1.3* * http://www.SuperSlide2.com/ Copyright 2011-, *

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	49749	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:20 UTC	430	OUT	GET /skin/js/hc-sticky.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:20 UTC	379	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:20 GMT Content-Type: application/javascript Content-Length: 6093 Last-Modified: Wed, 06 Mar 2024 15:30:22 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0e-17cd" Expires: Sat, 28 Sep 2024 10:15:20 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:20 UTC	6093	IN	Data Raw: 21 66 75 6e 63 74 69 6f 6e 28 63 4f 65 29 7b 63 4f 65 2e 66 6e 2e 74 68 65 69 61 53 74 69 63 6b 79 53 69 64 65 62 61 72 3d 66 75 6e 63 74 69 6f 6e 28 65 67 63 29 7b 66 75 6e 63 74 69 6f 6e 20 61 45 62 28 65 67 63 2c 61 45 62 29 7b 76 61 72 20 67 47 66 3d 51 61 50 28 65 67 63 2c 61 45 62 29 3b 67 47 66 7c 7c 28 63 6f 6e 73 6f 6c 65 2e 6c 6f 67 28 22 54 53 53 3a 20 42 6f 64 79 20 77 69 64 74 68 20 73 6d 61 6c 6c 65 72 20 74 68 61 6e 20 6f 70 74 69 6f 6e 73 2e 6d 69 6e 57 69 64 74 68 2e 20 49 6e 69 74 20 69 73 20 64 65 6c 61 79 65 64 2e 22 29 2c 63 4f 65 28 64 6f 63 75 6d 65 6e 74 29 2e 6f 6e 28 22 73 63 72 6f 6c 6c 2e 22 2b 65 67 63 2e 6e 61 6d 65 73 70 61 63 65 2c 66 75 6e 63 74 69 6f 6e 28 65 67 63 2c 61 45 62 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 Data Ascii: !function(cOe){cOe.fn.theiaStickySidebar=function(egc){function aEb(egc,aEb){var gGf=QaP(egc,aEb);gGf\|\|(console.log("TSS: Body width smaller than options.minWidth. Init is delayed."),cOe(document).on("scroll."+egc.namespace,function(egc,aEb){return functi

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	49748	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:20 UTC	679	OUT	GET /static/images/session2left.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:20 UTC	372	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:20 GMT Content-Type: image/jpeg Content-Length: 148298 Last-Modified: Wed, 06 Mar 2024 15:31:14 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c42-2434a" Expires: Sun, 27 Oct 2024 22:15:20 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:20 UTC	16012	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff e1 15 8a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 14 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 86 87 69 00 04 00 00 00 01 00 00 00 9c 00 00 00 c8 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 37 2e 30 00 32 30 32 33 3a 30 35 3a 32 36 20 30 37 3a 32 34 3a 32 30 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 01 fe a0 03 00 04 00 00 00 01 00 00 02 14 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 Data Ascii: JFIFHHExifMM*bj(1r2iHHAdobe Photoshop 7.02023:05:26 07:24:20
2024-09-27 22:15:20 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: 61 1e e8 9c 90 38 d3 fd 5f f3 93 a6 1b 9a cf 91 ff 00 57 fb c7 5d ff 00 c3 71 f4 6b 7e bd d5 db 1f f9 fd d9 bf f1 1d 72 39 f6 a1 39 20 52 a3 fd 5f f5 53 a6 4f 33 93 51 5c 7f ab fa 1d 72 ff 00 86 e2 e8 d6 64 be e7 ed 4f 5f 31 1f e3 3b 3b f7 79 ff 00 c3 1f de 9b 90 a0 83 35 cf e7 ff 00 5b 3a 4d 07 38 cd 21 a5 32 7e cf fa 03 a9 f0 ff 00 2c 7e a6 a8 18 7f 05 77 75 cd fd e0 fb 89 70 32 53 d5 ed 79 bf 8c 53 d1 d5 7d 9d 5d 56 27 fd f8 ff 00 e5 a7 1d 5d 49 2d 3f f9 37 fc 71 97 fe 52 3d a6 3c ab 0a 50 6a c7 e7 ff 00 41 f4 a1 f9 92 e1 e9 55 ff 00 07 fd 03 d4 fa 7f e5 67 d6 f5 90 e3 ea 28 ff 00 d3 e5 6d 3e 53 33 fc 07 17 51 4f fc 06 78 32 3b 82 e7 ee f0 38 9a bf f4 72 7e fa bb 1d ff 00 29 74 f4 df f5 23 de e6 e5 1b 4d 5f 17 fc 7b fe 83 ea c9 cc d7 7d d5 5f f8 ef fd Data Ascii: a8_W]qk~r99 R_SO3Q\rdO_1;;y5[:M8!2~,~wup2SyS}]V']I-?7qR=<PjAUg(m>S3QOx2;8r~)t#M_{}_
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: a1 ef 74 f7 4f 57 47 d9 fb 6f 2e 73 94 75 38 6e bf 9b 74 6d 2d db 9b c7 e7 8c d8 9d ab ba 37 25 36 db ad da 9f de 1a 50 7f 87 d7 50 e3 8e 26 ae 9f ee 3f ca bf 80 65 6b 22 ff 00 33 e6 9f c2 1f db 79 7f 7d 8f 93 25 b7 75 a1 20 9f f4 3f f7 e5 47 e2 f4 f9 f5 15 1d 9c cb 3b 5c b8 ef fd 9e 54 3c 0f f9 32 38 f9 92 0f 7c ae f9 4b 47 d6 fb ff 00 ac e1 c6 66 28 f7 56 cd c8 6c 0d ff 00 2e f2 c7 63 df 17 93 83 72 0d c6 db 3e 93 ad 3e cf 3e d4 1f 7e 0d 05 75 26 46 a3 ee 3e e7 ed 7e d6 79 7f e9 c3 9c ae 9b 9e d5 b4 4b 04 b9 24 9f e0 f3 26 9c 09 f5 f5 ea 44 f6 ab da fd eb 9a 77 96 9b c2 f0 ed e9 51 fd 9f 95 49 14 f1 10 8a 81 4a 91 e7 5c f5 69 df cb 63 28 fb 97 e3 fc 5b c9 e2 f0 53 ee 8d c3 96 a8 a5 80 45 53 04 36 a2 34 b8 9a c1 4a 79 fb c1 f7 f8 b9 bf a7 bc b6 fb bd 6d Data Ascii: tOWGo.su8ntm-7%6PP&?ek"3y}%u ?G;\T<28\|KGf(Vl.cr>>>~u&F>~yK$&DwQIJ\ic([SES64Jym
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: fa 7b 67 71 1f 53 b5 24 60 f0 3f f3 f7 e5 d6 c5 6e ae 20 5a 7c 24 9f f5 70 ea 06 6e 87 f8 b6 23 25 8d 4f b7 f2 56 50 54 45 11 92 2f b8 82 1a 8f f2 cf b4 fb ba 4f b1 c9 7f be 9b d8 07 dd fd 8d f7 9f 6f e4 b3 8f e3 11 48 47 db a4 d3 f1 2f 98 f5 ea 64 f6 4f 7e 8f 96 fd ca b1 dc a5 3f a6 59 14 f1 c0 62 aa 4e 15 8f 02 78 0a fa 75 07 ab f6 3f 56 6e dd 9f 49 53 99 eb 6d 89 5f 97 a2 aa 9f 17 98 a9 ca 6c ec 0d 75 7d 6d 45 1d 4f d9 d2 d5 d6 55 56 d0 e4 ad 5d f6 3e 1f f8 11 7f 7f 3c 3c e5 ee 0f 35 72 ad fc bb 5c 9b b5 27 56 61 4f 0a 1f c2 c4 71 11 b8 e3 f3 fd bd 76 bb 98 f9 4f 62 b5 dd e5 fa 4e e4 b8 03 4b 7e a0 ca 20 ae 19 bc bf 9d 7a af 9f e6 7f d2 7b 3b 11 b2 fa eb 3d 87 e9 7e bc ac d9 f8 3d c5 9f ab dd 94 58 bd 9b 80 c4 c1 91 cc 0c 09 a3 d9 3f de 1c b5 16 0e e7 Data Ascii: {gqS$`?n Z\|$pn#%OVPTE/OoHG/dO~?YbNxu?VnISm_lu}mEOUV]><<5r\'VaOqvObNK~ z{;=~=X?
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: 8e a7 ed fc fc d8 88 a6 fa c4 3d 9d ae 14 03 d1 d4 54 45 d2 4f 4d 53 f5 b5 54 91 6d 5a 18 b3 74 d8 dc 6e d6 96 9e 61 84 c5 ed ea 7a 3c 25 6c f4 94 94 b4 78 76 fb 25 ac 66 4a bd bf f6 3e 6a 33 f7 16 a5 7f 1c e2 e6 18 3c 3b eb 5d 3d f5 ff 00 5d e1 fa e6 8f 2f 8d c1 55 e6 67 a5 cc e6 ff 00 8c 88 b2 99 03 5c 28 8f f0 ac 46 23 ed 29 be e8 9f f2 10 b8 88 cf fc ac 5e 5f af d0 fb 4f d6 fa d2 13 fe 16 07 24 df e9 07 e1 7e a4 d1 0c 63 e4 84 71 c9 e5 b7 d7 05 f1 8f 9f f6 fe cf b6 cf ec 1b ed e8 a7 75 e0 bf 97 47 07 fe 12 27 ff 00 32 2f e4 cf fd 45 75 37 fe f5 1f 21 3d a2 b8 f8 ff 00 d5 e9 d6 f6 bf c5 d6 e1 be d3 74 69 d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5f ff d6 df e3 df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb Data Ascii: =TEOMSTmZtnaz<%lxv%fJ>j3<;]=]/Ug\(F#)^_O$~cquG'2/Eu7!=tiu~{^u~{_^u~
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: 33 7a 65 06 db c2 57 62 30 f5 98 8c 3f dc 52 c4 d4 9d 83 94 11 43 fe 49 7f e2 79 7a 9a ed aa 32 59 96 c8 d6 99 78 e0 8f cc f3 7b 86 77 3f 65 ae ee 79 9e e2 68 9a 96 42 9e 43 ce 31 eb 38 6f 88 9f f8 ae a6 3d bb dd cb 1b 71 e2 ca 2a f4 1e 67 fc 90 9e 87 2e b4 fe 55 5d 33 45 be fa e3 b4 bb 77 15 43 bd b7 6f 54 d5 b6 4f 61 e1 29 cd 42 ed 5d b5 99 d1 f6 a3 2b 57 4a 1b 1d fd e8 ad a0 fd a9 e9 3f 88 53 1a 6a 43 f8 b0 88 81 5f 20 7b 55 69 b0 df cf bd 5e 8d 51 0a 53 e2 19 c8 f2 95 8f 12 0d 34 ff 00 2a f4 0d e6 ef 76 2f 77 f0 62 b6 05 13 86 74 d6 9f f3 88 7c fc ea 3f 9f 56 cd 4d 08 81 12 34 4f 1a 25 e3 fa fe 07 1f ed af ee 71 b7 b4 74 1a dc e7 cb f9 7c fa 86 a7 ba d6 e1 00 ff 00 57 ec e9 ba a7 0d 8b a8 91 e6 93 13 8b a9 77 ac 35 45 a4 a0 a5 96 63 39 a5 38 6a 9a a3 Data Ascii: 3zeWb0?RCIyz2Yx{w?eyhBC18o=qg.U]3EwCoTOa)B]+WJ?SjC_ {Ui^QS4v/wbt\|?VM4O%qt\|Ww5Ec98j
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: 21 9b 2c 2b f1 0a 50 f1 af 5a d1 7c 9c 7d 5d eb bf f4 fa 3f cb f1 d1 0f 27 f5 fe 01 87 fe bc 7b 91 ec e5 2d 18 07 fd 58 eb 98 9c ed 1b ee 9c e7 bd 43 6b 88 2c ee 1d 69 f2 2c 69 c6 87 cb fa 5c 3e 7d 7d 6c be 71 6e 5c c6 cf f8 b9 da 3b 8f 07 28 8a be 86 8f 6f 84 79 a1 4a 80 61 ac dc f8 5a 2a ba 76 a4 ab 05 6b 29 2b a8 6a 66 1f bd 61 cf fa de ce bd b2 8a 29 f9 b7 6a b3 9f 2c 4c a2 9f 33 1b 90 7e 54 3f 3e a1 2f bc 0e f3 71 c9 7e d5 73 0f 31 44 7b d5 ed 87 97 e2 ba 85 3c d6 4a fc 47 f0 ff 00 9f aa c2 cf 57 e0 68 b0 9b 93 78 ef 5d d5 8f db 19 5e bf c6 63 f7 65 56 e0 8e aa 97 15 5d fc 3f 0f 82 02 b0 d5 e5 a8 ff 00 86 e3 e8 bf bc 34 55 7f 6f f6 f4 ff 00 f2 95 59 17 fc 76 fd 89 c3 9c 2d 6e 76 88 36 d9 15 ab 6c 4c a3 80 19 05 6a 28 49 6e 35 ff 00 27 40 4f 60 7d c0 Data Ascii: !,+PZ\|}]?'{-XCk,i,i\>}}lqn\;(oyJaZ*vk)+jfa)j,L3~T?>/q~s1D{<JGWhx]^ceV]?4UoYv-nv6lLj(In5'@O`}
2024-09-27 22:15:21 UTC	16384	IN	Data Raw: a5 d0 fb 61 cd 28 fb 33 3d b9 a2 3b 57 31 7f 10 ff 00 86 f5 f3 8e f9 2c ce bd e1 bf 11 e3 f1 f8 ea b0 f1 7f d5 45 1e d7 c3 fd df fb cf b8 49 23 86 e2 fe 69 43 71 24 f9 f9 f5 9e cf 06 e2 83 64 46 ff 00 43 04 1f 87 d1 47 5f 67 72 40 6f c7 f9 df f0 fa 7d cf 1f ec 2e 3d 85 ad a4 37 50 b6 b1 eb fe 0f cb a3 1b b2 d1 4c 85 3e df f0 74 98 cf 6d 7c 06 e9 a4 38 ec e6 2e 8f 23 4c 24 f2 c5 1d 4c 6b 51 2c 35 00 7e aa 42 2f f6 55 b8 f0 38 30 1b fb 4c b6 16 f1 c8 5b fc ff 00 e7 e8 de 3b cb b5 8d 48 1e 43 f8 7f cd d1 67 cd 7c 26 e9 fc de 77 1d ba ab 4e e7 87 75 e1 e8 72 f8 6c 2e eb a3 ad c5 8d d5 86 db fb 97 25 86 ac dc 38 0c 56 5b f8 2b 57 d1 e1 37 09 db d4 bf 77 00 3f ee 9f 65 97 d6 10 cd 32 fc b1 fe ac f4 76 db e4 ec 35 54 57 ec ff 00 63 d7 a1 df 62 f5 76 c7 eb d8 da Data Ascii: a(3=;W1,EI#iCq$dFCG_gr@o}.=7PL>tm\|8.#L$LkQ,5~B/U80L[;HCg\|&wNurl.%8V[+W7w?e2v5TWcbv
2024-09-27 22:15:21 UTC	1214	IN	Data Raw: 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7f ff d6 df e3 df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd Data Ascii: u~{^u~{^u~{^u~{^u~{^u~{^u~^u~{^u~{^u~{^u~{^u~{^u~{^u~{^u~{^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	49752	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:22 UTC	440	OUT	GET /static/images/session2left.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:24 UTC	372	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:23 GMT Content-Type: image/jpeg Content-Length: 148298 Last-Modified: Wed, 06 Mar 2024 15:31:14 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c42-2434a" Expires: Sun, 27 Oct 2024 22:15:23 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:24 UTC	16012	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 02 01 00 48 00 48 00 00 ff e1 15 8a 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 14 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 86 87 69 00 04 00 00 00 01 00 00 00 9c 00 00 00 c8 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 37 2e 30 00 32 30 32 33 3a 30 35 3a 32 36 20 30 37 3a 32 34 3a 32 30 00 00 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 01 fe a0 03 00 04 00 00 00 01 00 00 02 14 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 1a 00 05 00 00 00 01 00 00 01 Data Ascii: JFIFHHExifMM*bj(1r2iHHAdobe Photoshop 7.02023:05:26 07:24:20
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii:
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: 61 1e e8 9c 90 38 d3 fd 5f f3 93 a6 1b 9a cf 91 ff 00 57 fb c7 5d ff 00 c3 71 f4 6b 7e bd d5 db 1f f9 fd d9 bf f1 1d 72 39 f6 a1 39 20 52 a3 fd 5f f5 53 a6 4f 33 93 51 5c 7f ab fa 1d 72 ff 00 86 e2 e8 d6 64 be e7 ed 4f 5f 31 1f e3 3b 3b f7 79 ff 00 c3 1f de 9b 90 a0 83 35 cf e7 ff 00 5b 3a 4d 07 38 cd 21 a5 32 7e cf fa 03 a9 f0 ff 00 2c 7e a6 a8 18 7f 05 77 75 cd fd e0 fb 89 70 32 53 d5 ed 79 bf 8c 53 d1 d5 7d 9d 5d 56 27 fd f8 ff 00 e5 a7 1d 5d 49 2d 3f f9 37 fc 71 97 fe 52 3d a6 3c ab 0a 50 6a c7 e7 ff 00 41 f4 a1 f9 92 e1 e9 55 ff 00 07 fd 03 d4 fa 7f e5 67 d6 f5 90 e3 ea 28 ff 00 d3 e5 6d 3e 53 33 fc 07 17 51 4f fc 06 78 32 3b 82 e7 ee f0 38 9a bf f4 72 7e fa bb 1d ff 00 29 74 f4 df f5 23 de e6 e5 1b 4d 5f 17 fc 7b fe 83 ea c9 cc d7 7d d5 5f f8 ef fd Data Ascii: a8_W]qk~r99 R_SO3Q\rdO_1;;y5[:M8!2~,~wup2SyS}]V']I-?7qR=<PjAUg(m>S3QOx2;8r~)t#M_{}_
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: a1 ef 74 f7 4f 57 47 d9 fb 6f 2e 73 94 75 38 6e bf 9b 74 6d 2d db 9b c7 e7 8c d8 9d ab ba 37 25 36 db ad da 9f de 1a 50 7f 87 d7 50 e3 8e 26 ae 9f ee 3f ca bf 80 65 6b 22 ff 00 33 e6 9f c2 1f db 79 7f 7d 8f 93 25 b7 75 a1 20 9f f4 3f f7 e5 47 e2 f4 f9 f5 15 1d 9c cb 3b 5c b8 ef fd 9e 54 3c 0f f9 32 38 f9 92 0f 7c ae f9 4b 47 d6 fb ff 00 ac e1 c6 66 28 f7 56 cd c8 6c 0d ff 00 2e f2 c7 63 df 17 93 83 72 0d c6 db 3e 93 ad 3e cf 3e d4 1f 7e 0d 05 75 26 46 a3 ee 3e e7 ed 7e d6 79 7f e9 c3 9c ae 9b 9e d5 b4 4b 04 b9 24 9f e0 f3 26 9c 09 f5 f5 ea 44 f6 ab da fd eb 9a 77 96 9b c2 f0 ed e9 51 fd 9f 95 49 14 f1 10 8a 81 4a 91 e7 5c f5 69 df cb 63 28 fb 97 e3 fc 5b c9 e2 f0 53 ee 8d c3 96 a8 a5 80 45 53 04 36 a2 34 b8 9a c1 4a 79 fb c1 f7 f8 b9 bf a7 bc b6 fb bd 6d Data Ascii: tOWGo.su8ntm-7%6PP&?ek"3y}%u ?G;\T<28\|KGf(Vl.cr>>>~u&F>~yK$&DwQIJ\ic([SES64Jym
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: fa 7b 67 71 1f 53 b5 24 60 f0 3f f3 f7 e5 d6 c5 6e ae 20 5a 7c 24 9f f5 70 ea 06 6e 87 f8 b6 23 25 8d 4f b7 f2 56 50 54 45 11 92 2f b8 82 1a 8f f2 cf b4 fb ba 4f b1 c9 7f be 9b d8 07 dd fd 8d f7 9f 6f e4 b3 8f e3 11 48 47 db a4 d3 f1 2f 98 f5 ea 64 f6 4f 7e 8f 96 fd ca b1 dc a5 3f a6 59 14 f1 c0 62 aa 4e 15 8f 02 78 0a fa 75 07 ab f6 3f 56 6e dd 9f 49 53 99 eb 6d 89 5f 97 a2 aa 9f 17 98 a9 ca 6c ec 0d 75 7d 6d 45 1d 4f d9 d2 d5 d6 55 56 d0 e4 ad 5d f6 3e 1f f8 11 7f 7f 3c 3c e5 ee 0f 35 72 ad fc bb 5c 9b b5 27 56 61 4f 0a 1f c2 c4 71 11 b8 e3 f3 fd bd 76 bb 98 f9 4f 62 b5 dd e5 fa 4e e4 b8 03 4b 7e a0 ca 20 ae 19 bc bf 9d 7a af 9f e6 7f d2 7b 3b 11 b2 fa eb 3d 87 e9 7e bc ac d9 f8 3d c5 9f ab dd 94 58 bd 9b 80 c4 c1 91 cc 0c 09 a3 d9 3f de 1c b5 16 0e e7 Data Ascii: {gqS$`?n Z\|$pn#%OVPTE/OoHG/dO~?YbNxu?VnISm_lu}mEOUV]><<5r\'VaOqvObNK~ z{;=~=X?
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: 8e a7 ed fc fc d8 88 a6 fa c4 3d 9d ae 14 03 d1 d4 54 45 d2 4f 4d 53 f5 b5 54 91 6d 5a 18 b3 74 d8 dc 6e d6 96 9e 61 84 c5 ed ea 7a 3c 25 6c f4 94 94 b4 78 76 fb 25 ac 66 4a bd bf f6 3e 6a 33 f7 16 a5 7f 1c e2 e6 18 3c 3b eb 5d 3d f5 ff 00 5d e1 fa e6 8f 2f 8d c1 55 e6 67 a5 cc e6 ff 00 8c 88 b2 99 03 5c 28 8f f0 ac 46 23 ed 29 be e8 9f f2 10 b8 88 cf fc ac 5e 5f af d0 fb 4f d6 fa d2 13 fe 16 07 24 df e9 07 e1 7e a4 d1 0c 63 e4 84 71 c9 e5 b7 d7 05 f1 8f 9f f6 fe cf b6 cf ec 1b ed e8 a7 75 e0 bf 97 47 07 fe 12 27 ff 00 32 2f e4 cf fd 45 75 37 fe f5 1f 21 3d a2 b8 f8 ff 00 d5 e9 d6 f6 bf c5 d6 e1 be d3 74 69 d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5f ff d6 df e3 df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb Data Ascii: =TEOMSTmZtnaz<%lxv%fJ>j3<;]=]/Ug\(F#)^_O$~cquG'2/Eu7!=tiu~{^u~{_^u~
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: 33 7a 65 06 db c2 57 62 30 f5 98 8c 3f dc 52 c4 d4 9d 83 94 11 43 fe 49 7f e2 79 7a 9a ed aa 32 59 96 c8 d6 99 78 e0 8f cc f3 7b 86 77 3f 65 ae ee 79 9e e2 68 9a 96 42 9e 43 ce 31 eb 38 6f 88 9f f8 ae a6 3d bb dd cb 1b 71 e2 ca 2a f4 1e 67 fc 90 9e 87 2e b4 fe 55 5d 33 45 be fa e3 b4 bb 77 15 43 bd b7 6f 54 d5 b6 4f 61 e1 29 cd 42 ed 5d b5 99 d1 f6 a3 2b 57 4a 1b 1d fd e8 ad a0 fd a9 e9 3f 88 53 1a 6a 43 f8 b0 88 81 5f 20 7b 55 69 b0 df cf bd 5e 8d 51 0a 53 e2 19 c8 f2 95 8f 12 0d 34 ff 00 2a f4 0d e6 ef 76 2f 77 f0 62 b6 05 13 86 74 d6 9f f3 88 7c fc ea 3f 9f 56 cd 4d 08 81 12 34 4f 1a 25 e3 fa fe 07 1f ed af ee 71 b7 b4 74 1a dc e7 cb f9 7c fa 86 a7 ba d6 e1 00 ff 00 57 ec e9 ba a7 0d 8b a8 91 e6 93 13 8b a9 77 ac 35 45 a4 a0 a5 96 63 39 a5 38 6a 9a a3 Data Ascii: 3zeWb0?RCIyz2Yx{w?eyhBC18o=qg.U]3EwCoTOa)B]+WJ?SjC_ {Ui^QS4v/wbt\|?VM4O%qt\|Ww5Ec98j
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: 21 9b 2c 2b f1 0a 50 f1 af 5a d1 7c 9c 7d 5d eb bf f4 fa 3f cb f1 d1 0f 27 f5 fe 01 87 fe bc 7b 91 ec e5 2d 18 07 fd 58 eb 98 9c ed 1b ee 9c e7 bd 43 6b 88 2c ee 1d 69 f2 2c 69 c6 87 cb fa 5c 3e 7d 7d 6c be 71 6e 5c c6 cf f8 b9 da 3b 8f 07 28 8a be 86 8f 6f 84 79 a1 4a 80 61 ac dc f8 5a 2a ba 76 a4 ab 05 6b 29 2b a8 6a 66 1f bd 61 cf fa de ce bd b2 8a 29 f9 b7 6a b3 9f 2c 4c a2 9f 33 1b 90 7e 54 3f 3e a1 2f bc 0e f3 71 c9 7e d5 73 0f 31 44 7b d5 ed 87 97 e2 ba 85 3c d6 4a fc 47 f0 ff 00 9f aa c2 cf 57 e0 68 b0 9b 93 78 ef 5d d5 8f db 19 5e bf c6 63 f7 65 56 e0 8e aa 97 15 5d fc 3f 0f 82 02 b0 d5 e5 a8 ff 00 86 e3 e8 bf bc 34 55 7f 6f f6 f4 ff 00 f2 95 59 17 fc 76 fd 89 c3 9c 2d 6e 76 88 36 d9 15 ab 6c 4c a3 80 19 05 6a 28 49 6e 35 ff 00 27 40 4f 60 7d c0 Data Ascii: !,+PZ\|}]?'{-XCk,i,i\>}}lqn\;(oyJaZ*vk)+jfa)j,L3~T?>/q~s1D{<JGWhx]^ceV]?4UoYv-nv6lLj(In5'@O`}
2024-09-27 22:15:24 UTC	16384	IN	Data Raw: a5 d0 fb 61 cd 28 fb 33 3d b9 a2 3b 57 31 7f 10 ff 00 86 f5 f3 8e f9 2c ce bd e1 bf 11 e3 f1 f8 ea b0 f1 7f d5 45 1e d7 c3 fd df fb cf b8 49 23 86 e2 fe 69 43 71 24 f9 f9 f5 9e cf 06 e2 83 64 46 ff 00 43 04 1f 87 d1 47 5f 67 72 40 6f c7 f9 df f0 fa 7d cf 1f ec 2e 3d 85 ad a4 37 50 b6 b1 eb fe 0f cb a3 1b b2 d1 4c 85 3e df f0 74 98 cf 6d 7c 06 e9 a4 38 ec e6 2e 8f 23 4c 24 f2 c5 1d 4c 6b 51 2c 35 00 7e aa 42 2f f6 55 b8 f0 38 30 1b fb 4c b6 16 f1 c8 5b fc ff 00 e7 e8 de 3b cb b5 8d 48 1e 43 f8 7f cd d1 67 cd 7c 26 e9 fc de 77 1d ba ab 4e e7 87 75 e1 e8 72 f8 6c 2e eb a3 ad c5 8d d5 86 db fb 97 25 86 ac dc 38 0c 56 5b f8 2b 57 d1 e1 37 09 db d4 bf 77 00 3f ee 9f 65 97 d6 10 cd 32 fc b1 fe ac f4 76 db e4 ec 35 54 57 ec ff 00 63 d7 a1 df 62 f5 76 c7 eb d8 da Data Ascii: a(3=;W1,EI#iCq$dFCG_gr@o}.=7PL>tm\|8.#L$LkQ,5~B/U80L[;HCg\|&wNurl.%8V[+W7w?e2v5TWcbv
2024-09-27 22:15:24 UTC	1214	IN	Data Raw: 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7f ff d6 df e3 df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd d7 bd fb af 75 ef 7e eb dd 7b df ba f7 5e f7 ee bd Data Ascii: u~{^u~{^u~{^u~{^u~{^u~{^u~^u~{^u~{^u~{^u~{^u~{^u~{^u~{^u~{^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	49751	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:23 UTC	680	OUT	GET /static/images/session2right.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:26 UTC	370	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:24 GMT Content-Type: image/jpeg Content-Length: 31305 Last-Modified: Wed, 06 Mar 2024 15:31:14 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c42-7a49" Expires: Sun, 27 Oct 2024 22:15:24 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:26 UTC	16014	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 40 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 02 a0 02 00 04 00 00 00 01 00 00 01 ba a0 03 00 04 00 00 00 01 00 00 01 0e 00 00 00 00 ff ed 00 38 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 00 38 42 49 4d 04 25 00 00 00 00 00 10 d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e ff c0 00 11 08 01 0e 01 ba 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 Data Ascii: JFIFHH@ExifMM*i8Photoshop 3.08BIM8BIM%B~"}!1AQa"q2#BR$3br
2024-09-27 22:15:26 UTC	15291	IN	Data Raw: 77 7e 6f be e7 88 dc eb 1f 14 bc 30 ad 27 8d bc 09 73 25 ac 50 f9 f3 5f 78 7a e1 35 28 a3 4e fb e1 71 14 d9 5c 64 aa 09 0e 3a 66 b0 fc 41 f1 97 4c b3 f0 cc da ff 00 82 34 9b ff 00 1b 5c da 4f 14 77 7a 3e 94 a2 3d 52 da 29 32 5a 49 2d 6e 3c b9 54 20 fe 12 a0 9c 8c 71 cd 7e 85 5d 1b 54 8f f7 e0 00 78 18 1f 37 e1 5f 31 7c 45 f8 3f f0 db e2 86 b6 fa 8a 5e 1d 2f c6 1a 7a af 91 ab e9 17 4b 1e a7 6b b3 ee 79 8a ac 77 20 ee b2 2e 08 e3 a5 55 1c 6c 6b a7 19 fb bd 9a d7 f0 ff 00 87 f4 3c 49 52 a7 34 e5 4d 72 fe 5f 8f f9 9f 9d 69 e2 27 f8 b3 e2 bb 3f 14 69 8b 71 1d ce bd ae c3 6d a2 9b 85 68 ae ec 2d 2d 24 5d e4 21 39 84 a4 70 cb 24 80 75 62 43 67 a5 7e 80 ea 64 7f 67 de 11 c0 30 4d ff 00 a0 1a f9 27 e1 2f c2 1f 12 f8 1f e3 36 a3 a6 78 cb 52 59 a5 f0 76 98 13 4b 10 Data Ascii: w~o0's%P_xz5(Nq\d:fAL4\Owz>=R)2ZI-n<T q~]Tx7_1\|E?^/zKkyw .Ulk<IR4Mr_i'?iqmh--$]!9p$ubCg~dg0M'/6xRYvK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49753	90.84.161.25	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:27 UTC	587	OUT	POST /v6/collect?dt=4 HTTP/1.1 Host: collect-v6.51.la Connection: keep-alive Content-Length: 407 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Origin: https://www.telegramrm.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:27 UTC	407	OUT	Data Raw: 1f 8b 08 00 7d 2e f7 66 00 03 75 52 4b 4b 02 51 14 fe 2b 32 cb f0 aa f7 ce db ad 04 11 b4 2a a1 ad f3 32 71 1e 32 0f 87 88 20 08 29 d3 08 29 a4 85 b4 89 76 15 b5 28 44 f2 df 34 33 b5 ea 2f e4 99 87 4c 59 bb 73 be fb 9d ef 9c ef 9e 73 40 b5 14 aa 5a a0 e8 4d ab b6 af b7 6b 6e 7d 7d a3 6e 6e ed 52 c5 02 65 bb 8b 17 cc 13 9e e1 59 9a b0 84 c6 0b d0 05 90 da 51 75 b5 69 37 8c e0 f1 3a 9a 8f 50 96 be 4f 1f c2 f1 49 f8 dc 0f 86 e3 a8 7f 9a c3 07 1f f3 39 8a 66 d3 cf db 9b 70 32 4b 78 c0 c8 41 40 81 b6 6d 1f 3a b8 69 69 31 0b 92 56 cb 34 69 b2 4c 97 8a 39 04 04 73 e5 fd e0 fc 72 95 56 68 59 ce 5f c5 29 62 34 e4 62 74 f5 12 9e dd a5 7a ab 1e f2 d0 4f 4a 32 32 78 52 1c f0 14 4e 8e c2 f1 53 70 31 0a a6 c7 ff 7c d9 d7 db 30 e8 bd 2e c0 60 d8 0b 07 f7 d9 3c a0 e1 24 Data Ascii: }.fuRKKQ+2*2q2 ))v(D43/LYss@ZMkn}}nnReYQui7:POI9fp2KxA@m:ii1V4iL9srVhY_)b4btzOJ22xRNSp1\|0.`<$
2024-09-27 22:15:27 UTC	412	IN	HTTP/1.1 200 Date: Fri, 27 Sep 2024 22:15:27 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Access-Control-Allow-Origin: https://www.telegramrm.com Access-Control-Allow-Credentials: true via: EU-GER-frankfurt-EDGE5-CACHE4[309],EU-GER-frankfurt-EDGE5-CACHE4[ovl,308] X-CCDN-REQ-ID-46B1: e1aa46c3d2f0862179a590647611e82e

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49755	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:27 UTC	677	OUT	GET /static/images/section4i9.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4
2024-09-27 22:15:27 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:27 GMT Content-Type: image/gif Content-Length: 3145277 Last-Modified: Wed, 06 Mar 2024 15:31:13 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c41-2ffe3d" Expires: Sun, 27 Oct 2024 22:15:27 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:27 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 5b 25 02 00 00 00 7a 92 96 f4 22 6e b5 c3 c2 fe d8 21 98 3c 01 fa 6f 16 ff ff ff 5b 24 00 b6 4d 0a ff a4 00 b2 20 01 5a 24 01 fb 6e 15 f4 6b 15 5b 25 01 f9 6e 15 dc 60 11 b5 c2 c2 ea 67 13 d3 5c 10 5a 22 00 f6 6d 15 f4 21 6d b4 c4 c2 c8 55 0c 5b 23 00 e2 62 11 64 28 01 aa 49 0b ed 68 13 bc 52 0e d7 5e 10 60 26 01 d0 59 0e 7a 91 95 7d 34 05 67 2a 02 e8 66 12 c0 53 0d 5b 24 02 81 36 05 e0 62 11 b9 c6 c5 f8 6d 15 9e 3f 01 6d 2c 03 f0 6a 14 ad 4b 0b 78 32 04 62 27 01 6a 2c 03 95 3f 08 b0 4c 0b f2 6b 14 ba 50 0b cc 59 0f ca 57 0d a0 44 0a 8c 3b 07 6f 2e 04 75 30 04 fc 6f 15 ee 68 13 e6 65 12 89 Data Ascii: GIF89a!NETSCAPE2.0!,[%z"n!<o[$M Z$nk[%n`g\Z"m!mU[#bd(IhR^`&Yz}4g*fS[$6bm?m,jKx2b'j,?LkPYWD;o.u0ohe
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 02 40 33 80 27 ff c7 0a 44 a1 41 5f 55 68 38 b3 15 f3 44 0f a4 9e 13 50 ac 4e c0 51 a4 54 17 05 48 40 08 ec f4 4e 67 97 06 fc f4 4f ff 23 50 03 f5 08 f0 f4 0a e0 f4 da 8a 34 01 81 73 1d 13 82 03 3a 06 4c 0a d1 4a 2f d4 4e b8 f4 42 eb 44 11 4c db 01 84 40 8a ee 04 12 29 35 58 9b 1d 1d 73 f2 25 0c 4a 19 70 49 09 93 e7 54 8f 93 59 28 b4 42 7b f5 4a 9c c0 66 72 5e 58 b7 0e 07 8c c0 11 24 81 5e ef b5 5e e3 d3 13 08 97 48 3f 80 d2 72 72 29 44 8a 04 94 80 83 24 40 8b de ed 5a 0f d1 4e 04 72 42 6f c0 f1 02 c0 fd 4d c4 0d 88 ff 28 00 c8 40 48 d7 f5 50 00 81 0e 24 81 01 84 b6 68 8f 36 69 87 36 1f a8 c1 08 7c a6 e4 9a ef 2f 97 75 98 20 81 5b 57 8e e7 36 b6 24 91 85 14 26 74 03 04 32 b3 a4 57 05 ec 40 13 f0 40 a8 71 f6 88 70 00 68 97 b6 71 1f 77 68 5b c1 11 a8 b6 aa Data Ascii: @3'DA_Uh8DPNQTH@NgO#P4s:LJ/NBDL@)5Xs%JpITY(B{Jfr^X$^^H?rr)D$@ZNrBoM(@HP$h6i6\|/u [W6$&t2W@@qphqwh[
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 65 20 49 81 13 62 09 c8 82 2b 6e 60 39 25 4c 31 53 82 cc 82 85 34 73 86 74 42 32 81 e5 93 68 b9 23 c3 75 c8 61 f9 dc c6 00 43 6f 13 23 29 71 42 4e 8c cc dc 4e 8b 82 19 71 26 57 0a 6b 13 b9 7e 64 7a 18 49 6f a4 23 5d 0c 94 dc d9 23 6f 1a d5 a6 31 19 62 7a 25 40 d0 08 89 67 45 dd 80 2f a3 82 e5 9e a5 5b 8b 81 dc 12 05 b0 58 41 d6 cf ce 44 86 4d e2 89 8f f4 d7 21 ba c6 a4 62 c5 1a 6a 84 8c 17 99 08 c6 57 0a ea 87 91 8d 16 75 2d c1 75 8b b5 1f 12 eb 67 43 9a d6 27 c1 aa 47 b4 9b 69 6c b7 91 d7 64 9d c8 6d e5 59 de 82 9d d7 26 44 75 cb 7a ff cb e2 87 b7 f4 98 20 ce 6e b7 ac 31 8c 92 97 ee d8 e0 02 a9 77 1b fd cc a8 85 d4 51 9e a5 c6 97 e9 60 5c 99 d6 62 e4 2c 6e 99 00 58 d8 9d f0 39 e7 97 24 a6 f8 08 97 e9 1d f1 1f 2a a2 d3 4e 51 ad 7d cf 2a cf c8 16 6c 64 36 Data Ascii: e Ib+n`9%L1S4stB2h#uaCo#)qBNNq&Wk~dzIo#]#o1bz%@gE/[XADM!bjWu-ugC'GildmY&Duz n1wQ`\b,nX9$NQ}ld6
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: bd 4e 48 a2 77 8d ec a2 cd 13 d6 00 13 b6 b3 39 fd 80 5e 23 97 cf c9 ae f6 05 c3 ab df 90 3c 7b db e8 dd 33 c0 f4 8b 68 6b 8b 9b a2 65 2c e3 03 4c 36 2c 6e 3b 3b b6 c4 66 f7 a7 2f 2a ae 72 8f 7b de 17 1e d6 aa 3f 74 51 5f 67 3a d0 c4 b6 f5 45 01 86 b4 7c 0b 7c e0 04 2f b8 c1 f3 1d de 8b 26 29 04 e8 ae 60 bc e9 ad b8 80 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fa 6f 16 7a 92 96 f4 22 6e 00 00 00 b5 c3 c2 fe d8 21 98 3c 01 5b 25 02 5b 24 01 ff ff ff b6 4d 0a ff a4 00 b2 20 01 5a 24 01 b5 c3 c2 be be be fa 6f 15 d3 5c 10 5b 25 00 c8 55 0c e8 65 12 ea 67 13 f5 6b 15 59 22 00 f9 6e 15 61 27 02 68 2a 02 78 32 04 f3 6b 14 5e 27 03 6d 2d 03 f0 6a 14 f7 6d 15 fa 6e 15 e2 62 11 bf 52 0d 64 28 01 9e 3f 01 5c 25 01 8e 3c 07 cb 59 0f 96 3f 08 5b 22 Data Ascii: NHw9^#<{3hke,L6,n;;f/r{?tQ_g:E\|\|/&)`!,oz"n!<[%[$M Z$o\[%UegkY"na'hx2k^'m-jmnbRd(?\%<Y?["
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: b6 b0 43 6d e3 d1 41 60 32 4b 57 b7 c6 5c f7 40 08 d0 60 68 01 77 8f 37 5f 6b 41 b6 4d 00 7f 07 78 09 20 29 a1 94 b6 fe 9e f6 50 14 f6 ac 04 43 6d 63 1a 0c 24 f0 01 d0 b7 c6 80 45 42 e7 6a 7a 1e 77 5c 1c 01 1f 04 b8 5e e3 01 78 4b 8b 05 ec 37 4e ff 41 12 24 01 0d 00 d5 04 d0 40 89 07 78 17 f0 0a 48 33 ed 72 0f 46 6a 33 4a 33 98 40 6d bb 33 00 b4 72 12 4b b8 bc d4 b1 39 0f 04 71 c5 ff 05 05 cc 33 87 ef 75 09 60 38 c8 00 b8 55 27 c1 04 34 34 46 50 c0 11 4c 00 91 f7 76 1d 7c f8 82 f4 01 23 0f b6 60 18 02 a3 c0 c2 75 67 37 00 40 f2 d4 f2 78 b3 20 76 38 2f 34 1f 63 84 16 14 f9 70 13 f8 b8 6c 38 4e 03 02 92 17 06 10 e0 41 6f f3 81 93 6b 48 60 ff 34 6d 24 83 12 64 c3 75 df da ac 5d 1e 99 cf 8e 99 0f 04 ed de 84 78 b3 39 68 97 40 9e 57 ca 11 e4 34 0d 58 39 00 bc Data Ascii: CmA`2KW\@`hw7_kAMx )PCmc$EBjzw\^xK7NA$@xH3rFj3J3@m3rK9q3u`8U'44FPLv\|#`ug7@x v8/4cpl8NAokH`4m$du]x9h@W4X9
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 93 04 51 42 57 3c 9b 74 8d 74 e3 29 73 0b dd f5 09 c7 92 03 48 9e d6 ba bd 3a 2b 4a 33 eb 79 3f 84 b0 9b cf f0 80 79 2b 88 c0 f3 1b aa a0 b2 f6 7b 08 68 b3 80 1d 58 bd 5c 3a bb 73 32 a6 27 d1 3f b2 c9 be 82 c0 a0 03 70 36 86 08 37 41 f2 37 10 da ac 83 78 b1 cf 18 bf 82 68 9c c6 58 09 f6 83 40 86 d0 21 82 28 01 92 22 28 5a 78 b7 8b d0 b0 87 30 2f c4 da c0 a2 c9 be ed 2b 88 b8 79 88 9c 13 24 b6 22 a2 16 58 89 10 24 8b 1e 24 08 a0 3b 38 84 48 38 08 14 88 83 58 82 27 90 15 82 92 a9 8d b0 3f 5e 49 31 4f fb c1 a2 11 42 84 28 3f 62 8b a6 df 23 a2 c9 3a 00 ff 69 6b 0c 92 3b 08 e3 6a 0c f5 22 08 17 d0 bc 18 7c 88 6c 43 08 0e 60 43 33 ba c0 8d 20 03 a8 38 c1 da 0b c3 82 89 00 83 90 3c c9 83 42 11 ec b7 5c 52 aa 83 b0 9c e1 08 44 82 60 c0 c6 20 b8 03 78 40 3b 74 08 Data Ascii: QBW<tt)sH:+J3y?y+{hX\:s2'?p67A7xhX@!("(Zx0/+y$"X$$;8H8X'?^I1OB(?b#:ik;j"\|lC`C3 8<B\RD` x@;t
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: b2 d3 d3 c8 a3 4b 9f 2e f1 77 d3 09 ac 59 4a 0d 4b bd bb f7 ef 03 9d 3b ff e5 2a 5e 2a 73 f0 e8 d3 bb b6 be b8 27 50 f6 8b d5 cb 9f ef 59 35 d3 ec 41 db 3f c7 4f bf bf ff b8 5b 88 97 d3 51 dc fd 67 e0 81 6b 3d c5 1f 51 9b 20 86 e0 83 10 0e 55 de 79 46 59 37 60 84 18 66 c8 52 79 1f a9 f1 cf 03 ff 3c e3 91 7d 7d 69 68 e2 89 21 d9 e7 de 45 0f 00 d0 62 8b 00 c4 28 a3 8b 2d 3a a0 91 75 d0 a1 a8 e3 8e 13 e1 c8 22 8c 33 06 29 e4 8c 21 5a 64 df 16 99 f1 a8 e4 92 0b 09 68 91 03 40 0e 29 e5 90 20 56 24 de 82 4c 66 a9 24 6e 13 89 18 e5 94 60 4a e9 e1 44 e2 e5 a8 e5 99 26 82 45 d1 97 61 b6 39 24 45 5f a1 29 e7 89 26 a8 46 21 43 50 ba a9 e7 94 55 46 a4 94 53 77 ce 29 68 7f 71 4a c4 e6 9e 88 ca d8 e7 43 ec 0d ea e8 4c f6 fc 63 84 00 36 54 6a 84 11 95 da 20 00 a6 45 15 Data Ascii: K.wYJK;^s'PY5A?O[Qgk=Q UyFY7`fRy<}}ih!Eb(-:u"3)!Zdh@) V$Lf$n`JD&Ea9$E_)&F!CPUFSw)hqJCLc6Tj E
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 0b f1 40 04 b1 3c a6 20 80 ec 2c d5 e2 4b 11 00 08 d2 aa 8d 8d 17 2a 5b ff 6d 0e 37 ea 23 ab 0b 72 34 1c 2a 05 14 a9 d2 c4 bf b7 58 88 2f 84 01 31 4a 46 2c 4c 20 7a 42 c1 90 96 83 d0 c9 27 a1 8c 6e 42 8b 74 12 c9 07 1e 07 ca 51 28 27 a8 ea c3 8f 10 c1 5c c0 0f 12 4d dc 4e c5 33 25 cb f1 45 2c bb 52 84 be 1a c3 62 24 1d 2d 0d 28 ca aa 42 7e 6c 28 3e 15 88 c4 68 12 b1 5c 81 e8 04 19 96 6c 32 ca 43 11 4d 94 26 bb 7a 82 e8 28 2d 05 6a ea 0a f0 c2 04 d3 33 88 30 68 51 ad 18 cf 8c af bd 1c df 23 6d 0e 42 e0 14 8b 9e 1c e9 78 a0 ab 53 f2 5c 08 9d f8 b2 e8 f3 22 5e c6 92 05 a2 1d 96 3c 40 d1 5d 79 ed d5 24 09 33 1a 69 05 88 4c d3 12 3e a6 12 a9 b4 d2 11 09 d2 61 80 da b8 eb f4 cc 47 e9 7c 61 35 3b 4a 0d eb 54 ed 8a 52 d5 2a 56 5b 4d 48 ae f5 44 90 d5 22 1f c6 f2 Data Ascii: @< ,K[m7#r4X/1JF,L zB'nBtQ('\MN3%E,Rb$-(B~l(>h\l2CM&z(-j30hQ#mBxS\"^<@]y$3iL>aG\|a5;JTR*V[MHD"
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 74 da d3 2d 5c bc dc 42 c3 b4 8b 23 10 02 13 30 06 c7 b5 dd 3c a0 03 63 30 01 1d a0 50 59 15 02 da bd dd ee f5 5e 05 c8 03 12 88 51 d7 81 cd a5 58 dd bb 40 57 73 9b 89 86 4b 4c a4 70 56 82 98 38 e4 bd 88 7a f5 b3 23 84 b0 47 e0 de ef 9d dc 3c 78 84 4a 75 d2 1a c8 5f fd 8d dc 30 08 83 07 30 e0 30 f0 de 47 18 df a3 19 4c 07 33 8d a1 e5 89 19 eb 55 05 7d 8a 5c 33 5d f9 d5 88 0b 48 5d f8 bd 8b 23 78 84 3c 10 60 fd a5 83 ec fd cf 23 90 de 10 1e 60 03 56 e1 03 ee de 3c 00 5d 94 c9 c1 d4 b8 52 c4 e8 57 83 50 b8 12 f5 d5 a7 88 45 82 50 58 0c a6 88 80 2c 08 71 45 0a 0f 46 e1 01 f6 de 11 ce 50 16 00 e1 22 86 dc 15 76 62 16 be dd 62 80 dd 50 89 cb 29 b3 0d 14 ed 89 ca 6a 85 94 f8 55 0a ec 89 1e f6 e1 88 40 80 a8 f9 c2 7f bd c9 ff 25 46 e1 02 5e 61 02 be 5d 63 d8 dd Data Ascii: t-\B#0<c0PY^QX@WsKLpV8z#G<xJu_000GL3U}\3]H]#x<`#`V<]RWPEPX,qEFP"vbbP)jU@%F^a]c
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: fc ac ab 11 67 24 cd b7 9f 84 48 6f 59 c2 59 84 09 2d bc 44 a1 9e ba 92 cb 4a 41 d2 d4 b1 f3 6a 6f b8 de 0b df a2 14 56 76 30 e9 6e 43 56 b1 dc 94 75 eb b9 2e e9 5d 7f 4d d8 38 f2 86 24 3b 76 6a e1 76 1b ab d7 95 98 b1 6a 0b d6 0a 06 0b 25 14 af 45 58 81 25 15 6e 50 40 05 bd 0c b7 c5 5c a4 72 30 72 11 2c b1 f4 75 48 99 2c 26 0a 89 37 05 5e 13 2f a8 4b e8 a5 1c 04 80 eb 56 fa da 58 ba be a9 9d f1 00 67 a4 89 38 e9 c7 48 16 c8 91 21 12 24 a6 4d 98 20 02 4e 32 92 bd 0a 37 81 41 c0 4a 88 ad ad 94 a7 4c a9 8a 10 b8 c0 22 ba 08 8e b7 fc e3 31 c3 e8 4e 46 7a f2 f2 a8 4c 66 f8 fa 95 ff 29 73 e4 d0 87 d2 ec a6 b6 ce 56 cc 6c 6e 73 7f bb 12 67 aa c4 49 cf 5b b6 cd 7a 62 09 14 df b0 0b d0 48 16 b4 8f 5f f2 e6 bf 22 ba cd 30 54 dd 43 62 f0 0f 4a 53 da 01 ff 98 80 86 Data Ascii: g$HoYY-DJAjoVv0nCVu.]M8$;vjvj%EX%nP@\r0r,uH,&7^/KVXg8H!$M N27AJL"1NFzLf)sVlnsgI[zbH_"0TCbJS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49754	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:27 UTC	1041	OUT	GET /static/images/section4i8.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
2024-09-27 22:15:27 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:27 GMT Content-Type: image/gif Content-Length: 2700330 Last-Modified: Wed, 06 Mar 2024 15:31:11 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c3f-29342a" Expires: Sun, 27 Oct 2024 22:15:27 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:27 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 f6 ce b8 fc ee 21 cf 35 02 ff ff ff 00 00 00 dc 60 0a fa e6 db ff d5 27 fa 90 16 af 88 72 7d 09 09 ff 5d 1f af 88 71 fb 90 14 fb 8f 15 af 88 72 fc a8 1b ff d5 26 ae 87 71 fd bb 20 fa 94 16 af 87 71 ff cd 24 fe c5 22 ff d1 25 f9 90 15 fd b2 1d ff b4 84 f9 8f 15 db 60 0a ff d8 26 fd b6 1e fb 91 16 fe de 24 b3 8c 76 fa e3 d6 c0 99 82 f3 ca b4 f5 cd b6 ff c9 23 fc ec 20 fe e2 23 fc 9d 18 ff d3 26 de 60 09 fa 9a 17 fb a5 1a d7 b0 9a fe bf 21 fb a2 19 e5 bd a7 fa df d0 c9 a2 8c dc b4 9e ed c5 af bc 95 7f ea c2 ac fa 98 17 c4 9d 87 fc ab 1c fd e7 22 d3 ab 95 fc ae 1d b8 91 7b fa 95 17 f6 c8 ac 10 Data Ascii: GIF89a!NETSCAPE2.0!,!5`'r}]qr&q q$"%`&$v# #&`!"{
2024-09-27 22:15:27 UTC	16384	IN	Data Raw: 20 d4 f8 00 24 87 d5 f8 42 68 43 57 1e 47 b7 a2 8e c4 40 3d 1f 91 05 38 b4 ec 5e d8 8e e5 40 3f 97 54 08 a4 40 0a 54 c1 09 88 b4 0d b7 b4 46 7c af a7 7e f4 24 cd b4 cc cd 98 2e f7 c6 0e 9c 74 51 ad 80 59 fa af 50 7b c4 e7 b6 1a 45 1f f5 18 33 b3 e5 75 0e 05 f8 00 15 6b d3 0a 7c c0 40 27 ea 54 87 44 55 b7 5a 4e df 8e 05 64 75 8c aa 98 46 af 9d fa b9 d9 04 00 f5 46 97 35 1c 4b 9b 11 c0 80 53 23 0d 07 3b b0 b4 f5 5b 44 be dc 7e c1 00 5d d7 b5 5d 67 c4 59 17 17 04 14 c1 5e f7 d9 04 f8 f5 92 05 f2 7f dd 5a 44 b6 c0 c9 86 ff 55 11 3c 73 5b 1f b6 47 2c 75 77 42 c0 04 c4 74 96 60 c0 04 b4 6e 94 d1 5c 7b 3e dd 04 ac f3 ef 5c 80 0f 14 f6 48 73 36 50 e0 41 6a 67 dd 0e c0 00 6b 33 0a 69 9b 36 3c 37 73 a3 09 aa ac c4 c0 07 5c 40 63 33 8a 6b c3 f6 ce ca f6 50 78 76 65 Data Ascii: $BhCWG@=8^@?T@TF\|~$.tQYP{E3uk\|@'TDUZNduFF5KS#;[D~]]gY^ZDU<s[G,uwBt`n\{>\Hs6PAjgk3i6<7s\@c3kPxve
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 2a 6f 31 a8 a1 76 44 f7 56 ad 11 44 6e 04 e7 65 76 65 b0 49 5c 68 82 86 aa 31 51 2e 07 db 2c a4 36 cf 84 4e 00 11 90 f0 07 6c ef ad 82 ff ec 8c ae b0 d1 7e af 43 be b0 04 23 87 0c 07 29 c7 12 a6 e0 8e 12 f4 9e ad f4 92 a6 e9 ce 85 81 58 00 09 cb 99 7e 45 ee ce 7a c4 06 57 ad 0b c8 a9 15 47 b0 b9 5d ef 50 a0 c0 07 14 20 12 98 c0 08 34 31 39 85 81 dd 1e 41 6d 7e 30 08 73 e0 57 92 30 05 f4 ae 64 d1 b0 5c 68 2c ec da 6d 07 cc 6e c5 7e e4 b1 26 1c 59 74 c0 fb 52 aa 1d 8f 0c 68 c8 c5 19 1e 00 0a 90 f0 01 bf d5 b3 22 9a 28 c1 ac dd 02 ae 12 c3 b0 91 22 f2 58 b8 c0 ef 92 68 23 57 cc 23 ff c4 d1 0d 01 09 a7 9b 05 7b 26 47 18 71 cc 1a c1 e1 16 b2 3f 12 b2 f5 80 b2 58 54 01 e1 ba 00 79 a6 91 2d a7 a0 c2 15 70 85 72 d7 b8 26 44 a3 d2 ed ef 92 b1 4f 2a 31 4f a0 88 a5 Data Ascii: o1vDVDneveI\h1Q.,6Nl~C#)X~EzWG]P 419Am~0sW0d\h,mn~&YtRh"("Xh#W#{&Gq?XTy-pr&DO1O
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 7e 84 49 10 27 6c f2 a2 d5 51 c4 63 8e 84 66 12 49 54 2c e7 47 c4 df 40 ca 5b fd 00 26 61 1e 13 18 a2 52 6a 16 65 a2 99 86 49 b4 67 c8 24 64 f4 79 e6 32 5a 8e 54 c8 27 02 f8 a4 13 99 c6 6d 62 4e 75 46 4d 99 99 06 70 a2 d2 fc 0d 0e 4b 34 a6 75 7e e6 10 a6 e4 76 46 e1 7f 3a 21 5b 42 85 5b 62 40 4a 60 e7 47 fc df f1 44 27 52 7a d9 84 4a d3 51 36 c5 4a 70 68 45 98 04 59 22 e4 24 d6 e7 7e b2 c4 77 ae e6 4a 28 68 45 90 67 49 04 68 45 90 a6 e1 ac 25 8a f6 d5 13 41 15 7a 46 a1 29 92 e8 54 96 04 86 a6 a7 ce 59 ff 26 53 c8 68 4a 48 a5 71 3e 85 7e f2 a7 54 21 28 10 75 e6 f4 29 57 62 e4 21 2d 01 69 3c aa 04 96 9e c4 60 4e e9 fd 51 5b a1 9d 26 4a 9c e8 8a 48 45 85 1e 47 8f ae 28 10 d1 e8 28 f5 95 91 46 e8 30 75 26 84 a6 04 8c 06 29 49 d0 a8 97 52 5f 7d c6 d6 4d 68 1d Data Ascii: ~I'lQcfIT,G@[&aRjeIg$dy2ZT'mbNuFMpK4u~vF:![B[b@J`GD'RzJQ6JphEY"$~wJ(hEgIhE%AzF)TY&ShJHq>~T!(u)Wb!-i<`NQ[&JHEG((F0u&)IR_}Mh
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 9e 6d 0a aa 64 c1 77 66 b8 c5 55 8a 07 64 48 b8 cf 20 e4 2f 6a 9e 40 e9 8b 07 93 18 0c 2d 26 c1 45 8d 00 89 9b 1a c3 7b 16 79 4e 09 f2 80 60 a8 a4 af 51 b6 f3 80 93 3e 60 28 43 83 17 12 86 b6 03 cd dc 39 99 d3 1c 69 ea 6c 28 ce 45 0e f1 81 04 4b da 82 96 30 63 81 ae 5e 89 c8 c2 56 d9 cd 74 80 a1 81 08 09 9b 60 d7 e1 eb 75 93 9f c0 ee 3d 1a c2 10 57 67 67 8b f4 9d 5e 7d d9 88 22 6e 70 c8 df ff 7e 80 50 0c 1e f0 07 10 3c 43 02 cf 10 c2 e3 a7 f1 07 98 80 e3 49 14 f9 c8 3f ff 9e f2 8f bf fc 67 2e 10 03 8e 6b 35 ec 62 2f b8 50 90 c1 92 3c a4 83 af 98 46 3b 34 f8 a6 d5 14 b8 7d 76 9d 9d e1 15 fc e0 07 3b 3c a1 f6 b5 b7 83 1f f0 7e c5 c1 02 7d 20 fc 8e 78 f1 08 7f f8 e1 37 44 f1 0d 21 bc f0 8d ff 02 39 0d 64 92 5d 6c e5 e7 61 27 91 79 34 b9 ee f0 8e ea e9 d3 3e Data Ascii: mdwfUdH /j@-&E{yN`Q>`(C9il(EK0c^Vt`u=Wgg^}"np~P<CI?g.k5b/P<F;4}v;<~} x7D!9d]la'y4>
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: c3 5c 37 ec a0 d7 69 ab 75 41 6a 3e 84 90 f7 cf 90 e2 85 a8 e1 b6 51 0c 12 de 71 42 16 5c 49 9a e0 0c da 06 89 0d 01 03 e3 8d c9 6d e4 1d 7f 53 47 b3 e0 0d 17 21 48 ac e4 46 de d3 a2 22 0d 1c 3a c1 01 e3 85 ee eb b6 31 05 57 59 39 2a 53 52 1b 5b 18 28 16 18 5d 9c 90 da ec b4 47 55 e0 9f 0a 2b 98 cc b7 a9 d7 5c 04 15 ac ff 99 3b 4f 62 97 a0 fc bb 21 ba 85 3b f6 b4 31 d5 43 49 6e 2f d7 5c 17 07 8b e5 0f ab d4 dc 6c d0 22 6d 6c 89 57 ff 04 a0 73 0f 15 f3 46 52 e1 3c 75 5b 4b 2f fd 20 08 27 96 f0 e5 64 72 36 41 c1 e2 ee 17 aa 13 ac eb 71 04 cc 15 53 ec 77 80 c7 40 66 0c 48 79 02 df 0e 42 0d 05 15 41 2c 5b f0 de da 14 98 94 bd 91 8e 0a 02 31 9d 75 fe a7 42 81 84 45 00 cb 68 46 33 0a f2 c0 8e 18 d0 26 78 13 21 96 42 e0 83 d4 80 6f 86 7b 59 d4 0c 4a 92 1c c8 8c Data Ascii: \7iuAj>QqB\ImSG!HF":1WY9*SR[(]GU+\;Ob!;1CIn/\l"mlWsFR<u[K/ 'dr6AqSw@fHyBA,[1uBEhF3&x!Bo{YJ
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 96 aa 0c 80 f7 2f b0 03 97 77 f4 91 c2 05 55 a7 79 fa a1 00 6d c7 65 92 af eb 58 6f a0 89 85 2a 1c 47 ea 4e 20 78 34 d3 6c 07 12 da 17 4d 77 75 67 f7 a8 72 f8 77 b7 83 05 58 00 5e a0 82 87 ff 03 a7 3a 7b e4 b6 f7 01 2e 70 54 9e 61 7e a7 7a a9 ba ef 2b 78 ea 29 ff e7 c2 4e b3 6e 6e 20 62 7f 51 99 4f 79 7a 90 2a 96 67 7b b7 87 fc a6 7f 77 25 a0 f3 03 48 75 bb af 78 06 a2 e7 f4 26 56 8d 47 0f 6f 8e 2a c5 27 80 7a 50 ec 8a 5e 6a 34 b3 74 07 0a 77 fb 56 f8 4e 38 7d a8 72 77 69 ff 02 4b c8 84 6a 80 fc 05 90 7c ff 69 57 02 22 a0 e0 80 37 ef 3c b7 58 ab b7 64 e7 96 ed 9c a7 1f c4 7f aa 89 af 38 d2 fe e7 9f d7 b2 a1 e6 51 d1 bf 75 91 7f 2a 2d 80 77 51 b0 86 09 98 80 41 b0 7d b7 cf fd 5d df 04 22 c0 01 70 68 69 59 38 e4 eb 4e ef 06 76 a5 2f 67 20 4d 1f 29 72 9e 37 Data Ascii: /wUymeXoGN x4lMwugrwX^:{.pTa~z+x)Nnn bQOyzg{w%Hux&VGo'zP^j4twVN8}rwiKj\|iW"7<Xd8Qu-wQA}]"phiY8Nv/g M)r7
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 86 34 56 66 21 13 79 cf b1 6c 3d 7c ee bc 75 76 a1 ff 76 33 e8 c1 52 df 0c 5e 41 c8 6d e7 23 4a e5 89 6e b2 ff 5c cc b2 7d 21 f1 6c e8 1c 14 c9 72 e6 68 aa 6a 4a 12 1e dc 6e de 8d 23 92 e8 93 fe 30 62 86 21 76 95 e3 c5 4c e6 01 70 e8 ce cb 64 17 b2 01 98 1e ac b3 f4 48 2e 3e 80 5e 2e 03 5d d0 02 0e b6 0e f2 7d a1 e3 f5 e9 02 83 4a 46 56 90 e7 dc dd 01 58 dd fd f3 68 17 da e8 a6 a6 2a 42 c8 00 21 a8 3b c1 5a e4 04 0a 87 3b 20 00 02 70 87 32 b8 8e 82 cb 66 ad 46 2e 0b 60 e9 46 0e 69 9e 95 c3 27 54 cc 16 0a 66 b6 4e ad 4a f3 87 b2 e6 eb 47 48 05 eb 38 5c bc 4e af fb 5d cf 05 31 22 26 9c 55 66 96 bb 0d fe 60 9f c5 85 07 4c 30 5d e0 eb c9 36 05 eb 70 67 c1 46 2f 79 2e dd 17 42 d1 d6 93 65 13 74 6b 23 fa 00 b6 25 87 5d 78 04 be 2e 85 72 90 04 d8 db 4e 53 98 ec Data Ascii: 4Vf!yl=\|uvv3R^Am#Jn\}!lrhjJn#0b!vLpdH.>^.]}JFVXh*B!;Z; p2fF.`Fi'TfNJGH8\N]1"&Uf`L0]6pgF/y.Betk#%]x.rNS
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 46 d2 fc 29 bc 34 bc f5 e3 80 cc 84 a1 62 b4 1b ff d3 72 c0 0a c2 49 88 b4 4d 30 d3 c3 99 bb cc bd 94 20 90 cc 95 d6 8c a2 8f cc 09 1b 4c c6 01 f0 85 3b 2c 4e 9f 52 44 78 e4 3a dd b4 bb 0a 82 82 ee 1b 19 7d 63 02 95 80 a1 07 b0 85 2f 4c 05 95 bc 4e ea 2a 4c c3 43 33 10 30 cb 21 9c 97 0a 88 4d e7 b4 a0 9b 30 c9 d0 8c bd d9 5b cf b6 fa c5 48 eb 29 0e 00 bb 0a 92 04 9f 61 00 97 70 c8 2f 6c c7 fe 64 4f b1 44 38 12 c0 35 0a 98 46 6c 01 a4 0e 88 01 21 58 01 17 d8 81 10 60 01 0a a0 00 16 30 81 10 70 81 0f 18 81 01 65 33 9a 28 ca d7 2b 44 27 08 48 06 fd 29 4f 4c b8 a0 52 43 f5 09 c4 5f a1 b8 f1 7c 89 0a 88 21 3a 84 c0 50 70 51 18 f3 c5 dc ec a9 17 bc cf 6b 41 a3 1b 58 01 26 83 2f 0a d8 81 11 20 c7 1e bb 47 96 d0 d1 18 42 87 15 5d d0 1f 6d 4f c3 13 37 13 40 48 85 Data Ascii: F)4brIM0 L;,NRDx:}c/LN*LC30!M0[H)ap/ldOD85Fl!X`0pe3(+D'H)OLRC_\|!:PpQkAX&/ GB]mO7@H
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 4c 01 e2 47 0c 64 db 1b 52 a0 06 c6 5d 6f 82 d3 1b 02 1d 50 f1 01 f4 94 6f 4d ae f2 84 13 8d f0 2a f9 dd 6f 86 af 90 8b dd fe 77 28 e2 15 88 48 ca 7b 43 14 70 c1 af 0a 46 f1 5f 95 70 83 0c 64 e0 06 4a 98 6a 05 38 e0 e0 08 d3 e4 83 3d e9 24 7e ee 4b 10 4f 64 37 9e 17 1d 81 46 39 ba 02 8f 56 20 a4 2b 18 ff 29 17 b6 ba 5a 79 e6 d6 c3 42 f1 2d 48 28 41 45 0a 98 38 c5 57 b6 aa 0d 0c b0 65 2e bf 38 c6 ef c5 21 4b 6b 1c 13 e9 9e 53 39 16 96 a8 34 92 d9 d4 a7 9e 58 bd 16 c8 ea 09 c0 6c c9 07 88 82 19 4f 06 8a 63 13 40 89 81 de b0 01 1b c0 72 a0 a7 5a 04 2e 17 7a cb 5e 96 ea 0a ba 7a c3 65 8e b9 56 57 39 51 6c 07 72 8b 2b 58 12 04 7c 75 b3 a0 0f 50 81 23 34 a0 b9 74 bc c4 77 f1 ec 90 28 0f c4 13 7d ce 60 0e 2a a0 69 4d df c0 d0 af c6 80 0f d8 7b 02 02 5f 50 cc 8e Data Ascii: LGdR]oPoMow(H{CpF_pdJj8=$~KOd7F9V +)ZyB-H(AE8We.8!KkS94XlOc@rZ.z^zeVW9Qlr+X\|uP#4tw(}`iM{_P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49757	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:27 UTC	1041	OUT	GET /static/images/section4i7.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
2024-09-27 22:15:27 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:27 GMT Content-Type: image/gif Content-Length: 3327196 Last-Modified: Wed, 06 Mar 2024 15:31:06 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c3a-32c4dc" Expires: Sun, 27 Oct 2024 22:15:27 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:27 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 00 9b ff cf 35 02 00 32 52 fe d8 20 00 00 03 00 80 d2 ff 5d 1f ff d5 27 fa 90 16 00 58 8f fc ee 21 ff ff ff 00 00 00 00 58 90 05 56 54 56 be ff 7d 09 09 ff b4 84 00 57 8f fa 8f 15 fa 90 15 00 57 8e fa 93 16 ff d5 26 fb 91 15 00 84 d9 00 97 f9 00 98 fc 00 81 d5 00 9a fe ff cf 25 00 90 ed ff d3 26 00 8d e9 00 93 f4 ff d7 25 00 89 e2 fb 96 17 fe d5 26 fe c7 23 00 92 f0 fc a3 1a fe e3 22 00 6a ad 00 87 df fb 9e 19 ff cc 24 00 6d b3 fd ae 1c fe bd 20 00 8b e5 fc ed 21 fe c4 22 00 86 dc fe c1 21 fb 99 17 00 5d 98 fe e0 23 ff ca 23 fc a6 1a 00 80 d3 fc a9 1b fd b1 1d 10 0d 03 00 43 6d fc 90 14 00 Data Ascii: GIF89a!NETSCAPE2.0!,52R ]'X!XVTV}WW&%&%&#"j$m !"!]##Cm
2024-09-27 22:15:27 UTC	16384	IN	Data Raw: c0 1e f4 6d ad 66 c2 24 0c f4 6d f4 f1 32 76 1a 6d fc 72 0a e8 84 ec a6 c5 04 df ef ed da 86 14 a8 b1 02 b5 b1 44 98 e7 ff 69 f4 95 84 ef 6f 40 6b 44 10 a0 aa d8 1d 9d 60 74 10 1e b4 01 5b ad c0 4e f2 87 44 66 20 96 c0 48 db 85 0b f8 c0 1d 5f b1 0d db 46 f9 e8 45 17 f0 74 44 2c 32 08 02 b5 9f 6c da d4 ae 72 01 7e f4 b2 f8 34 7e 58 c0 19 43 44 27 14 b1 93 08 02 58 47 87 25 2f 4d 2f d3 06 2d 98 07 28 3b 6e 1e eb 8a ba de 05 c7 8c c8 57 57 84 2e 87 23 59 57 c9 db a1 e7 43 98 c0 f8 61 18 b3 d8 c0 75 3a 41 2f 4b 41 5e 08 ff 6c 40 eb ef 32 a6 00 42 57 06 58 aa 85 31 e7 2c 32 eb 8a 87 56 46 93 38 49 61 53 84 2c ef 44 10 24 36 8b bc 1d ac 12 5d f4 b0 b0 a6 b0 f5 7f 62 6b 5c bb 6c 45 2b c9 6a 5b 2c 9d cc 64 6b 34 6e d9 ea ca 0f d8 c6 69 a3 76 5d 3b 04 4e de 9b 17 Data Ascii: mf$m2vmrDio@kD`t[NDf H_FEtD,2lr~4~XCD'XG%/M/-(;nWW.#YWCau:A/KA^l@2BWX1,2VF8IaS,D$6]bk\lE+j[,dk4niv];N
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: f4 7e fa 64 8f d4 ff 4a c0 74 d1 6f f1 91 7b aa 92 43 3f 5b 4f fd c5 c6 e8 b2 9e fc 99 c9 03 02 17 e7 d9 bf 63 72 e8 f2 98 87 fa 59 80 54 dd b7 6a a3 36 47 6e cd a7 f5 05 0a 9a 76 fc e1 27 7e b2 33 7e 7a a3 ec 6b 51 84 4c c6 da e2 66 fe 22 ae 7d e4 46 f6 23 86 d4 79 c0 74 eb 47 c2 b2 7d aa ba 0f 8a 41 f7 74 ef 0f eb 28 67 5e 59 4e 98 f2 07 88 00 02 07 12 1c a8 c6 00 c2 84 0a 17 32 6c e8 d0 00 b9 09 12 27 4e 3c c5 50 4d 80 4d 04 36 72 ec e8 f1 63 b8 03 22 47 92 2c 69 f2 24 ca 94 2a 57 b2 6c e9 b2 25 a3 05 32 67 ce 64 b4 12 01 ce 9c 3a ff f1 ec e9 f3 27 d0 a0 42 87 12 2d 6a f4 28 d2 a4 4a 97 32 5d aa f3 29 82 1d 28 ad 28 a8 6a d5 aa 91 97 5a b5 2a 92 56 f0 ab c0 30 4e 1e 92 2d eb d0 17 c5 b4 13 2c 2e 7c a4 f1 23 5c b8 21 b7 d2 ad 6b f7 2e de 43 34 f7 6a 52 Data Ascii: ~dJto{C?[OcrYTj6Gnv'~3~zkQLf"}F#ytG}At(g^YN2l'N<PMM6rc"G,i$Wl%2gd:'B-j(J2])((jZV0N-,.\|#\!k.C4jR
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 1b 47 55 b2 9c b0 c2 ab 0c 32 18 c1 06 d2 19 67 5c 07 18 46 30 7c d3 30 c0 ac fc 52 c0 83 83 b4 84 0e 84 58 fc 3b 19 84 c8 c9 8a e6 5d 82 c7 93 d7 af 3f 00 17 d6 09 70 1d fb d4 70 d1 36 2e 19 a8 c8 09 0c 18 26 e7 3d 7d 8b 7e 0f be cb 12 a6 b6 c8 c6 e2 c7 6c c9 8a 2e 55 b0 01 fe ef 60 d3 41 88 7d 71 4e 80 3c aa e0 bd d7 a9 61 7b 78 20 a0 6a 52 25 18 21 a0 4f 7d 0f b4 88 0c d8 07 29 ef 70 44 02 f3 c3 91 4b f8 13 a3 ff 14 b0 01 82 df 01 45 3a 10 50 83 04 a2 ee 17 db 23 40 09 53 73 27 0b 7e d0 85 72 f9 5d 97 42 d0 12 f9 61 90 40 07 8a 91 07 46 e0 40 c6 01 f0 22 20 c0 07 2f 10 b0 02 15 e6 4d 03 9e 40 a1 08 8a d8 97 a3 bd d0 89 89 b2 c2 06 13 d4 1c 78 d9 70 40 99 fa 8f 07 3a c0 c3 27 6a a4 12 d4 40 00 02 5c a0 c4 25 16 0d 89 db 2b 63 5f 80 21 bb 55 75 d1 8d 1b Data Ascii: GU2g\F0\|0RX;]?pp6.&=}~l.U`A}qN<a{x jR%!O})pDKE:P#@Ss'~r]Ba@F@" /M@xp@:'j@\%+c_!Uu
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 8f 9e 95 d3 40 14 31 6a c2 89 be f1 04 ce cb 40 09 6a 70 4a 8e 09 cd 9f 1a c1 a0 7f 64 27 01 d8 f9 67 91 f9 22 5c 2b 53 e2 4b 8e a5 b3 00 f5 8b c1 da 28 5a 02 68 72 74 8e 75 fc a9 09 53 a0 c7 37 06 e1 a2 d0 03 01 0f 4a 6a 37 94 66 44 a5 f4 69 d9 9b 1a c1 34 60 b1 f4 76 e1 6a 68 48 7a c9 31 4b 38 a1 0c 31 98 5c 0b 29 5a 80 17 74 00 a9 42 9d 1c 0d 44 f8 81 b4 f6 cf 9e 7b fc 00 5a 93 5a 03 d4 09 ec 6e 4e ad 08 54 e7 43 80 3a 34 4a 16 80 38 63 2a ec 00 4e 26 49 aa 3f 28 c9 99 c0 8a 20 85 79 1e 80 a8 64 25 a6 5b 3b e7 d1 e5 ed 6f b2 f6 1b 65 5c e7 1a d2 02 b0 c0 ae cf 7a 55 5e f5 ba 57 f5 34 a3 b0 f9 62 e9 92 64 51 55 c1 91 84 83 02 4b a7 5c 33 ea 42 76 ff 7e 00 93 98 a5 dc 3d 97 e7 d3 dc 3e 8f 06 45 55 e2 51 9d 18 83 32 fc c0 6e 09 38 d1 68 27 d2 34 fa a4 02 Data Ascii: @1j@jpJd'g"\+SK(ZhrtuS7Jj7fDi4`vjhHz1K81\)ZtBD{ZZnNTC:4J8c*N&I?( yd%[;oe\zU^W4bdQUK\3Bv~=>EUQ2n8h'4
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: b3 60 63 92 c4 2b 6e 9a d3 5c 45 a2 36 e0 32 e7 8e 8c 9a d6 95 d4 65 7a 02 e1 80 00 9d 6a 2b 55 6a 2f aa 05 99 ea 77 7a a9 38 ac c2 6e a0 5b 0d 13 24 e1 f3 06 b0 96 a6 ae cf f1 69 51 4c 45 51 a0 a9 95 b1 74 4b 69 00 fb 18 d7 a7 8e 54 2b 34 a4 aa 1e 97 72 8b 96 82 cf af 62 6b df 8b be 7a 53 a8 45 d4 28 91 50 d4 50 1b 9b 5a 8f e0 91 22 b6 23 1d 91 9a 2a 59 b9 52 56 ac 4a 41 20 55 8b a7 15 52 30 0e 76 9d 6d 4f 2c 00 0b 9f 33 d8 54 36 b5 8d d7 38 e1 82 23 88 cc d1 a2 aa 75 2e 46 ea a2 84 64 2e 68 99 b2 f5 13 20 29 cb c1 ee 89 32 b7 6c 49 c7 3e 0b d7 48 df b2 22 b8 f0 81 43 61 89 65 5c 7b 1d a2 36 99 23 08 f3 ea 32 84 e7 3e f7 98 53 8c a7 75 63 98 5d a5 ff 78 60 bb 4f 09 d5 73 a0 51 4d d8 f5 d0 af ac d0 04 e4 94 d5 05 fd b2 05 93 96 31 ed ea 4a 38 df c6 a6 90 Data Ascii: `c+n\E62ezj+Uj/wz8n[$iQLEQtKiT+4rbkzSE(PPZ"#*YRVJA UR0vmO,3T68#u.Fd.h )2lI>H"Cae\{6#2>Suc]x`OsQM1J8
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 3d 91 75 0c b6 46 62 57 cb 90 8c 0a 19 5e 05 2d 90 3c 70 27 1b fc cc 9b b8 f1 92 09 91 63 f8 f6 58 8f 02 49 f8 a7 16 be 10 76 db ed dd 0f b7 0a a1 95 32 f1 89 8e 09 01 f9 d2 77 98 45 52 59 ab 76 72 c8 3d 3e 3a d2 93 ae f4 a5 f7 f8 8e 7a 04 32 9c 60 8e 27 99 5f 58 d3 80 b6 f9 cd a9 52 81 13 4b 7c e7 8c d4 35 98 17 3d 92 ac 11 bd c2 c1 94 ba 94 e4 71 85 66 bb 29 7a 59 8f 8b b4 a7 ed 75 2f 8e 49 03 89 fe 88 24 27 e9 ef d9 02 d5 ec a1 43 f7 d3 26 b1 ba d6 bd 3d 2e a9 ea fa dc bd b8 62 bf 7c a1 80 06 24 09 0c c8 7e c9 6f fb ff bd 85 80 3f 97 00 38 31 38 41 d8 af f0 fc 1c 13 84 12 5f cf 01 8a 24 ef ef e9 b7 48 36 ee cf 2b 04 b9 f2 70 ba fc b9 34 cf ad 52 60 dd f3 54 f1 e0 ad 45 af e2 31 15 c1 f1 51 c9 b8 48 c6 cc 2d 37 ac d0 f5 24 c3 6d e6 dd 44 7b db cb 65 eb Data Ascii: =uFbW^-<p'cXIv2wERYvr=>:z2`'_XRK\|5=qf)zYu/I$'C&=.b\|$~o?818A_$H6+p4R`TE1QH-7$mD{e
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: f3 aa 42 14 ab d9 52 09 21 a0 2b 6a 03 c0 9c c2 36 9d d8 42 b0 08 bf 3a 74 b9 e5 62 01 b4 38 01 46 6c c4 47 ec 82 35 44 43 9b 1b 36 af 03 09 24 b8 3f 4e 04 ab 33 68 a0 64 12 c4 56 23 45 89 68 93 4e 99 41 47 49 b2 3a 9c 87 26 a3 84 b3 90 04 58 94 40 f6 43 c3 8c c1 a2 2e 40 c3 2b 1b 36 9c f3 40 ae 5a 2e 18 d8 06 5e 0c 2b 38 a0 26 1c 60 24 44 c3 a9 66 aa 98 29 ec 81 d9 4b 08 04 04 c7 66 68 32 1e 38 8b 16 80 c6 08 14 8c 0a a4 c6 15 b2 46 34 a4 83 61 7b 85 32 30 8b 1f b0 b8 26 04 c7 01 28 c1 78 51 30 d9 93 08 7e 5b 28 dc 93 89 0f f8 be 6a 4a c0 42 fc 42 ff 19 a3 81 b3 c8 83 7a 5c 80 1f 44 43 b5 a9 c6 47 14 b6 61 d3 32 90 c8 81 26 a3 c3 82 1c 00 e9 53 89 37 8a 09 a6 2b ba 76 3a ba f0 80 89 10 a0 bc 82 70 47 70 34 b8 71 7b 40 8d 3c c3 47 3c 9e 15 aa 83 47 ec 84 Data Ascii: BR!+j6B:tb8FlG5DC6$?N3hdV#EhNAGI:&X@C.@+6@Z.^+8&`$Df)Kfh28F4a{20&(xQ0~[(jJBBz\DCGa2&S7+v:pGp4q{@<G<G
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 57 36 ff 22 9c 23 46 98 04 27 0a 83 30 9a a4 f9 87 01 d0 87 dc a6 8e 23 66 9b 09 f4 4c 4d c9 7a 8c 75 86 d5 38 8d 0e 33 9b 13 b3 99 19 46 08 95 b3 01 7d 09 24 e4 19 60 e8 48 70 75 07 6b b3 36 0c a2 90 98 01 30 70 67 19 60 36 b0 7c 6d 59 00 8e f5 96 4a 19 76 18 ca 2e 94 79 67 08 f4 94 5c a6 97 5d 83 02 29 59 24 7f f9 5d b1 e6 6d 11 1a 00 b1 10 8c 01 90 87 dc 86 8c 23 c6 06 13 ba 60 9a 96 99 89 a8 9f cd 48 8f cf c8 94 08 d4 9d f7 b5 3c da e7 7f 7f 59 66 9c 45 87 03 e7 a0 bd 15 70 de c6 9e df 35 00 f2 a9 33 ab 58 00 f8 59 8d ed 07 89 17 98 8f e8 33 42 b0 95 61 8d 00 3d 23 30 95 2b 72 84 bd 91 59 ea 29 6b 51 e8 5d d3 90 9c 11 70 0b 2e 6a 7c 58 10 a5 3a 23 9d 62 b8 a1 ed 92 58 76 2a 7d 52 e3 a3 23 04 a2 b2 f5 8f e5 23 90 c1 69 90 78 98 72 95 b0 87 78 98 a2 dd Data Ascii: W6"#F'0#fLMzu83F}$`Hpuk60pg`6\|mYJv.yg\])Y$]m#`H<YfEp53XY3Ba=#0+rY)kQ]p.j\|X:#bXv*}R##ixrx
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 6d 3b ff 25 94 cb 4a c4 0d b3 4e 32 75 4b e4 34 94 5d 66 ea 11 d3 b3 85 08 ec 41 05 ec 36 47 94 21 67 e6 db 94 93 27 65 62 45 f3 93 2d 0a 34 0a 00 49 33 24 c2 3d 67 2b 42 6b f4 48 d1 cf 6a 24 8f 47 69 65 a6 be 51 0c 62 20 4a 77 60 33 24 42 46 67 4b 44 91 34 4b f9 07 9f 16 91 49 f5 c8 11 d1 83 48 73 8a 46 b5 b4 4c f3 cf 3e bb d4 4b 63 65 a6 10 60 ee fa 82 28 05 0c 4b cd 74 4e 13 65 35 eb 50 4d 67 25 fa 94 62 38 39 43 4c 59 89 4c e9 34 50 79 4a 37 ef 14 4f 65 a5 bf 3a c0 ca 20 4d c0 8c 54 50 1d 15 4a 0e 74 21 7e d3 50 89 84 4d 79 33 2e fc 14 8b 1e 75 53 d9 4c 03 52 b4 27 29 b5 4f fa 0b 06 d0 03 4e 73 aa 51 39 35 55 53 43 11 d3 34 54 f9 84 4d 0b 34 2e 4c f5 4f 55 b5 56 9b 47 07 11 60 52 5d 55 48 b6 90 3a 8d 2c 53 cb cd 56 85 95 59 22 35 57 77 f5 4b 49 b2 54 Data Ascii: m;%JN2uK4]fA6G!g'ebE-4I3$=g+BkHj$GieQb Jw`3$BFgKD4KIHsFL>Kce`(KtNe5PMg%b89CLYL4PyJ7Oe: MTPJt!~PMy3.uSLR')ONsQ95USC4TM4.LOUVG`R]UH:,SVY"5WwKIT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49756	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:27 UTC	1041	OUT	GET /static/images/section4i6.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
2024-09-27 22:15:28 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:27 GMT Content-Type: image/gif Content-Length: 2424803 Last-Modified: Wed, 06 Mar 2024 15:31:01 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c35-24ffe3" Expires: Sun, 27 Oct 2024 22:15:27 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:28 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 98 2a 05 35 35 35 ff ff ff fc ee 21 ff 5d 1f 00 00 00 cf 35 02 fe d8 21 fa 90 16 d5 77 15 7d 09 09 b1 54 0b 97 2a 03 66 66 66 c5 63 10 a8 3e 09 ff b4 84 34 34 34 98 98 98 fa 90 15 97 29 03 fe d7 20 f9 90 15 fe d8 20 98 29 03 fa 8f 14 fa 92 15 fa 8f 16 f9 8f 15 b2 4a 0a 97 27 03 b5 4d 0b fa 99 17 b6 4f 0c fa 94 16 bc 57 0d b7 50 0c 40 40 40 ff d9 20 fe cc 1e fe d4 20 bb 55 0d c0 5b 0e b0 47 0a fe dd 20 fe c3 1d be 59 0d fc ed 20 fe da 20 4d 4d 4d ba 54 0d fb a4 18 fb a2 18 fe ce 1f ad 43 09 fd b8 1b fc b0 1a ae 45 0a b1 48 0a 99 27 03 fe c6 1d fd c9 1e fe d1 1f fd e4 20 fd b5 1b fd e6 20 eb Data Ascii: GIF89a!NETSCAPE2.0!,555!]5!w}Tfffc>444) )J'MOWP@@@ U[G Y MMMTCEH'
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: f4 37 d1 81 14 31 15 43 e0 6b e9 3a 71 50 ec 72 51 54 f4 1e 49 73 50 a0 b1 ba 96 31 60 12 86 26 93 b4 2f 15 02 12 2f 33 77 a2 cf 38 f3 f3 55 c0 f4 40 77 47 3a 6f 46 0e 98 64 e8 a8 47 16 eb 34 29 9d af 05 6d c2 2d ff b4 33 b7 74 39 3f 64 da 1e f5 55 24 b5 4d 5b 08 2c 93 af 53 27 52 3d 3b 46 2a 38 84 22 8f 2b 4b 8b f1 55 77 f5 d4 06 f4 68 70 b5 08 03 0e e7 82 84 33 86 b5 2f c1 c1 42 3b c6 3d 1f ee cd a6 b5 4b 27 00 51 03 40 fa 75 47 50 cf 74 84 c0 75 2f 77 5e e1 da b5 2f 71 f3 ff 36 44 0d d4 b0 f1 00 ef 5f 07 f6 01 1b ff f6 5b 2b 35 e0 34 e5 da 31 76 22 e1 b5 05 95 81 73 2d 84 cd 12 aa 5f af 35 f7 f6 96 5b 23 f5 39 97 47 88 70 9f 67 bf 90 63 db b3 43 6c 30 c9 ea 32 6a 27 b6 51 af f6 56 07 6c af b5 46 11 c7 76 0c c1 81 40 59 10 23 38 c4 f4 82 04 d9 d6 1a 1e Data Ascii: 71Ck:qPrQTIsP1`&//3w8U@wG:oFdG4)m-3t9?dU$M[,S'R=;F*8"+KUwhp3/B;=K'Q@uGPtu/w^/q6D_[+541v"s-_5[#9GpgcCl02j'QVlFv@Y#8
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 1c e3 60 06 70 42 c8 98 11 ee 64 77 c8 92 0e 0a 43 83 40 16 56 25 54 2f ec 4a e9 1a 75 ba 1a 52 b1 8a 74 f9 02 20 7c b3 c1 16 d9 ae 8b 5e bc 1d 05 88 a8 93 01 16 70 2c 49 24 9e b3 82 47 b8 4d 3d f1 21 0f c4 88 fc 9c 64 c5 39 d2 51 24 86 c0 21 62 26 a1 c3 2f 7a d1 7b b8 cb 5c c6 8e e8 99 33 12 64 89 6a 1c 5e 90 da d8 10 82 d5 b1 91 8e 14 c9 17 32 b1 1f a0 34 60 8f 7c 14 22 d6 00 49 40 de 99 31 85 5f 3b e4 f9 a2 a2 42 45 22 e4 8d 17 a1 c1 23 53 a9 4a 3a 58 62 92 94 ff b4 e4 25 fd 18 46 9e 85 0f 89 be b3 8e a7 06 22 bc 50 26 92 94 08 01 d8 d3 54 29 4c 3a 12 62 0f ae 0c 4a 25 b3 77 c9 2e ca 52 8c 01 20 23 27 ad 42 48 81 94 0f 94 0b 14 a5 2f 0f 62 ca 5d 29 6f 98 de a4 e1 17 c6 70 4c a1 24 73 37 cb c4 e4 f7 0a 03 4d 41 5a 66 9a 00 f0 1c 69 72 29 90 5d 5e b3 97 Data Ascii: `pBdwC@V%T/JuRt \|^p,I$GM=!d9Q$!b&/z{\3dj^24`\|"I@1_;BE"#SJ:Xb%F"P&T)L:bJ%w.R #'BH/b])opL$s7MAZfir)]^
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 53 ff 98 d1 39 df f8 9d 2a ed 35 a9 08 c4 2f 35 c6 30 ed c3 4d 6c 51 3f cc d2 63 dc 52 d3 bc 14 fd 88 a1 34 05 d4 aa 91 bf f9 73 2c 2b 7d 0a 40 14 50 63 44 52 3f 34 8e 3f cc 53 63 ec 4e 3e b5 14 12 2c c1 40 b5 54 86 51 02 fd b8 41 c9 c8 41 aa f8 43 23 3d c6 45 65 54 c9 78 02 47 45 c6 48 ed c3 19 4d 93 d9 f2 0d 24 b8 d4 57 ad 95 1a 6c 2c 00 99 80 5d 39 8c 4f 3d 52 2e 85 8c 3f 6c 01 2d 15 53 5f d1 8f 97 81 d5 61 8d 91 0a 40 c0 04 74 be 5a 4d 0c e1 b8 55 3f 04 55 45 7d 48 e0 f8 4a 00 78 d4 62 44 55 ec f4 15 4a 3d 80 1e e8 33 62 f5 56 dd 40 b1 e5 18 39 b9 61 aa 0a 84 0a 5c 0d 55 40 2c 0e 53 3d c6 6b dd 43 12 f0 95 32 ad 8c fe fa d6 7a ed 8c 0a e8 1d c2 c0 80 36 fd bf 15 f3 d7 aa 03 0a 74 85 56 5d 6d 8c 69 ad 56 62 74 57 00 18 17 e9 d3 89 20 b1 d7 87 1d 0b 15 Data Ascii: S9*5/50MlQ?cR4s,+}@PcDR?4?ScN>,@TQAAC#=EeTxGEHM$Wl,]9O=R.?l-S_a@tZMU?UE}HJxbDUJ=3bV@9a\U@,S=kC2z6tV]miVbtW
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 5a 75 4d 22 c6 cf fa 8d 21 6f c8 3d 83 cd 86 03 7e c0 51 8f 6e fb 3b fb 07 75 50 07 7f f0 07 41 bf ef 6e 2a 07 5e 4b 05 00 21 83 c0 40 82 05 0d 1e 44 98 50 e1 42 86 07 85 bd 82 10 51 e2 44 8a c2 1a 2e dc 12 4a c1 46 54 02 13 6e 29 10 52 64 c8 36 00 4c 9e 44 99 52 e5 4a 96 2d 5d be 3c b9 03 c1 4c 9a 35 11 fc c3 99 53 e7 4e 9e 3d 2b 18 00 1a d4 40 85 9e 45 8d 1e 45 9a 54 e9 52 a6 4d 97 da 84 ba 04 e6 54 aa 55 ad 9a b4 33 52 6b 48 33 75 a8 78 5c 28 63 8b 12 b2 4a b6 6c 91 21 e8 e2 5a b6 6d dd 16 3c 06 8f e2 5c 08 d4 de 16 04 35 66 e3 de 50 0a 95 6c 0d 39 ea ea 60 c2 55 e1 40 ad 49 c1 29 d2 9f 42 81 12 5d 1c 59 f2 64 ca 95 75 9e 40 4c 73 45 61 ce 9d 5d 52 02 1c 32 8c 92 bb a5 4d 9f 46 3d d0 9d 34 88 74 21 58 2c ad 69 ef ff 6c 05 c8 12 a2 09 6d c7 f3 6e cf 25 Data Ascii: ZuM"!o=~Qn;uPAn*^K!@DPBQD.JFTn)Rd6LDRJ-]<L5SN=+@EETRMTU3RkH3ux\(cJl!Zm<\5fPl9`U@I)B]Ydu@LsEa]R2MF=4t!X,ilmn%
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 0c a6 fb 23 61 f5 04 c5 cd 71 f0 0e 06 26 ed b3 f7 bd f4 40 06 3c f6 ba c0 08 8e b1 e0 49 9e cd 09 e7 c3 fe 24 28 0c 8c 07 a2 9f b8 ca 71 4f 65 a1 63 4f 0b 1c 1f 98 10 92 cd 13 d8 23 a7 93 ef 7d 97 08 48 cd f3 2c 30 df cc 67 80 9f ff 2a b4 ee 2e 27 7c fc f5 61 e6 8e 88 9c 54 04 b2 47 ab f6 52 27 c7 f7 cf dc 72 ec 41 83 98 f6 74 12 fa 9d ac 9d 9f 42 dc 5a f0 87 72 20 60 6d f3 77 66 8b 00 3f 7f a0 4d 31 27 25 d5 97 7e da 31 0b 4e c2 78 03 93 7c e9 76 6a 05 a8 67 ac 76 3d e3 55 30 2b c0 7a 5e a7 13 d6 37 1c b5 35 01 a0 07 2f 7a c7 73 48 f0 73 17 98 67 66 e0 51 d6 a3 05 2f f7 2e 3d 00 60 33 17 13 c3 d7 1c 9e 97 22 49 90 6b 52 97 82 2b 18 69 a1 a0 6d bc 03 77 1c 93 06 d4 67 13 21 e8 1b 39 58 22 53 c0 83 28 a8 82 3f a8 67 96 00 3f b9 d0 31 62 05 6e 48 e8 80 d3 Data Ascii: #aq&@<I$(qOecO#}H,0g*.'\|aTGR'rAtBZr `mwf?M1'%~1Nx\|vjgv=U0+z^75/zsHsgfQ/.=`3"IkR+imwg!9X"S(?g?1bnH
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 9b 6b 79 7d 09 30 40 02 e9 6f ff fd f1 9f ff 43 d3 bf fe 87 b2 f1 ff 01 30 00 05 70 00 09 b0 00 0d f0 00 11 30 01 15 70 01 19 b0 01 1d f0 01 21 30 02 25 70 02 99 2b 20 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fe d8 21 ff ff ff 00 00 00 fc ee 21 ff 5d 1f cf 35 02 35 35 35 98 2a 05 fa 90 16 d5 77 15 7d 09 09 b1 54 0b 97 2a 04 66 66 66 c5 63 10 a8 3e 09 ff b4 84 98 98 98 97 28 03 04 04 04 f9 90 15 fa 90 15 34 34 34 fe d8 20 fb 92 15 98 29 03 fa 8f 14 fa 8f 16 fe da 21 99 28 03 bd 58 0d fe d7 20 fe d4 20 b5 4e 0b fb a7 18 fc 90 14 bf 5b 0e b2 4a 0a fa 98 16 b6 50 0c fe e2 20 a5 2c 03 ff d9 20 fe c4 1d ad 44 0a fe ce 1f fe d1 1f fa 94 16 b0 48 0a fd e4 20 b3 4c 0b fb a4 18 fd e8 20 ba 54 0d fb 9f 17 fc ae 1a fc ec 20 af 46 0a fa 96 16 bb 56 Data Ascii: ky}0@oC0p0p!0%p+ !,!!]5555w}Tfffc>(444 )!(X N[JP , DH L T FV
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 17 c0 31 49 44 ae ce 29 68 7f db 67 bf 32 75 58 8f f5 13 46 35 4b 78 26 0e 38 dd 82 7f 4a 20 d0 b7 56 a9 70 49 24 f3 60 f0 ea f0 1a 77 47 2b 75 12 df 76 86 bb 78 4d 22 08 3f a3 c4 92 6a 1b 7c 87 b8 9e c0 41 76 6b 37 4a 80 c0 d6 4e ff 38 85 e7 88 18 58 b8 6d 2b 37 6e 6b f8 5f dc 30 02 d4 b8 54 b6 dd 87 eb 38 9e 14 33 5f d1 42 4a b8 f3 1c 3b 11 11 87 77 91 cb f8 43 34 f6 5d 33 b1 13 e9 b4 da a6 c4 79 32 9e 25 4a 39 93 54 35 5f d9 f7 7d 37 96 61 5f 4d 5d 70 f9 23 7f 35 86 3b b6 92 ff 85 86 3a 79 67 aa 1e 0e e4 b8 9a 67 88 15 28 02 6c 95 81 60 9f 04 08 e0 2d d7 6d 23 52 f3 46 97 43 36 61 01 78 73 f7 b1 13 31 79 93 a7 04 25 42 39 0a 28 78 a0 83 47 83 5b 56 19 40 f8 d3 c9 28 29 32 fa 6c 3b 7a 9d 27 47 67 1f 84 a4 e7 b9 39 d3 78 4a c4 21 e3 fd 79 75 77 ba 69 48 Data Ascii: 1ID)hg2uXF5Kx&8J VpI$`wG+uvxM"?j\|Avk7JN8Xm+7nk_0T83_BJ;wC4]3y2%J9T5_}7a_M]p#5;:ygg(l`-m#RFC6axs1y%B9(xG[V@()2l;z'Gg9xJ!yuwiH
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 7d b5 4e 96 14 42 a8 d2 a5 2e 67 ad 5b da c5 da 86 bb fa cb 28 78 6d 23 de b3 1c 97 5b 07 82 41 7a 03 4c b1 dc 6a 88 1a bb 85 6f 60 a3 44 55 7d 6e b7 bb 00 23 2e 25 fd 3b a0 0c a8 80 3a 5b 15 30 86 3b 39 0b f1 d0 61 17 fe 10 23 7c b5 ff 91 2a ec ee 06 b8 05 b1 ef 6b 5d 79 16 23 90 93 bf 9a 3b d0 8d 2c 8c e1 19 c7 a4 97 96 c0 44 1d 04 80 09 4b 98 64 0c 81 84 af 2f d8 36 5f bd d0 85 07 27 42 b1 ed fc 63 01 ba b0 18 a0 29 2e 58 72 37 c2 1c 1a 53 59 67 7f b8 f2 18 f8 e1 c2 de 9a b2 9b 8e 6d 8b 91 eb 6b 41 15 27 a4 c9 1b 4d 48 27 f4 36 a0 1f d0 d6 32 cf ad 32 9c 27 73 e5 03 bc 03 14 e5 f8 b1 01 18 c1 08 7b c0 23 55 57 ab c0 20 c8 8c 90 30 37 f8 50 2a 5a 72 5b cc ec da 70 56 ad bc 1a 99 66 62 c8 30 89 20 50 41 29 71 be b4 73 44 40 ae 03 51 60 c8 7b 29 f2 91 23 Data Ascii: }NB.g[(xm#[AzLjo`DU}n#.%;:[0;9a#\|k]y#;,DKd/6_'Bc).Xr7SYgmkA'MH'622's{#UW 07PZr[pVfb0 PA)qsD@Q`{)#
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 5d 84 2d 4d a8 6d 53 fc 7d 16 3b 45 00 c0 0b e0 c3 cd 00 a1 1d 5a d3 7d 98 51 f0 86 04 5e 5f 06 7e df 87 39 06 8d d0 a5 da a5 e0 eb 3d 3f 9e 25 8b a7 05 dc 0c f6 d3 88 59 56 04 68 b7 0f 6e 5b 12 35 5e 84 c8 55 6a 40 e1 14 56 e1 d5 65 83 87 81 07 04 b0 38 88 b0 5e 8e dd d9 0b be e1 4c d5 e0 67 a1 d7 86 f5 61 01 e6 e0 26 86 08 ba 62 83 5f 28 62 01 58 e0 23 76 80 e8 cd 8f ff 56 b8 53 18 0e d8 cb c5 d2 cb b0 e1 dd 95 41 ee f5 d8 fe e5 e0 1a cd 62 94 f5 00 11 46 8b 8a 30 60 53 08 63 71 20 e3 32 7e 18 34 46 80 bc 45 88 27 a6 d9 28 be 59 00 c8 d9 17 94 63 cc 4b 46 89 e1 60 10 c0 ce 3b 7e 58 20 fe b2 88 c8 55 2f 00 86 30 7e 85 40 36 63 e0 20 64 2e 3e e4 18 86 62 57 5d 55 0c 8e c1 47 b6 3c b5 a1 da 15 70 58 4b 46 d6 1c d8 62 8b 28 61 04 2e 62 64 00 e5 87 59 2e 89 Data Ascii: ]-MmS};EZ}Q^_~9=?%YVhn[5^Uj@Ve8^Lga&b_(bX#vVSAbF0`Scq 2~4FE'(YcKF`;~X U/0~@6c d.>bW]UG<pXKFb(a.bdY.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49758	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:27 UTC	1041	OUT	GET /static/images/section4i5.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
2024-09-27 22:15:28 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:28 GMT Content-Type: image/gif Content-Length: 2002471 Last-Modified: Wed, 06 Mar 2024 15:30:56 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c30-1e8e27" Expires: Sun, 27 Oct 2024 22:15:28 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:28 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 85 98 98 fa 90 16 9c b4 b4 94 83 95 cf 35 01 01 9c ff ff ff ff 3b 4b 4b ff d5 27 53 45 56 85 99 99 ff 5d 1f a6 93 a6 03 57 90 00 00 00 b7 b1 77 f7 ff bd 97 be e5 9c b5 b5 98 29 04 ba a7 ba fc ee 21 52 44 55 3a 4a 4a 89 d1 ff fa 90 15 72 85 85 4d 5e 5e 80 93 93 3e 50 50 7b 8e 8f ff b3 83 48 59 59 5c 6c 6c 5c 4e 5e 69 7b 7b 5f 70 70 77 8a 8a 39 4b 4b b7 b1 76 74 64 76 9a b2 b2 43 53 53 61 60 4b fd ca 23 57 49 58 65 77 77 55 67 67 6d 80 80 fa fb fc 51 62 63 89 79 8b fc c1 21 90 7f 91 90 a6 a6 8b 9f 9f 88 9c 9d 97 af af a0 c4 e6 83 96 96 d7 4d 0a 6c 5e 6e f4 54 18 a1 90 a2 9d 8b 9e f5 b1 1e 97 Data Ascii: GIF89a!NETSCAPE2.0!,5;KK'SEV]Ww)!RDU:JJrM^^>PP{HYY\ll\N^i{{_ppw9KKvtdvCSSa`K#WIXewwUggmQbcy!Ml^nT
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 01 77 28 e5 46 a0 df 5a 60 60 9c b8 c0 8e 80 40 9b fe b3 9c 05 74 2c 71 c0 0b 54 a5 0a 90 c0 e0 0a 53 e1 a6 84 e0 35 6b ca fe b4 0d af ec 05 2c 9f 43 8b 87 7b 4d 74 e5 55 34 18 16 31 18 61 e3 28 3d c2 2d 60 80 54 df c2 23 a4 33 9a 31 aa ad da 71 57 30 71 3f 8d 42 1e 23 d4 d0 aa 1e 47 a0 b4 5a e8 09 d6 1c 63 07 f4 b3 e6 24 09 1d 1d 6d 2f ee 80 41 0f 13 8c 68 84 5f 1e 00 51 cb c4 f2 79 e5 4f bb 94 81 16 75 78 18 db ba 22 f5 a2 29 b5 0c 62 f2 c2 92 92 54 27 b6 54 87 03 e9 5d 42 26 f8 02 30 00 83 2f d0 b1 5e 95 01 25 c8 ff 47 e6 26 94 21 98 00 71 a4 35 47 90 9a 6e fc 45 b9 70 c0 5e ef 70 3d 27 46 01 d3 d1 6a 32 84 be 71 f1 42 2f 84 db 00 c0 0e ac f6 75 62 06 4b 2c df 5d fb f5 31 1d db 3f b0 f1 7b 15 01 61 0b a0 39 27 60 01 10 83 62 2b 76 39 6c 22 1e 20 af 4d Data Ascii: w(FZ``@t,qTS5k,C{MtU41a(=-`T#31qW0q?B#GZc$m/Ah_QyOux")bT'T]B&0/^%G&!q5GnEp^p='Fj2qB/ubK,]1?{a9'`b+v9l" M
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: e5 d1 99 80 d4 2d 4f 80 a7 df 44 aa 3b 36 be ef 6f 23 2d 29 58 fd b6 83 1f 28 a0 ac 0a 50 69 ff ef 0c 10 cc eb d0 70 71 34 7d 2b 5c f9 b7 89 14 f5 4a a7 01 e8 58 4f 33 c3 81 a2 4a b4 8b 9f 5a 28 50 33 f0 d0 8a 02 05 8a 35 8b 0a 0e 9e 3a 93 17 c4 ee 9b 65 a9 6a 5a dc 18 d6 c9 52 d6 a4 28 35 2b 66 d1 da 3b 7c 26 a6 1f c2 83 5a 5c 43 fb d6 53 50 e2 13 9e a8 01 59 ba 06 80 e7 19 74 93 79 85 c9 5e 8d 9a 11 b8 81 4b 04 53 05 a7 09 64 66 a2 af cc 88 2a a8 81 8a 0f f8 7a 00 0d 40 70 48 60 3c 23 64 d7 28 cf ca 32 77 9e 27 25 2b 66 a3 7b d6 95 1a c6 8e 15 c1 87 f0 a6 20 da ed fe f3 14 2a 98 c4 df 42 41 96 3e 7c 29 93 3d 79 ad 66 38 70 5b b9 71 4e 04 20 70 2c c8 48 b0 41 c2 76 e5 b8 34 01 c0 6b d0 90 27 7d 01 ab 84 b8 5c 6e 73 03 bc c2 e7 4a b7 c0 65 85 c5 2f 21 b4 Data Ascii: -OD;6o#-)X(Pipq4}+\JXO3JZ(P35:ejZR(5+f;\|&Z\CSPYty^KSdfz@pH`<#d(2w'%+f{ BA>\|)=yf8p[qN p,HAv4k'}\nsJe/!
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 9e 45 5b ac 64 90 9c e6 2b fe 1f 2f 0e 01 a7 5e 0a 94 0e 46 c4 b2 6a 5d bc bf 74 7e 2c 45 55 89 43 e1 08 9a ae ce f3 25 c0 af fc ea b2 70 3e 5d b9 3b e0 9c 3e 8d de af 5e bd 4b 2a f6 48 51 e5 e7 7e ce 15 38 80 eb a5 c0 04 36 8e a6 e9 59 45 00 a8 eb 5f c6 6a e8 4c 25 c0 7e 8a f7 e0 eb 88 c0 02 15 90 2b 34 58 67 c1 1e 6c 9c 38 e5 5c 31 35 2b 7d ba 66 de af 28 c6 15 0f c0 01 e4 b4 62 ff 00 d2 15 4c a8 6c cb de 95 17 2e 56 7e e4 94 f9 52 a6 ce f6 ec 69 a9 a9 db b8 0d be 46 6d b9 7a 68 ae 56 5c d6 6e ed 9a 40 e6 4e b9 30 08 d6 b8 f9 dd af 6f ee 14 14 e0 42 d3 dc e7 a4 fe 1f c3 a5 ec df 56 8a 57 20 35 50 f2 01 24 a3 40 e4 ce 45 16 e0 e3 6b 62 ee fa d6 03 34 48 62 a1 8a 68 40 ae ee 9c 80 67 cc f6 e9 79 9e 61 bb 9b 63 a8 44 6a f2 ee 1f ef 96 04 f4 5e 0a 6b ee 94 Data Ascii: E[d+/^Fj]t~,EUC%p>];>^K*HQ~86YE_jL%~+4Xgl8\15+}f(bLl.V~RiFmzhV\n@N0oBVW 5P$@Ekb4Hbh@gyacDj^k
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 94 c3 f1 3b 42 3c cc c3 3d ac 93 3e 34 8d bd 58 ae 8e 89 34 44 34 2e c8 5b c4 7c db bf 18 d4 86 8f 9b bc 32 ac 93 1c 14 9c d6 ba 44 47 4a 81 2a 3a 1e 4e a4 12 15 50 00 50 94 43 3b d4 44 52 4c 1d dc 8b 38 54 1c 0d 55 9c 99 e1 73 45 e2 0a ba 58 3c 3e 47 84 44 5b 2c 00 54 30 43 e8 e3 bc 5e 34 00 10 c8 c4 f1 d9 82 da 8b 43 63 84 40 10 40 46 65 3c 1e 52 c8 3a 3c 71 c6 67 e4 8a af e0 18 34 98 c6 e2 52 44 6b 24 ba 59 e4 bf 30 cc 37 1e c0 c5 05 24 1c a8 eb c5 19 ba 32 e4 09 3d 3a 21 81 73 44 c7 ef 83 01 3b 64 47 84 1c b3 78 84 42 ff f8 eb 18 7a 43 44 24 88 02 2e d4 c7 8f 2b 87 2f 04 c3 8f 8b 07 3b 69 81 a4 02 47 4c c4 a0 19 a8 93 18 78 81 86 f4 3e 17 78 c8 51 8c 48 e4 11 c6 2a a1 48 c3 d8 8b 93 5b 17 7b 44 44 7b eb 48 e3 a3 06 47 ec bf 7c 33 05 3b 51 bf 29 eb c5 Data Ascii: ;B<=>4X4D4.[\|2DGJ:NPPC;DRL8TUsEX<>GD[,T0C^4Cc@@Fe<R:<qg4RDk$Y07$2=:!sD;dGxBzCD$.+/;iGLx>xQHH[{DD{HG\|3;Q)
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 50 60 68 e6 38 49 af b8 30 26 6b c0 63 26 2b a0 86 3d 6e b1 8f 7e bc 09 f5 e2 22 48 bf c0 20 88 00 08 41 11 13 99 c8 f1 35 92 91 2d 68 22 68 54 48 49 5a b2 e4 2e 57 d0 a4 26 3b 49 99 4e 1c 0f 94 38 01 64 5c 3a 31 c8 a9 80 a0 06 9b 42 81 2a 57 b9 4a dc b9 92 91 27 80 81 a9 fc f2 c4 5a 56 ff d3 3c 64 d9 41 2e 75 b9 4b d7 7c 72 7e ae e8 57 65 48 c9 97 12 98 51 88 1e 5c 66 3a 43 e0 4c 57 72 c0 03 d2 ec 4b fa ac 39 cf 8d dc 25 9b da cc 24 37 49 d6 32 1c ba 22 98 c2 24 a6 54 4c 09 a7 64 a6 d3 a0 8a 64 a7 33 dd 09 cf ef 30 8b 9e 0f d5 08 59 96 80 cf 4c 72 52 9f f2 89 42 1e aa e6 28 67 fc a2 82 81 0c 28 54 8c d9 3d 21 1c d4 a4 cd 4c 28 23 25 07 83 38 42 d4 a5 06 21 0b 2e 29 7a c5 8b 52 a7 13 79 08 c6 46 d7 02 89 5b 78 d4 a6 21 ad 48 39 e1 94 04 65 9a 74 99 49 e4 Data Ascii: P`h8I0&kc&+=n~"H A5-h"hTHIZ.W&;IN8d\:1B*WJ'ZV<dA.uK\|r~WeHQ\f:CLWrK9%$7I2"$TLdd30YLrRB(g(T=!L(#%8B!.)zRyF[x!H9etI
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: d7 d9 93 bb 46 07 20 af b2 67 10 dc 00 ff fc e8 8a dd 6a 29 df f1 01 2f ea bc 96 ee 3c 8b c7 79 2c ed ba ac b1 ca a5 03 37 1f 13 73 bb 5c e3 ca f3 2b 2b f2 b2 eb ed 41 1f 70 9d bc a5 5f 55 f4 32 41 da a5 bd 6b 4a 7f b1 31 2f bd ed ee ee 1b f7 bc 69 48 f5 46 5f ee 04 80 9e 3b df f3 b3 db e8 ca fb ee f3 9c 7a 61 2f f6 23 9e f3 5f b5 8e 67 bf f4 b3 8b f0 2c 9c 73 ed 58 c6 ba 0e f7 71 ff 82 66 bf f3 2f 6f d9 08 7e f1 79 bf 71 51 bf 60 7e 0f 13 41 1a f1 2d 3f f1 16 7b 08 f0 64 f8 3c db b2 02 87 c1 e2 be f8 71 9f 5c 03 8f ee 83 df ae 67 00 05 43 8c f7 51 6e a2 91 8e 98 9a ff 12 41 6a e2 6a 0b f9 03 3b d0 18 6f a2 eb 9b 59 a9 3f f6 f9 29 70 74 e0 fa 60 6c b0 26 8a f9 f4 0c 56 b5 cf f8 56 ff 55 9d 9f 6a b9 ff f9 ee ee b3 57 aa a5 c8 15 fc 30 a1 03 c8 16 f8 02 97 Data Ascii: F gj)/<y,7s\++Ap_U2AkJ1/iHF_;za/#_g,sXqf/o~yqQ`~A-?{d<q\gCQnAjj;oY?)pt`l&VVUjW0
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: c7 04 95 81 8e fd a2 96 54 34 23 eb 06 3c fc 67 98 43 21 92 42 d7 92 62 c9 84 2a 09 99 5f 57 74 8a 08 8e 75 67 99 03 10 89 68 69 87 a8 a7 66 df 47 58 a0 29 14 96 27 97 62 a9 97 a8 79 77 92 69 86 5f 59 80 05 c0 05 95 f1 8a 68 d9 49 89 b0 71 c8 b4 66 b8 58 98 b7 89 13 96 27 8c 89 c8 88 bd f9 7c 61 89 88 c1 59 72 99 57 9c b1 49 4c 8f c6 1b 07 f9 9c 2b ff 81 98 0c a9 88 94 59 9d 21 69 7b 5e 97 02 89 b8 94 60 37 8e dd d9 2a 56 a7 73 e2 39 13 ab e8 75 a4 89 86 70 40 96 82 48 77 2e 28 84 ec a9 94 e8 f7 86 fe 18 9f 82 32 6a 29 52 9f 87 09 72 ce a7 04 8a 98 9d 19 c8 75 fe d9 7c e5 29 a0 60 f7 86 16 69 a0 77 a2 85 95 a1 a0 3d 21 9a 25 17 a0 69 f8 92 04 48 72 20 9a 9a 15 9a 86 ee a9 8a 14 a9 a1 92 b2 89 d0 f1 99 1e 9a 13 77 77 9d 2a 8a 7b b2 57 77 8e 28 0e 35 f0 86 Data Ascii: T4#<gC!Bb_WtughifGX)'bywi_YhIqfX'\|aYrWIL+Y!i{^`7Vs9up@Hw.(2j)Rru\|)`iw=!%iHr ww*{Ww(5
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: ba 1f 9c 9a 73 a7 b4 b2 d4 d5 97 12 0f 04 c4 c1 86 03 60 9f e7 f1 fa bf bb 82 fc c0 21 e6 e7 e9 7e 7d 61 f3 fb b9 c0 c7 c7 ed 99 18 e1 71 0f d2 e4 f5 b6 bc bc b7 a5 b7 db dd 9e c1 c7 5b 74 73 59 ac 99 ac a4 a5 7f 03 5b 96 83 96 96 dc 5c 0a 01 8d e7 b0 35 0b f0 f7 fd d4 38 04 01 7f d0 01 99 f9 53 61 61 87 77 89 90 7f 91 b1 a0 b1 fb 85 17 fd e7 21 87 58 58 02 76 c3 3a b3 ff e7 85 15 3c 4c 4c fe 6b 1b fe e0 23 84 8d 8e 1d 5d 83 e9 8e 1a 7a cb ff 77 7b 86 d9 52 08 df 65 11 b4 b0 7c c7 3c 0c 9e a4 a4 f6 cf 28 6a 6a 7a 37 81 bc 8c 7b 8d b1 b3 8a fe c5 21 02 70 b8 e5 7a 12 d1 ce a8 b6 ba 8b fd 79 19 e8 c9 30 d0 83 29 ad b4 95 c7 bb c7 ca aa 26 df e1 c8 1f a8 ff f0 ef e2 a1 87 2f 46 4d 4a cf c7 d0 9d 51 42 a5 2e 06 aa b5 9f db d8 ba fd d4 25 4f 76 9f 9e bb cc e8 Data Ascii: s`!~}aq[tsY[\58Saaw!XXv:<LLk#]zw{Re\|<(jjz7{!pzy0)&/FMJQB.%Ov
2024-09-27 22:15:28 UTC	16384	IN	Data Raw: 6f 5b 7b a8 bf 9b 07 47 e9 bd 6f fb b6 52 41 b3 f7 3b 24 00 bc c7 7b 3c 3b 18 fc c1 7b 25 73 a7 05 31 dc f9 b0 cf 42 2f 9b 7b 6a b4 f9 29 cf fb 42 4c 3c af 79 30 a3 5f bc 1c e6 3b 19 2b 43 bf 1f b9 1b 7c bc cf 03 7c 3b a4 c3 c8 8b 73 75 e8 7c bf 5f c2 3b c4 f8 bb a3 04 ae 43 36 cc 2b 44 96 7b dc 0b 8c ba cd e7 22 ce 93 c9 3b 6c 3c b8 ff fb cf ff bc 19 70 83 c8 0f bd 5e ab 45 3e b8 c1 ce 2f 40 1f 84 0b 93 a3 06 b5 e7 ee d3 c7 fc 22 7f 70 d5 0f 78 76 17 ba d1 73 7c d7 e7 3d c0 53 03 d8 8b bd 19 3d 79 47 60 82 3f 24 c0 20 9c 7d 08 90 ee ad 2e fd 64 9f f9 db 43 7d 27 0b f0 dc 67 1f 25 d4 3d d6 6b ff fd a9 bb 01 22 e8 bd e6 27 80 19 d0 83 3d 84 bd df 6b cd 13 7c c3 34 f4 c3 e0 7b 3c 24 9c 7d c3 a7 c5 14 c0 37 a1 47 7c e3 47 7d e6 c9 a8 cd 4f 3e 45 17 c3 ce 87 Data Ascii: o[{GoRA;${<;{%s1B/{j)BL<y0_;+C\|\|;su\|_;C6+D{";l<p^E>/@"pxvs\|=S=yG`?$ }.dC}'g%=k"'=k\|4{<$}7G\|G}O>E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49759	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:28 UTC	801	OUT	GET /skin/js/jquery-2.2.4.min.js HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
2024-09-27 22:15:30 UTC	381	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:28 GMT Content-Type: application/javascript Content-Length: 85582 Last-Modified: Wed, 06 Mar 2024 15:30:22 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c0e-14e4e" Expires: Sat, 28 Sep 2024 10:15:28 GMT Cache-Control: max-age=43200 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:30 UTC	16003	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 32 2e 32 2e 34 20 7c 20 28 63 29 20 6a 51 75 65 72 79 20 46 6f 75 6e 64 61 74 69 6f 6e 20 7c 20 6a 71 75 65 72 79 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 20 2a 2f 0d 0a 21 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 26 26 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 61 2e 64 6f 63 75 6d 65 6e 74 3f 62 28 61 2c 21 30 29 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 64 6f 63 75 6d 65 6e 74 29 74 68 72 6f 77 20 6e 65 77 20 45 72 72 6f 72 28 22 6a 51 75 65 72 79 20 72 65 71 75 69 72 65 73 20 61 20 77 69 6e 64 6f 77 20 77 69 74 68 20 61 20 64 6f 63 75 6d 65 Data Ascii: /! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a docume
2024-09-27 22:15:34 UTC	16384	IN	Data Raw: 6e 20 64 5b 75 5d 3f 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 65 29 7b 76 61 72 20 66 2c 67 3d 64 28 61 2c 6e 75 6c 6c 2c 65 2c 5b 5d 29 2c 68 3d 61 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 68 2d 2d 29 28 66 3d 67 5b 68 5d 29 26 26 28 61 5b 68 5d 3d 21 28 62 5b 68 5d 3d 66 29 29 7d 29 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 65 2c 66 29 7b 72 65 74 75 72 6e 20 62 5b 30 5d 3d 61 2c 64 28 62 2c 6e 75 6c 6c 2c 66 2c 63 29 2c 62 5b 30 5d 3d 6e 75 6c 6c 2c 21 63 2e 70 6f 70 28 29 7d 7d 29 2c 68 61 73 3a 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 20 66 61 28 61 2c 62 29 2e 6c 65 6e 67 74 68 3e 30 7d 7d 29 2c 63 6f 6e 74 61 69 6e 73 3a 68 61 28 66 75 6e 63 74 69 6f 6e 28 61 29 Data Ascii: n d[u]?ha(function(a,b,c,e){var f,g=d(a,null,e,[]),h=a.length;while(h--)(f=g[h])&&(a[h]=!(b[h]=f))}):function(a,e,f){return b[0]=a,d(b,null,f,c),b[0]=null,!c.pop()}}),has:ha(function(a){return function(b){return fa(a,b).length>0}}),contains:ha(function(a)
2024-09-27 22:15:36 UTC	16384	IN	Data Raw: 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 4e 2e 72 65 6d 6f 76 65 28 61 2c 62 29 7d 7d 29 2c 6e 2e 66 6e 2e 65 78 74 65 6e 64 28 7b 64 61 74 61 3a 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 2c 64 2c 65 2c 66 3d 74 68 69 73 5b 30 5d 2c 67 3d 66 26 26 66 2e 61 74 74 72 69 62 75 74 65 73 3b 69 66 28 76 6f 69 64 20 30 3d 3d 3d 61 29 7b 69 66 28 74 68 69 73 2e 6c 65 6e 67 74 68 26 26 28 65 3d 4f 2e 67 65 74 28 66 29 2c 31 3d 3d 3d 66 2e 6e 6f 64 65 54 79 70 65 26 26 21 4e 2e 67 65 74 28 66 2c 22 68 61 73 44 61 74 61 41 74 74 72 73 22 29 29 29 7b 63 3d 67 2e 6c 65 6e 67 74 68 3b 77 68 69 6c 65 28 63 2d 2d 29 67 5b 63 5d 26 26 28 64 3d 67 5b 63 5d 2e 6e 61 6d 65 2c 30 3d 3d 3d 64 2e 69 6e 64 65 78 4f 66 28 22 64 61 74 61 2d 22 29 26 26 28 64 Data Ascii: a:function(a,b){N.remove(a,b)}}),n.fn.extend({data:function(a,b){var c,d,e,f=this[0],g=f&&f.attributes;if(void 0===a){if(this.length&&(e=O.get(f),1===f.nodeType&&!N.get(f,"hasDataAttrs"))){c=g.length;while(c--)g[c]&&(d=g[c].name,0===d.indexOf("data-")&&(d
2024-09-27 22:15:38 UTC	16384	IN	Data Raw: 7c 7c 28 63 3d 61 29 2c 63 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 62 29 7d 2c 44 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 2c 64 29 7b 76 61 72 20 65 2c 66 2c 67 3d 7b 7d 3b 66 6f 72 28 66 20 69 6e 20 62 29 67 5b 66 5d 3d 61 2e 73 74 79 6c 65 5b 66 5d 2c 61 2e 73 74 79 6c 65 5b 66 5d 3d 62 5b 66 5d 3b 65 3d 63 2e 61 70 70 6c 79 28 61 2c 64 7c 7c 5b 5d 29 3b 66 6f 72 28 66 20 69 6e 20 62 29 61 2e 73 74 79 6c 65 5b 66 5d 3d 67 5b 66 5d 3b 72 65 74 75 72 6e 20 65 7d 2c 45 61 3d 64 2e 64 6f 63 75 6d 65 6e 74 45 6c 65 6d 65 6e 74 3b 21 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 62 2c 63 2c 65 2c 66 2c 67 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 76 22 29 2c 68 3d 64 2e 63 72 65 61 74 65 45 6c 65 6d 65 6e 74 28 22 64 69 Data Ascii: \|\|(c=a),c.getComputedStyle(b)},Da=function(a,b,c,d){var e,f,g={};for(f in b)g[f]=a.style[f],a.style[f]=b[f];e=c.apply(a,d\|\|[]);for(f in b)a.style[f]=g[f];return e},Ea=d.documentElement;!function(){var b,c,e,f,g=d.createElement("div"),h=d.createElement("di
2024-09-27 22:15:40 UTC	16384	IN	Data Raw: 66 28 65 3d 66 62 28 63 29 2c 64 3d 31 3d 3d 3d 63 2e 6e 6f 64 65 54 79 70 65 26 26 28 22 20 22 2b 65 2b 22 20 22 29 2e 72 65 70 6c 61 63 65 28 65 62 2c 22 20 22 29 29 7b 67 3d 30 3b 77 68 69 6c 65 28 66 3d 62 5b 67 2b 2b 5d 29 64 2e 69 6e 64 65 78 4f 66 28 22 20 22 2b 66 2b 22 20 22 29 3c 30 26 26 28 64 2b 3d 66 2b 22 20 22 29 3b 68 3d 6e 2e 74 72 69 6d 28 64 29 2c 65 21 3d 3d 68 26 26 63 2e 73 65 74 41 74 74 72 69 62 75 74 65 28 22 63 6c 61 73 73 22 2c 68 29 7d 7d 72 65 74 75 72 6e 20 74 68 69 73 7d 2c 72 65 6d 6f 76 65 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 2c 63 2c 64 2c 65 2c 66 2c 67 2c 68 2c 69 3d 30 3b 69 66 28 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 61 29 29 72 65 74 75 72 6e 20 74 68 69 73 2e 65 61 63 68 28 66 75 6e Data Ascii: f(e=fb(c),d=1===c.nodeType&&(" "+e+" ").replace(eb," ")){g=0;while(f=b[g++])d.indexOf(" "+f+" ")<0&&(d+=f+" ");h=n.trim(d),e!==h&&c.setAttribute("class",h)}}return this},removeClass:function(a){var b,c,d,e,f,g,h,i=0;if(n.isFunction(a))return this.each(fun
2024-09-27 22:15:40 UTC	4043	IN	Data Raw: 2e 61 6c 77 61 79 73 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 6f 69 64 20 30 3d 3d 3d 66 3f 6e 28 61 29 2e 72 65 6d 6f 76 65 50 72 6f 70 28 65 29 3a 61 5b 65 5d 3d 66 2c 62 5b 65 5d 26 26 28 62 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 3d 63 2e 6a 73 6f 6e 70 43 61 6c 6c 62 61 63 6b 2c 4a 62 2e 70 75 73 68 28 65 29 29 2c 67 26 26 6e 2e 69 73 46 75 6e 63 74 69 6f 6e 28 66 29 26 26 66 28 67 5b 30 5d 29 2c 67 3d 66 3d 76 6f 69 64 20 30 7d 29 2c 22 73 63 72 69 70 74 22 29 3a 76 6f 69 64 20 30 7d 29 2c 6e 2e 70 61 72 73 65 48 54 4d 4c 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 7c 7c 22 73 74 72 69 6e 67 22 21 3d 74 79 70 65 6f 66 20 61 29 72 65 74 75 72 6e 20 6e 75 6c 6c 3b 22 62 6f 6f 6c 65 61 6e 22 3d 3d 74 79 70 65 6f 66 20 62 26 26 28 Data Ascii: .always(function(){void 0===f?n(a).removeProp(e):a[e]=f,b[e]&&(b.jsonpCallback=c.jsonpCallback,Jb.push(e)),g&&n.isFunction(f)&&f(g[0]),g=f=void 0}),"script"):void 0}),n.parseHTML=function(a,b,c){if(!a\|\|"string"!=typeof a)return null;"boolean"==typeof b&&(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	49760	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:28 UTC	805	OUT	GET /static/images/session2right.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
2024-09-27 22:15:29 UTC	370	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:28 GMT Content-Type: image/jpeg Content-Length: 31305 Last-Modified: Wed, 06 Mar 2024 15:31:14 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c42-7a49" Expires: Sun, 27 Oct 2024 22:15:28 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:29 UTC	16014	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 48 00 48 00 00 ff e1 00 40 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 02 a0 02 00 04 00 00 00 01 00 00 01 ba a0 03 00 04 00 00 00 01 00 00 01 0e 00 00 00 00 ff ed 00 38 50 68 6f 74 6f 73 68 6f 70 20 33 2e 30 00 38 42 49 4d 04 04 00 00 00 00 00 00 38 42 49 4d 04 25 00 00 00 00 00 10 d4 1d 8c d9 8f 00 b2 04 e9 80 09 98 ec f8 42 7e ff c0 00 11 08 01 0e 01 ba 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 23 42 b1 c1 15 52 d1 f0 24 33 62 72 82 09 Data Ascii: JFIFHH@ExifMM*i8Photoshop 3.08BIM8BIM%B~"}!1AQa"q2#BR$3br
2024-09-27 22:15:33 UTC	15291	IN	Data Raw: 77 7e 6f be e7 88 dc eb 1f 14 bc 30 ad 27 8d bc 09 73 25 ac 50 f9 f3 5f 78 7a e1 35 28 a3 4e fb e1 71 14 d9 5c 64 aa 09 0e 3a 66 b0 fc 41 f1 97 4c b3 f0 cc da ff 00 82 34 9b ff 00 1b 5c da 4f 14 77 7a 3e 94 a2 3d 52 da 29 32 5a 49 2d 6e 3c b9 54 20 fe 12 a0 9c 8c 71 cd 7e 85 5d 1b 54 8f f7 e0 00 78 18 1f 37 e1 5f 31 7c 45 f8 3f f0 db e2 86 b6 fa 8a 5e 1d 2f c6 1a 7a af 91 ab e9 17 4b 1e a7 6b b3 ee 79 8a ac 77 20 ee b2 2e 08 e3 a5 55 1c 6c 6b a7 19 fb bd 9a d7 f0 ff 00 87 f4 3c 49 52 a7 34 e5 4d 72 fe 5f 8f f9 9f 9d 69 e2 27 f8 b3 e2 bb 3f 14 69 8b 71 1d ce bd ae c3 6d a2 9b 85 68 ae ec 2d 2d 24 5d e4 21 39 84 a4 70 cb 24 80 75 62 43 67 a5 7e 80 ea 64 7f 67 de 11 c0 30 4d ff 00 a0 1a f9 27 e1 2f c2 1f 12 f8 1f e3 36 a3 a6 78 cb 52 59 a5 f0 76 98 13 4b 10 Data Ascii: w~o0's%P_xz5(Nq\d:fAL4\Owz>=R)2ZI-n<T q~]Tx7_1\|E?^/zKkyw .Ulk<IR4Mr_i'?iqmh--$]!9p$ubCg~dg0M'/6xRYvK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	49761	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:28 UTC	1041	OUT	GET /static/images/section4i4.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237
2024-09-27 22:15:29 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:29 GMT Content-Type: image/gif Content-Length: 3422486 Last-Modified: Wed, 06 Mar 2024 15:30:52 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c2c-343916" Expires: Sun, 27 Oct 2024 22:15:29 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:29 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fe d8 20 7a 02 02 ff 5d 1f 20 7f a9 fa 90 16 ff 7b 17 fe d8 21 ae 06 06 ff ff ff 60 b5 b1 5f 02 02 9b de ff bd ea ff cf 35 02 00 92 44 02 69 37 93 8e 79 00 00 00 e0 db c7 7d 09 09 1a d5 71 fc ee 21 ff 00 00 ff b4 84 cd ee ff 60 bf e9 79 01 01 fe c6 1d fa 8f 15 bd ea ff fe cd 1e fe d3 1f fc a3 18 a9 05 05 7c 01 01 fd c0 1c fb 9c 17 9d 04 04 fa 95 17 fd aa 1a d9 3f 0a 96 04 04 8f 03 03 ff 79 15 d3 39 06 84 04 03 7f 03 02 fe fd fa ac e4 ff fe d7 1f fd b4 1b f5 53 18 e3 a3 4f a4 04 04 8a 03 03 fd b9 1c fd af 1a 3e 3e 3e 35 91 ac bd ec ff 59 af b0 f3 69 13 fb 58 1b ff f7 d4 43 9d ae df 4b 11 ff Data Ascii: GIF89a!NETSCAPE2.0!, z] {!`_5Di7y}q!`y\|?y9SO>>>5YiXCK
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 2e 33 2b 34 48 64 9d 09 70 2d e0 42 05 35 dc 32 f4 4a 74 2e 6f 82 e3 02 b1 c9 3e 6a 2c 20 b2 46 e7 74 42 08 34 6f 44 6d 42 2c b3 28 9a f3 3a 9b f4 49 eb dc f8 e9 ac 72 f2 6c 42 08 83 88 1a 83 38 5c c2 25 08 83 54 0b 03 54 df 03 4c 6f 70 ec 92 82 e2 d6 b4 95 fa b2 b9 9a 81 17 64 c5 16 6c 85 57 34 06 64 3c 41 31 eb 34 cb a8 f1 91 bc 6c a7 22 b3 d6 3d 85 a7 ea 2d 51 5f 72 05 57 80 3c 27 84 38 3c 80 38 f8 43 3e 80 83 2f 80 1d bb 95 01 38 80 43 30 5c c2 55 3b c0 f7 86 b0 03 20 ad af d2 a4 a4 9a c1 20 2c 02 47 e3 8e 51 74 ff c1 22 f8 a8 5a b3 cc 20 1c 89 ef 2e f0 33 bb f1 48 12 f5 3f 1c e3 e8 ee 2c b2 7e 01 38 e8 9b 53 0a 36 01 80 83 30 58 f5 35 7f 2f 05 88 71 63 93 2b 11 93 a8 13 78 c1 16 54 b6 65 0b ca 10 2c c2 20 a4 f5 66 47 88 01 f0 6e 6f 78 81 68 1b 35 54 Data Ascii: .3+4Hdp-B52Jt.o>j, FtB4oDmB,(:IrlB8\%TTLopdlW4d<A14l"=-Q_rW<'8<8C>/8C0\U; ,GQt"Z .3H?,~8S60X5/qc+xTe, fGnoxh5T
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 88 84 6e 24 bc 2a a0 ce 35 68 ca 85 58 cd 7c 94 cf 8a 08 c5 da ab 02 95 64 49 2b f0 81 23 10 80 0e f5 d0 0f bd 01 1f 40 01 ac 04 06 05 ad 3d 19 cc 4d f8 64 46 b1 90 00 36 83 c8 03 08 81 74 ec cf e3 54 a3 b3 cb 48 92 30 ca d4 4b 04 43 e0 51 1e 35 50 ea 9c 00 13 25 3c 38 a0 ce be 74 4a 15 e5 4d 8c 98 05 05 ac 3d 22 c0 d0 81 1c 02 0e fd d0 29 a5 d2 23 18 82 ab e4 ca db 43 51 8c 88 50 5a 9c d0 8d 00 04 a0 dc 49 19 9d 51 ff 0c c2 8f 92 39 ff b9 3c 80 ff 33 03 20 05 52 e8 b4 50 ea 04 49 4d 64 88 2e d5 42 d7 9c 88 67 b4 3d 3a 30 4c 28 bd 01 2a 05 54 40 3d 82 11 5d c9 2d e8 ca da fb c6 8c d0 cd ed 4b 52 ae f0 cd 09 7a d1 03 48 4b db 59 cb 32 5d 8f cd 3c 09 17 7b 37 92 f8 bf 44 70 53 ea 3c d4 da a3 4e a6 b4 be 86 58 54 a8 ec 08 7e dc d3 3e 0d 48 2b 90 d2 40 85 d5 Data Ascii: n$5hX\|dI+#@=MdF6tTH0KCQ5P%<8tJM=")#CQPZIQ9<3 RPIMd.Bg=:0L(T@=]-KRzHKY2]<{7DpS<NXT~>H+@
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 82 4d cc 85 9a 99 50 6b 6d 28 a5 93 b4 d8 28 e0 77 d5 a1 8c 75 dd 68 1c 7a ae e6 3a ae 58 3b b2 21 e3 0a 04 5c 15 f5 b1 b3 5d 84 47 2f 57 d2 6c 42 41 db 7b 13 4e 17 be 5a ee a1 a2 fb c8 0e 46 b6 66 86 fb ba fd ed b6 c4 29 8e 6e c0 67 6a f0 0e 0a 66 fa 0e 8f 78 43 dd 7a 64 06 5d d3 de 12 6a ef 50 05 59 e1 48 37 35 66 73 90 83 96 33 0b f3 b1 c9 24 39 3b 8f ab cf 2b 8c d4 50 e2 85 50 25 bb 2c 12 24 99 eb 29 97 2d cb 0d 35 83 0e cb c6 8d e9 1b 31 ed 4d 3f 6a 68 26 bb 99 aa bd 37 65 b9 1e d1 a0 27 15 13 ae 2f 7e 75 90 cf 9c 1d 2c df bb fd cd 35 ff 9b e8 bd ce d0 3f 69 83 d8 b2 fb c1 51 40 75 cc 4e 02 e0 6d 9a c1 ba 29 28 3d 42 7f 5f dc f6 9b 6b f6 84 6a 00 3b 50 0b de d8 d2 79 9e a0 67 7e b5 06 fa 24 02 f3 07 77 d5 d1 66 f7 f7 66 cc 06 3f fc 87 52 08 d7 5f e6 Data Ascii: MPkm((wuhz:X;!\]G/WlBA{NZFf)ngjfxCzd]jPYH75fs3$9;+PP%,$)-51M?jh&7e'/~u,5?iQ@uNm)(=B_kj;Pyg~$wff?R_
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 56 11 f0 23 59 c5 65 09 df 75 4c 52 95 0e e4 a8 b8 1f 52 ff ee b2 ff e4 ec 42 49 7b e4 81 35 79 0f 92 dc e8 45 ae fc 01 4f ee 79 cb 81 1e 4d 2c 68 6c df 4d 50 5e af d8 f6 32 b0 8f bd 33 d8 a1 76 d7 7d 82 1c 8a 8f 3d cd 53 11 88 40 d4 5e d6 39 a2 34 ee 7f a5 fb ea e5 5a d7 29 d8 b6 4a b0 0d d8 55 0a 7f f8 aa c5 9e 31 6e 35 f3 eb 77 9d 1d b4 16 16 1d d8 b1 0e ee cf 9f ff 4a ce d1 35 c1 4f e8 ec cb f2 46 a2 af b6 ab 2b 58 ae 20 d8 af fd d4 62 b5 64 27 eb f2 64 eb fa 2f 28 52 61 1d c8 a1 1a ec 6f 30 fa a0 1a f2 cf f1 26 f0 03 9f e6 b2 ec 0d 6b ff 3c 2e a6 78 8b 00 e1 0e 5c bc c2 98 f8 6c 01 73 26 ef 64 87 19 06 0f 04 59 4c 1b 9c a1 1e d8 41 1c aa 61 07 77 50 1c c4 81 1d d8 81 1c d6 c1 19 f6 8f 06 41 90 de 8a 82 c9 48 90 ed e4 89 f7 f8 ed 51 86 65 df 8a 09 81 Data Ascii: V#YeuLRRBI{5yEOyM,hlMP^23v}=S@^94Z)JU1n5wJ5OF+X bd'd/(Rao0&k<.x\ls&dYLAawPAHQe
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 32 70 d3 09 7e 5c 25 2b 41 21 4e 11 ec a0 9c 22 10 27 28 fc a0 ce 24 b0 d3 9b de e4 26 3c 29 86 cb 6c d2 93 8f 4e 50 64 6d d4 27 9c 11 38 72 63 91 64 66 dd 90 29 d0 64 02 f4 2f 50 88 d5 09 b4 08 8f 68 4e 2f 02 3d 38 dc 69 14 f8 94 64 d4 b3 a2 16 d5 e3 45 2f fa c0 08 fa 67 38 f0 ea e7 01 70 40 00 2c 0c af a0 11 19 28 4a 27 b4 4c 4d 4a e0 18 02 2c 9a 01 0c 30 a5 86 1e 90 8e ea 69 14 69 92 e1 88 8c f2 b4 a7 3e 85 9c 11 93 b0 83 5e d6 26 07 6a aa 8b 09 38 00 d2 0f 10 a0 a9 66 18 a6 49 0b 62 cc 94 52 95 3a 2b 55 23 29 98 d5 cf e8 01 a5 a1 11 30 5c 7b 5c 87 38 f4 3c c0 16 b3 b0 04 ff 19 0a f9 d3 b5 b2 95 7c 7d 4c 22 51 71 c3 c8 e1 14 c8 91 1a 68 6a 53 6f 70 03 23 68 2e aa 53 ad 2a 60 21 c3 cc 6e 90 c2 0c 04 a0 81 52 fb 49 2b ad 79 35 02 73 4c 40 0f ae 47 14 24 Data Ascii: 2p~\%+A!N"'($&<)lNPdm'8rcdf)d/PhN/=8idE/g8p@,(J'LMJ,0ii>^&j8fIbR:+U#)0\{\8<\|}L"QqhjSop#h.S*`!nRI+y5sL@G$
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 5d 4e a9 c2 07 42 e0 86 e0 91 4f 7c 8b eb 07 f9 9c c2 bb 8c 7c a0 81 16 29 89 be ee c2 9f ff ff 50 aa 7e be d0 c2 f3 28 55 0a 2d 94 50 0d 27 3c 83 25 f0 b7 c2 fc 51 8a 6e fe 6b 1a 00 bb 31 c0 01 3e 66 61 4e b9 a0 04 1f 88 3b 09 e2 d0 0d 33 68 41 e2 a8 42 2d 0d a6 85 83 fd f1 dc 9b 7c c1 42 fc 59 e2 0c 29 64 22 fe 8a 30 c5 28 e2 4f 0d 2e 84 e1 ff 9e 36 43 1a 5a 2f 29 7a d9 5e 0f c3 b7 43 1e de 50 8c 04 a9 02 f8 2a 82 af 03 e4 20 37 fc 12 4f 24 be e5 26 2d 54 b1 8a 45 18 02 02 f4 88 80 21 14 21 8a 57 14 58 16 99 06 c0 4e 74 d1 7a 3a 78 dd 19 6f 47 46 f1 cd 41 0f 07 54 64 b4 82 40 12 37 7a 06 40 72 44 da b7 ea 68 47 16 5e 61 8f 9f 44 81 1f 59 88 89 4a 09 b2 64 00 94 80 32 0c 69 3a 44 ea e5 44 91 7c 0f 23 1f a8 01 d3 39 32 8c b0 74 4a 76 46 a2 21 c9 70 0c 40 Data Ascii: ]NBO\|\|)P~(U-P'<%Qnk1>faN;3hAB-\|BY)d"0(O.6CZ/)z^CP* 7O$&-TE!!WXNtz:xoGFATd@7z@rDhG^aDYJd2i:DD\|#92tJvF!p@
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: dc f5 a8 40 9c 9c ee d5 d0 0e 72 32 bc 6b 17 80 c6 c9 61 f7 a7 34 d9 79 dd ff 39 5f 09 35 c8 6a 66 dd a3 36 b1 b0 c1 70 3f fb f3 c2 6a d7 5d 34 de 2a bc cc df de 7c cb e5 f7 7c 2e ac f0 69 d4 75 8f b1 70 a6 89 df aa f0 c9 38 77 fd 35 d0 11 ab 10 27 85 95 c3 75 ac 7c 1b 04 be 2b e1 48 2c 6c 4a e8 cf 4a bb b0 d0 75 b3 8c ba a1 2b b8 d0 9f 81 ad b3 75 39 7a 25 a0 7d 2e 12 84 fb ee 6e 13 b8 df 4a e6 d6 84 17 a0 f5 ef 85 d2 20 79 d2 63 17 1f 96 c6 f1 95 a0 82 0c 04 73 4d f8 c9 27 44 5f 6b ae 0b d3 5d b7 ce d8 1b 7a c3 11 48 a3 e7 fd 58 fd 65 0e b4 fb 6b 1b b1 30 20 ea ab d5 e3 ce d5 b8 b5 51 2d 7e 2d 53 1d 7d 2e 76 bf ad 98 2d 3d 94 12 1c d0 ac 50 bd 1d 2c ac 10 01 e4 94 a7 16 56 3a a9 b5 0d 81 ba 0a de 02 bb d7 c0 a9 3c 10 79 ca c3 5e 0f aa 57 3b 82 8d 2c 83 Data Ascii: @r2ka4y9_5jf6p?j]4*\|\|.iup8w5'u\|+H,lJJu+u9z%}.nJ ycsM'D_k]zHXek0 Q-~-S}.v-=P,V:<y^W;,
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 98 c5 a0 1a 1f 6b f0 dd 5b f3 76 ac 19 0e 1f 28 e3 1e 17 c7 5a 56 90 09 40 ff 07 f4 e5 5f 9a bc 98 e7 a1 2f 86 96 cf 99 3f 1b 18 b5 49 77 29 ca 98 94 21 c8 21 cb 56 61 3d e0 52 04 f5 f2 e7 7e 49 aa 14 80 32 fb 6a 18 a8 a2 03 e7 5d fe af 9e 26 c0 83 e0 07 b2 53 e3 e2 3b d6 1a e4 c7 ab 17 40 01 0a 50 74 f7 62 d9 f6 1a d0 bd 81 38 c8 32 38 13 9f 96 96 a5 24 1e dc 85 63 41 8b 08 c1 88 66 34 b8 2c 6c 2c 6b 9a df 07 b5 12 9a a8 a1 05 21 54 e3 9f b9 14 c4 b5 5d 0c 90 85 2d 3c 9b cb 78 e5 ab 97 84 61 7b 0a 4c 82 73 c2 f7 40 64 dd 6a 0d 3f bb 61 49 22 60 10 be 41 a5 3d 41 c1 96 d2 40 98 44 ab 14 6e 3f a7 1b 88 b8 88 77 42 58 81 c0 76 b4 12 99 0b b1 98 c5 eb 19 ea 49 6d 53 0c 41 d8 e0 9c 2b e8 10 59 21 52 d2 13 7e 66 80 bc 19 a4 8a 50 b1 56 50 1e d6 17 0f 2a 51 89 Data Ascii: k[v(ZV@_/?Iw)!!Va=R~I2j]&S;@Ptb828$cAf4,l,k!T]-<xa{Ls@dj?aI"`A=A@Dn?wBXvImSA+Y!R~fPVP*Q
2024-09-27 22:15:29 UTC	16384	IN	Data Raw: 6e 50 fa 71 7f 75 4b e0 83 73 a7 6a 75 ef 67 34 ff 83 81 7f 76 b4 cb 9e 37 d0 83 93 67 f6 5a d0 d8 b1 cd 77 97 bf 91 31 e6 58 cb 6d 71 de 0a 00 fd 66 f6 29 70 ea ae 8f 83 9d 9f 90 4b 68 85 38 48 06 39 a8 74 af 51 78 e9 c5 f6 51 1f 03 a5 37 fc 6d ef 02 a6 e7 86 6f 98 f8 bf fe 86 a8 e7 06 a9 47 7c 33 a0 7c 33 58 00 8d 7f f5 7a 38 f7 08 e8 03 db 56 69 38 d8 fa 80 ef fa 64 b8 7b d8 55 1c b1 8f 82 2b 40 f9 9b cf 05 e3 be 1d 46 6e 64 b5 df 8f f2 95 f2 2d 8f bd 9e 66 17 ff 4b b5 88 1b cc ec 9b 67 f7 d1 8f 83 d2 bf 84 4b 78 84 99 2d fe e1 6f 85 bd e7 7b 39 e0 84 bf bf 79 50 b0 76 e9 3d ea 57 7f f8 c3 b7 fe eb 37 7c 33 b0 80 ed df 7e 57 30 03 72 b7 84 1f d8 7c 3e e8 73 ad f7 fd 61 e5 04 39 90 83 28 60 ff 28 d0 83 f7 87 ff f6 bf 02 d5 3f ff 0e 81 f2 81 03 f6 8b 31 Data Ascii: nPquKsjug4v7gZw1Xmqf)pKh8H9tQxQ7moG\|3\|3Xz8Vi8d{U+@Fnd-fKgKx-o{9yPv=W7\|3~W0r\|>sa9(`(?1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49763	90.84.161.25	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:28 UTC	355	OUT	GET /v6/collect?dt=4 HTTP/1.1 Host: collect-v6.51.la Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:29 UTC	315	IN	HTTP/1.1 220 Date: Fri, 27 Sep 2024 22:15:29 GMT Content-Length: 0 Connection: close Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers via: EU-GER-frankfurt-EDGE5-CACHE4[172],EU-GER-frankfurt-EDGE5-CACHE4[ovl,171] X-CCDN-REQ-ID-46B1: ec7ee73d14f0c826db8699475db96de1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49764	104.21.72.253	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:29 UTC	525	OUT	GET /matomo.js HTTP/1.1 Host: web.dcobxs.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:29 UTC	742	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:15:29 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=67460 ETag: W/"66f58035-10784" Expires: Sat, 28 Sep 2024 07:49:14 GMT Last-Modified: Thu, 26 Sep 2024 15:39:33 GMT CF-Cache-Status: HIT Age: 8775 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=k9m9%2F%2BgnGDWssW6XP1ogEL4bo3aLSWfeIYqLdYvZkKXA%2FYJI%2FYlHSL1b2YcIKWYkOvjRsk3cw%2FF8QIjYiGTbOWxYdTXgN6me8GplDAGJn2sxexsdfnDrhVVwp9Te6pi0Gg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9eda476d9e43c1-EWR
2024-09-27 22:15:29 UTC	627	IN	Data Raw: 33 39 65 63 0d 0a 2f 2a 21 21 0a 2a 20 4d 61 74 6f 6d 6f 20 2d 20 66 72 65 65 2f 6c 69 62 72 65 20 61 6e 61 6c 79 74 69 63 73 20 70 6c 61 74 66 6f 72 6d 0a 2a 0a 2a 20 4a 61 76 61 53 63 72 69 70 74 20 74 72 61 63 6b 69 6e 67 20 63 6c 69 65 6e 74 0a 2a 0a 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 70 69 77 69 6b 2e 6f 72 67 0a 2a 20 40 73 6f 75 72 63 65 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 6f 6d 6f 2d 6f 72 67 2f 6d 61 74 6f 6d 6f 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 6a 73 2f 70 69 77 69 6b 2e 6a 73 0a 2a 20 40 6c 69 63 65 6e 73 65 20 68 74 74 70 73 3a 2f 2f 70 69 77 69 6b 2e 6f 72 67 2f 66 72 65 65 2d 73 6f 66 74 77 61 72 65 2f 62 73 64 2f 20 42 53 44 2d 33 20 43 6c 61 75 73 65 20 28 61 6c 73 6f 20 69 6e 20 6a 73 2f Data Ascii: 39ec/!! Matomo - free/libre analytics platform JavaScript tracking client @link https://piwik.org* @source https://github.com/matomo-org/matomo/blob/master/js/piwik.js* @license https://piwik.org/free-software/bsd/ BSD-3 Clause (also in js/
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 57 3d 58 2e 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 6b 3d 75 6e 65 73 63 61 70 65 2c 4d 3d 5b 5d 2c 49 2c 76 2c 61 6d 3d 5b 5d 2c 7a 3d 30 2c 61 67 3d 30 2c 59 3d 30 2c 6d 3d 66 61 6c 73 65 2c 71 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 70 28 61 75 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 57 28 61 75 29 7d 63 61 74 63 68 28 61 76 29 7b 72 65 74 75 72 6e 20 75 6e 65 73 63 61 70 65 28 61 75 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 61 76 29 7b 76 61 72 20 61 75 3d 74 79 70 65 6f 66 20 61 76 3b 72 65 74 75 72 6e 20 61 75 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7d 66 75 6e 63 74 69 6f 6e 20 44 28 61 75 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 75 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 7d 66 75 6e 63 Data Ascii: RIComponent,W=X.decodeURIComponent,k=unescape,M=[],I,v,am=[],z=0,ag=0,Y=0,m=false,q="";function p(au){try{return W(au)}catch(av){return unescape(au)}}function N(av){var au=typeof av;return au!=="undefined"}function D(au){return typeof au==="function"}func
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 61 62 6c 65 2e 20 20 50 6c 65 61 73 65 20 68 61 76 65 20 61 20 6c 6f 6f 6b 20 61 74 20 74 68 65 20 4d 61 74 6f 6d 6f 20 74 72 61 63 6b 65 72 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 61 74 6f 6d 6f 2e 6f 72 67 2f 61 70 69 2d 72 65 66 65 72 65 6e 63 65 2f 74 72 61 63 6b 69 6e 67 2d 6a 61 76 61 73 63 72 69 70 74 27 3b 61 70 28 61 44 29 3b 69 66 28 21 61 43 29 7b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 61 44 29 7d 7d 69 66 28 61 42 3d 3d 3d 22 61 64 64 54 72 61 63 6b 65 72 22 29 7b 62 72 65 61 6b 7d 69 66 28 61 42 3d 3d 3d 22 73 65 74 54 72 61 63 6b 65 72 55 72 6c 22 7c 7c 61 42 3d 3d 3d 22 73 65 74 53 69 74 65 49 64 22 29 7b 62 72 65 61 6b 7d 7d 65 6c 73 65 7b 61 42 2e 61 70 Data Ascii: able. Please have a look at the Matomo tracker documentation: https://developer.matomo.org/api-reference/tracking-javascript';ap(aD);if(!aC){throw new TypeError(aD)}}if(aB==="addTracker"){break}if(aB==="setTrackerUrl"\|\|aB==="setSiteId"){break}}else{aB.ap
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 3d 62 5b 61 78 5d 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 62 5b 61 78 5d 5b 61 76 5d 3b 69 66 28 61 7a 29 7b 61 77 3d 62 5b 61 78 5d 5b 61 76 5d 3b 61 79 3d 61 77 28 61 41 7c 7c 7b 7d 2c 61 42 29 3b 69 66 28 61 79 29 7b 61 75 2b 3d 61 79 7d 7d 7d 7d 72 65 74 75 72 6e 20 61 75 7d 66 75 6e 63 74 69 6f 6e 20 61 6e 28 61 76 29 7b 76 61 72 20 61 75 3b 6d 3d 74 72 75 65 3b 61 68 28 22 75 6e 6c 6f 61 64 22 29 3b 61 75 3d 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 61 77 3d 61 75 2e 67 65 74 54 69 6d 65 41 6c 69 61 73 28 29 3b 69 66 28 28 73 2d 61 77 29 3e 33 30 30 30 29 7b 73 3d 61 77 2b 33 30 30 30 7d 69 66 28 73 29 7b 64 6f 7b 61 75 3d 6e 65 77 20 44 61 74 65 28 29 7d 77 68 69 6c 65 28 61 75 2e 67 65 74 54 69 6d 65 41 6c 69 61 73 28 Data Ascii: =b[ax]&&"function"===typeof b[ax][av];if(az){aw=b[ax][av];ay=aw(aA\|\|{},aB);if(ay){au+=ay}}}}return au}function an(av){var au;m=true;ah("unload");au=new Date();var aw=au.getTimeAlias();if((s-aw)>3000){s=aw+3000}if(s){do{au=new Date()}while(au.getTimeAlias(
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 61 76 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 61 75 29 29 7b 61 77 2b 3d 22 26 22 2b 75 28 61 75 29 2b 22 3d 22 2b 75 28 61 76 5b 61 75 5d 29 7d 7d 72 65 74 75 72 6e 20 61 77 7d 66 75 6e 63 74 69 6f 6e 20 61 6f 28 61 76 2c 61 75 29 7b 61 76 3d 53 74 72 69 6e 67 28 61 76 29 3b 72 65 74 75 72 6e 20 61 76 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 61 75 2c 30 29 3d 3d 3d 30 7d 66 75 6e 63 74 69 6f 6e 20 56 28 61 76 2c 61 75 29 7b 61 76 3d 53 74 72 69 6e 67 28 61 76 29 3b 72 65 74 75 72 6e 20 61 76 2e 69 6e 64 65 78 4f 66 28 61 75 2c 61 76 2e 6c 65 6e 67 74 68 2d 61 75 2e 6c 65 6e 67 74 68 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 42 28 61 76 2c 61 75 29 7b 61 76 3d 53 74 72 69 6e 67 28 61 76 29 3b 72 65 74 75 72 6e 20 61 76 2e 69 6e 64 65 78 4f 66 Data Ascii: av.hasOwnProperty(au)){aw+="&"+u(au)+"="+u(av[au])}}return aw}function ao(av,au){av=String(av);return av.lastIndexOf(au,0)===0}function V(av,au){av=String(av);return av.indexOf(au,av.length-au.length)!==-1}function B(av,au){av=String(av);return av.indexOf
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 61 28 61 75 29 7b 69 66 28 61 75 26 26 53 74 72 69 6e 67 28 61 75 29 3d 3d 3d 61 75 29 7b 72 65 74 75 72 6e 20 61 75 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 73 2b 7c 5c 73 2b 24 2f 67 2c 22 22 29 7d 72 65 74 75 72 6e 20 61 75 7d 66 75 6e 63 74 69 6f 6e 20 47 28 61 75 29 7b 72 65 74 75 72 6e 20 75 6e 65 73 63 61 70 65 28 75 28 61 75 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 72 28 61 4a 29 7b 76 61 72 20 61 77 3d 66 75 6e 63 74 69 6f 6e 28 61 50 2c 61 4f 29 7b 72 65 74 75 72 6e 28 61 50 3c 3c 61 4f 29 7c 28 61 50 3e 3e 3e 28 33 32 2d 61 4f 29 29 7d 2c 61 4b 3d 66 75 6e 63 74 69 6f 6e 28 61 52 29 7b 76 61 72 20 61 50 3d 22 22 2c 61 51 2c 61 4f 3b 66 6f 72 28 61 51 3d 37 3b 61 51 3e 3d 30 3b 61 51 2d 2d 29 7b 61 4f 3d 28 61 52 3e 3e 3e 28 Data Ascii: function a(au){if(au&&String(au)===au){return au.replace(/^\s+\|\s+$/g,"")}return au}function G(au){return unescape(u(au))}function ar(aJ){var aw=function(aP,aO){return(aP<<aO)\|(aP>>>(32-aO))},aK=function(aR){var aP="",aQ,aO;for(aQ=7;aQ>=0;aQ--){aO=(aR>>>(
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 47 26 61 46 29 29 2b 61 45 2b 61 76 5b 61 4d 5d 2b 32 34 30 30 39 35 39 37 30 38 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 45 3d 61 46 3b 61 46 3d 61 47 3b 61 47 3d 61 77 28 61 48 2c 33 30 29 3b 61 48 3d 61 49 3b 61 49 3d 61 4e 7d 66 6f 72 28 61 4d 3d 36 30 3b 61 4d 3c 3d 37 39 3b 61 4d 2b 2b 29 7b 61 4e 3d 28 61 77 28 61 49 2c 35 29 2b 28 61 48 5e 61 47 5e 61 46 29 2b 61 45 2b 61 76 5b 61 4d 5d 2b 33 33 39 35 34 36 39 37 38 32 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 45 3d 61 46 3b 61 46 3d 61 47 3b 61 47 3d 61 77 28 61 48 2c 33 30 29 3b 61 48 3d 61 49 3b 61 49 3d 61 4e 7d 61 44 3d 28 61 44 2b 61 49 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 42 3d 28 61 42 2b 61 48 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 41 3d 28 61 41 2b 61 47 29 26 34 32 39 34 39 36 Data Ascii: G&aF))+aE+av[aM]+2400959708)&4294967295;aE=aF;aF=aG;aG=aw(aH,30);aH=aI;aI=aN}for(aM=60;aM<=79;aM++){aN=(aw(aI,5)+(aH^aG^aF)+aE+av[aM]+3395469782)&4294967295;aE=aF;aF=aG;aG=aw(aH,30);aH=aI;aI=aN}aD=(aD+aI)&4294967295;aB=(aB+aH)&4294967295;aA=(aA+aG)&429496
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 74 75 72 6e 2d 31 7d 69 66 28 21 61 77 2e 6c 65 6e 67 74 68 29 7b 72 65 74 75 72 6e 2d 31 7d 76 61 72 20 61 75 3d 61 77 2e 6c 65 6e 67 74 68 3b 69 66 28 61 75 3d 3d 3d 30 29 7b 72 65 74 75 72 6e 2d 31 7d 76 61 72 20 61 76 3d 30 3b 77 68 69 6c 65 28 61 76 3c 61 75 29 7b 69 66 28 61 77 5b 61 76 5d 3d 3d 3d 61 78 29 7b 72 65 74 75 72 6e 20 61 76 7d 61 76 2b 2b 7d 72 65 74 75 72 6e 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 69 28 61 77 29 7b 69 66 28 21 61 77 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 7d 66 75 6e 63 74 69 6f 6e 20 61 75 28 61 79 2c 61 7a 29 7b 69 66 28 58 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 29 7b 72 65 74 75 72 6e 20 4b 2e 64 65 66 61 75 6c 74 56 69 65 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 61 79 2c 6e 75 6c 6c 29 5b Data Ascii: turn-1}if(!aw.length){return-1}var au=aw.length;if(au===0){return-1}var av=0;while(av<au){if(aw[av]===ax){return av}av++}return-1}function i(aw){if(!aw){return false}function au(ay,az){if(X.getComputedStyle){return K.defaultView.getComputedStyle(ay,null)[
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 6c 7c 7c 21 61 75 29 7b 72 65 74 75 72 6e 5b 5d 7d 76 61 72 20 61 76 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 75 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 68 74 6d 6c 43 6f 6c 6c 65 63 74 69 6f 6e 54 6f 41 72 72 61 79 28 61 76 29 7d 2c 66 69 6e 64 4d 75 6c 74 69 70 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 61 77 29 7b 69 66 28 21 61 77 7c 7c 21 61 77 2e 6c 65 6e 67 74 68 29 7b 72 65 74 75 72 6e 5b 5d 7d 76 61 72 20 61 76 2c 61 78 3b 76 61 72 20 61 75 3d 5b 5d 3b 66 6f 72 28 61 76 3d 30 3b 61 76 3c 61 77 2e 6c 65 6e 67 74 68 3b 61 76 2b 2b 29 7b 61 78 3d 74 68 69 73 2e 66 69 6e 64 28 61 77 5b 61 76 5d 29 3b 61 75 3d 61 75 2e 63 6f 6e 63 61 74 28 61 78 29 7d 61 75 3d 74 68 69 73 2e 6d 61 6b 65 4e 6f 64 65 73 55 6e 69 71 Data Ascii: l\|\|!au){return[]}var av=document.querySelectorAll(au);return this.htmlCollectionToArray(av)},findMultiple:function(aw){if(!aw\|\|!aw.length){return[]}var av,ax;var au=[];for(av=0;av<aw.length;av++){ax=this.find(aw[av]);au=au.concat(ax)}au=this.makeNodesUniq
2024-09-27 22:15:29 UTC	1369	IN	Data Raw: 74 72 69 62 75 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 77 2c 61 75 29 7b 69 66 28 61 77 26 26 61 77 2e 68 61 73 41 74 74 72 69 62 75 74 65 29 7b 72 65 74 75 72 6e 20 61 77 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 61 75 29 7d 69 66 28 61 77 26 26 61 77 2e 61 74 74 72 69 62 75 74 65 73 29 7b 76 61 72 20 61 76 3d 28 74 79 70 65 6f 66 20 61 77 2e 61 74 74 72 69 62 75 74 65 73 5b 61 75 5d 29 3b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 61 76 7d 72 65 74 75 72 6e 20 66 61 6c 73 65 7d 2c 68 61 73 4e 6f 64 65 43 73 73 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 77 2c 61 75 29 7b 69 66 28 61 77 26 26 61 75 26 26 61 77 2e 63 6c 61 73 73 4e 61 6d 65 29 7b 76 61 72 20 61 76 3d 74 79 70 65 6f 66 20 61 77 2e 63 6c 61 73 73 4e 61 6d 65 3d 3d 3d 22 Data Ascii: tribute:function(aw,au){if(aw&&aw.hasAttribute){return aw.hasAttribute(au)}if(aw&&aw.attributes){var av=(typeof aw.attributes[au]);return"undefined"!==av}return false},hasNodeCssClass:function(aw,au){if(aw&&au&&aw.className){var av=typeof aw.className==="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	49766	104.21.72.253	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:30 UTC	1516	OUT	POST /matomo.php?action_name=Telegram%E5%AE%98%E7%BD%91-Telegram%E4%B8%AD%E6%96%87%E6%B1%89%E5%8C%96%E7%89%88-Telegram%E4%B8%8B%E8%BD%BD-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%AD%E6%96%87%E7%89%88-%E7%BA%B8%E9%A3%9E%E6%9C%BA%E4%B8%8B%E8%BD%BD&idsite=19&rec=1&r=124021&h=18&m=15&s=28&url=https%3A%2F%2Fwww.telegramrm.com%2F&_id=6eab26ea7524a273&_idn=1&send_image=0&_refts=0&pv_id=gmB1pt&pf_net=1488&pf_srv=596&pf_tfr=278&pf_dm1=16395&uadata=%7B%22fullVersionList%22%3A%5B%7B%22brand%22%3A%22Google%20Chrome%22%2C%22version%22%3A%22117.0.5938.134%22%7D%2C%7B%22brand%22%3A%22Not%3BA%3DBrand%22%2C%22version%22%3A%228.0.0.0%22%7D%2C%7B%22brand%22%3A%22Chromium%22%2C%22version%22%3A%22117.0.5938.134%22%7D%5D%2C%22mobile%22%3Afalse%2C%22model%22%3A%22%22%2C%22platform%22%3A%22Windows%22%2C%22platformVersion%22%3A%2210.0.0%22%7D&pdf=1&qt=0&realp=0&wma=0&fla=0&java=0&ag=0&cookie=1&res=1280x1024 HTTP/1.1 Host: web.dcobxs.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/x-www-form-urlencoded; charset=utf-8 Accept: / Origin: https://www.telegramrm.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:31 UTC	626	IN	HTTP/1.1 204 No Response Date: Fri, 27 Sep 2024 22:15:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Access-Control-Allow-Origin: https://www.telegramrm.com Access-Control-Allow-Credentials: true CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l0VRPzVpvk602m4940jIoOk3R7%2BYvitjrGo92cWiTifSxyjhUSdoYTzHMDAa8Lhv2rVeEuStRAXsNAofWDzJ4L%2F9JWUbloJZzYLJ%2BwWLFln%2BqVYYs8gziZujkwjQx7BrZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9eda503b304277-EWR

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49767	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:30 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 4e 30 4a 4a 35 59 4f 4e 59 30 36 48 4b 46 63 6f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 32 63 35 62 33 35 38 32 34 35 38 64 61 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: N0JJ5YONY06HKFco.1Context: 7a2c5b3582458da
2024-09-27 22:15:30 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:15:30 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 4e 30 4a 4a 35 59 4f 4e 59 30 36 48 4b 46 63 6f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 32 63 35 62 33 35 38 32 34 35 38 64 61 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 59 Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: N0JJ5YONY06HKFco.2Context: 7a2c5b3582458da<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9GY
2024-09-27 22:15:30 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 4e 30 4a 4a 35 59 4f 4e 59 30 36 48 4b 46 63 6f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 61 32 63 35 62 33 35 38 32 34 35 38 64 61 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: N0JJ5YONY06HKFco.3Context: 7a2c5b3582458da<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:15:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:15:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 36 63 33 76 64 6b 39 64 68 45 47 33 72 49 53 78 5a 61 46 61 45 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 6c3vdk9dhEG3rISxZaFaEw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49769	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:31 UTC	1105	OUT	GET /static/images/section4i3.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:32 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:31 GMT Content-Type: image/gif Content-Length: 2254846 Last-Modified: Wed, 06 Mar 2024 15:30:45 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c25-2267fe" Expires: Sun, 27 Oct 2024 22:15:31 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:32 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fe d8 21 ff ff ff fc ee 21 03 b4 ff 72 89 12 a6 c8 36 00 00 00 ff 5d 1f cf 35 01 fa 90 16 7d 09 09 ff a9 8f 02 b3 ff 01 b4 ff ff b4 84 cf f2 5c fe d8 20 fb 8f 15 fe d7 20 71 89 11 ff d9 20 01 b6 ff f9 90 15 f2 52 17 fe d4 20 fd 5a 1d ff d8 20 e9 49 10 db 3e 08 fe d0 1f fa 95 16 fb 99 17 ee 4e 13 d2 37 02 f9 57 1b fc eb 20 fb a2 18 f6 55 19 72 88 10 d2 3f 03 fc b4 1b fc ce 1f fe c7 1d d4 39 04 fe db 20 fc af 1a cf 33 00 fb 92 15 fc aa 19 dc 5c 09 fe e2 20 d7 3c 06 fe fd f3 e5 46 0e e1 71 0d fe de 20 f3 af 18 d8 54 07 fd bd 1c d4 48 05 00 b3 ff e1 44 0c e7 86 11 fd b9 1b a3 c5 33 fb 9e 17 fe Data Ascii: GIF89a!NETSCAPE2.0!,!!r6]5}\ q R Z I>N7W Ur?9 3\ <Fq THD3
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 8c 3e 43 b4 44 03 27 40 63 b4 f5 e2 31 a4 24 f1 19 9f 84 2c e3 df 42 8f 34 4d 8f ca 59 ee f3 f5 7a 40 2d b6 05 8b fa 98 4a 4b 05 44 eb 6e 1f 7f f0 49 44 f1 d4 85 74 4d 27 b5 98 90 33 1e 7b 00 0a 3c 31 49 dc 74 ed fe 34 54 68 b4 06 cf 86 46 43 35 00 f4 a9 4c 2b b5 57 ff 48 37 d7 ee f5 c2 c0 b1 b9 c1 1b 84 81 b9 c2 ad 9c 50 35 54 04 b5 12 ef f4 dd ca ec 57 cf 35 73 48 40 4f e3 31 0c 88 b3 48 a4 28 0d 64 1c 00 1c e2 aa b2 35 53 b8 b5 45 1b b4 4e 70 f5 f3 cd 34 5d 2f f6 5b e4 5d 04 39 0a 09 fc 6e 49 10 71 4c 64 1c 2a 07 ff b6 60 27 05 61 2b b1 5e 93 04 33 03 1e 52 33 b6 68 9b 95 31 6b f0 07 ec e9 49 60 6e 11 03 c0 5d 4f 75 66 0f f6 66 6b b0 ff 9e 04 62 e7 ed 68 df b6 79 3e 13 8b 38 75 5b 90 eb 5d 48 b5 45 bf 36 6c 3b 0a 06 08 81 0e c0 40 69 87 11 0e b7 c5 67 Data Ascii: >CD'@c1$,B4MYz@-JKDnIDtM'3{<1It4ThFC5L+WH7P5TW5sH@O1H(d5SENp4]/[]9nIqLd*`'a+^3R3h1kI`n]Ouffkbhy>8u[]HE6l;@ig
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: ea 24 24 a3 ff d5 86 f0 1c af c2 ba f1 77 fe 91 7c 8d 03 03 e6 46 1f a3 ec f1 45 27 4a 91 cd 2c d4 d1 cb 2f 24 ff 4e 33 48 77 75 d6 bf 03 f6 ba dd 53 3c 1e fe 94 ba 47 be a9 04 ca 2f 10 18 84 79 d6 d0 3e a4 80 a0 76 f3 7b 20 88 6e b2 01 87 cd ca 6d d8 89 03 36 48 f7 17 23 a0 6e 31 99 28 87 2d ce 61 0b 5b 98 8b 2a 67 48 17 00 a7 f4 af 01 4e e5 0c e0 53 4a 1d 5a 71 9e 3e 24 45 03 42 70 20 04 73 28 ad 9b ac 0d 2e 33 c0 da 6a 46 80 05 98 d1 86 83 1e e4 d3 79 bc 71 2c df a0 b0 5f 4d 18 02 16 e0 b3 13 1d e8 20 15 43 d0 60 82 c6 c7 c2 a7 c0 01 30 5f 78 90 17 94 32 a8 9c e9 b0 8c f7 f1 1b 5c 5a 70 3d ec e0 00 1b 87 9b 8d 11 a9 a2 8d 61 3d 88 1c 35 fa 9f a6 9a 80 85 11 d8 a5 70 58 fc 0e 1c b6 e8 14 3c 26 a5 0f 33 5a e0 51 7e 10 32 33 32 92 39 38 21 81 5b 42 50 84 Data Ascii: $$w\|FE'J,/$N3HwuS<G/y>v{ nm6H#n1(-a[*gHNSJZq>$EBp s(.3jFyq,_M C`0_x2\Zp=a=5pX<&3ZQ~23298![BP
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: db c1 56 ec c1 57 94 bd 32 b4 89 22 b4 c5 43 71 8b 5c 34 06 39 bc 0a 23 68 bb 0c db be 14 99 80 16 7c c1 62 34 c6 2c d1 2e 89 62 46 68 4c 8c 96 13 27 3e 2b 02 6a 8c 40 39 28 bb 32 f4 c0 6d 54 43 24 30 86 df ba 8a 11 3b 21 10 48 b5 e6 98 c2 2a 54 c7 ad 88 c1 2c f1 39 d1 b3 89 f4 eb 0d 79 0c 27 3e 6b 3f ff 7b 7c 3f 20 58 3c c9 12 02 7e e4 48 04 b0 81 59 28 c7 8e d0 80 8e 23 41 70 ac 8b 3c 24 ba 63 4c c8 6d 12 14 ed 79 c8 67 8c c8 2d cc a4 e4 6b c0 07 b4 c8 e6 0b 02 46 4c 2a 71 70 87 3b e8 48 8e 84 01 19 a8 06 4c e4 08 03 c4 1f 15 e4 8a dc da 2d 95 5c c9 84 d1 44 11 7a 49 99 44 0c be 0b 27 1d ac 31 43 bc c9 ad 8b 87 78 60 07 76 28 87 72 e8 07 77 10 cb 77 20 4b 4c 68 86 5a b4 c5 13 a8 01 34 48 90 31 d9 c6 13 60 02 67 f9 88 18 14 c7 13 fa b8 6d fa 30 a6 6c 4a Data Ascii: VW2"Cq\49#h\|b4,.bFhL'>+j@9(2mTC$0;!HT,9y'>k?{\|? X<~HY(#Ap<$cLmyg-kFLqp;HL-\DzID'1Cx`v(rww KLhZ4H1`gm0lJ
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: c0 97 0d bc 71 96 1c 41 60 40 6d 78 db ae fc 98 00 9d 4c 7b e3 90 00 2f 20 ca a4 5c ca f2 68 07 d8 7b 7e 68 00 94 32 f0 05 4b a0 9b 1a b0 af af cc ab 51 2c cb de ca b6 4a 6b 09 b5 6c cb b8 ac cb 1d d7 cb fc 63 b7 ce 16 a3 ee 47 94 f1 3b 0e 64 f0 ce b2 60 7b 18 a0 cc cb 8c 02 f6 4b 03 a0 a0 84 3e 00 c2 2e 4b 04 32 bb 9b 21 9b cd fc aa 05 52 8c c2 de bc ad 38 d0 05 e1 5c cb 80 70 00 6f bb 97 94 4c 6d 8b a0 42 71 40 6d eb 37 c7 1c 29 7d 4e e8 6c a3 4c ca f6 6c bf 65 37 af 76 89 09 d0 28 03 37 b0 99 fd 99 b4 02 ad b4 52 f0 07 27 dc b4 26 bb ad 95 d0 c8 0b ff 6d c6 46 00 02 b9 bc c6 1d 37 d1 12 54 b9 cf 76 d1 39 48 07 1c 49 07 4e e8 01 ce c6 08 cb 2c 00 1f 0d d2 00 a0 06 98 20 d2 7c 00 0a 64 50 d2 79 39 a2 35 80 cd 2b 9d b6 52 80 0a a6 50 07 5e 5d 07 31 7d a9 Data Ascii: qA`@mxL{/ \h{~h2KQ,JklcG;d`{K>.K2!R8\poLmBq@m7)}NlLle7v(7R'&mF7Tv9HIN, \|dPy95+RP^]1}
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 44 38 22 b6 e3 91 19 99 08 e4 92 4c 12 60 22 44 45 d2 86 e4 94 10 e9 12 65 93 58 42 c8 e2 42 e9 79 66 21 95 60 12 94 e5 98 63 02 f8 e5 3f 57 86 a9 66 41 3d 5e 49 e6 9b 1c 4a 60 63 76 c0 ad 69 a7 8c 70 e6 d9 24 80 62 e6 76 a6 9d 2f ea 09 9c 13 60 40 51 45 16 59 6c d1 c4 16 5b 20 5a 45 15 50 80 21 28 64 ff 3c 08 28 92 0e 4e 4a 00 18 55 6c b1 44 17 8b 90 81 45 01 a4 16 30 cb a9 7c a4 aa ea a9 b3 90 3a c6 22 7a 2c ff b1 45 15 5c c0 e9 e6 a5 47 ba 39 23 a7 9e 76 41 46 a9 c0 92 3a 0b 22 c5 44 60 ec b1 c8 22 5b 4c 24 91 20 b2 c9 26 ad 8e d1 45 13 59 48 9a 25 8e 7f e2 7a 5f 8f 6f 42 b1 45 17 a3 06 2b 6e a9 91 24 6b ee b9 c9 ee d2 ec 26 7c 14 30 c6 12 d5 62 b9 61 b6 da c6 37 a6 13 55 34 01 ee b8 fc 02 bb 0b ba 00 07 1c 81 ba 88 b4 4b c6 12 55 ec 09 99 26 f5 2e d8 Data Ascii: D8"L`"DEeXBByf!`c?WfA=^IJ`cvip$bv/`@QEYl[ ZEP!(d<(NJUlDE0\|:"z,E\G9#vAF:"D`"[L$ &EYH%z_oBE+n$k&\|0ba7U4KU&.
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 0c 60 64 d4 bc 84 ac 24 0b cb 82 9c 2b ca 82 61 1a 68 e0 82 3e 41 0d 15 ba 3f 27 0a 11 80 17 06 d5 ae 2f 82 3c 53 2b 2c 49 61 dd 0d ca 47 63 35 0e 29 3a c9 b2 93 20 1b 10 d5 74 a4 06 18 00 96 01 51 89 2d f6 2d 52 21 e2 c0 d4 bc c6 3c 01 37 00 8e f8 8e 03 f8 6a ad 56 2a 37 ad 15 88 4a 85 c6 a2 b0 3b c0 20 30 29 d8 60 8d 2d d7 dc 97 90 4d 40 06 21 4f 15 50 3b 1e 0a 1d e4 3b 12 a8 cd d6 5e 86 1c 85 74 5b 6b 29 78 ff 0a 23 e5 74 25 e8 16 2d 51 02 b6 d3 73 11 4e 98 a4 ef 12 08 52 d0 31 05 10 a1 a9 c9 e6 ad f7 de 58 67 95 f2 e2 83 f6 45 a8 db 2b 5d fb ae a5 60 15 50 40 e1 93 8b 4d b7 61 76 51 85 98 4c a1 84 9b f7 d5 8d d7 74 14 38 9a db b4 28 c2 7f eb 3c 48 09 0c 61 1a 17 e5 a1 f9 64 e0 1d 86 85 a8 48 a0 96 21 86 f7 05 3c 19 9e 19 e7 05 1f c8 57 e3 a9 17 ba da Data Ascii: `d$+ah>A?'/<S+,IaGc5): tQ--R!<7jV*7J; 0)`-M@!OP;;^t[k)x#t%-QsNR1XgE+]`P@MavQLt8(<HadH!<W
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: e2 ac 47 d2 28 64 16 82 0b 04 20 f8 1f 04 41 7a 20 a7 36 92 fb 3d 11 a4 b3 26 11 2a 0f 74 26 7c fb 74 a8 4b ff 84 e6 58 81 c0 6c 65 05 67 c8 3e 92 ef dd f4 f9 cc ad a2 81 c0 0b be f4 42 90 9e ad c7 98 63 b3 73 3a ed d7 51 fa e3 4f 61 13 0c c0 8d f2 0e a9 03 7a be 40 5b c7 24 a1 f3 9e cf e5 50 0c 7b 95 20 94 be f8 24 90 5e 71 29 bc d8 dd 28 61 22 00 bf 4e 28 1e ef 80 3d b8 3d b3 31 b6 3d 99 77 03 81 45 cb aa d1 da dc fb ef a1 58 91 ec 5b 85 04 c5 2f fd 0f a6 a7 ef 16 f2 3b 3e d0 75 a3 80 a2 2f 7d ea cf 9e ba 75 0d 01 0a 3a d0 01 19 25 6e 0c 6d 10 05 1f 9c 05 02 98 00 be 65 45 16 44 0b 27 38 46 52 71 53 f8 e5 d2 2d 48 44 2d d0 82 a5 99 df f9 09 5e fc 70 97 21 ad 1e 6f 40 5c a7 65 89 fc 49 df 20 54 1f 4d 54 01 0a 84 c0 cb 3d 84 74 ed 1f 97 65 00 1d 0c 80 0b Data Ascii: G(d Az 6=&*t&\|tKXleg>Bcs:QOaz@[$P{ $^q)(a"N(==1=wEX[/;>u/}u:%nmeED'8FRqS-HD-^p!o@\eI TMT=te
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 5a 7a 9d 4e 3f f0 5c ee 34 dd 7b fd cf d2 0d 55 9a 95 0a 24 60 dd d6 bd 20 f7 1a 58 99 21 01 8b 38 45 a1 4d 8b dc 4d a0 93 55 0c 19 c0 56 e0 25 5f e0 3d 5e d3 f4 03 2a 2d 8a 88 4d 51 e7 35 0a 0e 58 dc 9d 90 5e 41 c1 00 80 0d 9e c0 8d a2 0a b8 88 2d 2c 44 b5 f0 5e 04 8a 5f 9e d8 80 86 2d df 02 36 60 a3 78 d2 14 8d d9 a3 a8 81 d4 55 0c 23 d0 58 36 a9 df d7 5d 30 00 f8 ab fc 4d 81 fd 3d 5c ee bd 48 35 dd 0d 0f 68 dc 03 16 61 11 66 5e 14 05 d6 a3 78 81 18 95 0a 23 28 06 63 a9 df bf fd 17 70 5c 23 e4 72 81 fd dd de ff d5 08 63 bb 5d 30 ca 8e 0d 48 da 11 06 e2 f2 2d 61 14 0d 5d a3 f8 80 bd e5 0b 20 68 61 76 71 81 14 48 01 18 26 12 e4 e2 5a 87 d3 d9 8b 98 c1 74 44 dc 43 dc 61 1e de 0d 0e 08 e2 2f 36 e0 21 0e d0 13 46 0a 0e d0 0d ff 20 10 86 d0 aa 5f 65 ad 8e e5 Data Ascii: ZzN?\4{U$` X!8EMMUV%_=^*-MQ5X^A-,D^_-6`xU#X6]0M=\H5haf^x#(cp\#rc]0H-a] havqH&ZtDCa/6!F _e
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: c5 9b 57 ef 5e be 7d fd fe c5 6b ca 2e 4b 18 21 7b 40 7d 6a c2 ed 62 c6 58 cb a4 bd a8 a3 eb 58 ca 95 21 b6 10 01 02 f2 66 04 2b 7e 34 c6 4a 2a 6e 49 4a 53 3e ee 18 bc f2 25 60 d6 ad 5d bf 86 1d 1b 6f ff ea 04 31 42 e2 40 ec 54 09 68 de bd 39 3e e6 5c 51 72 8b 13 96 8d 2b 44 d1 82 c5 8d e0 9b 3d 6f f4 4d 35 c8 68 92 6e 3e 1e a1 9d 40 f6 76 ee dd bd 7f 37 9a fd 48 48 15 b9 05 c4 8a 9e de ed 8f e6 91 4b 2c 39 78 9c 21 8a b2 2c 40 e8 68 cf f9 b9 fa a9 8d a8 93 54 e5 a3 26 b2 03 af 40 03 0f 44 30 36 0e 68 fb c0 30 f3 14 e3 2f 42 aa aa 58 21 bf ad 3c 00 a1 04 11 36 dc b0 05 cc 38 b4 0f 04 10 98 b3 b0 b9 1c 7e 80 4e 42 8f 1c 50 e5 bf 00 e6 f2 08 b5 d4 56 4b b0 46 1b 6f c4 51 a7 05 53 33 e2 36 f3 76 53 31 48 8f 8a a8 b0 44 23 8f 0c 0e 0c b6 84 04 c9 0d 17 b5 f0 Data Ascii: W^}k.K!{@}jbXX!f+~4J*nIJS>%`]o1B@Th9>\Qr+D=oM5hn>@v7HHK,9x!,@hT&@D06h0/BX!<68~NBPVKFoQS36vS1HD#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49772	104.21.72.253	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:31 UTC	347	OUT	GET /matomo.js HTTP/1.1 Host: web.dcobxs.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-09-27 22:15:31 UTC	744	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 22:15:31 GMT Content-Type: application/javascript Transfer-Encoding: chunked Connection: close Cache-Control: max-age=86400 Cf-Bgj: minify Cf-Polished: origSize=67460 ETag: W/"66f58035-10784" Expires: Sat, 28 Sep 2024 07:49:14 GMT Last-Modified: Thu, 26 Sep 2024 15:39:33 GMT CF-Cache-Status: HIT Age: 8777 Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yx0R%2FCbUTUA3dTIKNbUsFlYjjW1d0gp0mC6xOk9Qrun5YZIdgCQRkfduVaXQ2j%2FotCglQ9umdqhg3lYoLQPEU%2BDH8ZByFBP8Rd2Zv04Y%2BpI8%2B6tujrIx%2F47VHskOryLs9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9eda564ebc4271-EWR
2024-09-27 22:15:31 UTC	625	IN	Data Raw: 33 39 65 64 0d 0a 2f 2a 21 21 0a 2a 20 4d 61 74 6f 6d 6f 20 2d 20 66 72 65 65 2f 6c 69 62 72 65 20 61 6e 61 6c 79 74 69 63 73 20 70 6c 61 74 66 6f 72 6d 0a 2a 0a 2a 20 4a 61 76 61 53 63 72 69 70 74 20 74 72 61 63 6b 69 6e 67 20 63 6c 69 65 6e 74 0a 2a 0a 2a 20 40 6c 69 6e 6b 20 68 74 74 70 73 3a 2f 2f 70 69 77 69 6b 2e 6f 72 67 0a 2a 20 40 73 6f 75 72 63 65 20 68 74 74 70 73 3a 2f 2f 67 69 74 68 75 62 2e 63 6f 6d 2f 6d 61 74 6f 6d 6f 2d 6f 72 67 2f 6d 61 74 6f 6d 6f 2f 62 6c 6f 62 2f 6d 61 73 74 65 72 2f 6a 73 2f 70 69 77 69 6b 2e 6a 73 0a 2a 20 40 6c 69 63 65 6e 73 65 20 68 74 74 70 73 3a 2f 2f 70 69 77 69 6b 2e 6f 72 67 2f 66 72 65 65 2d 73 6f 66 74 77 61 72 65 2f 62 73 64 2f 20 42 53 44 2d 33 20 43 6c 61 75 73 65 20 28 61 6c 73 6f 20 69 6e 20 6a 73 2f Data Ascii: 39ed/!! Matomo - free/libre analytics platform JavaScript tracking client @link https://piwik.org* @source https://github.com/matomo-org/matomo/blob/master/js/piwik.js* @license https://piwik.org/free-software/bsd/ BSD-3 Clause (also in js/
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 57 3d 58 2e 64 65 63 6f 64 65 55 52 49 43 6f 6d 70 6f 6e 65 6e 74 2c 6b 3d 75 6e 65 73 63 61 70 65 2c 4d 3d 5b 5d 2c 49 2c 76 2c 61 6d 3d 5b 5d 2c 7a 3d 30 2c 61 67 3d 30 2c 59 3d 30 2c 6d 3d 66 61 6c 73 65 2c 71 3d 22 22 3b 66 75 6e 63 74 69 6f 6e 20 70 28 61 75 29 7b 74 72 79 7b 72 65 74 75 72 6e 20 57 28 61 75 29 7d 63 61 74 63 68 28 61 76 29 7b 72 65 74 75 72 6e 20 75 6e 65 73 63 61 70 65 28 61 75 29 7d 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 61 76 29 7b 76 61 72 20 61 75 3d 74 79 70 65 6f 66 20 61 76 3b 72 65 74 75 72 6e 20 61 75 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 7d 66 75 6e 63 74 69 6f 6e 20 44 28 61 75 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 61 75 3d 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 7d 66 75 Data Ascii: eURIComponent,W=X.decodeURIComponent,k=unescape,M=[],I,v,am=[],z=0,ag=0,Y=0,m=false,q="";function p(au){try{return W(au)}catch(av){return unescape(au)}}function N(av){var au=typeof av;return au!=="undefined"}function D(au){return typeof au==="function"}fu
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 72 69 61 62 6c 65 2e 20 20 50 6c 65 61 73 65 20 68 61 76 65 20 61 20 6c 6f 6f 6b 20 61 74 20 74 68 65 20 4d 61 74 6f 6d 6f 20 74 72 61 63 6b 65 72 20 64 6f 63 75 6d 65 6e 74 61 74 69 6f 6e 3a 20 68 74 74 70 73 3a 2f 2f 64 65 76 65 6c 6f 70 65 72 2e 6d 61 74 6f 6d 6f 2e 6f 72 67 2f 61 70 69 2d 72 65 66 65 72 65 6e 63 65 2f 74 72 61 63 6b 69 6e 67 2d 6a 61 76 61 73 63 72 69 70 74 27 3b 61 70 28 61 44 29 3b 69 66 28 21 61 43 29 7b 74 68 72 6f 77 20 6e 65 77 20 54 79 70 65 45 72 72 6f 72 28 61 44 29 7d 7d 69 66 28 61 42 3d 3d 3d 22 61 64 64 54 72 61 63 6b 65 72 22 29 7b 62 72 65 61 6b 7d 69 66 28 61 42 3d 3d 3d 22 73 65 74 54 72 61 63 6b 65 72 55 72 6c 22 7c 7c 61 42 3d 3d 3d 22 73 65 74 53 69 74 65 49 64 22 29 7b 62 72 65 61 6b 7d 7d 65 6c 73 65 7b 61 42 2e Data Ascii: riable. Please have a look at the Matomo tracker documentation: https://developer.matomo.org/api-reference/tracking-javascript';ap(aD);if(!aC){throw new TypeError(aD)}}if(aB==="addTracker"){break}if(aB==="setTrackerUrl"\|\|aB==="setSiteId"){break}}else{aB.
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 61 7a 3d 62 5b 61 78 5d 26 26 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 3d 74 79 70 65 6f 66 20 62 5b 61 78 5d 5b 61 76 5d 3b 69 66 28 61 7a 29 7b 61 77 3d 62 5b 61 78 5d 5b 61 76 5d 3b 61 79 3d 61 77 28 61 41 7c 7c 7b 7d 2c 61 42 29 3b 69 66 28 61 79 29 7b 61 75 2b 3d 61 79 7d 7d 7d 7d 72 65 74 75 72 6e 20 61 75 7d 66 75 6e 63 74 69 6f 6e 20 61 6e 28 61 76 29 7b 76 61 72 20 61 75 3b 6d 3d 74 72 75 65 3b 61 68 28 22 75 6e 6c 6f 61 64 22 29 3b 61 75 3d 6e 65 77 20 44 61 74 65 28 29 3b 76 61 72 20 61 77 3d 61 75 2e 67 65 74 54 69 6d 65 41 6c 69 61 73 28 29 3b 69 66 28 28 73 2d 61 77 29 3e 33 30 30 30 29 7b 73 3d 61 77 2b 33 30 30 30 7d 69 66 28 73 29 7b 64 6f 7b 61 75 3d 6e 65 77 20 44 61 74 65 28 29 7d 77 68 69 6c 65 28 61 75 2e 67 65 74 54 69 6d 65 41 6c 69 61 Data Ascii: az=b[ax]&&"function"===typeof b[ax][av];if(az){aw=b[ax][av];ay=aw(aA\|\|{},aB);if(ay){au+=ay}}}}return au}function an(av){var au;m=true;ah("unload");au=new Date();var aw=au.getTimeAlias();if((s-aw)>3000){s=aw+3000}if(s){do{au=new Date()}while(au.getTimeAlia
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 66 28 61 76 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 28 61 75 29 29 7b 61 77 2b 3d 22 26 22 2b 75 28 61 75 29 2b 22 3d 22 2b 75 28 61 76 5b 61 75 5d 29 7d 7d 72 65 74 75 72 6e 20 61 77 7d 66 75 6e 63 74 69 6f 6e 20 61 6f 28 61 76 2c 61 75 29 7b 61 76 3d 53 74 72 69 6e 67 28 61 76 29 3b 72 65 74 75 72 6e 20 61 76 2e 6c 61 73 74 49 6e 64 65 78 4f 66 28 61 75 2c 30 29 3d 3d 3d 30 7d 66 75 6e 63 74 69 6f 6e 20 56 28 61 76 2c 61 75 29 7b 61 76 3d 53 74 72 69 6e 67 28 61 76 29 3b 72 65 74 75 72 6e 20 61 76 2e 69 6e 64 65 78 4f 66 28 61 75 2c 61 76 2e 6c 65 6e 67 74 68 2d 61 75 2e 6c 65 6e 67 74 68 29 21 3d 3d 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 42 28 61 76 2c 61 75 29 7b 61 76 3d 53 74 72 69 6e 67 28 61 76 29 3b 72 65 74 75 72 6e 20 61 76 2e 69 6e 64 65 78 Data Ascii: f(av.hasOwnProperty(au)){aw+="&"+u(au)+"="+u(av[au])}}return aw}function ao(av,au){av=String(av);return av.lastIndexOf(au,0)===0}function V(av,au){av=String(av);return av.indexOf(au,av.length-au.length)!==-1}function B(av,au){av=String(av);return av.index
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 22 7d 66 75 6e 63 74 69 6f 6e 20 61 28 61 75 29 7b 69 66 28 61 75 26 26 53 74 72 69 6e 67 28 61 75 29 3d 3d 3d 61 75 29 7b 72 65 74 75 72 6e 20 61 75 2e 72 65 70 6c 61 63 65 28 2f 5e 5c 73 2b 7c 5c 73 2b 24 2f 67 2c 22 22 29 7d 72 65 74 75 72 6e 20 61 75 7d 66 75 6e 63 74 69 6f 6e 20 47 28 61 75 29 7b 72 65 74 75 72 6e 20 75 6e 65 73 63 61 70 65 28 75 28 61 75 29 29 7d 66 75 6e 63 74 69 6f 6e 20 61 72 28 61 4a 29 7b 76 61 72 20 61 77 3d 66 75 6e 63 74 69 6f 6e 28 61 50 2c 61 4f 29 7b 72 65 74 75 72 6e 28 61 50 3c 3c 61 4f 29 7c 28 61 50 3e 3e 3e 28 33 32 2d 61 4f 29 29 7d 2c 61 4b 3d 66 75 6e 63 74 69 6f 6e 28 61 52 29 7b 76 61 72 20 61 50 3d 22 22 2c 61 51 2c 61 4f 3b 66 6f 72 28 61 51 3d 37 3b 61 51 3e 3d 30 3b 61 51 2d 2d 29 7b 61 4f 3d 28 61 52 3e 3e Data Ascii: "}function a(au){if(au&&String(au)===au){return au.replace(/^\s+\|\s+$/g,"")}return au}function G(au){return unescape(u(au))}function ar(aJ){var aw=function(aP,aO){return(aP<<aO)\|(aP>>>(32-aO))},aK=function(aR){var aP="",aQ,aO;for(aQ=7;aQ>=0;aQ--){aO=(aR>>
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 28 61 47 26 61 46 29 29 2b 61 45 2b 61 76 5b 61 4d 5d 2b 32 34 30 30 39 35 39 37 30 38 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 45 3d 61 46 3b 61 46 3d 61 47 3b 61 47 3d 61 77 28 61 48 2c 33 30 29 3b 61 48 3d 61 49 3b 61 49 3d 61 4e 7d 66 6f 72 28 61 4d 3d 36 30 3b 61 4d 3c 3d 37 39 3b 61 4d 2b 2b 29 7b 61 4e 3d 28 61 77 28 61 49 2c 35 29 2b 28 61 48 5e 61 47 5e 61 46 29 2b 61 45 2b 61 76 5b 61 4d 5d 2b 33 33 39 35 34 36 39 37 38 32 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 45 3d 61 46 3b 61 46 3d 61 47 3b 61 47 3d 61 77 28 61 48 2c 33 30 29 3b 61 48 3d 61 49 3b 61 49 3d 61 4e 7d 61 44 3d 28 61 44 2b 61 49 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 42 3d 28 61 42 2b 61 48 29 26 34 32 39 34 39 36 37 32 39 35 3b 61 41 3d 28 61 41 2b 61 47 29 26 34 32 39 34 Data Ascii: (aG&aF))+aE+av[aM]+2400959708)&4294967295;aE=aF;aF=aG;aG=aw(aH,30);aH=aI;aI=aN}for(aM=60;aM<=79;aM++){aN=(aw(aI,5)+(aH^aG^aF)+aE+av[aM]+3395469782)&4294967295;aE=aF;aF=aG;aG=aw(aH,30);aH=aI;aI=aN}aD=(aD+aI)&4294967295;aB=(aB+aH)&4294967295;aA=(aA+aG)&4294
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 72 65 74 75 72 6e 2d 31 7d 69 66 28 21 61 77 2e 6c 65 6e 67 74 68 29 7b 72 65 74 75 72 6e 2d 31 7d 76 61 72 20 61 75 3d 61 77 2e 6c 65 6e 67 74 68 3b 69 66 28 61 75 3d 3d 3d 30 29 7b 72 65 74 75 72 6e 2d 31 7d 76 61 72 20 61 76 3d 30 3b 77 68 69 6c 65 28 61 76 3c 61 75 29 7b 69 66 28 61 77 5b 61 76 5d 3d 3d 3d 61 78 29 7b 72 65 74 75 72 6e 20 61 76 7d 61 76 2b 2b 7d 72 65 74 75 72 6e 2d 31 7d 66 75 6e 63 74 69 6f 6e 20 69 28 61 77 29 7b 69 66 28 21 61 77 29 7b 72 65 74 75 72 6e 20 66 61 6c 73 65 7d 66 75 6e 63 74 69 6f 6e 20 61 75 28 61 79 2c 61 7a 29 7b 69 66 28 58 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 29 7b 72 65 74 75 72 6e 20 4b 2e 64 65 66 61 75 6c 74 56 69 65 77 2e 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 61 79 2c 6e 75 6c 6c Data Ascii: return-1}if(!aw.length){return-1}var au=aw.length;if(au===0){return-1}var av=0;while(av<au){if(aw[av]===ax){return av}av++}return-1}function i(aw){if(!aw){return false}function au(ay,az){if(X.getComputedStyle){return K.defaultView.getComputedStyle(ay,null
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 41 6c 6c 7c 7c 21 61 75 29 7b 72 65 74 75 72 6e 5b 5d 7d 76 61 72 20 61 76 3d 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 61 75 29 3b 72 65 74 75 72 6e 20 74 68 69 73 2e 68 74 6d 6c 43 6f 6c 6c 65 63 74 69 6f 6e 54 6f 41 72 72 61 79 28 61 76 29 7d 2c 66 69 6e 64 4d 75 6c 74 69 70 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 61 77 29 7b 69 66 28 21 61 77 7c 7c 21 61 77 2e 6c 65 6e 67 74 68 29 7b 72 65 74 75 72 6e 5b 5d 7d 76 61 72 20 61 76 2c 61 78 3b 76 61 72 20 61 75 3d 5b 5d 3b 66 6f 72 28 61 76 3d 30 3b 61 76 3c 61 77 2e 6c 65 6e 67 74 68 3b 61 76 2b 2b 29 7b 61 78 3d 74 68 69 73 2e 66 69 6e 64 28 61 77 5b 61 76 5d 29 3b 61 75 3d 61 75 2e 63 6f 6e 63 61 74 28 61 78 29 7d 61 75 3d 74 68 69 73 2e 6d 61 6b 65 4e 6f 64 65 73 55 6e Data Ascii: All\|\|!au){return[]}var av=document.querySelectorAll(au);return this.htmlCollectionToArray(av)},findMultiple:function(aw){if(!aw\|\|!aw.length){return[]}var av,ax;var au=[];for(av=0;av<aw.length;av++){ax=this.find(aw[av]);au=au.concat(ax)}au=this.makeNodesUn
2024-09-27 22:15:31 UTC	1369	IN	Data Raw: 41 74 74 72 69 62 75 74 65 3a 66 75 6e 63 74 69 6f 6e 28 61 77 2c 61 75 29 7b 69 66 28 61 77 26 26 61 77 2e 68 61 73 41 74 74 72 69 62 75 74 65 29 7b 72 65 74 75 72 6e 20 61 77 2e 68 61 73 41 74 74 72 69 62 75 74 65 28 61 75 29 7d 69 66 28 61 77 26 26 61 77 2e 61 74 74 72 69 62 75 74 65 73 29 7b 76 61 72 20 61 76 3d 28 74 79 70 65 6f 66 20 61 77 2e 61 74 74 72 69 62 75 74 65 73 5b 61 75 5d 29 3b 72 65 74 75 72 6e 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 3d 61 76 7d 72 65 74 75 72 6e 20 66 61 6c 73 65 7d 2c 68 61 73 4e 6f 64 65 43 73 73 43 6c 61 73 73 3a 66 75 6e 63 74 69 6f 6e 28 61 77 2c 61 75 29 7b 69 66 28 61 77 26 26 61 75 26 26 61 77 2e 63 6c 61 73 73 4e 61 6d 65 29 7b 76 61 72 20 61 76 3d 74 79 70 65 6f 66 20 61 77 2e 63 6c 61 73 73 4e 61 6d 65 3d 3d Data Ascii: Attribute:function(aw,au){if(aw&&aw.hasAttribute){return aw.hasAttribute(au)}if(aw&&aw.attributes){var av=(typeof aw.attributes[au]);return"undefined"!==av}return false},hasNodeCssClass:function(aw,au){if(aw&&au&&aw.className){var av=typeof aw.className==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	49771	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:31 UTC	1105	OUT	GET /static/images/section4i2.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:32 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:31 GMT Content-Type: image/gif Content-Length: 2202471 Last-Modified: Wed, 06 Mar 2024 15:30:42 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c22-219b67" Expires: Sun, 27 Oct 2024 22:15:31 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:32 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 05 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 88 7e 68 ff 5d 1f fe d8 20 bc a8 71 3e 39 2d 00 00 00 80 76 62 ff d5 27 fa 90 16 ff fa ca cf 35 02 9c 92 7c 33 2b 07 ff 8c 00 4e 4d 4d ff ff ff 35 2f 20 a7 f6 ff fc ee 21 7d 09 09 80 80 80 63 5b 4a 35 30 21 ff 8b 00 3d 38 2c 32 1d 04 fb 90 15 ff b4 84 33 33 33 f9 90 15 3d 38 2d ff d4 26 87 7d 67 fa 97 17 cc cb cb fb a0 19 85 7b 65 81 78 62 fa 93 16 fb 9c 18 fe c0 20 47 41 33 0b 08 02 fe c5 22 ff d0 25 fd ba 1f 83 79 64 6e 66 53 fd b6 1d 42 3c 2f 51 4b 3c 12 0d 01 19 14 03 24 1e 04 79 70 5c fd af 1b fc 8f 13 fe e4 21 5a 54 45 f4 54 18 69 61 4f 4c 46 38 fc a5 19 db 3e 08 ff cc 24 ff d8 24 56 Data Ascii: GIF89a!NETSCAPE2.0!,~h] q>9-vb'5\|3+NMM5/ !}c[J50!=8,2333=8-&}g{exb GA3"%ydnfSB</QK<$yp\!ZTETiaOLF8>$$V
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: f0 15 db 33 79 f8 81 10 7f 73 17 7f 01 05 7c 81 25 9b 43 dd 50 73 56 9c 40 46 8b 48 07 77 34 56 9c 47 e6 91 88 e0 fd c4 28 4d 0a 42 bf 1d 1e 0e 73 04 44 ee 78 2c c3 43 ab b0 27 50 00 05 d0 82 03 77 b1 0e 94 f3 d3 f4 17 4d d7 34 79 9c 33 29 23 72 7c a4 33 67 20 e8 63 49 ca 6d 86 a5 2f 62 6c 16 7b 06 0a ef b1 3e a7 b0 1d 30 35 53 7b 82 44 77 b1 2c 3f cd c9 7e ab 55 53 87 45 cf 6e 47 9b 55 2d 73 86 de 26 26 58 93 34 d7 9a f4 78 fc 42 52 2b 35 5b b7 f5 53 0f 71 54 3f 8d f2 3e 73 5d ef c4 07 34 5c 56 df 30 36 67 49 6a ed ff 34 97 88 2e 51 db f1 85 8c 83 43 27 f5 5a 53 00 3d 44 01 5b 3b 75 17 4b b0 d3 08 34 3c 3f b6 67 c8 2e 4e ff 43 7c 0c f0 85 c8 74 56 c0 f1 13 ca 31 c6 4a 9f 51 8b 47 4a 17 76 1f 78 02 3e a4 c2 3d a5 02 69 53 00 39 74 31 45 33 76 c9 48 11 6b Data Ascii: 3ys\|%CPsV@FHw4VG(MBsDx,C'PwM4y3)#r\|3g cIm/bl{>05S{Dw,?~USEnGU-s&&X4xBR+5[SqT?>s]4\V06gIj4.QC'ZS=D[;uK4<?g.NC\|tV1JQGJvx>=iS9t1E3vHk
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: ff 26 74 53 3a de 31 b8 a9 bc 89 55 6e 11 c2 bb d4 f6 72 d7 bc f8 7d 5b 55 99 6b df 7a e6 37 bf f2 15 42 2d a3 e9 cd db e6 76 6c eb c5 0e 7c f1 2b e0 33 1d c0 00 0e c8 2e 46 36 89 d3 33 1c 78 c1 f8 0c f0 bb c0 7a d0 56 e2 10 8c 09 56 f0 7f cb 5b 59 83 4a 54 85 3d 0c f1 32 47 0c e0 92 4a a1 ad e2 d5 ec 1a 2e cc e2 86 d2 32 7d 08 ad 0f 0f 55 3c 05 0c ff f7 8e 1a b6 61 45 d9 90 59 1f d7 15 bd f3 45 64 61 f7 c7 63 fd 18 99 c5 48 25 30 42 69 8c 3b 22 53 b9 c6 2c ad 0a 92 fd 95 63 70 4a af c9 e0 c5 72 77 e9 fb 04 f5 4a 94 77 b4 79 43 91 c5 fc da 06 9b 34 a9 f4 bc a9 1a 3b a3 e6 27 63 78 cb 5e 92 23 85 f7 06 e6 0d da b9 c6 2e 8e c2 30 a5 ec 4d f1 f5 d9 cf 6c c6 70 90 bb a2 54 2c 5e 79 36 12 4b b4 98 35 fc 59 53 be 46 5f 87 c6 df 9f 15 0d 3f f5 3a d6 d1 19 d4 83 Data Ascii: &tS:1Unr}[Ukz7B-vl\|+3.F63xzVV[YJT=2GJ.2}U<aEYEdacH%0Bi;"S,cpJrwJwyC4;'cx^#.0MlpT,^y6K5YSF_?:
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: f5 50 da 15 94 18 86 01 18 00 8a 69 54 a3 13 17 70 00 07 c2 a3 4e 57 1c 53 2c 02 c8 45 97 81 40 6d 60 fc 05 3c 64 f6 af 03 24 60 8d 81 14 a4 ff 0b 13 60 80 29 e6 c4 8a 72 34 1e f5 0e b2 29 57 f0 50 8f 5c c1 91 f7 b6 50 31 04 11 a6 0c 1f 40 e3 20 39 c9 c9 05 94 31 24 03 e0 d9 78 f0 92 21 26 a4 2d 65 eb fb 82 1d 85 73 b5 48 fa 0b 89 65 00 e5 13 3e d0 c4 4e de 92 93 09 38 00 15 79 51 2c 2d 78 c0 03 57 30 c6 30 2d 50 4c 46 81 ad 0d db 80 a4 e0 74 45 17 56 be 72 4e 15 13 9d 1b 70 59 cd 5b 1a e0 8d 9c e8 97 31 8c d3 04 d3 00 40 00 60 e9 e3 6c d2 e0 4a 5d 69 e0 99 d0 84 07 25 cb 10 cb 2c f0 92 5f 80 b4 e6 3c 3d d9 00 78 30 67 0d e3 cc 82 31 d2 f9 43 af b9 02 9d ea dc ca 24 c1 e0 ce 30 f0 72 93 b7 04 03 3d 63 98 80 59 4e 82 7c 61 f3 05 3b 1b 19 38 bb 81 a3 9f 02 Data Ascii: PiTpNWS,E@m`<d$``)r4)WP\P1@ 91$x!&-esHe>N8yQ,-xW00-PLFtEVrNpY[1@`lJ]i%,_<=x0g1C$0r=cYN\|a;8
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: f4 fa b5 f7 ae ff 64 f9 1b 1c fb 14 1a 20 b5 c7 76 de 78 5b c9 0e fb 32 68 ee af 61 d3 b9 b5 60 a6 e9 ec b6 c7 65 59 df da 96 bd 3a 1b d5 72 62 ff 33 12 8a 9b 0b bc 7b ac 3c 1b 47 a2 db 79 97 38 6b 2b db 7a 39 7a 0b 38 fa a2 bf 60 02 08 39 a3 21 db 21 c8 2f b9 5f d1 20 ed 3b a6 01 67 bb f9 05 b9 15 8e ba 0f d8 b3 d5 1b 0b 34 00 11 67 55 5c 16 3c 99 ca 97 af 0d 04 02 1c ff 1c 0c ba 76 44 66 55 bc 03 1c 2a 31 81 ca 02 e4 a4 d9 bb 08 26 c0 08 b8 5a 54 57 1b 5c 40 9c 94 13 a1 37 62 e2 c0 bf e0 03 a0 d6 bf 31 ba c3 5d 9c ff 18 aa 08 01 80 8f a9 a0 00 ce f8 0b 34 5c c7 2f f4 76 43 1b 0c 30 00 38 24 01 c2 83 c4 0b 88 1c 0c 4c bc c8 a7 b2 b0 6d ef 81 7d 09 00 a4 c2 37 b6 40 03 ba dc cb bf dc 08 9a bc 0c 08 1c a5 b1 c0 bb 35 5b a5 a7 3c 09 81 3b 31 7f 23 0b 00 05 Data Ascii: d vx[2ha`eY:rb3{<Gy8k+z9z8`9!!/_ ;g4gU\<vDfU*1&ZTW\@7b1]4\/vC08$Lm}7@5[<;1#
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: e4 cd 37 1c 7b eb 72 70 15 81 6f fc 51 d7 68 14 3e 0d ce 7f fb 61 ae e2 dd f8 dd f8 db 5c 40 1e f9 df 92 43 fd 85 e5 dc 64 5e 95 e7 ae 72 1e 8d c6 98 f3 21 ba 68 06 60 3d 39 26 88 af 8e f2 79 97 ba 2e f4 45 a4 27 de ff ba ec b8 2b 0d ba 98 a7 ef 67 71 ef b9 eb 3d af a9 bb f3 83 d3 ed 43 13 1d bc be 49 74 7a 2f 8d de 0c be 3c 23 11 03 3f 0d 8e c5 4f 4f 38 92 5f 6b af f6 18 c8 3f 93 fd e4 14 87 8f cd f8 97 87 f9 06 be 60 58 ef 7d ac 17 93 fd fe 6d e6 87 6c be 32 84 66 9c 75 f6 24 bb 6f 4d dd 12 2b 1e fb 3e 26 2e f4 9d ef 0e 03 9c 9f 02 a9 90 40 be a5 2e 61 0b c4 d2 19 ee 27 8d ee 45 f0 0a 0d 24 96 ff b0 b1 16 03 2a ac 75 14 14 14 b6 ea 25 39 10 aa 2c 68 2b 0b e1 05 45 96 c1 32 a8 d0 22 2b e4 4d 0c 51 88 91 da 11 ae 49 6b 78 21 35 74 e8 12 70 04 ae 85 69 90 Data Ascii: 7{rpoQh>a\@Cd^r!h`=9&y.E'+gq=CItz/<#?OO8_k?`X}ml2fu$oM+>&.@.a'E$*u%9,h+E2"+MQIkx!5tpi
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 27 be c6 75 97 d0 a8 25 8b 6b dc 1a 8e d6 bb a8 eb c0 d5 98 13 db e7 36 43 b6 7f 25 a4 38 53 f9 aa a1 6e 61 16 a1 ad 42 87 12 0b 0f ff 2c 86 77 6f f8 1d ce 6a 45 4a 53 23 74 80 8c 96 65 9c 70 cc eb a7 a0 72 b4 a8 b8 b8 6f 58 50 ab df 26 d0 15 b8 0e 96 93 71 00 f0 cd ca 76 75 c0 97 29 b0 6d 0f 65 86 0d 10 20 9e f2 ad 82 c3 12 ab 00 5a 4a f8 8a 68 1a 2e 8a 33 21 2a 2c 20 29 af 18 a6 dc 70 36 4c db 00 99 c1 21 1e 35 ec 51 b1 70 01 b1 24 e3 c4 2c be 25 83 85 1c 12 fe 76 93 04 00 48 40 02 04 9c 61 f6 d4 18 45 96 3b c3 02 74 6c d8 4a fc d6 be 72 45 a8 1d dd 21 02 2f f7 82 04 3a 22 41 0e c7 9c c7 15 17 19 b2 58 3a a6 bf a0 dc ce 0e 97 c1 00 ae d1 0a 8f f3 90 d0 33 13 47 53 91 f1 f2 9e 87 d0 3c 32 93 d9 08 14 10 f4 a0 8f 20 04 43 13 01 d0 5a 44 73 48 22 cb cb 21 Data Ascii: 'u%k6C%8SnaB,wojEJS#teproXP&qvu)me ZJh.3!*, )p6L!5Qp$,%vH@aE;tlJrE!/:"AX:3GS<2 CZDsH"!
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 4c a9 12 09 be 5d 24 35 61 34 52 64 63 a4 95 86 28 6a 41 f9 f1 e5 36 85 09 05 51 f1 66 73 a8 cd 90 3a 7d f9 24 d2 8f e6 93 70 44 4b 6e aa 28 a2 42 1c 9e 3d e9 08 cc 72 f4 29 d7 6c ff 14 75 35 b4 7a 29 29 91 27 11 86 30 3d 25 b6 eb 1a 79 70 0a b2 35 d3 6a 6b dc ba bd 42 5e b5 72 f6 6c 94 98 4e ed 42 29 88 d3 0b d5 8f 80 c7 98 94 7a 78 b1 2a 9c 0e d7 8e 8d 62 aa cf d9 7e 31 21 73 6d e9 70 27 51 b2 72 e3 31 0e 8d 29 1d 5e 6d 49 ff 14 c1 c8 97 09 20 d1 b8 06 0f 8b 84 79 31 36 ba ae 6f 93 c1 16 36 ef b1 23 31 85 94 95 82 0a 37 4b a9 b6 c3 3c 45 e3 d9 c8 f2 e2 a0 89 43 b7 f3 90 9d bf 64 c0 cd b2 46 f2 97 78 ae 9c 5a a7 ca 8e fe e9 7b 69 f1 e6 83 62 83 fb 8d ec 92 df 46 d0 22 c1 38 5c 3c de 86 56 d4 bb 2e 80 3f 49 f7 34 6e cf 03 98 84 66 f8 cc e3 19 53 ab bd 97 Data Ascii: L]$5a4Rdc(jA6Qfs:}$pDKn(B=r)lu5z))'0=%yp5jkB^rlNB)zx*b~1!smp'Qr1)^mI y16o6#17K<ECdFxZ{ibF"8\<V.?I4nfS
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 68 fb ed 90 5e e4 78 ff 8e a4 e7 c2 61 ea 8e f6 a8 db 6e 84 80 11 eb e1 bc 2c 4e eb ac b1 e0 e2 59 8f be f8 06 d5 25 68 01 13 07 f0 be f6 4e 78 d1 6c ec 16 dc 85 bc 4e 74 eb f0 c4 a9 66 11 13 c4 01 35 4c 31 16 7d 89 0b ea a0 07 3f 13 f2 aa e6 42 81 a0 14 78 62 9c f1 c6 ee 5e ea 31 50 fc ba 23 99 c6 2c 53 a1 e9 52 2a 9f 53 67 cd 3e 56 18 85 cf 3c b3 9c 70 ce fc ec fc ed c8 55 94 5c 6e d0 74 48 d5 d7 d0 0a 33 6d 91 d2 50 5c 3c 25 d2 52 1b ec 2f 97 40 67 1d 2d 62 e2 1e 81 b5 c8 41 8f 4d 6d ad 5c a6 4a b5 d7 8c 01 18 e7 cf f0 5a 64 34 b0 6b 73 d4 e8 63 cd 6a 86 91 d9 66 19 c4 37 5e dd 01 76 45 cc 6c ef ea 56 74 50 77 dd cd ad 75 17 ae 15 9e 44 9e 1c 12 cd 85 47 45 30 d7 58 36 5e 0d e5 d9 ca 11 77 d8 d9 bd f4 77 d0 84 a7 5d af e6 95 5f 84 56 c2 db 8e 8e 0d ea Data Ascii: h^xan,NY%hNxlNtf5L1}?Bxb^1P#,SR*Sg>V<pU\ntH3mP\<%R/@g-bAMm\JZd4kscjf7^vElVtPwuDGE0X6^ww]_V
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 4b fa c0 6f 16 2c 07 50 56 90 05 ed a0 d0 1e 67 d6 5e b0 16 c0 af e8 8a 50 04 0c 60 d1 de 49 08 3e c0 00 02 d0 16 04 4a 09 97 10 13 be 10 1e 24 60 0a 73 4f fc c4 4f fe e2 ef 16 70 09 0c 9f e1 40 c4 70 9b ac 20 01 70 a1 0c 3f 90 0a 89 60 04 99 00 0d cb 04 0e db 90 0d 90 ee fd 84 d0 f2 ac 70 08 30 ea a0 b4 f0 0e fd 30 5d 08 e0 16 00 90 f2 72 0f 12 e1 89 04 23 51 11 e5 a2 07 a9 60 0e ad 20 0f b7 eb 06 45 60 13 97 00 0a e7 8f f4 ac e0 f9 f6 b0 12 eb 66 fd 02 cf 0a ea 50 f8 68 90 0a 3e 31 f7 4c 90 63 2e 31 46 8a 2f 18 c8 f0 11 1d 91 12 a9 a0 f4 1c 50 4f 3c 86 16 a5 65 00 32 51 0e 30 40 cf d2 00 08 51 ff 4f 08 b9 b0 09 20 f0 14 7f b1 09 36 40 1a 91 c0 01 52 f1 08 60 71 00 d5 50 0a 0b 8f 10 d3 e0 e4 a0 90 52 82 91 63 8c 82 e2 18 71 0e 56 8a cd b6 28 f1 b0 ce 19 Data Ascii: Ko,PVg^P`I>J$`sOOp@p p?`p00]r#Q` E`fPh>1Lc.1F/PO<e2Q0@QO 6@R`qPRcqV(

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	49770	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:31 UTC	1105	OUT	GET /static/images/section4i1.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:33 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:31 GMT Content-Type: image/gif Content-Length: 2415534 Last-Modified: Wed, 06 Mar 2024 15:30:38 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c1e-24dbae" Expires: Sun, 27 Oct 2024 22:15:31 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:33 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fe d8 20 fc ee 21 7d 09 09 d6 e5 eb ff ff ff cf 35 02 00 00 00 fa 90 16 ff 5d 1f 86 b1 c4 ff b4 84 f9 90 15 fa 90 14 fe d7 1f fa 8f 14 fe d8 20 fe d4 1f 86 b1 c3 fc a8 19 fb 91 15 fa 92 16 fb a1 18 fb 8f 16 fe d0 1e fe c2 1c fc b0 19 fa 99 16 fb 9e 17 fa 94 16 fe d9 1f fa 96 16 fd b5 1a fb a5 18 fe c7 1d fe c5 1c fc 90 14 fe cc 1d fe db 2e fe e1 1f fc ad 19 fe d2 1e fd e6 20 fc ab 19 fd ea 20 fd b7 1a fd be 1b fb ce 1e fc 5a 1d fd bb 1b f3 53 18 e0 43 0c fe ce 1e d2 3e 03 fb a2 18 ff fd f3 85 b1 c4 e6 47 0f fc b3 1a da 3d 07 fb 9b 17 fd b9 1b bd 98 4f bf a2 18 f3 af 18 fd df 1f ed f4 f7 fd Data Ascii: GIF89a!NETSCAPE2.0!, !}5] . ZSC>G=O
2024-09-27 22:15:34 UTC	16384	IN	Data Raw: 99 49 5f 51 0c 2f 28 06 ff 96 61 ff fc ec b6 d0 db b0 bf 89 f0 53 1c 90 14 0b df bd 1e ca c7 69 9c b7 a5 e0 ce 4a ce 3d 16 ff e6 6c d5 41 17 0f 0d 02 10 0e 02 db 5c 09 d7 53 07 d8 54 07 97 bc cc ff f2 b2 c0 c5 74 fe e1 52 ff 6e 33 ce af 1a d8 cc 54 ae 94 16 be a2 18 fa d6 26 1f 1b 04 bd a2 71 a5 22 0f e7 87 11 e7 d1 3f 3f ab c6 d1 cb 5e ff 8b 54 a5 bb 99 db 5d 09 f6 d6 2a ff ac 7b fe de 40 ff a6 74 b8 c1 7f 96 9f 74 c7 38 14 ff f5 c3 fe dd 37 60 51 0c 4f 43 0a b1 a6 84 db 45 18 9f 1e 0e fe df 48 b1 9b 5a ff b2 82 bf a2 18 ab be 90 ff 85 4d ff 7b 41 c5 97 47 2d ae d8 f0 b1 1e ff ee a5 50 44 0a 5b a7 ab 67 a5 a0 74 a3 94 8e 79 12 82 b2 cb a0 9d 6a 19 b1 ea ff 74 3a 4f a9 b7 fd d6 a2 ff 80 47 fc bd 74 70 5f 0e 6f 5e 0e c8 a0 62 fe e5 c9 fb c4 83 ff d8 6e fa Data Ascii: I_Q/(aSiJ=lA\STtRn3T&q"??^T]*{@tt87`QOCEHZM{AG-PD[gtyjt:OGtp_o^bn
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: e8 05 fb 81 83 e9 bc 9b ce 48 0c 3f e4 6d 33 06 45 e8 5c e0 b5 b2 77 95 b9 92 33 e4 8a 3b c1 6d f4 2e 3d ef 47 ec d1 8a d1 49 2c cf 9e 75 c9 6b 05 f1 7e 0c 70 e0 f6 f3 f3 f2 32 fd f9 a6 e3 10 43 1b 6e a0 3c 41 d5 06 26 d8 7d 55 10 da 50 02 f9 16 47 8f fe fe a4 7f 31 46 1b 7e 38 99 09 fc 56 20 7d cd 0f 2a da eb ce 07 44 80 bf 8b f9 81 11 fc 8b 60 e3 be 10 83 21 9c cc 03 49 23 90 fc 0e c8 14 e3 81 2f 09 43 6b 60 c5 7e 20 c1 12 32 4e 16 5d 08 a0 c5 30 30 03 d8 69 ee 39 1c 44 4a 02 b9 d3 82 ae 89 f0 64 3a 18 c3 ee 4c 28 41 0a 5a d0 62 17 48 02 84 ff 62 78 94 ef e5 c7 05 1e b8 61 d1 fc b0 05 1d 0c a1 0d 72 db 83 32 96 c0 43 e9 1d e1 07 ed ab d8 04 82 55 20 22 0e 65 86 db c9 40 08 95 a8 37 3f e8 e0 07 58 88 01 15 ab d8 b8 25 74 21 8b 04 73 c0 0c 3c a8 39 2f 02 Data Ascii: H?m3E\w3;m.=GI,uk~p2Cn<A&}UPG1F~8V }*D`!I#/Ck`~ 2N]00i9DJd:L(AZbHbxar2CU "e@7?X%t!s<9/
2024-09-27 22:15:38 UTC	16384	IN	Data Raw: 6b 22 ff b7 9e cb 81 22 dc e7 aa b0 a6 a7 c9 d6 8a 8f 08 da cc 67 23 13 cf 0e bc 6d d5 04 28 ac 1d 35 ab 67 07 52 e6 b3 7f c5 50 e5 e1 11 a1 af ac c2 40 88 b3 c3 b4 a1 5e 00 8a 8a 56 f4 1e c6 4c 00 1b 78 75 55 40 70 b1 75 5e 26 1f e2 66 5a d1 6f 1e 9e a7 7d e5 81 f8 c4 b5 5c f2 e9 ef a9 4f ed 67 1c 7f 3a 53 7f 4d 4f 03 98 03 6b f5 c8 60 c6 b3 26 b2 18 cc 2b bb 55 f7 2a 0a ea c1 f3 87 e2 63 81 9a 06 1b cc 7b 2d f6 ad 2f 35 01 03 a7 27 cf f1 f9 f2 b3 15 8d 3e 1c db 17 d4 3c c6 8e b2 1f 14 9f 49 6e 7b db 57 c8 c1 ec ee 40 e7 4c 91 e0 bb 8e 8a 8f 09 ce 4d ef 3d a8 5b 76 8a 30 f3 aa ec 8c 1e 47 3d b9 3a 51 a6 77 bd ef fd 39 1d 24 f9 5b eb 05 ed 9d 86 4a 5b 81 9f db de 6b ed 55 ab d5 f3 6a 0f fd fb 00 5f 70 b8 c3 21 2e 3b 4e b2 0a d9 77 be 91 7a 2c 90 68 8d f3 Data Ascii: k""g#m(5gRP@^VLxuU@pu^&fZo}\Og:SMOk`&+U*c{-/5'><In{W@LM=[v0G=:Qw9$[J[kUj_p!.;Nwz,h
2024-09-27 22:15:40 UTC	16384	IN	Data Raw: e0 0d ca d0 0d 06 50 95 56 79 95 58 69 00 bf 20 0b de 50 08 55 a4 89 be 38 1a f3 31 88 98 32 8c c4 68 93 4f 79 30 51 29 0b 5c 90 95 6e f9 96 56 f9 0b b3 e0 09 24 d4 82 c8 41 1a cf 54 02 ea 27 28 cf d8 94 69 69 30 85 30 0b bf 00 97 06 90 02 86 79 98 29 40 98 56 c9 05 4a 40 97 e8 93 8c f8 18 1a 58 28 8c dc a8 90 7f 69 2d 9e e0 0d 54 49 98 29 c0 00 9e f9 99 9e 69 98 8a 59 95 5c 30 0b e8 d3 7d 03 09 1a 40 30 1f fb 98 29 69 30 89 d0 f8 8f 97 59 2d 9e a0 04 6d a9 98 9d 09 9a ba c9 00 89 39 9a 06 d0 0d 5e 69 3a 79 68 8d a0 d1 48 0e 90 7d 2f 50 99 b3 49 9b b6 e9 9b b9 b9 9b ba d9 9b a3 c9 05 b5 d0 3b 4c 28 1a f3 b1 76 9a 42 93 a1 78 89 cb 29 2c c8 00 08 be ff 59 95 cf 09 9d a0 39 9e 06 40 9d a6 f3 6a e5 86 9d 1a b9 94 dc e8 8d df 09 2b 9e b0 99 e8 69 9e d0 29 9d Data Ascii: PVyXi PU812hOy0Q)\nV$AT'(ii00y)@VJ@X(i-TI)iY\0}@0)i0Y-m9^i:yhH}/PI;L(vBx),Y9@j+i)
2024-09-27 22:15:43 UTC	16384	IN	Data Raw: 7a 37 56 10 06 89 7b ba a8 5b 0b 45 3b 30 41 7a a0 40 79 b3 ba 25 81 ff b8 19 38 da 1e 25 27 29 4c b9 ab 52 83 99 c7 e9 b9 59 1a 9f e2 f9 35 55 60 06 a8 5b bc a9 db b8 66 99 b1 56 49 09 d9 30 ba cb 95 87 0a 69 b9 ef f1 9f 8f 82 a2 55 3b 34 db 19 9f be fb 9d a0 6b 95 ce 19 35 4f ff 10 b6 c6 3b be a7 5b 05 4a 40 2f a4 d0 06 cd 7a 95 a1 d0 06 4c 7b 5e 6a c8 19 ee 13 b1 6f 72 af bc a8 a7 38 b3 0e eb ab 99 6d da a1 5a ab 96 df 8b 33 c7 40 bc e4 5b c0 88 6b 06 56 40 30 4b bb b4 ce 0b 62 a4 89 1d f2 0b 1f 78 09 27 13 7b 89 52 6a 93 ca 7b 9b 30 da 99 dd 6b 95 c1 7b 32 4a d0 0b 06 3c c2 89 db 0b c8 0b 7b c3 1a bd 9a 71 4e b8 0a 27 d8 6a 89 30 5b 32 1a ba a1 1b fc 99 07 da c0 14 f3 04 04 4c c2 3c 5c b6 55 10 7c 5e 8a 1d f1 77 19 76 8a bb e7 6a 33 ad 3a a4 fd 6b a4 Data Ascii: z7V{[E;0Az@y%8%')LRY5U`[fVI0iU;4k5O;[J@/zL{^jor8mZ3@[kV@0Kbx'{Rj{0k{2J<{qN'j0[2L<\U\|^wvj3:k
2024-09-27 22:15:48 UTC	16384	IN	Data Raw: 51 4d 30 f4 4c d5 7d 39 c7 f5 12 04 90 3b bb 3b ad d5 ba fc cd 5d 0d ce d7 f0 d5 b9 3c 04 44 6d bd 8f 40 d6 0b f7 93 e1 41 b3 95 21 1f 08 c6 c0 05 d3 c6 70 2d af 05 93 d3 76 8d d7 dc 9c 0b 7b 1d ce 7d ad cb 34 c0 09 19 bc 0c d9 0b 70 9a aa 1c a2 1b 1f 0b fc c2 f3 32 a8 8f dd 9f fd 3c 2d 72 40 bb 9c 40 d9 04 ad 0b 97 cd d7 41 ad cb 80 fd c9 d5 50 04 1c ec 6b 17 85 d8 94 a1 80 2d 2c 8d 0f 50 30 1a 9b da 7d 39 9b 04 e3 c5 b2 bb 06 b0 2d d2 3e 3d db e2 bc d0 60 cd d9 3b ec 05 b9 bd db c4 82 b4 da ad b4 70 a5 a8 bf ff 6d 1e 73 58 28 a5 7b 97 06 53 dc c6 9d 93 54 b0 da d3 52 04 b3 2b d0 cd 4d d0 06 0d dd 0b 20 0c bf ac cb 29 0d c6 05 b0 0c 8f 50 0d 57 70 05 ca 80 b4 dc 0d 00 41 a0 dd ca 70 05 6f 3b bb 8f 50 04 80 dc 52 36 b8 9c 9a 91 c0 99 32 de 9f b8 b3 19 7d Data Ascii: QM0L}9;;]<Dm@A!p-v{}4p2<-r@@APk-,P0}9->=`;pmsX({STR+M )PWpApo;PR62}
2024-09-27 22:15:51 UTC	16384	IN	Data Raw: 9b b0 09 9a 10 f8 8a 6c 2c 05 ff b9 12 5d f4 cf ed 08 ef bd f0 0b 60 09 e7 20 08 0f 2f cf 9e 9c 03 39 10 0c 53 9f ed 9f 4b f5 c2 90 03 98 8c eb 56 1f e2 17 4f 4b 3a c9 b0 43 8d 1e 3e 19 28 60 af b6 9d b2 09 72 70 f6 ae ff fa b0 6f f6 6b 3f f2 27 9f 08 b3 cf f2 27 7f f2 72 b0 ee ed ee 09 94 a0 09 b0 22 f4 c2 8b 06 88 7f e5 cd 90 f4 8c 9f d1 cd e0 08 91 5f fc 13 cd cf c4 8b f5 ea a4 79 9b 84 19 9a 17 bd 84 b2 e6 7f b8 e8 82 ff a2 09 e8 1e fb e0 1f fe e2 5f f6 b9 7f f6 72 00 fc 9c 02 e2 c4 7b f8 ce 0f ed 8b 9f fc b3 ed 0a e7 d0 0c cc a0 cc 82 e0 08 8e 70 eb 88 3f 03 98 ff b9 98 a0 4e 00 11 e2 c0 40 82 05 0f fc 43 98 50 e1 42 86 0d 1d 3e 84 18 51 e2 44 8a 15 2d 5e 5c 68 d0 20 0a 00 1d 3d 76 6c 11 40 e4 c8 91 2d 3e 9e 04 30 e1 53 02 96 2d 5d be 84 19 53 e6 4c Data Ascii: l,]` /9SKVOK:C>(`rpok?''r"_y_r{p?N@CPB>QD-^\h =vl@->0S-]SL
2024-09-27 22:15:52 UTC	16384	IN	Data Raw: 20 ae 2a 19 a0 c7 01 f8 e0 6a b5 cd 76 a8 b0 c8 d7 70 f0 cd b6 0e 97 64 92 c9 08 7c 23 41 a3 34 e4 fb c9 0b 8c 64 21 05 45 2d 9b 7a 6e 4b a4 58 90 e5 3f 09 05 9c b1 4c 85 fa 38 06 15 1c 49 a3 83 2b 1e 0a f1 d1 c7 49 b6 8a 81 b5 23 8c c4 73 2e bc 68 db ab 49 3f ff 54 cf b7 0b a4 a4 32 80 34 ff 2e 1a c6 b1 a7 da 28 a0 51 47 1f 85 34 d2 48 c3 40 e2 0b 22 88 58 e3 0d 46 14 d0 e4 8e 3b 0e c9 23 0f 37 dc 68 a4 8d 33 ce 50 24 90 40 ca f0 12 29 57 34 ba 44 c2 18 cd a4 35 21 56 6c 44 70 cd 05 50 5b 48 88 52 e2 f4 d1 10 3a ed cc b3 d8 8d 46 f0 ad 01 40 97 65 36 b0 24 35 b2 a1 d0 10 2e 32 05 2a 45 90 90 34 5b 6d b7 95 14 09 22 de 50 20 5c 71 c7 d5 a4 d3 4f db 88 ac cb a3 4c 81 64 a3 2c c6 ac 35 de ad fc a0 45 4d 1c e9 60 65 a1 1c 0c 01 36 ce ad 84 84 8b 0c 63 07 b6 Data Ascii: jvpd\|#A4d!E-znKX?L8I+I#s.hI?T24.(QG4H@"XF;#7h3P$@)W4D5!VlDpP[HR:F@e6$5.2E4[m"P \qOLd,5EM`e6c
2024-09-27 22:15:53 UTC	16384	IN	Data Raw: 98 a6 bc 79 e7 57 d9 03 c7 3e 88 f1 fc a3 b1 81 1c 3d fb 81 60 b1 43 16 66 4e c7 33 75 bc 20 61 fd 6d 54 f2 6a a1 22 10 67 07 d4 bd f7 5c c6 3d fe 56 b7 fc 89 23 13 1a 46 02 23 1f a2 d1 4d 0f 32 90 07 a0 d0 c4 f0 b8 c8 39 cf 80 93 c3 5c ae a0 82 88 62 28 e8 23 60 a0 8b 25 b4 37 c1 82 c0 a2 11 8d b0 43 06 65 b1 1d ff b6 95 47 10 e5 2b 19 26 98 75 17 27 41 e4 0b ec 03 94 07 54 25 3f 16 1e 0a 3f 35 80 11 7f 1a 55 8c dd 50 21 80 37 9c 42 2d 98 77 c0 03 46 82 10 7a c0 11 2b da 14 12 20 a8 81 2e 23 a4 60 12 bd 53 2f 10 de 0b 0e fa c2 cb 0e ce e3 90 2e a0 50 4a 0f 10 d4 7b 5a b8 c5 2c b5 06 56 de 9a 0d ad 74 a6 9b 5c dc f0 78 03 84 1c 0f d5 38 89 40 78 cd 46 16 50 47 d8 e2 f2 05 ba 24 41 89 77 94 0e 2a 48 d6 44 4c 08 41 2f 33 a0 0b 10 ac 18 a5 14 ac 90 8b 87 4c Data Ascii: yW>=`CfN3u amTj"g\=V#F#M29\b(#`%7CeG+&u'AT%??5UP!7B-wFz+ .#`S/.PJ{Z,Vt\x8@xFPG$Aw*HDLA/3L

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	49773	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:31 UTC	1126	OUT	GET /static/upload/image/20231217/1702817607573664.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:32 UTC	372	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:32 GMT Content-Type: image/jpeg Content-Length: 100018 Last-Modified: Wed, 06 Mar 2024 15:30:32 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c18-186b2" Expires: Sun, 27 Oct 2024 22:15:32 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:32 UTC	16012	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 39 30 0a ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 02 32 03 e8 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90CC2"
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 54 67 f5 cd 74 f1 95 59 14 81 82 46 0f bd 7e 99 74 d2 b1 f8 bd 9a 93 4c b6 24 f2 a2 50 72 58 e1 7f 12 71 52 4a 42 47 26 0e 41 6c 66 a2 2e 8f 21 50 7e 58 d0 be 7e 9d 3f 5a 74 8a 1a 34 53 d4 f4 f7 3d 7f c6 91 bb 24 84 94 45 cf a6 d1 4a a3 62 26 ee a0 f4 14 03 82 18 8c 6d ed 43 9f 2f 32 76 45 06 81 00 21 89 27 bf 23 14 f5 4d d2 a0 ec 4d 37 18 61 b4 64 2f 53 4f 8c 95 60 e3 a8 04 d0 04 8e a1 8b 6d c6 e2 c7 9a 8f 2d 11 5e 46 5b ef 7a 53 c2 63 18 04 92 32 40 f5 a6 a8 2c 71 b4 96 4c 64 7f 76 80 15 df f7 9f 74 b6 7f 8b b5 48 99 0c 41 5c 22 fa 75 63 51 6e cc 44 67 0b bb f3 34 a3 71 43 91 8f 5e 7a 50 03 86 0a 9c 72 07 40 29 cb 1e e0 51 41 18 1f 7a a3 de b2 f0 87 20 77 a7 6e 6c 02 0f f0 d0 04 e2 64 8c b8 8c 65 4f ca 5b de 9a d8 65 01 7b 75 a8 63 24 9c a0 e0 e3 3f 5a Data Ascii: TgtYF~tL$PrXqRJBG&Alf.!P~X~?Zt4S=$EJb&mC/2vE!'#MM7ad/SO`m-^F[zSc2@,qLdvtHA\"ucQnDg4qC^zPr@)QAz wnldeO[e{uc$?Z
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: 78 d0 f0 18 30 6c 7e 95 1e 91 e1 00 10 3d fa e4 e0 e2 15 27 e5 e7 b9 1d 6b 42 eb c2 b6 12 c4 44 50 88 64 ea ae ac dc 1f 7a 03 43 5a de e6 1b d1 fe 8f 2c 73 2f 43 b4 f2 3f c2 8a e2 a3 f0 fe b1 6b 37 ee e2 62 bb 81 dd 1b 8c 1f 7e b4 50 1a 1d 11 04 26 49 ef 48 cd 82 09 3d 69 78 8c e7 d7 a5 27 95 99 09 07 06 b7 b1 ee 0e 0a 1c 82 7a 54 8d 21 42 bb 14 71 4c 69 37 8c 01 83 4d 04 f2 b9 c7 6c d2 18 d6 62 5b 20 fc a3 8a 1d 82 e0 11 cf 5a 37 14 5d a3 9f 97 ef 7f 4a 08 00 b3 1e 7d a9 81 1a ae 06 5b 80 4f 14 e6 8f f8 9b 1e c2 9c f9 63 96 1c 91 4c e3 96 23 26 9d c2 c4 6c 9c 13 bb f0 aa 8e 84 13 d8 77 26 ae ba e0 0c 9c e3 9a 8e 4d ae 87 1c 7f 5a 68 4d 14 27 50 13 82 47 b8 ef 54 a6 83 77 04 f3 d4 12 6b 48 8c 72 38 06 a9 4c 9b 87 1e b9 aa 32 69 b3 16 ea 26 74 60 31 c5 73 Data Ascii: x0l~='kBDPdzCZ,s/C?k7b~P&IH=ix'zT!BqLi7Mlb[ Z7]J}[OcL#&lw&MZhM'PGTwkHr8L2i&t`1s
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: b5 35 17 4d e8 fa da f6 30 a4 b1 18 5c 5d 0e 6a 8e 4a a2 d5 3e f6 b9 ef 3e be d4 50 06 09 34 57 c9 35 63 ec 77 30 fc 6f e3 0d 3f c0 3e 16 d4 35 fd 4e 49 12 d2 ca 32 ec 23 e5 98 92 15 54 7b b3 32 a8 cf 1c d7 85 58 7c 5c f8 e5 e2 ed 35 f5 cf 0e f8 0b 4b 4d 02 40 64 b3 4d 41 9c 5c cb 18 fe 35 fd fa 13 9e a0 aa 80 72 31 9e fb 7f b6 3c ad 1f c3 1d 25 24 91 93 4d 9b 5b b6 8e fc a9 23 10 6d 72 73 8e 71 b8 29 fa a8 af 6e 86 de 2b 7b 48 ad e0 41 15 b2 46 15 16 20 b8 55 03 8c 76 20 0e 31 d3 15 f4 f4 55 1c 16 0a 38 89 c1 4d cd db 5e 9f f0 4f 93 af ed f1 b8 ea 98 78 54 70 8c 12 7a 6e df f9 1c 2f c1 9f 8b 76 ff 00 14 f4 2b af 3a c9 b4 af 10 e9 52 8b 5d 5b 4c 70 43 5b 4f c8 3c 1e 70 59 5c 0c f2 0a 90 6b ac f1 6f 88 13 c2 7e 16 d5 f5 a9 61 96 e2 3d 3e d6 4b 93 14 23 73 Data Ascii: 5M0\]jJ>>P4W5cw0o?>5NI2#T{2X\|\5KM@dMA\5r1<%$M[#mrsq)n+{HAF Uv 1U8M^OxTpzn/v+:R][LpC[O<pY\ko~a=>K#s
2024-09-27 22:15:32 UTC	16384	IN	Data Raw: f9 7d 6f 22 ea 3b 60 9b fe f2 3f 37 ee ad a4 b2 b9 9e 09 94 a4 d0 c8 63 74 23 04 10 70 7f 5a de f8 73 e1 19 be 20 78 fb c3 de 1b 81 5c be a9 7d 0d ab 18 c7 2a 8c e0 3b 7e 0b b8 e7 b0 15 d0 7c 79 f0 f0 d0 3e 24 6a 0c 89 b6 de f4 2d da 8f f7 f3 b8 ff 00 df 6a f5 dd 7e c3 da 6c b3 7e d1 3a 2e a7 b0 7d 8f 44 b3 be d4 2f 9c ff 00 cb 28 85 bb 44 1b 1d fe 79 53 a5 3a f2 e4 a7 26 2c 24 15 4a b0 ed 74 7d 59 f1 16 f6 39 fc 57 7d 6f 0c 7e 4d b5 8b 7d 86 18 fb 22 45 fb b0 07 b7 cb 9f c6 bf 35 db 93 c7 a5 7e 84 6a 37 b2 6a ba 95 dd e4 e3 13 dc 4a f3 b8 ed b9 98 b1 fe 75 f9 ea 33 8e 78 ab 84 7d 9d 38 c4 c2 a5 47 56 b4 e7 e6 7a 47 c4 dd 36 78 be 1e fc 27 be c1 fb 35 ce 83 73 02 39 1c 17 4d 52 f5 98 67 e8 eb f9 d7 73 f0 af c4 82 6f d9 3f e3 56 8a d2 2a 8b 69 f4 bb d8 a3 Data Ascii: }o";`?7ct#pZs x\};~\|y>$j-j~l~:.}D/(DyS:&,$Jt}Y9W}o~M}"E5~j7jJu3x}8GVzG6x'5s9MRgso?Vi
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 28 da 3e ee dc 75 06 bf 3d dc 99 1f 93 96 f7 ed ed fc eb ed 09 2f 8a 7e c4 1e 0e 9e e1 8c 9b b4 ed 66 12 4f 5e 6e 99 17 f2 e0 56 73 8a f6 d0 93 fe b4 34 83 94 b0 f5 29 c5 d9 68 ff 00 13 e2 ec 67 81 de be 94 f8 e9 a5 0d 3f f6 62 f8 31 00 1f ea ad 0d c9 f6 17 2f 34 b9 fc 76 d7 cd 6d cf 4a fa 47 e3 8f c5 5f 06 f8 bb e1 17 85 34 0d 1b 57 fb 5e a1 a4 e8 fa 75 9b 44 2d a6 4c 4b 12 6d 94 65 90 03 8d cd ce 70 71 c5 39 a6 ea c0 74 64 95 0a 8b ab b1 c1 fe cb 3a c8 d0 7f 68 5f 01 dc 87 0a 25 d4 96 d7 27 fe 9a 83 17 fe cf 5d c7 ed 5e 8f 06 9f a0 23 02 ae 97 13 a9 04 74 21 54 57 88 78 27 59 1e 1c f1 af 87 f5 85 72 9f d9 fa 8d bd de e0 33 8d 92 2b 74 ff 00 80 d7 d0 bf b6 f5 bf d8 b5 98 60 23 21 75 3b bd bf 4c ae 3f 42 28 8f f1 9b 7d 57 e4 44 d5 f0 f1 f2 97 e7 ff 00 0c Data Ascii: (>u=/~fO^nVs4)hg?b1/4vmJG_4W^uD-LKmepq9td:h_%']^#t!TWx'Yr3+t`#!u;L?B(}WD
2024-09-27 22:15:33 UTC	2086	IN	Data Raw: fd 0c 19 2d 8a 9c 63 9a 8c c6 07 18 3e f5 b6 d6 e4 a6 ed a0 e7 b9 eb 55 da d7 2a 40 18 73 eb d2 bd cb 9f 34 e9 db 63 28 c6 14 77 34 8d 19 63 c8 c6 38 e2 af fd 84 87 ce 72 bd cd 21 88 1c 0c f2 4f 35 5c c8 cb 91 94 0c 44 76 cf d2 8f 2f e9 57 1e 17 04 e0 7c a2 99 e4 96 00 85 c5 17 4c 4d 15 cc 43 02 9a e9 86 e3 a5 59 68 58 0e 46 3e b4 2c 04 0e 46 68 26 c5 5c 73 c0 e6 93 61 39 fd 2a df 91 cf 4c 7d 69 e2 d8 91 cf e9 40 6b d8 a3 b0 e3 a1 a0 26 0f 4a bf f6 6c 75 5f c6 97 ec 98 27 e6 1c 55 5c 35 28 88 49 e7 1c 52 88 54 f2 49 cf a0 ab cd 6d 9e 46 48 c7 4e d4 e1 6c 07 45 03 e9 52 df 56 52 bf 42 88 80 bf 23 a5 28 b7 e7 9f d2 af 34 1f 37 cb 90 be d5 22 db 87 1c 8e 9d 28 bf 62 ac ca 06 db 69 f9 54 81 ef 4f 10 01 d4 1a be 21 0a b8 ea 7d e9 c9 10 fe 31 9c 53 b9 2d 32 92 Data Ascii: -c>U@s4c(w4c8r!O5\Dv/W\|LMCYhXF>,Fh&\sa9L}i@k&Jlu_'U\5(IRTImFHNlERVRB#(47"(biTO!}1S-2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49774	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:31 UTC	1126	OUT	GET /static/upload/image/20231216/1702728345765756.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:32 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:32 GMT Content-Type: image/png Content-Length: 3393 Last-Modified: Wed, 06 Mar 2024 15:30:32 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c18-d41" Expires: Sun, 27 Oct 2024 22:15:32 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:32 UTC	3393	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 00 a8 08 03 00 00 00 6d f5 23 3d 00 00 00 b7 50 4c 54 45 ba ef fa ff ff ff fe ff ff 4b aa e3 46 a2 d6 48 a5 db 4c ab e5 49 a7 de 46 a1 d4 48 a5 dc 4d ac e7 b6 ee fa d2 e5 f1 4a a6 df 49 a6 db bb f0 fa b5 cf e4 e3 f8 fd c2 f1 fb d3 f5 fc cb f3 fb f2 fc fe ea fa fd f2 f8 fb dc f7 fc d9 e9 f3 e0 ed f5 cd e2 f0 ef f6 fa f6 fd fe 60 b7 ea 43 a8 e6 b0 e8 f7 6d b9 df 33 a0 db c1 dd f0 9d da f0 3a 9a d2 92 d2 eb c6 ea f5 7d c8 ef 6b bd ec 55 b0 e6 90 d3 f0 7e c7 eb 9d cc ec c1 d9 ea b6 d3 e7 5e b0 dc 76 be e1 cb e8 f3 a9 e4 f7 a7 d1 ee 7d be e7 78 bb e6 b2 d6 ee 90 c5 e8 a2 cd eb 5c ad dc b6 db ec b8 e1 f1 12 14 35 db 00 00 0c 45 49 44 41 54 78 9c ed 9d 7b 43 a2 4c 14 c6 19 aa 35 76 a0 21 6d 33 6f Data Ascii: PNGIHDR,m#=PLTEKFHLIFHMJI`Cm3:}kU~^v}x\5EIDATx{CL5v!m3o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49776	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:32 UTC	866	OUT	GET /static/images/section4i8.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:33 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:33 GMT Content-Type: image/gif Content-Length: 2700330 Last-Modified: Wed, 06 Mar 2024 15:31:11 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c3f-29342a" Expires: Sun, 27 Oct 2024 22:15:33 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:33 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 f6 ce b8 fc ee 21 cf 35 02 ff ff ff 00 00 00 dc 60 0a fa e6 db ff d5 27 fa 90 16 af 88 72 7d 09 09 ff 5d 1f af 88 71 fb 90 14 fb 8f 15 af 88 72 fc a8 1b ff d5 26 ae 87 71 fd bb 20 fa 94 16 af 87 71 ff cd 24 fe c5 22 ff d1 25 f9 90 15 fd b2 1d ff b4 84 f9 8f 15 db 60 0a ff d8 26 fd b6 1e fb 91 16 fe de 24 b3 8c 76 fa e3 d6 c0 99 82 f3 ca b4 f5 cd b6 ff c9 23 fc ec 20 fe e2 23 fc 9d 18 ff d3 26 de 60 09 fa 9a 17 fb a5 1a d7 b0 9a fe bf 21 fb a2 19 e5 bd a7 fa df d0 c9 a2 8c dc b4 9e ed c5 af bc 95 7f ea c2 ac fa 98 17 c4 9d 87 fc ab 1c fd e7 22 d3 ab 95 fc ae 1d b8 91 7b fa 95 17 f6 c8 ac 10 Data Ascii: GIF89a!NETSCAPE2.0!,!5`'r}]qr&q q$"%`&$v# #&`!"{
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 20 d4 f8 00 24 87 d5 f8 42 68 43 57 1e 47 b7 a2 8e c4 40 3d 1f 91 05 38 b4 ec 5e d8 8e e5 40 3f 97 54 08 a4 40 0a 54 c1 09 88 b4 0d b7 b4 46 7c af a7 7e f4 24 cd b4 cc cd 98 2e f7 c6 0e 9c 74 51 ad 80 59 fa af 50 7b c4 e7 b6 1a 45 1f f5 18 33 b3 e5 75 0e 05 f8 00 15 6b d3 0a 7c c0 40 27 ea 54 87 44 55 b7 5a 4e df 8e 05 64 75 8c aa 98 46 af 9d fa b9 d9 04 00 f5 46 97 35 1c 4b 9b 11 c0 80 53 23 0d 07 3b b0 b4 f5 5b 44 be dc 7e c1 00 5d d7 b5 5d 67 c4 59 17 17 04 14 c1 5e f7 d9 04 f8 f5 92 05 f2 7f dd 5a 44 b6 c0 c9 86 ff 55 11 3c 73 5b 1f b6 47 2c 75 77 42 c0 04 c4 74 96 60 c0 04 b4 6e 94 d1 5c 7b 3e dd 04 ac f3 ef 5c 80 0f 14 f6 48 73 36 50 e0 41 6a 67 dd 0e c0 00 6b 33 0a 69 9b 36 3c 37 73 a3 09 aa ac c4 c0 07 5c 40 63 33 8a 6b c3 f6 ce ca f6 50 78 76 65 Data Ascii: $BhCWG@=8^@?T@TF\|~$.tQYP{E3uk\|@'TDUZNduFF5KS#;[D~]]gY^ZDU<s[G,uwBt`n\{>\Hs6PAjgk3i6<7s\@c3kPxve
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 2a 6f 31 a8 a1 76 44 f7 56 ad 11 44 6e 04 e7 65 76 65 b0 49 5c 68 82 86 aa 31 51 2e 07 db 2c a4 36 cf 84 4e 00 11 90 f0 07 6c ef ad 82 ff ec 8c ae b0 d1 7e af 43 be b0 04 23 87 0c 07 29 c7 12 a6 e0 8e 12 f4 9e ad f4 92 a6 e9 ce 85 81 58 00 09 cb 99 7e 45 ee ce 7a c4 06 57 ad 0b c8 a9 15 47 b0 b9 5d ef 50 a0 c0 07 14 20 12 98 c0 08 34 31 39 85 81 dd 1e 41 6d 7e 30 08 73 e0 57 92 30 05 f4 ae 64 d1 b0 5c 68 2c ec da 6d 07 cc 6e c5 7e e4 b1 26 1c 59 74 c0 fb 52 aa 1d 8f 0c 68 c8 c5 19 1e 00 0a 90 f0 01 bf d5 b3 22 9a 28 c1 ac dd 02 ae 12 c3 b0 91 22 f2 58 b8 c0 ef 92 68 23 57 cc 23 ff c4 d1 0d 01 09 a7 9b 05 7b 26 47 18 71 cc 1a c1 e1 16 b2 3f 12 b2 f5 80 b2 58 54 01 e1 ba 00 79 a6 91 2d a7 a0 c2 15 70 85 72 d7 b8 26 44 a3 d2 ed ef 92 b1 4f 2a 31 4f a0 88 a5 Data Ascii: o1vDVDneveI\h1Q.,6Nl~C#)X~EzWG]P 419Am~0sW0d\h,mn~&YtRh"("Xh#W#{&Gq?XTy-pr&DO1O
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 7e 84 49 10 27 6c f2 a2 d5 51 c4 63 8e 84 66 12 49 54 2c e7 47 c4 df 40 ca 5b fd 00 26 61 1e 13 18 a2 52 6a 16 65 a2 99 86 49 b4 67 c8 24 64 f4 79 e6 32 5a 8e 54 c8 27 02 f8 a4 13 99 c6 6d 62 4e 75 46 4d 99 99 06 70 a2 d2 fc 0d 0e 4b 34 a6 75 7e e6 10 a6 e4 76 46 e1 7f 3a 21 5b 42 85 5b 62 40 4a 60 e7 47 fc df f1 44 27 52 7a d9 84 4a d3 51 36 c5 4a 70 68 45 98 04 59 22 e4 24 d6 e7 7e b2 c4 77 ae e6 4a 28 68 45 90 67 49 04 68 45 90 a6 e1 ac 25 8a f6 d5 13 41 15 7a 46 a1 29 92 e8 54 96 04 86 a6 a7 ce 59 ff 26 53 c8 68 4a 48 a5 71 3e 85 7e f2 a7 54 21 28 10 75 e6 f4 29 57 62 e4 21 2d 01 69 3c aa 04 96 9e c4 60 4e e9 fd 51 5b a1 9d 26 4a 9c e8 8a 48 45 85 1e 47 8f ae 28 10 d1 e8 28 f5 95 91 46 e8 30 75 26 84 a6 04 8c 06 29 49 d0 a8 97 52 5f 7d c6 d6 4d 68 1d Data Ascii: ~I'lQcfIT,G@[&aRjeIg$dy2ZT'mbNuFMpK4u~vF:![B[b@J`GD'RzJQ6JphEY"$~wJ(hEgIhE%AzF)TY&ShJHq>~T!(u)Wb!-i<`NQ[&JHEG((F0u&)IR_}Mh
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 9e 6d 0a aa 64 c1 77 66 b8 c5 55 8a 07 64 48 b8 cf 20 e4 2f 6a 9e 40 e9 8b 07 93 18 0c 2d 26 c1 45 8d 00 89 9b 1a c3 7b 16 79 4e 09 f2 80 60 a8 a4 af 51 b6 f3 80 93 3e 60 28 43 83 17 12 86 b6 03 cd dc 39 99 d3 1c 69 ea 6c 28 ce 45 0e f1 81 04 4b da 82 96 30 63 81 ae 5e 89 c8 c2 56 d9 cd 74 80 a1 81 08 09 9b 60 d7 e1 eb 75 93 9f c0 ee 3d 1a c2 10 57 67 67 8b f4 9d 5e 7d d9 88 22 6e 70 c8 df ff 7e 80 50 0c 1e f0 07 10 3c 43 02 cf 10 c2 e3 a7 f1 07 98 80 e3 49 14 f9 c8 3f ff 9e f2 8f bf fc 67 2e 10 03 8e 6b 35 ec 62 2f b8 50 90 c1 92 3c a4 83 af 98 46 3b 34 f8 a6 d5 14 b8 7d 76 9d 9d e1 15 fc e0 07 3b 3c a1 f6 b5 b7 83 1f f0 7e c5 c1 02 7d 20 fc 8e 78 f1 08 7f f8 e1 37 44 f1 0d 21 bc f0 8d ff 02 39 0d 64 92 5d 6c e5 e7 61 27 91 79 34 b9 ee f0 8e ea e9 d3 3e Data Ascii: mdwfUdH /j@-&E{yN`Q>`(C9il(EK0c^Vt`u=Wgg^}"np~P<CI?g.k5b/P<F;4}v;<~} x7D!9d]la'y4>
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: c3 5c 37 ec a0 d7 69 ab 75 41 6a 3e 84 90 f7 cf 90 e2 85 a8 e1 b6 51 0c 12 de 71 42 16 5c 49 9a e0 0c da 06 89 0d 01 03 e3 8d c9 6d e4 1d 7f 53 47 b3 e0 0d 17 21 48 ac e4 46 de d3 a2 22 0d 1c 3a c1 01 e3 85 ee eb b6 31 05 57 59 39 2a 53 52 1b 5b 18 28 16 18 5d 9c 90 da ec b4 47 55 e0 9f 0a 2b 98 cc b7 a9 d7 5c 04 15 ac ff 99 3b 4f 62 97 a0 fc bb 21 ba 85 3b f6 b4 31 d5 43 49 6e 2f d7 5c 17 07 8b e5 0f ab d4 dc 6c d0 22 6d 6c 89 57 ff 04 a0 73 0f 15 f3 46 52 e1 3c 75 5b 4b 2f fd 20 08 27 96 f0 e5 64 72 36 41 c1 e2 ee 17 aa 13 ac eb 71 04 cc 15 53 ec 77 80 c7 40 66 0c 48 79 02 df 0e 42 0d 05 15 41 2c 5b f0 de da 14 98 94 bd 91 8e 0a 02 31 9d 75 fe a7 42 81 84 45 00 cb 68 46 33 0a f2 c0 8e 18 d0 26 78 13 21 96 42 e0 83 d4 80 6f 86 7b 59 d4 0c 4a 92 1c c8 8c Data Ascii: \7iuAj>QqB\ImSG!HF":1WY9*SR[(]GU+\;Ob!;1CIn/\l"mlWsFR<u[K/ 'dr6AqSw@fHyBA,[1uBEhF3&x!Bo{YJ
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 96 aa 0c 80 f7 2f b0 03 97 77 f4 91 c2 05 55 a7 79 fa a1 00 6d c7 65 92 af eb 58 6f a0 89 85 2a 1c 47 ea 4e 20 78 34 d3 6c 07 12 da 17 4d 77 75 67 f7 a8 72 f8 77 b7 83 05 58 00 5e a0 82 87 ff 03 a7 3a 7b e4 b6 f7 01 2e 70 54 9e 61 7e a7 7a a9 ba ef 2b 78 ea 29 ff e7 c2 4e b3 6e 6e 20 62 7f 51 99 4f 79 7a 90 2a 96 67 7b b7 87 fc a6 7f 77 25 a0 f3 03 48 75 bb af 78 06 a2 e7 f4 26 56 8d 47 0f 6f 8e 2a c5 27 80 7a 50 ec 8a 5e 6a 34 b3 74 07 0a 77 fb 56 f8 4e 38 7d a8 72 77 69 ff 02 4b c8 84 6a 80 fc 05 90 7c ff 69 57 02 22 a0 e0 80 37 ef 3c b7 58 ab b7 64 e7 96 ed 9c a7 1f c4 7f aa 89 af 38 d2 fe e7 9f d7 b2 a1 e6 51 d1 bf 75 91 7f 2a 2d 80 77 51 b0 86 09 98 80 41 b0 7d b7 cf fd 5d df 04 22 c0 01 70 68 69 59 38 e4 eb 4e ef 06 76 a5 2f 67 20 4d 1f 29 72 9e 37 Data Ascii: /wUymeXoGN x4lMwugrwX^:{.pTa~z+x)Nnn bQOyzg{w%Hux&VGo'zP^j4twVN8}rwiKj\|iW"7<Xd8Qu-wQA}]"phiY8Nv/g M)r7
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 86 34 56 66 21 13 79 cf b1 6c 3d 7c ee bc 75 76 a1 ff 76 33 e8 c1 52 df 0c 5e 41 c8 6d e7 23 4a e5 89 6e b2 ff 5c cc b2 7d 21 f1 6c e8 1c 14 c9 72 e6 68 aa 6a 4a 12 1e dc 6e de 8d 23 92 e8 93 fe 30 62 86 21 76 95 e3 c5 4c e6 01 70 e8 ce cb 64 17 b2 01 98 1e ac b3 f4 48 2e 3e 80 5e 2e 03 5d d0 02 0e b6 0e f2 7d a1 e3 f5 e9 02 83 4a 46 56 90 e7 dc dd 01 58 dd fd f3 68 17 da e8 a6 a6 2a 42 c8 00 21 a8 3b c1 5a e4 04 0a 87 3b 20 00 02 70 87 32 b8 8e 82 cb 66 ad 46 2e 0b 60 e9 46 0e 69 9e 95 c3 27 54 cc 16 0a 66 b6 4e ad 4a f3 87 b2 e6 eb 47 48 05 eb 38 5c bc 4e af fb 5d cf 05 31 22 26 9c 55 66 96 bb 0d fe 60 9f c5 85 07 4c 30 5d e0 eb c9 36 05 eb 70 67 c1 46 2f 79 2e dd 17 42 d1 d6 93 65 13 74 6b 23 fa 00 b6 25 87 5d 78 04 be 2e 85 72 90 04 d8 db 4e 53 98 ec Data Ascii: 4Vf!yl=\|uvv3R^Am#Jn\}!lrhjJn#0b!vLpdH.>^.]}JFVXh*B!;Z; p2fF.`Fi'TfNJGH8\N]1"&Uf`L0]6pgF/y.Betk#%]x.rNS
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 46 d2 fc 29 bc 34 bc f5 e3 80 cc 84 a1 62 b4 1b ff d3 72 c0 0a c2 49 88 b4 4d 30 d3 c3 99 bb cc bd 94 20 90 cc 95 d6 8c a2 8f cc 09 1b 4c c6 01 f0 85 3b 2c 4e 9f 52 44 78 e4 3a dd b4 bb 0a 82 82 ee 1b 19 7d 63 02 95 80 a1 07 b0 85 2f 4c 05 95 bc 4e ea 2a 4c c3 43 33 10 30 cb 21 9c 97 0a 88 4d e7 b4 a0 9b 30 c9 d0 8c bd d9 5b cf b6 fa c5 48 eb 29 0e 00 bb 0a 92 04 9f 61 00 97 70 c8 2f 6c c7 fe 64 4f b1 44 38 12 c0 35 0a 98 46 6c 01 a4 0e 88 01 21 58 01 17 d8 81 10 60 01 0a a0 00 16 30 81 10 70 81 0f 18 81 01 65 33 9a 28 ca d7 2b 44 27 08 48 06 fd 29 4f 4c b8 a0 52 43 f5 09 c4 5f a1 b8 f1 7c 89 0a 88 21 3a 84 c0 50 70 51 18 f3 c5 dc ec a9 17 bc cf 6b 41 a3 1b 58 01 26 83 2f 0a d8 81 11 20 c7 1e bb 47 96 d0 d1 18 42 87 15 5d d0 1f 6d 4f c3 13 37 13 40 48 85 Data Ascii: F)4brIM0 L;,NRDx:}c/LN*LC30!M0[H)ap/ldOD85Fl!X`0pe3(+D'H)OLRC_\|!:PpQkAX&/ GB]mO7@H
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 4c 01 e2 47 0c 64 db 1b 52 a0 06 c6 5d 6f 82 d3 1b 02 1d 50 f1 01 f4 94 6f 4d ae f2 84 13 8d f0 2a f9 dd 6f 86 af 90 8b dd fe 77 28 e2 15 88 48 ca 7b 43 14 70 c1 af 0a 46 f1 5f 95 70 83 0c 64 e0 06 4a 98 6a 05 38 e0 e0 08 d3 e4 83 3d e9 24 7e ee 4b 10 4f 64 37 9e 17 1d 81 46 39 ba 02 8f 56 20 a4 2b 18 ff 29 17 b6 ba 5a 79 e6 d6 c3 42 f1 2d 48 28 41 45 0a 98 38 c5 57 b6 aa 0d 0c b0 65 2e bf 38 c6 ef c5 21 4b 6b 1c 13 e9 9e 53 39 16 96 a8 34 92 d9 d4 a7 9e 58 bd 16 c8 ea 09 c0 6c c9 07 88 82 19 4f 06 8a 63 13 40 89 81 de b0 01 1b c0 72 a0 a7 5a 04 2e 17 7a cb 5e 96 ea 0a ba 7a c3 65 8e b9 56 57 39 51 6c 07 72 8b 2b 58 12 04 7c 75 b3 a0 0f 50 81 23 34 a0 b9 74 bc c4 77 f1 ec 90 28 0f c4 13 7d ce 60 0e 2a a0 69 4d df c0 d0 af c6 80 0f d8 7b 02 02 5f 50 cc 8e Data Ascii: LGdR]oPoMow(H{CpF_pdJj8=$~KOd7F9V +)ZyB-H(AE8We.8!KkS94XlOc@rZ.z^zeVW9Qlr+X\|uP#4tw(}`iM{_P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	49778	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:32 UTC	866	OUT	GET /static/images/section4i5.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:33 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:33 GMT Content-Type: image/gif Content-Length: 2002471 Last-Modified: Wed, 06 Mar 2024 15:30:56 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c30-1e8e27" Expires: Sun, 27 Oct 2024 22:15:33 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:33 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 85 98 98 fa 90 16 9c b4 b4 94 83 95 cf 35 01 01 9c ff ff ff ff 3b 4b 4b ff d5 27 53 45 56 85 99 99 ff 5d 1f a6 93 a6 03 57 90 00 00 00 b7 b1 77 f7 ff bd 97 be e5 9c b5 b5 98 29 04 ba a7 ba fc ee 21 52 44 55 3a 4a 4a 89 d1 ff fa 90 15 72 85 85 4d 5e 5e 80 93 93 3e 50 50 7b 8e 8f ff b3 83 48 59 59 5c 6c 6c 5c 4e 5e 69 7b 7b 5f 70 70 77 8a 8a 39 4b 4b b7 b1 76 74 64 76 9a b2 b2 43 53 53 61 60 4b fd ca 23 57 49 58 65 77 77 55 67 67 6d 80 80 fa fb fc 51 62 63 89 79 8b fc c1 21 90 7f 91 90 a6 a6 8b 9f 9f 88 9c 9d 97 af af a0 c4 e6 83 96 96 d7 4d 0a 6c 5e 6e f4 54 18 a1 90 a2 9d 8b 9e f5 b1 1e 97 Data Ascii: GIF89a!NETSCAPE2.0!,5;KK'SEV]Ww)!RDU:JJrM^^>PP{HYY\ll\N^i{{_ppw9KKvtdvCSSa`K#WIXewwUggmQbcy!Ml^nT
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 01 77 28 e5 46 a0 df 5a 60 60 9c b8 c0 8e 80 40 9b fe b3 9c 05 74 2c 71 c0 0b 54 a5 0a 90 c0 e0 0a 53 e1 a6 84 e0 35 6b ca fe b4 0d af ec 05 2c 9f 43 8b 87 7b 4d 74 e5 55 34 18 16 31 18 61 e3 28 3d c2 2d 60 80 54 df c2 23 a4 33 9a 31 aa ad da 71 57 30 71 3f 8d 42 1e 23 d4 d0 aa 1e 47 a0 b4 5a e8 09 d6 1c 63 07 f4 b3 e6 24 09 1d 1d 6d 2f ee 80 41 0f 13 8c 68 84 5f 1e 00 51 cb c4 f2 79 e5 4f bb 94 81 16 75 78 18 db ba 22 f5 a2 29 b5 0c 62 f2 c2 92 92 54 27 b6 54 87 03 e9 5d 42 26 f8 02 30 00 83 2f d0 b1 5e 95 01 25 c8 ff 47 e6 26 94 21 98 00 71 a4 35 47 90 9a 6e fc 45 b9 70 c0 5e ef 70 3d 27 46 01 d3 d1 6a 32 84 be 71 f1 42 2f 84 db 00 c0 0e ac f6 75 62 06 4b 2c df 5d fb f5 31 1d db 3f b0 f1 7b 15 01 61 0b a0 39 27 60 01 10 83 62 2b 76 39 6c 22 1e 20 af 4d Data Ascii: w(FZ``@t,qTS5k,C{MtU41a(=-`T#31qW0q?B#GZc$m/Ah_QyOux")bT'T]B&0/^%G&!q5GnEp^p='Fj2qB/ubK,]1?{a9'`b+v9l" M
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: e5 d1 99 80 d4 2d 4f 80 a7 df 44 aa 3b 36 be ef 6f 23 2d 29 58 fd b6 83 1f 28 a0 ac 0a 50 69 ff ef 0c 10 cc eb d0 70 71 34 7d 2b 5c f9 b7 89 14 f5 4a a7 01 e8 58 4f 33 c3 81 a2 4a b4 8b 9f 5a 28 50 33 f0 d0 8a 02 05 8a 35 8b 0a 0e 9e 3a 93 17 c4 ee 9b 65 a9 6a 5a dc 18 d6 c9 52 d6 a4 28 35 2b 66 d1 da 3b 7c 26 a6 1f c2 83 5a 5c 43 fb d6 53 50 e2 13 9e a8 01 59 ba 06 80 e7 19 74 93 79 85 c9 5e 8d 9a 11 b8 81 4b 04 53 05 a7 09 64 66 a2 af cc 88 2a a8 81 8a 0f f8 7a 00 0d 40 70 48 60 3c 23 64 d7 28 cf ca 32 77 9e 27 25 2b 66 a3 7b d6 95 1a c6 8e 15 c1 87 f0 a6 20 da ed fe f3 14 2a 98 c4 df 42 41 96 3e 7c 29 93 3d 79 ad 66 38 70 5b b9 71 4e 04 20 70 2c c8 48 b0 41 c2 76 e5 b8 34 01 c0 6b d0 90 27 7d 01 ab 84 b8 5c 6e 73 03 bc c2 e7 4a b7 c0 65 85 c5 2f 21 b4 Data Ascii: -OD;6o#-)X(Pipq4}+\JXO3JZ(P35:ejZR(5+f;\|&Z\CSPYty^KSdfz@pH`<#d(2w'%+f{ BA>\|)=yf8p[qN p,HAv4k'}\nsJe/!
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 9e 45 5b ac 64 90 9c e6 2b fe 1f 2f 0e 01 a7 5e 0a 94 0e 46 c4 b2 6a 5d bc bf 74 7e 2c 45 55 89 43 e1 08 9a ae ce f3 25 c0 af fc ea b2 70 3e 5d b9 3b e0 9c 3e 8d de af 5e bd 4b 2a f6 48 51 e5 e7 7e ce 15 38 80 eb a5 c0 04 36 8e a6 e9 59 45 00 a8 eb 5f c6 6a e8 4c 25 c0 7e 8a f7 e0 eb 88 c0 02 15 90 2b 34 58 67 c1 1e 6c 9c 38 e5 5c 31 35 2b 7d ba 66 de af 28 c6 15 0f c0 01 e4 b4 62 ff 00 d2 15 4c a8 6c cb de 95 17 2e 56 7e e4 94 f9 52 a6 ce f6 ec 69 a9 a9 db b8 0d be 46 6d b9 7a 68 ae 56 5c d6 6e ed 9a 40 e6 4e b9 30 08 d6 b8 f9 dd af 6f ee 14 14 e0 42 d3 dc e7 a4 fe 1f c3 a5 ec df 56 8a 57 20 35 50 f2 01 24 a3 40 e4 ce 45 16 e0 e3 6b 62 ee fa d6 03 34 48 62 a1 8a 68 40 ae ee 9c 80 67 cc f6 e9 79 9e 61 bb 9b 63 a8 44 6a f2 ee 1f ef 96 04 f4 5e 0a 6b ee 94 Data Ascii: E[d+/^Fj]t~,EUC%p>];>^K*HQ~86YE_jL%~+4Xgl8\15+}f(bLl.V~RiFmzhV\n@N0oBVW 5P$@Ekb4Hbh@gyacDj^k
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 94 c3 f1 3b 42 3c cc c3 3d ac 93 3e 34 8d bd 58 ae 8e 89 34 44 34 2e c8 5b c4 7c db bf 18 d4 86 8f 9b bc 32 ac 93 1c 14 9c d6 ba 44 47 4a 81 2a 3a 1e 4e a4 12 15 50 00 50 94 43 3b d4 44 52 4c 1d dc 8b 38 54 1c 0d 55 9c 99 e1 73 45 e2 0a ba 58 3c 3e 47 84 44 5b 2c 00 54 30 43 e8 e3 bc 5e 34 00 10 c8 c4 f1 d9 82 da 8b 43 63 84 40 10 40 46 65 3c 1e 52 c8 3a 3c 71 c6 67 e4 8a af e0 18 34 98 c6 e2 52 44 6b 24 ba 59 e4 bf 30 cc 37 1e c0 c5 05 24 1c a8 eb c5 19 ba 32 e4 09 3d 3a 21 81 73 44 c7 ef 83 01 3b 64 47 84 1c b3 78 84 42 ff f8 eb 18 7a 43 44 24 88 02 2e d4 c7 8f 2b 87 2f 04 c3 8f 8b 07 3b 69 81 a4 02 47 4c c4 a0 19 a8 93 18 78 81 86 f4 3e 17 78 c8 51 8c 48 e4 11 c6 2a a1 48 c3 d8 8b 93 5b 17 7b 44 44 7b eb 48 e3 a3 06 47 ec bf 7c 33 05 3b 51 bf 29 eb c5 Data Ascii: ;B<=>4X4D4.[\|2DGJ:NPPC;DRL8TUsEX<>GD[,T0C^4Cc@@Fe<R:<qg4RDk$Y07$2=:!sD;dGxBzCD$.+/;iGLx>xQHH[{DD{HG\|3;Q)
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 50 60 68 e6 38 49 af b8 30 26 6b c0 63 26 2b a0 86 3d 6e b1 8f 7e bc 09 f5 e2 22 48 bf c0 20 88 00 08 41 11 13 99 c8 f1 35 92 91 2d 68 22 68 54 48 49 5a b2 e4 2e 57 d0 a4 26 3b 49 99 4e 1c 0f 94 38 01 64 5c 3a 31 c8 a9 80 a0 06 9b 42 81 2a 57 b9 4a dc b9 92 91 27 80 81 a9 fc f2 c4 5a 56 ff d3 3c 64 d9 41 2e 75 b9 4b d7 7c 72 7e ae e8 57 65 48 c9 97 12 98 51 88 1e 5c 66 3a 43 e0 4c 57 72 c0 03 d2 ec 4b fa ac 39 cf 8d dc 25 9b da cc 24 37 49 d6 32 1c ba 22 98 c2 24 a6 54 4c 09 a7 64 a6 d3 a0 8a 64 a7 33 dd 09 cf ef 30 8b 9e 0f d5 08 59 96 80 cf 4c 72 52 9f f2 89 42 1e aa e6 28 67 fc a2 82 81 0c 28 54 8c d9 3d 21 1c d4 a4 cd 4c 28 23 25 07 83 38 42 d4 a5 06 21 0b 2e 29 7a c5 8b 52 a7 13 79 08 c6 46 d7 02 89 5b 78 d4 a6 21 ad 48 39 e1 94 04 65 9a 74 99 49 e4 Data Ascii: P`h8I0&kc&+=n~"H A5-h"hTHIZ.W&;IN8d\:1B*WJ'ZV<dA.uK\|r~WeHQ\f:CLWrK9%$7I2"$TLdd30YLrRB(g(T=!L(#%8B!.)zRyF[x!H9etI
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: d7 d9 93 bb 46 07 20 af b2 67 10 dc 00 ff fc e8 8a dd 6a 29 df f1 01 2f ea bc 96 ee 3c 8b c7 79 2c ed ba ac b1 ca a5 03 37 1f 13 73 bb 5c e3 ca f3 2b 2b f2 b2 eb ed 41 1f 70 9d bc a5 5f 55 f4 32 41 da a5 bd 6b 4a 7f b1 31 2f bd ed ee ee 1b f7 bc 69 48 f5 46 5f ee 04 80 9e 3b df f3 b3 db e8 ca fb ee f3 9c 7a 61 2f f6 23 9e f3 5f b5 8e 67 bf f4 b3 8b f0 2c 9c 73 ed 58 c6 ba 0e f7 71 ff 82 66 bf f3 2f 6f d9 08 7e f1 79 bf 71 51 bf 60 7e 0f 13 41 1a f1 2d 3f f1 16 7b 08 f0 64 f8 3c db b2 02 87 c1 e2 be f8 71 9f 5c 03 8f ee 83 df ae 67 00 05 43 8c f7 51 6e a2 91 8e 98 9a ff 12 41 6a e2 6a 0b f9 03 3b d0 18 6f a2 eb 9b 59 a9 3f f6 f9 29 70 74 e0 fa 60 6c b0 26 8a f9 f4 0c 56 b5 cf f8 56 ff 55 9d 9f 6a b9 ff f9 ee ee b3 57 aa a5 c8 15 fc 30 a1 03 c8 16 f8 02 97 Data Ascii: F gj)/<y,7s\++Ap_U2AkJ1/iHF_;za/#_g,sXqf/o~yqQ`~A-?{d<q\gCQnAjj;oY?)pt`l&VVUjW0
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: c7 04 95 81 8e fd a2 96 54 34 23 eb 06 3c fc 67 98 43 21 92 42 d7 92 62 c9 84 2a 09 99 5f 57 74 8a 08 8e 75 67 99 03 10 89 68 69 87 a8 a7 66 df 47 58 a0 29 14 96 27 97 62 a9 97 a8 79 77 92 69 86 5f 59 80 05 c0 05 95 f1 8a 68 d9 49 89 b0 71 c8 b4 66 b8 58 98 b7 89 13 96 27 8c 89 c8 88 bd f9 7c 61 89 88 c1 59 72 99 57 9c b1 49 4c 8f c6 1b 07 f9 9c 2b ff 81 98 0c a9 88 94 59 9d 21 69 7b 5e 97 02 89 b8 94 60 37 8e dd d9 2a 56 a7 73 e2 39 13 ab e8 75 a4 89 86 70 40 96 82 48 77 2e 28 84 ec a9 94 e8 f7 86 fe 18 9f 82 32 6a 29 52 9f 87 09 72 ce a7 04 8a 98 9d 19 c8 75 fe d9 7c e5 29 a0 60 f7 86 16 69 a0 77 a2 85 95 a1 a0 3d 21 9a 25 17 a0 69 f8 92 04 48 72 20 9a 9a 15 9a 86 ee a9 8a 14 a9 a1 92 b2 89 d0 f1 99 1e 9a 13 77 77 9d 2a 8a 7b b2 57 77 8e 28 0e 35 f0 86 Data Ascii: T4#<gC!Bb_WtughifGX)'bywi_YhIqfX'\|aYrWIL+Y!i{^`7Vs9up@Hw.(2j)Rru\|)`iw=!%iHr ww*{Ww(5
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: ba 1f 9c 9a 73 a7 b4 b2 d4 d5 97 12 0f 04 c4 c1 86 03 60 9f e7 f1 fa bf bb 82 fc c0 21 e6 e7 e9 7e 7d 61 f3 fb b9 c0 c7 c7 ed 99 18 e1 71 0f d2 e4 f5 b6 bc bc b7 a5 b7 db dd 9e c1 c7 5b 74 73 59 ac 99 ac a4 a5 7f 03 5b 96 83 96 96 dc 5c 0a 01 8d e7 b0 35 0b f0 f7 fd d4 38 04 01 7f d0 01 99 f9 53 61 61 87 77 89 90 7f 91 b1 a0 b1 fb 85 17 fd e7 21 87 58 58 02 76 c3 3a b3 ff e7 85 15 3c 4c 4c fe 6b 1b fe e0 23 84 8d 8e 1d 5d 83 e9 8e 1a 7a cb ff 77 7b 86 d9 52 08 df 65 11 b4 b0 7c c7 3c 0c 9e a4 a4 f6 cf 28 6a 6a 7a 37 81 bc 8c 7b 8d b1 b3 8a fe c5 21 02 70 b8 e5 7a 12 d1 ce a8 b6 ba 8b fd 79 19 e8 c9 30 d0 83 29 ad b4 95 c7 bb c7 ca aa 26 df e1 c8 1f a8 ff f0 ef e2 a1 87 2f 46 4d 4a cf c7 d0 9d 51 42 a5 2e 06 aa b5 9f db d8 ba fd d4 25 4f 76 9f 9e bb cc e8 Data Ascii: s`!~}aq[tsY[\58Saaw!XXv:<LLk#]zw{Re\|<(jjz7{!pzy0)&/FMJQB.%Ov
2024-09-27 22:15:33 UTC	16384	IN	Data Raw: 6f 5b 7b a8 bf 9b 07 47 e9 bd 6f fb b6 52 41 b3 f7 3b 24 00 bc c7 7b 3c 3b 18 fc c1 7b 25 73 a7 05 31 dc f9 b0 cf 42 2f 9b 7b 6a b4 f9 29 cf fb 42 4c 3c af 79 30 a3 5f bc 1c e6 3b 19 2b 43 bf 1f b9 1b 7c bc cf 03 7c 3b a4 c3 c8 8b 73 75 e8 7c bf 5f c2 3b c4 f8 bb a3 04 ae 43 36 cc 2b 44 96 7b dc 0b 8c ba cd e7 22 ce 93 c9 3b 6c 3c b8 ff fb cf ff bc 19 70 83 c8 0f bd 5e ab 45 3e b8 c1 ce 2f 40 1f 84 0b 93 a3 06 b5 e7 ee d3 c7 fc 22 7f 70 d5 0f 78 76 17 ba d1 73 7c d7 e7 3d c0 53 03 d8 8b bd 19 3d 79 47 60 82 3f 24 c0 20 9c 7d 08 90 ee ad 2e fd 64 9f f9 db 43 7d 27 0b f0 dc 67 1f 25 d4 3d d6 6b ff fd a9 bb 01 22 e8 bd e6 27 80 19 d0 83 3d 84 bd df 6b cd 13 7c c3 34 f4 c3 e0 7b 3c 24 9c 7d c3 a7 c5 14 c0 37 a1 47 7c e3 47 7d e6 c9 a8 cd 4f 3e 45 17 c3 ce 87 Data Ascii: o[{GoRA;${<;{%s1B/{j)BL<y0_;+C\|\|;su\|_;C6+D{";l<p^E>/@"pxvs\|=S=yG`?$ }.dC}'g%=k"'=k\|4{<$}7G\|G}O>E

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	49775	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:32 UTC	866	OUT	GET /static/images/section4i6.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:35 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:33 GMT Content-Type: image/gif Content-Length: 2424803 Last-Modified: Wed, 06 Mar 2024 15:31:01 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c35-24ffe3" Expires: Sun, 27 Oct 2024 22:15:33 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:35 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 98 2a 05 35 35 35 ff ff ff fc ee 21 ff 5d 1f 00 00 00 cf 35 02 fe d8 21 fa 90 16 d5 77 15 7d 09 09 b1 54 0b 97 2a 03 66 66 66 c5 63 10 a8 3e 09 ff b4 84 34 34 34 98 98 98 fa 90 15 97 29 03 fe d7 20 f9 90 15 fe d8 20 98 29 03 fa 8f 14 fa 92 15 fa 8f 16 f9 8f 15 b2 4a 0a 97 27 03 b5 4d 0b fa 99 17 b6 4f 0c fa 94 16 bc 57 0d b7 50 0c 40 40 40 ff d9 20 fe cc 1e fe d4 20 bb 55 0d c0 5b 0e b0 47 0a fe dd 20 fe c3 1d be 59 0d fc ed 20 fe da 20 4d 4d 4d ba 54 0d fb a4 18 fb a2 18 fe ce 1f ad 43 09 fd b8 1b fc b0 1a ae 45 0a b1 48 0a 99 27 03 fe c6 1d fd c9 1e fe d1 1f fd e4 20 fd b5 1b fd e6 20 eb Data Ascii: GIF89a!NETSCAPE2.0!,555!]5!w}Tfffc>444) )J'MOWP@@@ U[G Y MMMTCEH'
2024-09-27 22:15:36 UTC	16384	IN	Data Raw: f4 37 d1 81 14 31 15 43 e0 6b e9 3a 71 50 ec 72 51 54 f4 1e 49 73 50 a0 b1 ba 96 31 60 12 86 26 93 b4 2f 15 02 12 2f 33 77 a2 cf 38 f3 f3 55 c0 f4 40 77 47 3a 6f 46 0e 98 64 e8 a8 47 16 eb 34 29 9d af 05 6d c2 2d ff b4 33 b7 74 39 3f 64 da 1e f5 55 24 b5 4d 5b 08 2c 93 af 53 27 52 3d 3b 46 2a 38 84 22 8f 2b 4b 8b f1 55 77 f5 d4 06 f4 68 70 b5 08 03 0e e7 82 84 33 86 b5 2f c1 c1 42 3b c6 3d 1f ee cd a6 b5 4b 27 00 51 03 40 fa 75 47 50 cf 74 84 c0 75 2f 77 5e e1 da b5 2f 71 f3 ff 36 44 0d d4 b0 f1 00 ef 5f 07 f6 01 1b ff f6 5b 2b 35 e0 34 e5 da 31 76 22 e1 b5 05 95 81 73 2d 84 cd 12 aa 5f af 35 f7 f6 96 5b 23 f5 39 97 47 88 70 9f 67 bf 90 63 db b3 43 6c 30 c9 ea 32 6a 27 b6 51 af f6 56 07 6c af b5 46 11 c7 76 0c c1 81 40 59 10 23 38 c4 f4 82 04 d9 d6 1a 1e Data Ascii: 71Ck:qPrQTIsP1`&//3w8U@wG:oFdG4)m-3t9?dU$M[,S'R=;F*8"+KUwhp3/B;=K'Q@uGPtu/w^/q6D_[+541v"s-_5[#9GpgcCl02j'QVlFv@Y#8
2024-09-27 22:15:40 UTC	16384	IN	Data Raw: 1c e3 60 06 70 42 c8 98 11 ee 64 77 c8 92 0e 0a 43 83 40 16 56 25 54 2f ec 4a e9 1a 75 ba 1a 52 b1 8a 74 f9 02 20 7c b3 c1 16 d9 ae 8b 5e bc 1d 05 88 a8 93 01 16 70 2c 49 24 9e b3 82 47 b8 4d 3d f1 21 0f c4 88 fc 9c 64 c5 39 d2 51 24 86 c0 21 62 26 a1 c3 2f 7a d1 7b b8 cb 5c c6 8e e8 99 33 12 64 89 6a 1c 5e 90 da d8 10 82 d5 b1 91 8e 14 c9 17 32 b1 1f a0 34 60 8f 7c 14 22 d6 00 49 40 de 99 31 85 5f 3b e4 f9 a2 a2 42 45 22 e4 8d 17 a1 c1 23 53 a9 4a 3a 58 62 92 94 ff b4 e4 25 fd 18 46 9e 85 0f 89 be b3 8e a7 06 22 bc 50 26 92 94 08 01 d8 d3 54 29 4c 3a 12 62 0f ae 0c 4a 25 b3 77 c9 2e ca 52 8c 01 20 23 27 ad 42 48 81 94 0f 94 0b 14 a5 2f 0f 62 ca 5d 29 6f 98 de a4 e1 17 c6 70 4c a1 24 73 37 cb c4 e4 f7 0a 03 4d 41 5a 66 9a 00 f0 1c 69 72 29 90 5d 5e b3 97 Data Ascii: `pBdwC@V%T/JuRt \|^p,I$GM=!d9Q$!b&/z{\3dj^24`\|"I@1_;BE"#SJ:Xb%F"P&T)L:bJ%w.R #'BH/b])opL$s7MAZfir)]^
2024-09-27 22:16:12 UTC	16384	IN	Data Raw: 53 ff 98 d1 39 df f8 9d 2a ed 35 a9 08 c4 2f 35 c6 30 ed c3 4d 6c 51 3f cc d2 63 dc 52 d3 bc 14 fd 88 a1 34 05 d4 aa 91 bf f9 73 2c 2b 7d 0a 40 14 50 63 44 52 3f 34 8e 3f cc 53 63 ec 4e 3e b5 14 12 2c c1 40 b5 54 86 51 02 fd b8 41 c9 c8 41 aa f8 43 23 3d c6 45 65 54 c9 78 02 47 45 c6 48 ed c3 19 4d 93 d9 f2 0d 24 b8 d4 57 ad 95 1a 6c 2c 00 99 80 5d 39 8c 4f 3d 52 2e 85 8c 3f 6c 01 2d 15 53 5f d1 8f 97 81 d5 61 8d 91 0a 40 c0 04 74 be 5a 4d 0c e1 b8 55 3f 04 55 45 7d 48 e0 f8 4a 00 78 d4 62 44 55 ec f4 15 4a 3d 80 1e e8 33 62 f5 56 dd 40 b1 e5 18 39 b9 61 aa 0a 84 0a 5c 0d 55 40 2c 0e 53 3d c6 6b dd 43 12 f0 95 32 ad 8c fe fa d6 7a ed 8c 0a e8 1d c2 c0 80 36 fd bf 15 f3 d7 aa 03 0a 74 85 56 5d 6d 8c 69 ad 56 62 74 57 00 18 17 e9 d3 89 20 b1 d7 87 1d 0b 15 Data Ascii: S9*5/50MlQ?cR4s,+}@PcDR?4?ScN>,@TQAAC#=EeTxGEHM$Wl,]9O=R.?l-S_a@tZMU?UE}HJxbDUJ=3bV@9a\U@,S=kC2z6tV]miVbtW
2024-09-27 22:16:15 UTC	16384	IN	Data Raw: 5a 75 4d 22 c6 cf fa 8d 21 6f c8 3d 83 cd 86 03 7e c0 51 8f 6e fb 3b fb 07 75 50 07 7f f0 07 41 bf ef 6e 2a 07 5e 4b 05 00 21 83 c0 40 82 05 0d 1e 44 98 50 e1 42 86 07 85 bd 82 10 51 e2 44 8a c2 1a 2e dc 12 4a c1 46 54 02 13 6e 29 10 52 64 c8 36 00 4c 9e 44 99 52 e5 4a 96 2d 5d be 3c b9 03 c1 4c 9a 35 11 fc c3 99 53 e7 4e 9e 3d 2b 18 00 1a d4 40 85 9e 45 8d 1e 45 9a 54 e9 52 a6 4d 97 da 84 ba 04 e6 54 aa 55 ad 9a b4 33 52 6b 48 33 75 a8 78 5c 28 63 8b 12 b2 4a b6 6c 91 21 e8 e2 5a b6 6d dd 16 3c 06 8f e2 5c 08 d4 de 16 04 35 66 e3 de 50 0a 95 6c 0d 39 ea ea 60 c2 55 e1 40 ad 49 c1 29 d2 9f 42 81 12 5d 1c 59 f2 64 ca 95 75 9e 40 4c 73 45 61 ce 9d 5d 52 02 1c 32 8c 92 bb a5 4d 9f 46 3d d0 9d 34 88 74 21 58 2c ad 69 ef ff 6c 05 c8 12 a2 09 6d c7 f3 6e cf 25 Data Ascii: ZuM"!o=~Qn;uPAn*^K!@DPBQD.JFTn)Rd6LDRJ-]<L5SN=+@EETRMTU3RkH3ux\(cJl!Zm<\5fPl9`U@I)B]Ydu@LsEa]R2MF=4t!X,ilmn%
2024-09-27 22:16:18 UTC	16384	IN	Data Raw: 0c a6 fb 23 61 f5 04 c5 cd 71 f0 0e 06 26 ed b3 f7 bd f4 40 06 3c f6 ba c0 08 8e b1 e0 49 9e cd 09 e7 c3 fe 24 28 0c 8c 07 a2 9f b8 ca 71 4f 65 a1 63 4f 0b 1c 1f 98 10 92 cd 13 d8 23 a7 93 ef 7d 97 08 48 cd f3 2c 30 df cc 67 80 9f ff 2a b4 ee 2e 27 7c fc f5 61 e6 8e 88 9c 54 04 b2 47 ab f6 52 27 c7 f7 cf dc 72 ec 41 83 98 f6 74 12 fa 9d ac 9d 9f 42 dc 5a f0 87 72 20 60 6d f3 77 66 8b 00 3f 7f a0 4d 31 27 25 d5 97 7e da 31 0b 4e c2 78 03 93 7c e9 76 6a 05 a8 67 ac 76 3d e3 55 30 2b c0 7a 5e a7 13 d6 37 1c b5 35 01 a0 07 2f 7a c7 73 48 f0 73 17 98 67 66 e0 51 d6 a3 05 2f f7 2e 3d 00 60 33 17 13 c3 d7 1c 9e 97 22 49 90 6b 52 97 82 2b 18 69 a1 a0 6d bc 03 77 1c 93 06 d4 67 13 21 e8 1b 39 58 22 53 c0 83 28 a8 82 3f a8 67 96 00 3f b9 d0 31 62 05 6e 48 e8 80 d3 Data Ascii: #aq&@<I$(qOecO#}H,0g*.'\|aTGR'rAtBZr `mwf?M1'%~1Nx\|vjgv=U0+z^75/zsHsgfQ/.=`3"IkR+imwg!9X"S(?g?1bnH
2024-09-27 22:16:20 UTC	16384	IN	Data Raw: 9b 6b 79 7d 09 30 40 02 e9 6f ff fd f1 9f ff 43 d3 bf fe 87 b2 f1 ff 01 30 00 05 70 00 09 b0 00 0d f0 00 11 30 01 15 70 01 19 b0 01 1d f0 01 21 30 02 25 70 02 99 2b 20 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fe d8 21 ff ff ff 00 00 00 fc ee 21 ff 5d 1f cf 35 02 35 35 35 98 2a 05 fa 90 16 d5 77 15 7d 09 09 b1 54 0b 97 2a 04 66 66 66 c5 63 10 a8 3e 09 ff b4 84 98 98 98 97 28 03 04 04 04 f9 90 15 fa 90 15 34 34 34 fe d8 20 fb 92 15 98 29 03 fa 8f 14 fa 8f 16 fe da 21 99 28 03 bd 58 0d fe d7 20 fe d4 20 b5 4e 0b fb a7 18 fc 90 14 bf 5b 0e b2 4a 0a fa 98 16 b6 50 0c fe e2 20 a5 2c 03 ff d9 20 fe c4 1d ad 44 0a fe ce 1f fe d1 1f fa 94 16 b0 48 0a fd e4 20 b3 4c 0b fb a4 18 fd e8 20 ba 54 0d fb 9f 17 fc ae 1a fc ec 20 af 46 0a fa 96 16 bb 56 Data Ascii: ky}0@oC0p0p!0%p+ !,!!]5555w}Tfffc>(444 )!(X N[JP , DH L T FV
2024-09-27 22:16:23 UTC	16384	IN	Data Raw: 17 c0 31 49 44 ae ce 29 68 7f db 67 bf 32 75 58 8f f5 13 46 35 4b 78 26 0e 38 dd 82 7f 4a 20 d0 b7 56 a9 70 49 24 f3 60 f0 ea f0 1a 77 47 2b 75 12 df 76 86 bb 78 4d 22 08 3f a3 c4 92 6a 1b 7c 87 b8 9e c0 41 76 6b 37 4a 80 c0 d6 4e ff 38 85 e7 88 18 58 b8 6d 2b 37 6e 6b f8 5f dc 30 02 d4 b8 54 b6 dd 87 eb 38 9e 14 33 5f d1 42 4a b8 f3 1c 3b 11 11 87 77 91 cb f8 43 34 f6 5d 33 b1 13 e9 b4 da a6 c4 79 32 9e 25 4a 39 93 54 35 5f d9 f7 7d 37 96 61 5f 4d 5d 70 f9 23 7f 35 86 3b b6 92 ff 85 86 3a 79 67 aa 1e 0e e4 b8 9a 67 88 15 28 02 6c 95 81 60 9f 04 08 e0 2d d7 6d 23 52 f3 46 97 43 36 61 01 78 73 f7 b1 13 31 79 93 a7 04 25 42 39 0a 28 78 a0 83 47 83 5b 56 19 40 f8 d3 c9 28 29 32 fa 6c 3b 7a 9d 27 47 67 1f 84 a4 e7 b9 39 d3 78 4a c4 21 e3 fd 79 75 77 ba 69 48 Data Ascii: 1ID)hg2uXF5Kx&8J VpI$`wG+uvxM"?j\|Avk7JN8Xm+7nk_0T83_BJ;wC4]3y2%J9T5_}7a_M]p#5;:ygg(l`-m#RFC6axs1y%B9(xG[V@()2l;z'Gg9xJ!yuwiH
2024-09-27 22:16:25 UTC	16384	IN	Data Raw: 7d b5 4e 96 14 42 a8 d2 a5 2e 67 ad 5b da c5 da 86 bb fa cb 28 78 6d 23 de b3 1c 97 5b 07 82 41 7a 03 4c b1 dc 6a 88 1a bb 85 6f 60 a3 44 55 7d 6e b7 bb 00 23 2e 25 fd 3b a0 0c a8 80 3a 5b 15 30 86 3b 39 0b f1 d0 61 17 fe 10 23 7c b5 ff 91 2a ec ee 06 b8 05 b1 ef 6b 5d 79 16 23 90 93 bf 9a 3b d0 8d 2c 8c e1 19 c7 a4 97 96 c0 44 1d 04 80 09 4b 98 64 0c 81 84 af 2f d8 36 5f bd d0 85 07 27 42 b1 ed fc 63 01 ba b0 18 a0 29 2e 58 72 37 c2 1c 1a 53 59 67 7f b8 f2 18 f8 e1 c2 de 9a b2 9b 8e 6d 8b 91 eb 6b 41 15 27 a4 c9 1b 4d 48 27 f4 36 a0 1f d0 d6 32 cf ad 32 9c 27 73 e5 03 bc 03 14 e5 f8 b1 01 18 c1 08 7b c0 23 55 57 ab c0 20 c8 8c 90 30 37 f8 50 2a 5a 72 5b cc ec da 70 56 ad bc 1a 99 66 62 c8 30 89 20 50 41 29 71 be b4 73 44 40 ae 03 51 60 c8 7b 29 f2 91 23 Data Ascii: }NB.g[(xm#[AzLjo`DU}n#.%;:[0;9a#\|k]y#;,DKd/6_'Bc).Xr7SYgmkA'MH'622's{#UW 07PZr[pVfb0 PA)qsD@Q`{)#
2024-09-27 22:16:28 UTC	16384	IN	Data Raw: 5d 84 2d 4d a8 6d 53 fc 7d 16 3b 45 00 c0 0b e0 c3 cd 00 a1 1d 5a d3 7d 98 51 f0 86 04 5e 5f 06 7e df 87 39 06 8d d0 a5 da a5 e0 eb 3d 3f 9e 25 8b a7 05 dc 0c f6 d3 88 59 56 04 68 b7 0f 6e 5b 12 35 5e 84 c8 55 6a 40 e1 14 56 e1 d5 65 83 87 81 07 04 b0 38 88 b0 5e 8e dd d9 0b be e1 4c d5 e0 67 a1 d7 86 f5 61 01 e6 e0 26 86 08 ba 62 83 5f 28 62 01 58 e0 23 76 80 e8 cd 8f ff 56 b8 53 18 0e d8 cb c5 d2 cb b0 e1 dd 95 41 ee f5 d8 fe e5 e0 1a cd 62 94 f5 00 11 46 8b 8a 30 60 53 08 63 71 20 e3 32 7e 18 34 46 80 bc 45 88 27 a6 d9 28 be 59 00 c8 d9 17 94 63 cc 4b 46 89 e1 60 10 c0 ce 3b 7e 58 20 fe b2 88 c8 55 2f 00 86 30 7e 85 40 36 63 e0 20 64 2e 3e e4 18 86 62 57 5d 55 0c 8e c1 47 b6 3c b5 a1 da 15 70 58 4b 46 d6 1c d8 62 8b 28 61 04 2e 62 64 00 e5 87 59 2e 89 Data Ascii: ]-MmS};EZ}Q^_~9=?%YVhn[5^Uj@Ve8^Lga&b_(bX#vVSAbF0`Scq 2~4FE'(YcKF`;~X U/0~@6c d.>bW]UG<pXKFb(a.bdY.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	49780	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:33 UTC	1030	OUT	GET /Spider/?url=/ HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://www.telegramrm.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:33 UTC	164	IN	HTTP/1.1 404 Not Found Server: nginx Date: Fri, 27 Sep 2024 22:15:33 GMT Content-Type: text/html Content-Length: 138 Connection: close ETag: "65f1ef30-8a"
2024-09-27 22:15:33 UTC	138	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49779	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:33 UTC	1122	OUT	GET /static/images/session2i.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://www.telegramrm.com/skin/css/style.css Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:33 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:33 GMT Content-Type: image/png Content-Length: 1959 Last-Modified: Wed, 06 Mar 2024 15:31:13 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c41-7a7" Expires: Sun, 27 Oct 2024 22:15:33 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:33 UTC	1959	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 15 00 00 00 78 08 06 00 00 00 1d 7d b9 12 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 38 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 02 a0 02 00 04 00 00 00 01 00 00 00 15 a0 03 00 04 00 00 00 01 00 00 00 78 00 00 00 00 4a 71 83 c8 00 00 07 1a 49 44 41 54 68 05 ed 5a 6b 6c 14 55 14 be e7 ce cc b6 5b 5b 68 81 16 d2 02 a9 3c 4a 57 2a c1 10 0c 06 13 8a 09 11 a3 51 83 89 a2 c4 c4 c4 18 7f 18 45 7e b5 25 c6 d6 44 2c 55 8c f8 c0 04 fe f8 c3 c4 1f 8d 0f a2 51 31 80 6d 8c c1 c4 67 05 22 2c 0f 51 40 2b af d2 52 da 74 77 67 ee f1 bb b3 ec 76 3a 3b db 2e db 68 62 dc 49 66 ef b9 e7 9e f3 dd 73 cf 3d 73 e7 9e b9 4b 22 8f 6b 6a fb d1 3b 04 f3 13 42 90 Data Ascii: PNGIHDRx}gAMAa8eXIfMMixJqIDAThZklU[[h<JWQE~%D,UQ1mg",Q@+Rtwgv:;.hbIfs=sK"kj;B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49777	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:34 UTC	866	OUT	GET /static/images/section4i9.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:38 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:34 GMT Content-Type: image/gif Content-Length: 3145277 Last-Modified: Wed, 06 Mar 2024 15:31:13 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c41-2ffe3d" Expires: Sun, 27 Oct 2024 22:15:34 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:38 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 5b 25 02 00 00 00 7a 92 96 f4 22 6e b5 c3 c2 fe d8 21 98 3c 01 fa 6f 16 ff ff ff 5b 24 00 b6 4d 0a ff a4 00 b2 20 01 5a 24 01 fb 6e 15 f4 6b 15 5b 25 01 f9 6e 15 dc 60 11 b5 c2 c2 ea 67 13 d3 5c 10 5a 22 00 f6 6d 15 f4 21 6d b4 c4 c2 c8 55 0c 5b 23 00 e2 62 11 64 28 01 aa 49 0b ed 68 13 bc 52 0e d7 5e 10 60 26 01 d0 59 0e 7a 91 95 7d 34 05 67 2a 02 e8 66 12 c0 53 0d 5b 24 02 81 36 05 e0 62 11 b9 c6 c5 f8 6d 15 9e 3f 01 6d 2c 03 f0 6a 14 ad 4b 0b 78 32 04 62 27 01 6a 2c 03 95 3f 08 b0 4c 0b f2 6b 14 ba 50 0b cc 59 0f ca 57 0d a0 44 0a 8c 3b 07 6f 2e 04 75 30 04 fc 6f 15 ee 68 13 e6 65 12 89 Data Ascii: GIF89a!NETSCAPE2.0!,[%z"n!<o[$M Z$nk[%n`g\Z"m!mU[#bd(IhR^`&Yz}4g*fS[$6bm?m,jKx2b'j,?LkPYWD;o.u0ohe
2024-09-27 22:15:39 UTC	16384	IN	Data Raw: 02 40 33 80 27 ff c7 0a 44 a1 41 5f 55 68 38 b3 15 f3 44 0f a4 9e 13 50 ac 4e c0 51 a4 54 17 05 48 40 08 ec f4 4e 67 97 06 fc f4 4f ff 23 50 03 f5 08 f0 f4 0a e0 f4 da 8a 34 01 81 73 1d 13 82 03 3a 06 4c 0a d1 4a 2f d4 4e b8 f4 42 eb 44 11 4c db 01 84 40 8a ee 04 12 29 35 58 9b 1d 1d 73 f2 25 0c 4a 19 70 49 09 93 e7 54 8f 93 59 28 b4 42 7b f5 4a 9c c0 66 72 5e 58 b7 0e 07 8c c0 11 24 81 5e ef b5 5e e3 d3 13 08 97 48 3f 80 d2 72 72 29 44 8a 04 94 80 83 24 40 8b de ed 5a 0f d1 4e 04 72 42 6f c0 f1 02 c0 fd 4d c4 0d 88 ff 28 00 c8 40 48 d7 f5 50 00 81 0e 24 81 01 84 b6 68 8f 36 69 87 36 1f a8 c1 08 7c a6 e4 9a ef 2f 97 75 98 20 81 5b 57 8e e7 36 b6 24 91 85 14 26 74 03 04 32 b3 a4 57 05 ec 40 13 f0 40 a8 71 f6 88 70 00 68 97 b6 71 1f 77 68 5b c1 11 a8 b6 aa Data Ascii: @3'DA_Uh8DPNQTH@NgO#P4s:LJ/NBDL@)5Xs%JpITY(B{Jfr^X$^^H?rr)D$@ZNrBoM(@HP$h6i6\|/u [W6$&t2W@@qphqwh[
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: 65 20 49 81 13 62 09 c8 82 2b 6e 60 39 25 4c 31 53 82 cc 82 85 34 73 86 74 42 32 81 e5 93 68 b9 23 c3 75 c8 61 f9 dc c6 00 43 6f 13 23 29 71 42 4e 8c cc dc 4e 8b 82 19 71 26 57 0a 6b 13 b9 7e 64 7a 18 49 6f a4 23 5d 0c 94 dc d9 23 6f 1a d5 a6 31 19 62 7a 25 40 d0 08 89 67 45 dd 80 2f a3 82 e5 9e a5 5b 8b 81 dc 12 05 b0 58 41 d6 cf ce 44 86 4d e2 89 8f f4 d7 21 ba c6 a4 62 c5 1a 6a 84 8c 17 99 08 c6 57 0a ea 87 91 8d 16 75 2d c1 75 8b b5 1f 12 eb 67 43 9a d6 27 c1 aa 47 b4 9b 69 6c b7 91 d7 64 9d c8 6d e5 59 de 82 9d d7 26 44 75 cb 7a ff cb e2 87 b7 f4 98 20 ce 6e b7 ac 31 8c 92 97 ee d8 e0 02 a9 77 1b fd cc a8 85 d4 51 9e a5 c6 97 e9 60 5c 99 d6 62 e4 2c 6e 99 00 58 d8 9d f0 39 e7 97 24 a6 f8 08 97 e9 1d f1 1f 2a a2 d3 4e 51 ad 7d cf 2a cf c8 16 6c 64 36 Data Ascii: e Ib+n`9%L1S4stB2h#uaCo#)qBNNq&Wk~dzIo#]#o1bz%@gE/[XADM!bjWu-ugC'GildmY&Duz n1wQ`\b,nX9$NQ}ld6
2024-09-27 22:15:45 UTC	16384	IN	Data Raw: bd 4e 48 a2 77 8d ec a2 cd 13 d6 00 13 b6 b3 39 fd 80 5e 23 97 cf c9 ae f6 05 c3 ab df 90 3c 7b db e8 dd 33 c0 f4 8b 68 6b 8b 9b a2 65 2c e3 03 4c 36 2c 6e 3b 3b b6 c4 66 f7 a7 2f 2a ae 72 8f 7b de 17 1e d6 aa 3f 74 51 5f 67 3a d0 c4 b6 f5 45 01 86 b4 7c 0b 7c e0 04 2f b8 c1 f3 1d de 8b 26 29 04 e8 ae 60 bc e9 ad b8 80 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fa 6f 16 7a 92 96 f4 22 6e 00 00 00 b5 c3 c2 fe d8 21 98 3c 01 5b 25 02 5b 24 01 ff ff ff b6 4d 0a ff a4 00 b2 20 01 5a 24 01 b5 c3 c2 be be be fa 6f 15 d3 5c 10 5b 25 00 c8 55 0c e8 65 12 ea 67 13 f5 6b 15 59 22 00 f9 6e 15 61 27 02 68 2a 02 78 32 04 f3 6b 14 5e 27 03 6d 2d 03 f0 6a 14 f7 6d 15 fa 6e 15 e2 62 11 bf 52 0d 64 28 01 9e 3f 01 5c 25 01 8e 3c 07 cb 59 0f 96 3f 08 5b 22 Data Ascii: NHw9^#<{3hke,L6,n;;f/r{?tQ_g:E\|\|/&)`!,oz"n!<[%[$M Z$o\[%UegkY"na'hx2k^'m-jmnbRd(?\%<Y?["
2024-09-27 22:15:48 UTC	16384	IN	Data Raw: b6 b0 43 6d e3 d1 41 60 32 4b 57 b7 c6 5c f7 40 08 d0 60 68 01 77 8f 37 5f 6b 41 b6 4d 00 7f 07 78 09 20 29 a1 94 b6 fe 9e f6 50 14 f6 ac 04 43 6d 63 1a 0c 24 f0 01 d0 b7 c6 80 45 42 e7 6a 7a 1e 77 5c 1c 01 1f 04 b8 5e e3 01 78 4b 8b 05 ec 37 4e ff 41 12 24 01 0d 00 d5 04 d0 40 89 07 78 17 f0 0a 48 33 ed 72 0f 46 6a 33 4a 33 98 40 6d bb 33 00 b4 72 12 4b b8 bc d4 b1 39 0f 04 71 c5 ff 05 05 cc 33 87 ef 75 09 60 38 c8 00 b8 55 27 c1 04 34 34 46 50 c0 11 4c 00 91 f7 76 1d 7c f8 82 f4 01 23 0f b6 60 18 02 a3 c0 c2 75 67 37 00 40 f2 d4 f2 78 b3 20 76 38 2f 34 1f 63 84 16 14 f9 70 13 f8 b8 6c 38 4e 03 02 92 17 06 10 e0 41 6f f3 81 93 6b 48 60 ff 34 6d 24 83 12 64 c3 75 df da ac 5d 1e 99 cf 8e 99 0f 04 ed de 84 78 b3 39 68 97 40 9e 57 ca 11 e4 34 0d 58 39 00 bc Data Ascii: CmA`2KW\@`hw7_kAMx )PCmc$EBjzw\^xK7NA$@xH3rFj3J3@m3rK9q3u`8U'44FPLv\|#`ug7@x v8/4cpl8NAokH`4m$du]x9h@W4X9
2024-09-27 22:15:50 UTC	16384	IN	Data Raw: 93 04 51 42 57 3c 9b 74 8d 74 e3 29 73 0b dd f5 09 c7 92 03 48 9e d6 ba bd 3a 2b 4a 33 eb 79 3f 84 b0 9b cf f0 80 79 2b 88 c0 f3 1b aa a0 b2 f6 7b 08 68 b3 80 1d 58 bd 5c 3a bb 73 32 a6 27 d1 3f b2 c9 be 82 c0 a0 03 70 36 86 08 37 41 f2 37 10 da ac 83 78 b1 cf 18 bf 82 68 9c c6 58 09 f6 83 40 86 d0 21 82 28 01 92 22 28 5a 78 b7 8b d0 b0 87 30 2f c4 da c0 a2 c9 be ed 2b 88 b8 79 88 9c 13 24 b6 22 a2 16 58 89 10 24 8b 1e 24 08 a0 3b 38 84 48 38 08 14 88 83 58 82 27 90 15 82 92 a9 8d b0 3f 5e 49 31 4f fb c1 a2 11 42 84 28 3f 62 8b a6 df 23 a2 c9 3a 00 ff 69 6b 0c 92 3b 08 e3 6a 0c f5 22 08 17 d0 bc 18 7c 88 6c 43 08 0e 60 43 33 ba c0 8d 20 03 a8 38 c1 da 0b c3 82 89 00 83 90 3c c9 83 42 11 ec b7 5c 52 aa 83 b0 9c e1 08 44 82 60 c0 c6 20 b8 03 78 40 3b 74 08 Data Ascii: QBW<tt)sH:+J3y?y+{hX\:s2'?p67A7xhX@!("(Zx0/+y$"X$$;8H8X'?^I1OB(?b#:ik;j"\|lC`C3 8<B\RD` x@;t
2024-09-27 22:16:13 UTC	16384	IN	Data Raw: b2 d3 d3 c8 a3 4b 9f 2e f1 77 d3 09 ac 59 4a 0d 4b bd bb f7 ef 03 9d 3b ff e5 2a 5e 2a 73 f0 e8 d3 bb b6 be b8 27 50 f6 8b d5 cb 9f ef 59 35 d3 ec 41 db 3f c7 4f bf bf ff b8 5b 88 97 d3 51 dc fd 67 e0 81 6b 3d c5 1f 51 9b 20 86 e0 83 10 0e 55 de 79 46 59 37 60 84 18 66 c8 52 79 1f a9 f1 cf 03 ff 3c e3 91 7d 7d 69 68 e2 89 21 d9 e7 de 45 0f 00 d0 62 8b 00 c4 28 a3 8b 2d 3a a0 91 75 d0 a1 a8 e3 8e 13 e1 c8 22 8c 33 06 29 e4 8c 21 5a 64 df 16 99 f1 a8 e4 92 0b 09 68 91 03 40 0e 29 e5 90 20 56 24 de 82 4c 66 a9 24 6e 13 89 18 e5 94 60 4a e9 e1 44 e2 e5 a8 e5 99 26 82 45 d1 97 61 b6 39 24 45 5f a1 29 e7 89 26 a8 46 21 43 50 ba a9 e7 94 55 46 a4 94 53 77 ce 29 68 7f 71 4a c4 e6 9e 88 ca d8 e7 43 ec 0d ea e8 4c f6 fc 63 84 00 36 54 6a 84 11 95 da 20 00 a6 45 15 Data Ascii: K.wYJK;^s'PY5A?O[Qgk=Q UyFY7`fRy<}}ih!Eb(-:u"3)!Zdh@) V$Lf$n`JD&Ea9$E_)&F!CPUFSw)hqJCLc6Tj E
2024-09-27 22:16:18 UTC	16384	IN	Data Raw: 0b f1 40 04 b1 3c a6 20 80 ec 2c d5 e2 4b 11 00 08 d2 aa 8d 8d 17 2a 5b ff 6d 0e 37 ea 23 ab 0b 72 34 1c 2a 05 14 a9 d2 c4 bf b7 58 88 2f 84 01 31 4a 46 2c 4c 20 7a 42 c1 90 96 83 d0 c9 27 a1 8c 6e 42 8b 74 12 c9 07 1e 07 ca 51 28 27 a8 ea c3 8f 10 c1 5c c0 0f 12 4d dc 4e c5 33 25 cb f1 45 2c bb 52 84 be 1a c3 62 24 1d 2d 0d 28 ca aa 42 7e 6c 28 3e 15 88 c4 68 12 b1 5c 81 e8 04 19 96 6c 32 ca 43 11 4d 94 26 bb 7a 82 e8 28 2d 05 6a ea 0a f0 c2 04 d3 33 88 30 68 51 ad 18 cf 8c af bd 1c df 23 6d 0e 42 e0 14 8b 9e 1c e9 78 a0 ab 53 f2 5c 08 9d f8 b2 e8 f3 22 5e c6 92 05 a2 1d 96 3c 40 d1 5d 79 ed d5 24 09 33 1a 69 05 88 4c d3 12 3e a6 12 a9 b4 d2 11 09 d2 61 80 da b8 eb f4 cc 47 e9 7c 61 35 3b 4a 0d eb 54 ed 8a 52 d5 2a 56 5b 4d 48 ae f5 44 90 d5 22 1f c6 f2 Data Ascii: @< ,K[m7#r4X/1JF,L zB'nBtQ('\MN3%E,Rb$-(B~l(>h\l2CM&z(-j30hQ#mBxS\"^<@]y$3iL>aG\|a5;JTR*V[MHD"
2024-09-27 22:16:20 UTC	16384	IN	Data Raw: 74 da d3 2d 5c bc dc 42 c3 b4 8b 23 10 02 13 30 06 c7 b5 dd 3c a0 03 63 30 01 1d a0 50 59 15 02 da bd dd ee f5 5e 05 c8 03 12 88 51 d7 81 cd a5 58 dd bb 40 57 73 9b 89 86 4b 4c a4 70 56 82 98 38 e4 bd 88 7a f5 b3 23 84 b0 47 e0 de ef 9d dc 3c 78 84 4a 75 d2 1a c8 5f fd 8d dc 30 08 83 07 30 e0 30 f0 de 47 18 df a3 19 4c 07 33 8d a1 e5 89 19 eb 55 05 7d 8a 5c 33 5d f9 d5 88 0b 48 5d f8 bd 8b 23 78 84 3c 10 60 fd a5 83 ec fd cf 23 90 de 10 1e 60 03 56 e1 03 ee de 3c 00 5d 94 c9 c1 d4 b8 52 c4 e8 57 83 50 b8 12 f5 d5 a7 88 45 82 50 58 0c a6 88 80 2c 08 71 45 0a 0f 46 e1 01 f6 de 11 ce 50 16 00 e1 22 86 dc 15 76 62 16 be dd 62 80 dd 50 89 cb 29 b3 0d 14 ed 89 ca 6a 85 94 f8 55 0a ec 89 1e f6 e1 88 40 80 a8 f9 c2 7f bd c9 ff 25 46 e1 02 5e 61 02 be 5d 63 d8 dd Data Ascii: t-\B#0<c0PY^QX@WsKLpV8z#G<xJu_000GL3U}\3]H]#x<`#`V<]RWPEPX,qEFP"vbbP)jU@%F^a]c
2024-09-27 22:16:21 UTC	16384	IN	Data Raw: fc ac ab 11 67 24 cd b7 9f 84 48 6f 59 c2 59 84 09 2d bc 44 a1 9e ba 92 cb 4a 41 d2 d4 b1 f3 6a 6f b8 de 0b df a2 14 56 76 30 e9 6e 43 56 b1 dc 94 75 eb b9 2e e9 5d 7f 4d d8 38 f2 86 24 3b 76 6a e1 76 1b ab d7 95 98 b1 6a 0b d6 0a 06 0b 25 14 af 45 58 81 25 15 6e 50 40 05 bd 0c b7 c5 5c a4 72 30 72 11 2c b1 f4 75 48 99 2c 26 0a 89 37 05 5e 13 2f a8 4b e8 a5 1c 04 80 eb 56 fa da 58 ba be a9 9d f1 00 67 a4 89 38 e9 c7 48 16 c8 91 21 12 24 a6 4d 98 20 02 4e 32 92 bd 0a 37 81 41 c0 4a 88 ad ad 94 a7 4c a9 8a 10 b8 c0 22 ba 08 8e b7 fc e3 31 c3 e8 4e 46 7a f2 f2 a8 4c 66 f8 fa 95 ff 29 73 e4 d0 87 d2 ec a6 b6 ce 56 cc 6c 6e 73 7f bb 12 67 aa c4 49 cf 5b b6 cd 7a 62 09 14 df b0 0b d0 48 16 b4 8f 5f f2 e6 bf 22 ba cd 30 54 dd 43 62 f0 0f 4a 53 da 01 ff 98 80 86 Data Ascii: g$HoYY-DJAjoVv0nCVu.]M8$;vjvj%EX%nP@\r0r,uH,&7^/KVXg8H!$M N27AJL"1NFzLf)sVlnsgI[zbH_"0TCbJS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	49781	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:34 UTC	866	OUT	GET /static/images/section4i7.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:35 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:34 GMT Content-Type: image/gif Content-Length: 3327196 Last-Modified: Wed, 06 Mar 2024 15:31:06 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c3a-32c4dc" Expires: Sun, 27 Oct 2024 22:15:34 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:35 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 00 9b ff cf 35 02 00 32 52 fe d8 20 00 00 03 00 80 d2 ff 5d 1f ff d5 27 fa 90 16 00 58 8f fc ee 21 ff ff ff 00 00 00 00 58 90 05 56 54 56 be ff 7d 09 09 ff b4 84 00 57 8f fa 8f 15 fa 90 15 00 57 8e fa 93 16 ff d5 26 fb 91 15 00 84 d9 00 97 f9 00 98 fc 00 81 d5 00 9a fe ff cf 25 00 90 ed ff d3 26 00 8d e9 00 93 f4 ff d7 25 00 89 e2 fb 96 17 fe d5 26 fe c7 23 00 92 f0 fc a3 1a fe e3 22 00 6a ad 00 87 df fb 9e 19 ff cc 24 00 6d b3 fd ae 1c fe bd 20 00 8b e5 fc ed 21 fe c4 22 00 86 dc fe c1 21 fb 99 17 00 5d 98 fe e0 23 ff ca 23 fc a6 1a 00 80 d3 fc a9 1b fd b1 1d 10 0d 03 00 43 6d fc 90 14 00 Data Ascii: GIF89a!NETSCAPE2.0!,52R ]'X!XVTV}WW&%&%&#"j$m !"!]##Cm
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: c0 1e f4 6d ad 66 c2 24 0c f4 6d f4 f1 32 76 1a 6d fc 72 0a e8 84 ec a6 c5 04 df ef ed da 86 14 a8 b1 02 b5 b1 44 98 e7 ff 69 f4 95 84 ef 6f 40 6b 44 10 a0 aa d8 1d 9d 60 74 10 1e b4 01 5b ad c0 4e f2 87 44 66 20 96 c0 48 db 85 0b f8 c0 1d 5f b1 0d db 46 f9 e8 45 17 f0 74 44 2c 32 08 02 b5 9f 6c da d4 ae 72 01 7e f4 b2 f8 34 7e 58 c0 19 43 44 27 14 b1 93 08 02 58 47 87 25 2f 4d 2f d3 06 2d 98 07 28 3b 6e 1e eb 8a ba de 05 c7 8c c8 57 57 84 2e 87 23 59 57 c9 db a1 e7 43 98 c0 f8 61 18 b3 d8 c0 75 3a 41 2f 4b 41 5e 08 ff 6c 40 eb ef 32 a6 00 42 57 06 58 aa 85 31 e7 2c 32 eb 8a 87 56 46 93 38 49 61 53 84 2c ef 44 10 24 36 8b bc 1d ac 12 5d f4 b0 b0 a6 b0 f5 7f 62 6b 5c bb 6c 45 2b c9 6a 5b 2c 9d cc 64 6b 34 6e d9 ea ca 0f d8 c6 69 a3 76 5d 3b 04 4e de 9b 17 Data Ascii: mf$m2vmrDio@kD`t[NDf H_FEtD,2lr~4~XCD'XG%/M/-(;nWW.#YWCau:A/KA^l@2BWX1,2VF8IaS,D$6]bk\lE+j[,dk4niv];N
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: f4 7e fa 64 8f d4 ff 4a c0 74 d1 6f f1 91 7b aa 92 43 3f 5b 4f fd c5 c6 e8 b2 9e fc 99 c9 03 02 17 e7 d9 bf 63 72 e8 f2 98 87 fa 59 80 54 dd b7 6a a3 36 47 6e cd a7 f5 05 0a 9a 76 fc e1 27 7e b2 33 7e 7a a3 ec 6b 51 84 4c c6 da e2 66 fe 22 ae 7d e4 46 f6 23 86 d4 79 c0 74 eb 47 c2 b2 7d aa ba 0f 8a 41 f7 74 ef 0f eb 28 67 5e 59 4e 98 f2 07 88 00 02 07 12 1c a8 c6 00 c2 84 0a 17 32 6c e8 d0 00 b9 09 12 27 4e 3c c5 50 4d 80 4d 04 36 72 ec e8 f1 63 b8 03 22 47 92 2c 69 f2 24 ca 94 2a 57 b2 6c e9 b2 25 a3 05 32 67 ce 64 b4 12 01 ce 9c 3a ff f1 ec e9 f3 27 d0 a0 42 87 12 2d 6a f4 28 d2 a4 4a 97 32 5d aa f3 29 82 1d 28 ad 28 a8 6a d5 aa 91 97 5a b5 2a 92 56 f0 ab c0 30 4e 1e 92 2d eb d0 17 c5 b4 13 2c 2e 7c a4 f1 23 5c b8 21 b7 d2 ad 6b f7 2e de 43 34 f7 6a 52 Data Ascii: ~dJto{C?[OcrYTj6Gnv'~3~zkQLf"}F#ytG}At(g^YN2l'N<PMM6rc"G,i$Wl%2gd:'B-j(J2])((jZV0N-,.\|#\!k.C4jR
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: 1b 47 55 b2 9c b0 c2 ab 0c 32 18 c1 06 d2 19 67 5c 07 18 46 30 7c d3 30 c0 ac fc 52 c0 83 83 b4 84 0e 84 58 fc 3b 19 84 c8 c9 8a e6 5d 82 c7 93 d7 af 3f 00 17 d6 09 70 1d fb d4 70 d1 36 2e 19 a8 c8 09 0c 18 26 e7 3d 7d 8b 7e 0f be cb 12 a6 b6 c8 c6 e2 c7 6c c9 8a 2e 55 b0 01 fe ef 60 d3 41 88 7d 71 4e 80 3c aa e0 bd d7 a9 61 7b 78 20 a0 6a 52 25 18 21 a0 4f 7d 0f b4 88 0c d8 07 29 ef 70 44 02 f3 c3 91 4b f8 13 a3 ff 14 b0 01 82 df 01 45 3a 10 50 83 04 a2 ee 17 db 23 40 09 53 73 27 0b 7e d0 85 72 f9 5d 97 42 d0 12 f9 61 90 40 07 8a 91 07 46 e0 40 c6 01 f0 22 20 c0 07 2f 10 b0 02 15 e6 4d 03 9e 40 a1 08 8a d8 97 a3 bd d0 89 89 b2 c2 06 13 d4 1c 78 d9 70 40 99 fa 8f 07 3a c0 c3 27 6a a4 12 d4 40 00 02 5c a0 c4 25 16 0d 89 db 2b 63 5f 80 21 bb 55 75 d1 8d 1b Data Ascii: GU2g\F0\|0RX;]?pp6.&=}~l.U`A}qN<a{x jR%!O})pDKE:P#@Ss'~r]Ba@F@" /M@xp@:'j@\%+c_!Uu
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: 8f 9e 95 d3 40 14 31 6a c2 89 be f1 04 ce cb 40 09 6a 70 4a 8e 09 cd 9f 1a c1 a0 7f 64 27 01 d8 f9 67 91 f9 22 5c 2b 53 e2 4b 8e a5 b3 00 f5 8b c1 da 28 5a 02 68 72 74 8e 75 fc a9 09 53 a0 c7 37 06 e1 a2 d0 03 01 0f 4a 6a 37 94 66 44 a5 f4 69 d9 9b 1a c1 34 60 b1 f4 76 e1 6a 68 48 7a c9 31 4b 38 a1 0c 31 98 5c 0b 29 5a 80 17 74 00 a9 42 9d 1c 0d 44 f8 81 b4 f6 cf 9e 7b fc 00 5a 93 5a 03 d4 09 ec 6e 4e ad 08 54 e7 43 80 3a 34 4a 16 80 38 63 2a ec 00 4e 26 49 aa 3f 28 c9 99 c0 8a 20 85 79 1e 80 a8 64 25 a6 5b 3b e7 d1 e5 ed 6f b2 f6 1b 65 5c e7 1a d2 02 b0 c0 ae cf 7a 55 5e f5 ba 57 f5 34 a3 b0 f9 62 e9 92 64 51 55 c1 91 84 83 02 4b a7 5c 33 ea 42 76 ff 7e 00 93 98 a5 dc 3d 97 e7 d3 dc 3e 8f 06 45 55 e2 51 9d 18 83 32 fc c0 6e 09 38 d1 68 27 d2 34 fa a4 02 Data Ascii: @1j@jpJd'g"\+SK(ZhrtuS7Jj7fDi4`vjhHz1K81\)ZtBD{ZZnNTC:4J8c*N&I?( yd%[;oe\zU^W4bdQUK\3Bv~=>EUQ2n8h'4
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: b3 60 63 92 c4 2b 6e 9a d3 5c 45 a2 36 e0 32 e7 8e 8c 9a d6 95 d4 65 7a 02 e1 80 00 9d 6a 2b 55 6a 2f aa 05 99 ea 77 7a a9 38 ac c2 6e a0 5b 0d 13 24 e1 f3 06 b0 96 a6 ae cf f1 69 51 4c 45 51 a0 a9 95 b1 74 4b 69 00 fb 18 d7 a7 8e 54 2b 34 a4 aa 1e 97 72 8b 96 82 cf af 62 6b df 8b be 7a 53 a8 45 d4 28 91 50 d4 50 1b 9b 5a 8f e0 91 22 b6 23 1d 91 9a 2a 59 b9 52 56 ac 4a 41 20 55 8b a7 15 52 30 0e 76 9d 6d 4f 2c 00 0b 9f 33 d8 54 36 b5 8d d7 38 e1 82 23 88 cc d1 a2 aa 75 2e 46 ea a2 84 64 2e 68 99 b2 f5 13 20 29 cb c1 ee 89 32 b7 6c 49 c7 3e 0b d7 48 df b2 22 b8 f0 81 43 61 89 65 5c 7b 1d a2 36 99 23 08 f3 ea 32 84 e7 3e f7 98 53 8c a7 75 63 98 5d a5 ff 78 60 bb 4f 09 d5 73 a0 51 4d d8 f5 d0 af ac d0 04 e4 94 d5 05 fd b2 05 93 96 31 ed ea 4a 38 df c6 a6 90 Data Ascii: `c+n\E62ezj+Uj/wz8n[$iQLEQtKiT+4rbkzSE(PPZ"#*YRVJA UR0vmO,3T68#u.Fd.h )2lI>H"Cae\{6#2>Suc]x`OsQM1J8
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: 3d 91 75 0c b6 46 62 57 cb 90 8c 0a 19 5e 05 2d 90 3c 70 27 1b fc cc 9b b8 f1 92 09 91 63 f8 f6 58 8f 02 49 f8 a7 16 be 10 76 db ed dd 0f b7 0a a1 95 32 f1 89 8e 09 01 f9 d2 77 98 45 52 59 ab 76 72 c8 3d 3e 3a d2 93 ae f4 a5 f7 f8 8e 7a 04 32 9c 60 8e 27 99 5f 58 d3 80 b6 f9 cd a9 52 81 13 4b 7c e7 8c d4 35 98 17 3d 92 ac 11 bd c2 c1 94 ba 94 e4 71 85 66 bb 29 7a 59 8f 8b b4 a7 ed 75 2f 8e 49 03 89 fe 88 24 27 e9 ef d9 02 d5 ec a1 43 f7 d3 26 b1 ba d6 bd 3d 2e a9 ea fa dc bd b8 62 bf 7c a1 80 06 24 09 0c c8 7e c9 6f fb ff bd 85 80 3f 97 00 38 31 38 41 d8 af f0 fc 1c 13 84 12 5f cf 01 8a 24 ef ef e9 b7 48 36 ee cf 2b 04 b9 f2 70 ba fc b9 34 cf ad 52 60 dd f3 54 f1 e0 ad 45 af e2 31 15 c1 f1 51 c9 b8 48 c6 cc 2d 37 ac d0 f5 24 c3 6d e6 dd 44 7b db cb 65 eb Data Ascii: =uFbW^-<p'cXIv2wERYvr=>:z2`'_XRK\|5=qf)zYu/I$'C&=.b\|$~o?818A_$H6+p4R`TE1QH-7$mD{e
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: f3 aa 42 14 ab d9 52 09 21 a0 2b 6a 03 c0 9c c2 36 9d d8 42 b0 08 bf 3a 74 b9 e5 62 01 b4 38 01 46 6c c4 47 ec 82 35 44 43 9b 1b 36 af 03 09 24 b8 3f 4e 04 ab 33 68 a0 64 12 c4 56 23 45 89 68 93 4e 99 41 47 49 b2 3a 9c 87 26 a3 84 b3 90 04 58 94 40 f6 43 c3 8c c1 a2 2e 40 c3 2b 1b 36 9c f3 40 ae 5a 2e 18 d8 06 5e 0c 2b 38 a0 26 1c 60 24 44 c3 a9 66 aa 98 29 ec 81 d9 4b 08 04 04 c7 66 68 32 1e 38 8b 16 80 c6 08 14 8c 0a a4 c6 15 b2 46 34 a4 83 61 7b 85 32 30 8b 1f b0 b8 26 04 c7 01 28 c1 78 51 30 d9 93 08 7e 5b 28 dc 93 89 0f f8 be 6a 4a c0 42 fc 42 ff 19 a3 81 b3 c8 83 7a 5c 80 1f 44 43 b5 a9 c6 47 14 b6 61 d3 32 90 c8 81 26 a3 c3 82 1c 00 e9 53 89 37 8a 09 a6 2b ba 76 3a ba f0 80 89 10 a0 bc 82 70 47 70 34 b8 71 7b 40 8d 3c c3 47 3c 9e 15 aa 83 47 ec 84 Data Ascii: BR!+j6B:tb8FlG5DC6$?N3hdV#EhNAGI:&X@C.@+6@Z.^+8&`$Df)Kfh28F4a{20&(xQ0~[(jJBBz\DCGa2&S7+v:pGp4q{@<G<G
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: 57 36 ff 22 9c 23 46 98 04 27 0a 83 30 9a a4 f9 87 01 d0 87 dc a6 8e 23 66 9b 09 f4 4c 4d c9 7a 8c 75 86 d5 38 8d 0e 33 9b 13 b3 99 19 46 08 95 b3 01 7d 09 24 e4 19 60 e8 48 70 75 07 6b b3 36 0c a2 90 98 01 30 70 67 19 60 36 b0 7c 6d 59 00 8e f5 96 4a 19 76 18 ca 2e 94 79 67 08 f4 94 5c a6 97 5d 83 02 29 59 24 7f f9 5d b1 e6 6d 11 1a 00 b1 10 8c 01 90 87 dc 86 8c 23 c6 06 13 ba 60 9a 96 99 89 a8 9f cd 48 8f cf c8 94 08 d4 9d f7 b5 3c da e7 7f 7f 59 66 9c 45 87 03 e7 a0 bd 15 70 de c6 9e df 35 00 f2 a9 33 ab 58 00 f8 59 8d ed 07 89 17 98 8f e8 33 42 b0 95 61 8d 00 3d 23 30 95 2b 72 84 bd 91 59 ea 29 6b 51 e8 5d d3 90 9c 11 70 0b 2e 6a 7c 58 10 a5 3a 23 9d 62 b8 a1 ed 92 58 76 2a 7d 52 e3 a3 23 04 a2 b2 f5 8f e5 23 90 c1 69 90 78 98 72 95 b0 87 78 98 a2 dd Data Ascii: W6"#F'0#fLMzu83F}$`Hpuk60pg`6\|mYJv.yg\])Y$]m#`H<YfEp53XY3Ba=#0+rY)kQ]p.j\|X:#bXv*}R##ixrx
2024-09-27 22:15:35 UTC	16384	IN	Data Raw: 6d 3b ff 25 94 cb 4a c4 0d b3 4e 32 75 4b e4 34 94 5d 66 ea 11 d3 b3 85 08 ec 41 05 ec 36 47 94 21 67 e6 db 94 93 27 65 62 45 f3 93 2d 0a 34 0a 00 49 33 24 c2 3d 67 2b 42 6b f4 48 d1 cf 6a 24 8f 47 69 65 a6 be 51 0c 62 20 4a 77 60 33 24 42 46 67 4b 44 91 34 4b f9 07 9f 16 91 49 f5 c8 11 d1 83 48 73 8a 46 b5 b4 4c f3 cf 3e bb d4 4b 63 65 a6 10 60 ee fa 82 28 05 0c 4b cd 74 4e 13 65 35 eb 50 4d 67 25 fa 94 62 38 39 43 4c 59 89 4c e9 34 50 79 4a 37 ef 14 4f 65 a5 bf 3a c0 ca 20 4d c0 8c 54 50 1d 15 4a 0e 74 21 7e d3 50 89 84 4d 79 33 2e fc 14 8b 1e 75 53 d9 4c 03 52 b4 27 29 b5 4f fa 0b 06 d0 03 4e 73 aa 51 39 35 55 53 43 11 d3 34 54 f9 84 4d 0b 34 2e 4c f5 4f 55 b5 56 9b 47 07 11 60 52 5d 55 48 b6 90 3a 8d 2c 53 cb cd 56 85 95 59 22 35 57 77 f5 4b 49 b2 54 Data Ascii: m;%JN2uK4]fA6G!g'ebE-4I3$=g+BkHj$GieQb Jw`3$BFgKD4KIHsFL>Kce`(KtNe5PMg%b89CLYL4PyJ7Oe: MTPJt!~PMy3.uSLR')ONsQ95USC4TM4.LOUVG`R]UH:,SVY"5WwKIT

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49783	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:36 UTC	866	OUT	GET /static/images/section4i4.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:37 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:37 GMT Content-Type: image/gif Content-Length: 3422486 Last-Modified: Wed, 06 Mar 2024 15:30:52 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c2c-343916" Expires: Sun, 27 Oct 2024 22:15:37 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:37 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fe d8 20 7a 02 02 ff 5d 1f 20 7f a9 fa 90 16 ff 7b 17 fe d8 21 ae 06 06 ff ff ff 60 b5 b1 5f 02 02 9b de ff bd ea ff cf 35 02 00 92 44 02 69 37 93 8e 79 00 00 00 e0 db c7 7d 09 09 1a d5 71 fc ee 21 ff 00 00 ff b4 84 cd ee ff 60 bf e9 79 01 01 fe c6 1d fa 8f 15 bd ea ff fe cd 1e fe d3 1f fc a3 18 a9 05 05 7c 01 01 fd c0 1c fb 9c 17 9d 04 04 fa 95 17 fd aa 1a d9 3f 0a 96 04 04 8f 03 03 ff 79 15 d3 39 06 84 04 03 7f 03 02 fe fd fa ac e4 ff fe d7 1f fd b4 1b f5 53 18 e3 a3 4f a4 04 04 8a 03 03 fd b9 1c fd af 1a 3e 3e 3e 35 91 ac bd ec ff 59 af b0 f3 69 13 fb 58 1b ff f7 d4 43 9d ae df 4b 11 ff Data Ascii: GIF89a!NETSCAPE2.0!, z] {!`_5Di7y}q!`y\|?y9SO>>>5YiXCK
2024-09-27 22:15:37 UTC	16384	IN	Data Raw: 2e 33 2b 34 48 64 9d 09 70 2d e0 42 05 35 dc 32 f4 4a 74 2e 6f 82 e3 02 b1 c9 3e 6a 2c 20 b2 46 e7 74 42 08 34 6f 44 6d 42 2c b3 28 9a f3 3a 9b f4 49 eb dc f8 e9 ac 72 f2 6c 42 08 83 88 1a 83 38 5c c2 25 08 83 54 0b 03 54 df 03 4c 6f 70 ec 92 82 e2 d6 b4 95 fa b2 b9 9a 81 17 64 c5 16 6c 85 57 34 06 64 3c 41 31 eb 34 cb a8 f1 91 bc 6c a7 22 b3 d6 3d 85 a7 ea 2d 51 5f 72 05 57 80 3c 27 84 38 3c 80 38 f8 43 3e 80 83 2f 80 1d bb 95 01 38 80 43 30 5c c2 55 3b c0 f7 86 b0 03 20 ad af d2 a4 a4 9a c1 20 2c 02 47 e3 8e 51 74 ff c1 22 f8 a8 5a b3 cc 20 1c 89 ef 2e f0 33 bb f1 48 12 f5 3f 1c e3 e8 ee 2c b2 7e 01 38 e8 9b 53 0a 36 01 80 83 30 58 f5 35 7f 2f 05 88 71 63 93 2b 11 93 a8 13 78 c1 16 54 b6 65 0b ca 10 2c c2 20 a4 f5 66 47 88 01 f0 6e 6f 78 81 68 1b 35 54 Data Ascii: .3+4Hdp-B52Jt.o>j, FtB4oDmB,(:IrlB8\%TTLopdlW4d<A14l"=-Q_rW<'8<8C>/8C0\U; ,GQt"Z .3H?,~8S60X5/qc+xTe, fGnoxh5T
2024-09-27 22:15:37 UTC	16384	IN	Data Raw: 88 84 6e 24 bc 2a a0 ce 35 68 ca 85 58 cd 7c 94 cf 8a 08 c5 da ab 02 95 64 49 2b f0 81 23 10 80 0e f5 d0 0f bd 01 1f 40 01 ac 04 06 05 ad 3d 19 cc 4d f8 64 46 b1 90 00 36 83 c8 03 08 81 74 ec cf e3 54 a3 b3 cb 48 92 30 ca d4 4b 04 43 e0 51 1e 35 50 ea 9c 00 13 25 3c 38 a0 ce be 74 4a 15 e5 4d 8c 98 05 05 ac 3d 22 c0 d0 81 1c 02 0e fd d0 29 a5 d2 23 18 82 ab e4 ca db 43 51 8c 88 50 5a 9c d0 8d 00 04 a0 dc 49 19 9d 51 ff 0c c2 8f 92 39 ff b9 3c 80 ff 33 03 20 05 52 e8 b4 50 ea 04 49 4d 64 88 2e d5 42 d7 9c 88 67 b4 3d 3a 30 4c 28 bd 01 2a 05 54 40 3d 82 11 5d c9 2d e8 ca da fb c6 8c d0 cd ed 4b 52 ae f0 cd 09 7a d1 03 48 4b db 59 cb 32 5d 8f cd 3c 09 17 7b 37 92 f8 bf 44 70 53 ea 3c d4 da a3 4e a6 b4 be 86 58 54 a8 ec 08 7e dc d3 3e 0d 48 2b 90 d2 40 85 d5 Data Ascii: n$5hX\|dI+#@=MdF6tTH0KCQ5P%<8tJM=")#CQPZIQ9<3 RPIMd.Bg=:0L(T@=]-KRzHKY2]<{7DpS<NXT~>H+@
2024-09-27 22:15:37 UTC	16384	IN	Data Raw: 82 4d cc 85 9a 99 50 6b 6d 28 a5 93 b4 d8 28 e0 77 d5 a1 8c 75 dd 68 1c 7a ae e6 3a ae 58 3b b2 21 e3 0a 04 5c 15 f5 b1 b3 5d 84 47 2f 57 d2 6c 42 41 db 7b 13 4e 17 be 5a ee a1 a2 fb c8 0e 46 b6 66 86 fb ba fd ed b6 c4 29 8e 6e c0 67 6a f0 0e 0a 66 fa 0e 8f 78 43 dd 7a 64 06 5d d3 de 12 6a ef 50 05 59 e1 48 37 35 66 73 90 83 96 33 0b f3 b1 c9 24 39 3b 8f ab cf 2b 8c d4 50 e2 85 50 25 bb 2c 12 24 99 eb 29 97 2d cb 0d 35 83 0e cb c6 8d e9 1b 31 ed 4d 3f 6a 68 26 bb 99 aa bd 37 65 b9 1e d1 a0 27 15 13 ae 2f 7e 75 90 cf 9c 1d 2c df bb fd cd 35 ff 9b e8 bd ce d0 3f 69 83 d8 b2 fb c1 51 40 75 cc 4e 02 e0 6d 9a c1 ba 29 28 3d 42 7f 5f dc f6 9b 6b f6 84 6a 00 3b 50 0b de d8 d2 79 9e a0 67 7e b5 06 fa 24 02 f3 07 77 d5 d1 66 f7 f7 66 cc 06 3f fc 87 52 08 d7 5f e6 Data Ascii: MPkm((wuhz:X;!\]G/WlBA{NZFf)ngjfxCzd]jPYH75fs3$9;+PP%,$)-51M?jh&7e'/~u,5?iQ@uNm)(=B_kj;Pyg~$wff?R_
2024-09-27 22:15:37 UTC	16384	IN	Data Raw: 56 11 f0 23 59 c5 65 09 df 75 4c 52 95 0e e4 a8 b8 1f 52 ff ee b2 ff e4 ec 42 49 7b e4 81 35 79 0f 92 dc e8 45 ae fc 01 4f ee 79 cb 81 1e 4d 2c 68 6c df 4d 50 5e af d8 f6 32 b0 8f bd 33 d8 a1 76 d7 7d 82 1c 8a 8f 3d cd 53 11 88 40 d4 5e d6 39 a2 34 ee 7f a5 fb ea e5 5a d7 29 d8 b6 4a b0 0d d8 55 0a 7f f8 aa c5 9e 31 6e 35 f3 eb 77 9d 1d b4 16 16 1d d8 b1 0e ee cf 9f ff 4a ce d1 35 c1 4f e8 ec cb f2 46 a2 af b6 ab 2b 58 ae 20 d8 af fd d4 62 b5 64 27 eb f2 64 eb fa 2f 28 52 61 1d c8 a1 1a ec 6f 30 fa a0 1a f2 cf f1 26 f0 03 9f e6 b2 ec 0d 6b ff 3c 2e a6 78 8b 00 e1 0e 5c bc c2 98 f8 6c 01 73 26 ef 64 87 19 06 0f 04 59 4c 1b 9c a1 1e d8 41 1c aa 61 07 77 50 1c c4 81 1d d8 81 1c d6 c1 19 f6 8f 06 41 90 de 8a 82 c9 48 90 ed e4 89 f7 f8 ed 51 86 65 df 8a 09 81 Data Ascii: V#YeuLRRBI{5yEOyM,hlMP^23v}=S@^94Z)JU1n5wJ5OF+X bd'd/(Rao0&k<.x\ls&dYLAawPAHQe
2024-09-27 22:15:37 UTC	16384	IN	Data Raw: 32 70 d3 09 7e 5c 25 2b 41 21 4e 11 ec a0 9c 22 10 27 28 fc a0 ce 24 b0 d3 9b de e4 26 3c 29 86 cb 6c d2 93 8f 4e 50 64 6d d4 27 9c 11 38 72 63 91 64 66 dd 90 29 d0 64 02 f4 2f 50 88 d5 09 b4 08 8f 68 4e 2f 02 3d 38 dc 69 14 f8 94 64 d4 b3 a2 16 d5 e3 45 2f fa c0 08 fa 67 38 f0 ea e7 01 70 40 00 2c 0c af a0 11 19 28 4a 27 b4 4c 4d 4a e0 18 02 2c 9a 01 0c 30 a5 86 1e 90 8e ea 69 14 69 92 e1 88 8c f2 b4 a7 3e 85 9c 11 93 b0 83 5e d6 26 07 6a aa 8b 09 38 00 d2 0f 10 a0 a9 66 18 a6 49 0b 62 cc 94 52 95 3a 2b 55 23 29 98 d5 cf e8 01 a5 a1 11 30 5c 7b 5c 87 38 f4 3c c0 16 b3 b0 04 ff 19 0a f9 d3 b5 b2 95 7c 7d 4c 22 51 71 c3 c8 e1 14 c8 91 1a 68 6a 53 6f 70 03 23 68 2e aa 53 ad 2a 60 21 c3 cc 6e 90 c2 0c 04 a0 81 52 fb 49 2b ad 79 35 02 73 4c 40 0f ae 47 14 24 Data Ascii: 2p~\%+A!N"'($&<)lNPdm'8rcdf)d/PhN/=8idE/g8p@,(J'LMJ,0ii>^&j8fIbR:+U#)0\{\8<\|}L"QqhjSop#h.S*`!nRI+y5sL@G$
2024-09-27 22:15:38 UTC	16384	IN	Data Raw: 5d 4e a9 c2 07 42 e0 86 e0 91 4f 7c 8b eb 07 f9 9c c2 bb 8c 7c a0 81 16 29 89 be ee c2 9f ff ff 50 aa 7e be d0 c2 f3 28 55 0a 2d 94 50 0d 27 3c 83 25 f0 b7 c2 fc 51 8a 6e fe 6b 1a 00 bb 31 c0 01 3e 66 61 4e b9 a0 04 1f 88 3b 09 e2 d0 0d 33 68 41 e2 a8 42 2d 0d a6 85 83 fd f1 dc 9b 7c c1 42 fc 59 e2 0c 29 64 22 fe 8a 30 c5 28 e2 4f 0d 2e 84 e1 ff 9e 36 43 1a 5a 2f 29 7a d9 5e 0f c3 b7 43 1e de 50 8c 04 a9 02 f8 2a 82 af 03 e4 20 37 fc 12 4f 24 be e5 26 2d 54 b1 8a 45 18 02 02 f4 88 80 21 14 21 8a 57 14 58 16 99 06 c0 4e 74 d1 7a 3a 78 dd 19 6f 47 46 f1 cd 41 0f 07 54 64 b4 82 40 12 37 7a 06 40 72 44 da b7 ea 68 47 16 5e 61 8f 9f 44 81 1f 59 88 89 4a 09 b2 64 00 94 80 32 0c 69 3a 44 ea e5 44 91 7c 0f 23 1f a8 01 d3 39 32 8c b0 74 4a 76 46 a2 21 c9 70 0c 40 Data Ascii: ]NBO\|\|)P~(U-P'<%Qnk1>faN;3hAB-\|BY)d"0(O.6CZ/)z^CP* 7O$&-TE!!WXNtz:xoGFATd@7z@rDhG^aDYJd2i:DD\|#92tJvF!p@
2024-09-27 22:15:38 UTC	16384	IN	Data Raw: dc f5 a8 40 9c 9c ee d5 d0 0e 72 32 bc 6b 17 80 c6 c9 61 f7 a7 34 d9 79 dd ff 39 5f 09 35 c8 6a 66 dd a3 36 b1 b0 c1 70 3f fb f3 c2 6a d7 5d 34 de 2a bc cc df de 7c cb e5 f7 7c 2e ac f0 69 d4 75 8f b1 70 a6 89 df aa f0 c9 38 77 fd 35 d0 11 ab 10 27 85 95 c3 75 ac 7c 1b 04 be 2b e1 48 2c 6c 4a e8 cf 4a bb b0 d0 75 b3 8c ba a1 2b b8 d0 9f 81 ad b3 75 39 7a 25 a0 7d 2e 12 84 fb ee 6e 13 b8 df 4a e6 d6 84 17 a0 f5 ef 85 d2 20 79 d2 63 17 1f 96 c6 f1 95 a0 82 0c 04 73 4d f8 c9 27 44 5f 6b ae 0b d3 5d b7 ce d8 1b 7a c3 11 48 a3 e7 fd 58 fd 65 0e b4 fb 6b 1b b1 30 20 ea ab d5 e3 ce d5 b8 b5 51 2d 7e 2d 53 1d 7d 2e 76 bf ad 98 2d 3d 94 12 1c d0 ac 50 bd 1d 2c ac 10 01 e4 94 a7 16 56 3a a9 b5 0d 81 ba 0a de 02 bb d7 c0 a9 3c 10 79 ca c3 5e 0f aa 57 3b 82 8d 2c 83 Data Ascii: @r2ka4y9_5jf6p?j]4*\|\|.iup8w5'u\|+H,lJJu+u9z%}.nJ ycsM'D_k]zHXek0 Q-~-S}.v-=P,V:<y^W;,
2024-09-27 22:15:38 UTC	16384	IN	Data Raw: 98 c5 a0 1a 1f 6b f0 dd 5b f3 76 ac 19 0e 1f 28 e3 1e 17 c7 5a 56 90 09 40 ff 07 f4 e5 5f 9a bc 98 e7 a1 2f 86 96 cf 99 3f 1b 18 b5 49 77 29 ca 98 94 21 c8 21 cb 56 61 3d e0 52 04 f5 f2 e7 7e 49 aa 14 80 32 fb 6a 18 a8 a2 03 e7 5d fe af 9e 26 c0 83 e0 07 b2 53 e3 e2 3b d6 1a e4 c7 ab 17 40 01 0a 50 74 f7 62 d9 f6 1a d0 bd 81 38 c8 32 38 13 9f 96 96 a5 24 1e dc 85 63 41 8b 08 c1 88 66 34 b8 2c 6c 2c 6b 9a df 07 b5 12 9a a8 a1 05 21 54 e3 9f b9 14 c4 b5 5d 0c 90 85 2d 3c 9b cb 78 e5 ab 97 84 61 7b 0a 4c 82 73 c2 f7 40 64 dd 6a 0d 3f bb 61 49 22 60 10 be 41 a5 3d 41 c1 96 d2 40 98 44 ab 14 6e 3f a7 1b 88 b8 88 77 42 58 81 c0 76 b4 12 99 0b b1 98 c5 eb 19 ea 49 6d 53 0c 41 d8 e0 9c 2b e8 10 59 21 52 d2 13 7e 66 80 bc 19 a4 8a 50 b1 56 50 1e d6 17 0f 2a 51 89 Data Ascii: k[v(ZV@_/?Iw)!!Va=R~I2j]&S;@Ptb828$cAf4,l,k!T]-<xa{Ls@dj?aI"`A=A@Dn?wBXvImSA+Y!R~fPVP*Q
2024-09-27 22:15:38 UTC	16384	IN	Data Raw: 6e 50 fa 71 7f 75 4b e0 83 73 a7 6a 75 ef 67 34 ff 83 81 7f 76 b4 cb 9e 37 d0 83 93 67 f6 5a d0 d8 b1 cd 77 97 bf 91 31 e6 58 cb 6d 71 de 0a 00 fd 66 f6 29 70 ea ae 8f 83 9d 9f 90 4b 68 85 38 48 06 39 a8 74 af 51 78 e9 c5 f6 51 1f 03 a5 37 fc 6d ef 02 a6 e7 86 6f 98 f8 bf fe 86 a8 e7 06 a9 47 7c 33 a0 7c 33 58 00 8d 7f f5 7a 38 f7 08 e8 03 db 56 69 38 d8 fa 80 ef fa 64 b8 7b d8 55 1c b1 8f 82 2b 40 f9 9b cf 05 e3 be 1d 46 6e 64 b5 df 8f f2 95 f2 2d 8f bd 9e 66 17 ff 4b b5 88 1b cc ec 9b 67 f7 d1 8f 83 d2 bf 84 4b 78 84 99 2d fe e1 6f 85 bd e7 7b 39 e0 84 bf bf 79 50 b0 76 e9 3d ea 57 7f f8 c3 b7 fe eb 37 7c 33 b0 80 ed df 7e 57 30 03 72 b7 84 1f d8 7c 3e e8 73 ad f7 fd 61 e5 04 39 90 83 28 60 ff 28 d0 83 f7 87 ff f6 bf 02 d5 3f ff 0e 81 f2 81 03 f6 8b 31 Data Ascii: nPquKsjug4v7gZw1Xmqf)pKh8H9tQxQ7moG\|3\|3Xz8Vi8d{U+@Fnd-fKgKx-o{9yPv=W7\|3~W0r\|>sa9(`(?1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	49784	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:39 UTC	887	OUT	GET /static/upload/image/20231216/1702728345765756.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:39 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:39 GMT Content-Type: image/png Content-Length: 3393 Last-Modified: Wed, 06 Mar 2024 15:30:32 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c18-d41" Expires: Sun, 27 Oct 2024 22:15:39 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:39 UTC	3393	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 00 a8 08 03 00 00 00 6d f5 23 3d 00 00 00 b7 50 4c 54 45 ba ef fa ff ff ff fe ff ff 4b aa e3 46 a2 d6 48 a5 db 4c ab e5 49 a7 de 46 a1 d4 48 a5 dc 4d ac e7 b6 ee fa d2 e5 f1 4a a6 df 49 a6 db bb f0 fa b5 cf e4 e3 f8 fd c2 f1 fb d3 f5 fc cb f3 fb f2 fc fe ea fa fd f2 f8 fb dc f7 fc d9 e9 f3 e0 ed f5 cd e2 f0 ef f6 fa f6 fd fe 60 b7 ea 43 a8 e6 b0 e8 f7 6d b9 df 33 a0 db c1 dd f0 9d da f0 3a 9a d2 92 d2 eb c6 ea f5 7d c8 ef 6b bd ec 55 b0 e6 90 d3 f0 7e c7 eb 9d cc ec c1 d9 ea b6 d3 e7 5e b0 dc 76 be e1 cb e8 f3 a9 e4 f7 a7 d1 ee 7d be e7 78 bb e6 b2 d6 ee 90 c5 e8 a2 cd eb 5c ad dc b6 db ec b8 e1 f1 12 14 35 db 00 00 0c 45 49 44 41 54 78 9c ed 9d 7b 43 a2 4c 14 c6 19 aa 35 76 a0 21 6d 33 6f Data Ascii: PNGIHDR,m#=PLTEKFHLIFHMJI`Cm3:}kU~^v}x\5EIDATx{CL5v!m3o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49785	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:40 UTC	887	OUT	GET /static/upload/image/20231217/1702817607573664.jpg HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:41 UTC	372	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:41 GMT Content-Type: image/jpeg Content-Length: 100018 Last-Modified: Wed, 06 Mar 2024 15:30:32 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c18-186b2" Expires: Sun, 27 Oct 2024 22:15:41 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:41 UTC	16012	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff fe 00 3b 43 52 45 41 54 4f 52 3a 20 67 64 2d 6a 70 65 67 20 76 31 2e 30 20 28 75 73 69 6e 67 20 49 4a 47 20 4a 50 45 47 20 76 36 32 29 2c 20 71 75 61 6c 69 74 79 20 3d 20 39 30 0a ff db 00 43 00 03 02 02 03 02 02 03 03 03 03 04 03 03 04 05 08 05 05 04 04 05 0a 07 07 06 08 0c 0a 0c 0c 0b 0a 0b 0b 0d 0e 12 10 0d 0e 11 0e 0b 0b 10 16 10 11 13 14 15 15 15 0c 0f 17 18 16 14 18 12 14 15 14 ff db 00 43 01 03 04 04 05 04 05 09 05 05 09 14 0d 0b 0d 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 14 ff c0 00 11 08 02 32 03 e8 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 Data Ascii: JFIF;CREATOR: gd-jpeg v1.0 (using IJG JPEG v62), quality = 90CC2"
2024-09-27 22:15:41 UTC	16384	IN	Data Raw: 54 67 f5 cd 74 f1 95 59 14 81 82 46 0f bd 7e 99 74 d2 b1 f8 bd 9a 93 4c b6 24 f2 a2 50 72 58 e1 7f 12 71 52 4a 42 47 26 0e 41 6c 66 a2 2e 8f 21 50 7e 58 d0 be 7e 9d 3f 5a 74 8a 1a 34 53 d4 f4 f7 3d 7f c6 91 bb 24 84 94 45 cf a6 d1 4a a3 62 26 ee a0 f4 14 03 82 18 8c 6d ed 43 9f 2f 32 76 45 06 81 00 21 89 27 bf 23 14 f5 4d d2 a0 ec 4d 37 18 61 b4 64 2f 53 4f 8c 95 60 e3 a8 04 d0 04 8e a1 8b 6d c6 e2 c7 9a 8f 2d 11 5e 46 5b ef 7a 53 c2 63 18 04 92 32 40 f5 a6 a8 2c 71 b4 96 4c 64 7f 76 80 15 df f7 9f 74 b6 7f 8b b5 48 99 0c 41 5c 22 fa 75 63 51 6e cc 44 67 0b bb f3 34 a3 71 43 91 8f 5e 7a 50 03 86 0a 9c 72 07 40 29 cb 1e e0 51 41 18 1f 7a a3 de b2 f0 87 20 77 a7 6e 6c 02 0f f0 d0 04 e2 64 8c b8 8c 65 4f ca 5b de 9a d8 65 01 7b 75 a8 63 24 9c a0 e0 e3 3f 5a Data Ascii: TgtYF~tL$PrXqRJBG&Alf.!P~X~?Zt4S=$EJb&mC/2vE!'#MM7ad/SO`m-^F[zSc2@,qLdvtHA\"ucQnDg4qC^zPr@)QAz wnldeO[e{uc$?Z
2024-09-27 22:15:41 UTC	16384	IN	Data Raw: 78 d0 f0 18 30 6c 7e 95 1e 91 e1 00 10 3d fa e4 e0 e2 15 27 e5 e7 b9 1d 6b 42 eb c2 b6 12 c4 44 50 88 64 ea ae ac dc 1f 7a 03 43 5a de e6 1b d1 fe 8f 2c 73 2f 43 b4 f2 3f c2 8a e2 a3 f0 fe b1 6b 37 ee e2 62 bb 81 dd 1b 8c 1f 7e b4 50 1a 1d 11 04 26 49 ef 48 cd 82 09 3d 69 78 8c e7 d7 a5 27 95 99 09 07 06 b7 b1 ee 0e 0a 1c 82 7a 54 8d 21 42 bb 14 71 4c 69 37 8c 01 83 4d 04 f2 b9 c7 6c d2 18 d6 62 5b 20 fc a3 8a 1d 82 e0 11 cf 5a 37 14 5d a3 9f 97 ef 7f 4a 08 00 b3 1e 7d a9 81 1a ae 06 5b 80 4f 14 e6 8f f8 9b 1e c2 9c f9 63 96 1c 91 4c e3 96 23 26 9d c2 c4 6c 9c 13 bb f0 aa 8e 84 13 d8 77 26 ae ba e0 0c 9c e3 9a 8e 4d ae 87 1c 7f 5a 68 4d 14 27 50 13 82 47 b8 ef 54 a6 83 77 04 f3 d4 12 6b 48 8c 72 38 06 a9 4c 9b 87 1e b9 aa 32 69 b3 16 ea 26 74 60 31 c5 73 Data Ascii: x0l~='kBDPdzCZ,s/C?k7b~P&IH=ix'zT!BqLi7Mlb[ Z7]J}[OcL#&lw&MZhM'PGTwkHr8L2i&t`1s
2024-09-27 22:15:41 UTC	16384	IN	Data Raw: b5 35 17 4d e8 fa da f6 30 a4 b1 18 5c 5d 0e 6a 8e 4a a2 d5 3e f6 b9 ef 3e be d4 50 06 09 34 57 c9 35 63 ec 77 30 fc 6f e3 0d 3f c0 3e 16 d4 35 fd 4e 49 12 d2 ca 32 ec 23 e5 98 92 15 54 7b b3 32 a8 cf 1c d7 85 58 7c 5c f8 e5 e2 ed 35 f5 cf 0e f8 0b 4b 4d 02 40 64 b3 4d 41 9c 5c cb 18 fe 35 fd fa 13 9e a0 aa 80 72 31 9e fb 7f b6 3c ad 1f c3 1d 25 24 91 93 4d 9b 5b b6 8e fc a9 23 10 6d 72 73 8e 71 b8 29 fa a8 af 6e 86 de 2b 7b 48 ad e0 41 15 b2 46 15 16 20 b8 55 03 8c 76 20 0e 31 d3 15 f4 f4 55 1c 16 0a 38 89 c1 4d cd db 5e 9f f0 4f 93 af ed f1 b8 ea 98 78 54 70 8c 12 7a 6e df f9 1c 2f c1 9f 8b 76 ff 00 14 f4 2b af 3a c9 b4 af 10 e9 52 8b 5d 5b 4c 70 43 5b 4f c8 3c 1e 70 59 5c 0c f2 0a 90 6b ac f1 6f 88 13 c2 7e 16 d5 f5 a9 61 96 e2 3d 3e d6 4b 93 14 23 73 Data Ascii: 5M0\]jJ>>P4W5cw0o?>5NI2#T{2X\|\5KM@dMA\5r1<%$M[#mrsq)n+{HAF Uv 1U8M^OxTpzn/v+:R][LpC[O<pY\ko~a=>K#s
2024-09-27 22:15:41 UTC	16384	IN	Data Raw: f9 7d 6f 22 ea 3b 60 9b fe f2 3f 37 ee ad a4 b2 b9 9e 09 94 a4 d0 c8 63 74 23 04 10 70 7f 5a de f8 73 e1 19 be 20 78 fb c3 de 1b 81 5c be a9 7d 0d ab 18 c7 2a 8c e0 3b 7e 0b b8 e7 b0 15 d0 7c 79 f0 f0 d0 3e 24 6a 0c 89 b6 de f4 2d da 8f f7 f3 b8 ff 00 df 6a f5 dd 7e c3 da 6c b3 7e d1 3a 2e a7 b0 7d 8f 44 b3 be d4 2f 9c ff 00 cb 28 85 bb 44 1b 1d fe 79 53 a5 3a f2 e4 a7 26 2c 24 15 4a b0 ed 74 7d 59 f1 16 f6 39 fc 57 7d 6f 0c 7e 4d b5 8b 7d 86 18 fb 22 45 fb b0 07 b7 cb 9f c6 bf 35 db 93 c7 a5 7e 84 6a 37 b2 6a ba 95 dd e4 e3 13 dc 4a f3 b8 ed b9 98 b1 fe 75 f9 ea 33 8e 78 ab 84 7d 9d 38 c4 c2 a5 47 56 b4 e7 e6 7a 47 c4 dd 36 78 be 1e fc 27 be c1 fb 35 ce 83 73 02 39 1c 17 4d 52 f5 98 67 e8 eb f9 d7 73 f0 af c4 82 6f d9 3f e3 56 8a d2 2a 8b 69 f4 bb d8 a3 Data Ascii: }o";`?7ct#pZs x\};~\|y>$j-j~l~:.}D/(DyS:&,$Jt}Y9W}o~M}"E5~j7jJu3x}8GVzG6x'5s9MRgso?Vi
2024-09-27 22:15:41 UTC	16384	IN	Data Raw: 28 da 3e ee dc 75 06 bf 3d dc 99 1f 93 96 f7 ed ed fc eb ed 09 2f 8a 7e c4 1e 0e 9e e1 8c 9b b4 ed 66 12 4f 5e 6e 99 17 f2 e0 56 73 8a f6 d0 93 fe b4 34 83 94 b0 f5 29 c5 d9 68 ff 00 13 e2 ec 67 81 de be 94 f8 e9 a5 0d 3f f6 62 f8 31 00 1f ea ad 0d c9 f6 17 2f 34 b9 fc 76 d7 cd 6d cf 4a fa 47 e3 8f c5 5f 06 f8 bb e1 17 85 34 0d 1b 57 fb 5e a1 a4 e8 fa 75 9b 44 2d a6 4c 4b 12 6d 94 65 90 03 8d cd ce 70 71 c5 39 a6 ea c0 74 64 95 0a 8b ab b1 c1 fe cb 3a c8 d0 7f 68 5f 01 dc 87 0a 25 d4 96 d7 27 fe 9a 83 17 fe cf 5d c7 ed 5e 8f 06 9f a0 23 02 ae 97 13 a9 04 74 21 54 57 88 78 27 59 1e 1c f1 af 87 f5 85 72 9f d9 fa 8d bd de e0 33 8d 92 2b 74 ff 00 80 d7 d0 bf b6 f5 bf d8 b5 98 60 23 21 75 3b bd bf 4c ae 3f 42 28 8f f1 9b 7d 57 e4 44 d5 f0 f1 f2 97 e7 ff 00 0c Data Ascii: (>u=/~fO^nVs4)hg?b1/4vmJG_4W^uD-LKmepq9td:h_%']^#t!TWx'Yr3+t`#!u;L?B(}WD
2024-09-27 22:15:41 UTC	2086	IN	Data Raw: fd 0c 19 2d 8a 9c 63 9a 8c c6 07 18 3e f5 b6 d6 e4 a6 ed a0 e7 b9 eb 55 da d7 2a 40 18 73 eb d2 bd cb 9f 34 e9 db 63 28 c6 14 77 34 8d 19 63 c8 c6 38 e2 af fd 84 87 ce 72 bd cd 21 88 1c 0c f2 4f 35 5c c8 cb 91 94 0c 44 76 cf d2 8f 2f e9 57 1e 17 04 e0 7c a2 99 e4 96 00 85 c5 17 4c 4d 15 cc 43 02 9a e9 86 e3 a5 59 68 58 0e 46 3e b4 2c 04 0e 46 68 26 c5 5c 73 c0 e6 93 61 39 fd 2a df 91 cf 4c 7d 69 e2 d8 91 cf e9 40 6b d8 a3 b0 e3 a1 a0 26 0f 4a bf f6 6c 75 5f c6 97 ec 98 27 e6 1c 55 5c 35 28 88 49 e7 1c 52 88 54 f2 49 cf a0 ab cd 6d 9e 46 48 c7 4e d4 e1 6c 07 45 03 e9 52 df 56 52 bf 42 88 80 bf 23 a5 28 b7 e7 9f d2 af 34 1f 37 cb 90 be d5 22 db 87 1c 8e 9d 28 bf 62 ac ca 06 db 69 f9 54 81 ef 4f 10 01 d4 1a be 21 0a b8 ea 7d e9 c9 10 fe 31 9c 53 b9 2d 32 92 Data Ascii: -c>U@s4c(w4c8r!O5\Dv/W\|LMCYhXF>,Fh&\sa9L}i@k&Jlu_'U\5(IRTImFHNlERVRB#(47"(biTO!}1S-2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	49782	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:41 UTC	865	OUT	GET /static/images/session2i.png HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:42 UTC	367	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:41 GMT Content-Type: image/png Content-Length: 1959 Last-Modified: Wed, 06 Mar 2024 15:31:13 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c41-7a7" Expires: Sun, 27 Oct 2024 22:15:41 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:42 UTC	1959	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 15 00 00 00 78 08 06 00 00 00 1d 7d b9 12 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 38 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 01 87 69 00 04 00 00 00 01 00 00 00 1a 00 00 00 00 00 02 a0 02 00 04 00 00 00 01 00 00 00 15 a0 03 00 04 00 00 00 01 00 00 00 78 00 00 00 00 4a 71 83 c8 00 00 07 1a 49 44 41 54 68 05 ed 5a 6b 6c 14 55 14 be e7 ce cc b6 5b 5b 68 81 16 d2 02 a9 3c 4a 57 2a c1 10 0c 06 13 8a 09 11 a3 51 83 89 a2 c4 c4 c4 18 7f 18 45 7e b5 25 c6 d6 44 2c 55 8c f8 c0 04 fe f8 c3 c4 1f 8d 0f a2 51 31 80 6d 8c c1 c4 67 05 22 2c 0f 51 40 2b af d2 52 da 74 77 67 ee f1 bb b3 ec 76 3a 3b db 2e db 68 62 dc 49 66 ef b9 e7 9e f3 dd 73 cf 3d 73 e7 9e b9 4b 22 8f 6b 6a fb d1 3b 04 f3 13 42 90 Data Ascii: PNGIHDRx}gAMAa8eXIfMMixJqIDAThZklU[[h<JWQE~%D,UQ1mg",Q@+Rtwgv:;.hbIfs=sK"kj;B

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	49786	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:41 UTC	866	OUT	GET /static/images/section4i3.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:42 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:41 GMT Content-Type: image/gif Content-Length: 2254846 Last-Modified: Wed, 06 Mar 2024 15:30:45 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c25-2267fe" Expires: Sun, 27 Oct 2024 22:15:41 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:42 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 09 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 fe d8 21 ff ff ff fc ee 21 03 b4 ff 72 89 12 a6 c8 36 00 00 00 ff 5d 1f cf 35 01 fa 90 16 7d 09 09 ff a9 8f 02 b3 ff 01 b4 ff ff b4 84 cf f2 5c fe d8 20 fb 8f 15 fe d7 20 71 89 11 ff d9 20 01 b6 ff f9 90 15 f2 52 17 fe d4 20 fd 5a 1d ff d8 20 e9 49 10 db 3e 08 fe d0 1f fa 95 16 fb 99 17 ee 4e 13 d2 37 02 f9 57 1b fc eb 20 fb a2 18 f6 55 19 72 88 10 d2 3f 03 fc b4 1b fc ce 1f fe c7 1d d4 39 04 fe db 20 fc af 1a cf 33 00 fb 92 15 fc aa 19 dc 5c 09 fe e2 20 d7 3c 06 fe fd f3 e5 46 0e e1 71 0d fe de 20 f3 af 18 d8 54 07 fd bd 1c d4 48 05 00 b3 ff e1 44 0c e7 86 11 fd b9 1b a3 c5 33 fb 9e 17 fe Data Ascii: GIF89a!NETSCAPE2.0!,!!r6]5}\ q R Z I>N7W Ur?9 3\ <Fq THD3
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: 8c 3e 43 b4 44 03 27 40 63 b4 f5 e2 31 a4 24 f1 19 9f 84 2c e3 df 42 8f 34 4d 8f ca 59 ee f3 f5 7a 40 2d b6 05 8b fa 98 4a 4b 05 44 eb 6e 1f 7f f0 49 44 f1 d4 85 74 4d 27 b5 98 90 33 1e 7b 00 0a 3c 31 49 dc 74 ed fe 34 54 68 b4 06 cf 86 46 43 35 00 f4 a9 4c 2b b5 57 ff 48 37 d7 ee f5 c2 c0 b1 b9 c1 1b 84 81 b9 c2 ad 9c 50 35 54 04 b5 12 ef f4 dd ca ec 57 cf 35 73 48 40 4f e3 31 0c 88 b3 48 a4 28 0d 64 1c 00 1c e2 aa b2 35 53 b8 b5 45 1b b4 4e 70 f5 f3 cd 34 5d 2f f6 5b e4 5d 04 39 0a 09 fc 6e 49 10 71 4c 64 1c 2a 07 ff b6 60 27 05 61 2b b1 5e 93 04 33 03 1e 52 33 b6 68 9b 95 31 6b f0 07 ec e9 49 60 6e 11 03 c0 5d 4f 75 66 0f f6 66 6b b0 ff 9e 04 62 e7 ed 68 df b6 79 3e 13 8b 38 75 5b 90 eb 5d 48 b5 45 bf 36 6c 3b 0a 06 08 81 0e c0 40 69 87 11 0e b7 c5 67 Data Ascii: >CD'@c1$,B4MYz@-JKDnIDtM'3{<1It4ThFC5L+WH7P5TW5sH@O1H(d5SENp4]/[]9nIqLd*`'a+^3R3h1kI`n]Ouffkbhy>8u[]HE6l;@ig
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: ea 24 24 a3 ff d5 86 f0 1c af c2 ba f1 77 fe 91 7c 8d 03 03 e6 46 1f a3 ec f1 45 27 4a 91 cd 2c d4 d1 cb 2f 24 ff 4e 33 48 77 75 d6 bf 03 f6 ba dd 53 3c 1e fe 94 ba 47 be a9 04 ca 2f 10 18 84 79 d6 d0 3e a4 80 a0 76 f3 7b 20 88 6e b2 01 87 cd ca 6d d8 89 03 36 48 f7 17 23 a0 6e 31 99 28 87 2d ce 61 0b 5b 98 8b 2a 67 48 17 00 a7 f4 af 01 4e e5 0c e0 53 4a 1d 5a 71 9e 3e 24 45 03 42 70 20 04 73 28 ad 9b ac 0d 2e 33 c0 da 6a 46 80 05 98 d1 86 83 1e e4 d3 79 bc 71 2c df a0 b0 5f 4d 18 02 16 e0 b3 13 1d e8 20 15 43 d0 60 82 c6 c7 c2 a7 c0 01 30 5f 78 90 17 94 32 a8 9c e9 b0 8c f7 f1 1b 5c 5a 70 3d ec e0 00 1b 87 9b 8d 11 a9 a2 8d 61 3d 88 1c 35 fa 9f a6 9a 80 85 11 d8 a5 70 58 fc 0e 1c b6 e8 14 3c 26 a5 0f 33 5a e0 51 7e 10 32 33 32 92 39 38 21 81 5b 42 50 84 Data Ascii: $$w\|FE'J,/$N3HwuS<G/y>v{ nm6H#n1(-a[*gHNSJZq>$EBp s(.3jFyq,_M C`0_x2\Zp=a=5pX<&3ZQ~23298![BP
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: db c1 56 ec c1 57 94 bd 32 b4 89 22 b4 c5 43 71 8b 5c 34 06 39 bc 0a 23 68 bb 0c db be 14 99 80 16 7c c1 62 34 c6 2c d1 2e 89 62 46 68 4c 8c 96 13 27 3e 2b 02 6a 8c 40 39 28 bb 32 f4 c0 6d 54 43 24 30 86 df ba 8a 11 3b 21 10 48 b5 e6 98 c2 2a 54 c7 ad 88 c1 2c f1 39 d1 b3 89 f4 eb 0d 79 0c 27 3e 6b 3f ff 7b 7c 3f 20 58 3c c9 12 02 7e e4 48 04 b0 81 59 28 c7 8e d0 80 8e 23 41 70 ac 8b 3c 24 ba 63 4c c8 6d 12 14 ed 79 c8 67 8c c8 2d cc a4 e4 6b c0 07 b4 c8 e6 0b 02 46 4c 2a 71 70 87 3b e8 48 8e 84 01 19 a8 06 4c e4 08 03 c4 1f 15 e4 8a dc da 2d 95 5c c9 84 d1 44 11 7a 49 99 44 0c be 0b 27 1d ac 31 43 bc c9 ad 8b 87 78 60 07 76 28 87 72 e8 07 77 10 cb 77 20 4b 4c 68 86 5a b4 c5 13 a8 01 34 48 90 31 d9 c6 13 60 02 67 f9 88 18 14 c7 13 fa b8 6d fa 30 a6 6c 4a Data Ascii: VW2"Cq\49#h\|b4,.bFhL'>+j@9(2mTC$0;!HT,9y'>k?{\|? X<~HY(#Ap<$cLmyg-kFLqp;HL-\DzID'1Cx`v(rww KLhZ4H1`gm0lJ
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: c0 97 0d bc 71 96 1c 41 60 40 6d 78 db ae fc 98 00 9d 4c 7b e3 90 00 2f 20 ca a4 5c ca f2 68 07 d8 7b 7e 68 00 94 32 f0 05 4b a0 9b 1a b0 af af cc ab 51 2c cb de ca b6 4a 6b 09 b5 6c cb b8 ac cb 1d d7 cb fc 63 b7 ce 16 a3 ee 47 94 f1 3b 0e 64 f0 ce b2 60 7b 18 a0 cc cb 8c 02 f6 4b 03 a0 a0 84 3e 00 c2 2e 4b 04 32 bb 9b 21 9b cd fc aa 05 52 8c c2 de bc ad 38 d0 05 e1 5c cb 80 70 00 6f bb 97 94 4c 6d 8b a0 42 71 40 6d eb 37 c7 1c 29 7d 4e e8 6c a3 4c ca f6 6c bf 65 37 af 76 89 09 d0 28 03 37 b0 99 fd 99 b4 02 ad b4 52 f0 07 27 dc b4 26 bb ad 95 d0 c8 0b ff 6d c6 46 00 02 b9 bc c6 1d 37 d1 12 54 b9 cf 76 d1 39 48 07 1c 49 07 4e e8 01 ce c6 08 cb 2c 00 1f 0d d2 00 a0 06 98 20 d2 7c 00 0a 64 50 d2 79 39 a2 35 80 cd 2b 9d b6 52 80 0a a6 50 07 5e 5d 07 31 7d a9 Data Ascii: qA`@mxL{/ \h{~h2KQ,JklcG;d`{K>.K2!R8\poLmBq@m7)}NlLle7v(7R'&mF7Tv9HIN, \|dPy95+RP^]1}
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: 44 38 22 b6 e3 91 19 99 08 e4 92 4c 12 60 22 44 45 d2 86 e4 94 10 e9 12 65 93 58 42 c8 e2 42 e9 79 66 21 95 60 12 94 e5 98 63 02 f8 e5 3f 57 86 a9 66 41 3d 5e 49 e6 9b 1c 4a 60 63 76 c0 ad 69 a7 8c 70 e6 d9 24 80 62 e6 76 a6 9d 2f ea 09 9c 13 60 40 51 45 16 59 6c d1 c4 16 5b 20 5a 45 15 50 80 21 28 64 ff 3c 08 28 92 0e 4e 4a 00 18 55 6c b1 44 17 8b 90 81 45 01 a4 16 30 cb a9 7c a4 aa ea a9 b3 90 3a c6 22 7a 2c ff b1 45 15 5c c0 e9 e6 a5 47 ba 39 23 a7 9e 76 41 46 a9 c0 92 3a 0b 22 c5 44 60 ec b1 c8 22 5b 4c 24 91 20 b2 c9 26 ad 8e d1 45 13 59 48 9a 25 8e 7f e2 7a 5f 8f 6f 42 b1 45 17 a3 06 2b 6e a9 91 24 6b ee b9 c9 ee d2 ec 26 7c 14 30 c6 12 d5 62 b9 61 b6 da c6 37 a6 13 55 34 01 ee b8 fc 02 bb 0b ba 00 07 1c 81 ba 88 b4 4b c6 12 55 ec 09 99 26 f5 2e d8 Data Ascii: D8"L`"DEeXBByf!`c?WfA=^IJ`cvip$bv/`@QEYl[ ZEP!(d<(NJUlDE0\|:"z,E\G9#vAF:"D`"[L$ &EYH%z_oBE+n$k&\|0ba7U4KU&.
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: 0c 60 64 d4 bc 84 ac 24 0b cb 82 9c 2b ca 82 61 1a 68 e0 82 3e 41 0d 15 ba 3f 27 0a 11 80 17 06 d5 ae 2f 82 3c 53 2b 2c 49 61 dd 0d ca 47 63 35 0e 29 3a c9 b2 93 20 1b 10 d5 74 a4 06 18 00 96 01 51 89 2d f6 2d 52 21 e2 c0 d4 bc c6 3c 01 37 00 8e f8 8e 03 f8 6a ad 56 2a 37 ad 15 88 4a 85 c6 a2 b0 3b c0 20 30 29 d8 60 8d 2d d7 dc 97 90 4d 40 06 21 4f 15 50 3b 1e 0a 1d e4 3b 12 a8 cd d6 5e 86 1c 85 74 5b 6b 29 78 ff 0a 23 e5 74 25 e8 16 2d 51 02 b6 d3 73 11 4e 98 a4 ef 12 08 52 d0 31 05 10 a1 a9 c9 e6 ad f7 de 58 67 95 f2 e2 83 f6 45 a8 db 2b 5d fb ae a5 60 15 50 40 e1 93 8b 4d b7 61 76 51 85 98 4c a1 84 9b f7 d5 8d d7 74 14 38 9a db b4 28 c2 7f eb 3c 48 09 0c 61 1a 17 e5 a1 f9 64 e0 1d 86 85 a8 48 a0 96 21 86 f7 05 3c 19 9e 19 e7 05 1f c8 57 e3 a9 17 ba da Data Ascii: `d$+ah>A?'/<S+,IaGc5): tQ--R!<7jV*7J; 0)`-M@!OP;;^t[k)x#t%-QsNR1XgE+]`P@MavQLt8(<HadH!<W
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: e2 ac 47 d2 28 64 16 82 0b 04 20 f8 1f 04 41 7a 20 a7 36 92 fb 3d 11 a4 b3 26 11 2a 0f 74 26 7c fb 74 a8 4b ff 84 e6 58 81 c0 6c 65 05 67 c8 3e 92 ef dd f4 f9 cc ad a2 81 c0 0b be f4 42 90 9e ad c7 98 63 b3 73 3a ed d7 51 fa e3 4f 61 13 0c c0 8d f2 0e a9 03 7a be 40 5b c7 24 a1 f3 9e cf e5 50 0c 7b 95 20 94 be f8 24 90 5e 71 29 bc d8 dd 28 61 22 00 bf 4e 28 1e ef 80 3d b8 3d b3 31 b6 3d 99 77 03 81 45 cb aa d1 da dc fb ef a1 58 91 ec 5b 85 04 c5 2f fd 0f a6 a7 ef 16 f2 3b 3e d0 75 a3 80 a2 2f 7d ea cf 9e ba 75 0d 01 0a 3a d0 01 19 25 6e 0c 6d 10 05 1f 9c 05 02 98 00 be 65 45 16 44 0b 27 38 46 52 71 53 f8 e5 d2 2d 48 44 2d d0 82 a5 99 df f9 09 5e fc 70 97 21 ad 1e 6f 40 5c a7 65 89 fc 49 df 20 54 1f 4d 54 01 0a 84 c0 cb 3d 84 74 ed 1f 97 65 00 1d 0c 80 0b Data Ascii: G(d Az 6=&*t&\|tKXleg>Bcs:QOaz@[$P{ $^q)(a"N(==1=wEX[/;>u/}u:%nmeED'8FRqS-HD-^p!o@\eI TMT=te
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: 5a 7a 9d 4e 3f f0 5c ee 34 dd 7b fd cf d2 0d 55 9a 95 0a 24 60 dd d6 bd 20 f7 1a 58 99 21 01 8b 38 45 a1 4d 8b dc 4d a0 93 55 0c 19 c0 56 e0 25 5f e0 3d 5e d3 f4 03 2a 2d 8a 88 4d 51 e7 35 0a 0e 58 dc 9d 90 5e 41 c1 00 80 0d 9e c0 8d a2 0a b8 88 2d 2c 44 b5 f0 5e 04 8a 5f 9e d8 80 86 2d df 02 36 60 a3 78 d2 14 8d d9 a3 a8 81 d4 55 0c 23 d0 58 36 a9 df d7 5d 30 00 f8 ab fc 4d 81 fd 3d 5c ee bd 48 35 dd 0d 0f 68 dc 03 16 61 11 66 5e 14 05 d6 a3 78 81 18 95 0a 23 28 06 63 a9 df bf fd 17 70 5c 23 e4 72 81 fd dd de ff d5 08 63 bb 5d 30 ca 8e 0d 48 da 11 06 e2 f2 2d 61 14 0d 5d a3 f8 80 bd e5 0b 20 68 61 76 71 81 14 48 01 18 26 12 e4 e2 5a 87 d3 d9 8b 98 c1 74 44 dc 43 dc 61 1e de 0d 0e 08 e2 2f 36 e0 21 0e d0 13 46 0a 0e d0 0d ff 20 10 86 d0 aa 5f 65 ad 8e e5 Data Ascii: ZzN?\4{U$` X!8EMMUV%_=^*-MQ5X^A-,D^_-6`xU#X6]0M=\H5haf^x#(cp\#rc]0H-a] havqH&ZtDCa/6!F _e
2024-09-27 22:15:42 UTC	16384	IN	Data Raw: c5 9b 57 ef 5e be 7d fd fe c5 6b ca 2e 4b 18 21 7b 40 7d 6a c2 ed 62 c6 58 cb a4 bd a8 a3 eb 58 ca 95 21 b6 10 01 02 f2 66 04 2b 7e 34 c6 4a 2a 6e 49 4a 53 3e ee 18 bc f2 25 60 d6 ad 5d bf 86 1d 1b 6f ff ea 04 31 42 e2 40 ec 54 09 68 de bd 39 3e e6 5c 51 72 8b 13 96 8d 2b 44 d1 82 c5 8d e0 9b 3d 6f f4 4d 35 c8 68 92 6e 3e 1e a1 9d 40 f6 76 ee dd bd 7f 37 9a fd 48 48 15 b9 05 c4 8a 9e de ed 8f e6 91 4b 2c 39 78 9c 21 8a b2 2c 40 e8 68 cf f9 b9 fa a9 8d a8 93 54 e5 a3 26 b2 03 af 40 03 0f 44 30 36 0e 68 fb c0 30 f3 14 e3 2f 42 aa aa 58 21 bf ad 3c 00 a1 04 11 36 dc b0 05 cc 38 b4 0f 04 10 98 b3 b0 b9 1c 7e 80 4e 42 8f 1c 50 e5 bf 00 e6 f2 08 b5 d4 56 4b b0 46 1b 6f c4 51 a7 05 53 33 e2 36 f3 76 53 31 48 8f 8a a8 b0 44 23 8f 0c 0e 0c b6 84 04 c9 0d 17 b5 f0 Data Ascii: W^}k.K!{@}jbXX!f+~4J*nIJS>%`]o1B@Th9>\Qr+D=oM5hn>@v7HHK,9x!,@hT&@D06h0/BX!<68~NBPVKFoQS36vS1HD#

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	49787	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:42 UTC	866	OUT	GET /static/images/section4i2.gif HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:43 UTC	373	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:42 GMT Content-Type: image/gif Content-Length: 2202471 Last-Modified: Wed, 06 Mar 2024 15:30:42 GMT Connection: close Vary: Accept-Encoding ETag: "65e88c22-219b67" Expires: Sun, 27 Oct 2024 22:15:42 GMT Cache-Control: max-age=2592000 Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:43 UTC	16011	IN	Data Raw: 47 49 46 38 39 61 00 02 00 02 80 00 00 00 00 00 00 00 00 21 ff 0b 4e 45 54 53 43 41 50 45 32 2e 30 03 01 00 00 00 21 f9 04 05 02 00 ff 00 2c 00 00 00 00 00 02 00 02 87 88 7e 68 ff 5d 1f fe d8 20 bc a8 71 3e 39 2d 00 00 00 80 76 62 ff d5 27 fa 90 16 ff fa ca cf 35 02 9c 92 7c 33 2b 07 ff 8c 00 4e 4d 4d ff ff ff 35 2f 20 a7 f6 ff fc ee 21 7d 09 09 80 80 80 63 5b 4a 35 30 21 ff 8b 00 3d 38 2c 32 1d 04 fb 90 15 ff b4 84 33 33 33 f9 90 15 3d 38 2d ff d4 26 87 7d 67 fa 97 17 cc cb cb fb a0 19 85 7b 65 81 78 62 fa 93 16 fb 9c 18 fe c0 20 47 41 33 0b 08 02 fe c5 22 ff d0 25 fd ba 1f 83 79 64 6e 66 53 fd b6 1d 42 3c 2f 51 4b 3c 12 0d 01 19 14 03 24 1e 04 79 70 5c fd af 1b fc 8f 13 fe e4 21 5a 54 45 f4 54 18 69 61 4f 4c 46 38 fc a5 19 db 3e 08 ff cc 24 ff d8 24 56 Data Ascii: GIF89a!NETSCAPE2.0!,~h] q>9-vb'5\|3+NMM5/ !}c[J50!=8,2333=8-&}g{exb GA3"%ydnfSB</QK<$yp\!ZTETiaOLF8>$$V
2024-09-27 22:15:44 UTC	16384	IN	Data Raw: f0 15 db 33 79 f8 81 10 7f 73 17 7f 01 05 7c 81 25 9b 43 dd 50 73 56 9c 40 46 8b 48 07 77 34 56 9c 47 e6 91 88 e0 fd c4 28 4d 0a 42 bf 1d 1e 0e 73 04 44 ee 78 2c c3 43 ab b0 27 50 00 05 d0 82 03 77 b1 0e 94 f3 d3 f4 17 4d d7 34 79 9c 33 29 23 72 7c a4 33 67 20 e8 63 49 ca 6d 86 a5 2f 62 6c 16 7b 06 0a ef b1 3e a7 b0 1d 30 35 53 7b 82 44 77 b1 2c 3f cd c9 7e ab 55 53 87 45 cf 6e 47 9b 55 2d 73 86 de 26 26 58 93 34 d7 9a f4 78 fc 42 52 2b 35 5b b7 f5 53 0f 71 54 3f 8d f2 3e 73 5d ef c4 07 34 5c 56 df 30 36 67 49 6a ed ff 34 97 88 2e 51 db f1 85 8c 83 43 27 f5 5a 53 00 3d 44 01 5b 3b 75 17 4b b0 d3 08 34 3c 3f b6 67 c8 2e 4e ff 43 7c 0c f0 85 c8 74 56 c0 f1 13 ca 31 c6 4a 9f 51 8b 47 4a 17 76 1f 78 02 3e a4 c2 3d a5 02 69 53 00 39 74 31 45 33 76 c9 48 11 6b Data Ascii: 3ys\|%CPsV@FHw4VG(MBsDx,C'PwM4y3)#r\|3g cIm/bl{>05S{Dw,?~USEnGU-s&&X4xBR+5[SqT?>s]4\V06gIj4.QC'ZS=D[;uK4<?g.NC\|tV1JQGJvx>=iS9t1E3vHk
2024-09-27 22:15:45 UTC	16384	IN	Data Raw: ff 26 74 53 3a de 31 b8 a9 bc 89 55 6e 11 c2 bb d4 f6 72 d7 bc f8 7d 5b 55 99 6b df 7a e6 37 bf f2 15 42 2d a3 e9 cd db e6 76 6c eb c5 0e 7c f1 2b e0 33 1d c0 00 0e c8 2e 46 36 89 d3 33 1c 78 c1 f8 0c f0 bb c0 7a d0 56 e2 10 8c 09 56 f0 7f cb 5b 59 83 4a 54 85 3d 0c f1 32 47 0c e0 92 4a a1 ad e2 d5 ec 1a 2e cc e2 86 d2 32 7d 08 ad 0f 0f 55 3c 05 0c ff f7 8e 1a b6 61 45 d9 90 59 1f d7 15 bd f3 45 64 61 f7 c7 63 fd 18 99 c5 48 25 30 42 69 8c 3b 22 53 b9 c6 2c ad 0a 92 fd 95 63 70 4a af c9 e0 c5 72 77 e9 fb 04 f5 4a 94 77 b4 79 43 91 c5 fc da 06 9b 34 a9 f4 bc a9 1a 3b a3 e6 27 63 78 cb 5e 92 23 85 f7 06 e6 0d da b9 c6 2e 8e c2 30 a5 ec 4d f1 f5 d9 cf 6c c6 70 90 bb a2 54 2c 5e 79 36 12 4b b4 98 35 fc 59 53 be 46 5f 87 c6 df 9f 15 0d 3f f5 3a d6 d1 19 d4 83 Data Ascii: &tS:1Unr}[Ukz7B-vl\|+3.F63xzVV[YJT=2GJ.2}U<aEYEdacH%0Bi;"S,cpJrwJwyC4;'cx^#.0MlpT,^y6K5YSF_?:
2024-09-27 22:15:45 UTC	16384	IN	Data Raw: f5 50 da 15 94 18 86 01 18 00 8a 69 54 a3 13 17 70 00 07 c2 a3 4e 57 1c 53 2c 02 c8 45 97 81 40 6d 60 fc 05 3c 64 f6 af 03 24 60 8d 81 14 a4 ff 0b 13 60 80 29 e6 c4 8a 72 34 1e f5 0e b2 29 57 f0 50 8f 5c c1 91 f7 b6 50 31 04 11 a6 0c 1f 40 e3 20 39 c9 c9 05 94 31 24 03 e0 d9 78 f0 92 21 26 a4 2d 65 eb fb 82 1d 85 73 b5 48 fa 0b 89 65 00 e5 13 3e d0 c4 4e de 92 93 09 38 00 15 79 51 2c 2d 78 c0 03 57 30 c6 30 2d 50 4c 46 81 ad 0d db 80 a4 e0 74 45 17 56 be 72 4e 15 13 9d 1b 70 59 cd 5b 1a e0 8d 9c e8 97 31 8c d3 04 d3 00 40 00 60 e9 e3 6c d2 e0 4a 5d 69 e0 99 d0 84 07 25 cb 10 cb 2c f0 92 5f 80 b4 e6 3c 3d d9 00 78 30 67 0d e3 cc 82 31 d2 f9 43 af b9 02 9d ea dc ca 24 c1 e0 ce 30 f0 72 93 b7 04 03 3d 63 98 80 59 4e 82 7c 61 f3 05 3b 1b 19 38 bb 81 a3 9f 02 Data Ascii: PiTpNWS,E@m`<d$``)r4)WP\P1@ 91$x!&-esHe>N8yQ,-xW00-PLFtEVrNpY[1@`lJ]i%,_<=x0g1C$0r=cYN\|a;8
2024-09-27 22:16:03 UTC	16384	IN	Data Raw: f4 fa b5 f7 ae ff 64 f9 1b 1c fb 14 1a 20 b5 c7 76 de 78 5b c9 0e fb 32 68 ee af 61 d3 b9 b5 60 a6 e9 ec b6 c7 65 59 df da 96 bd 3a 1b d5 72 62 ff 33 12 8a 9b 0b bc 7b ac 3c 1b 47 a2 db 79 97 38 6b 2b db 7a 39 7a 0b 38 fa a2 bf 60 02 08 39 a3 21 db 21 c8 2f b9 5f d1 20 ed 3b a6 01 67 bb f9 05 b9 15 8e ba 0f d8 b3 d5 1b 0b 34 00 11 67 55 5c 16 3c 99 ca 97 af 0d 04 02 1c ff 1c 0c ba 76 44 66 55 bc 03 1c 2a 31 81 ca 02 e4 a4 d9 bb 08 26 c0 08 b8 5a 54 57 1b 5c 40 9c 94 13 a1 37 62 e2 c0 bf e0 03 a0 d6 bf 31 ba c3 5d 9c ff 18 aa 08 01 80 8f a9 a0 00 ce f8 0b 34 5c c7 2f f4 76 43 1b 0c 30 00 38 24 01 c2 83 c4 0b 88 1c 0c 4c bc c8 a7 b2 b0 6d ef 81 7d 09 00 a4 c2 37 b6 40 03 ba dc cb bf dc 08 9a bc 0c 08 1c a5 b1 c0 bb 35 5b a5 a7 3c 09 81 3b 31 7f 23 0b 00 05 Data Ascii: d vx[2ha`eY:rb3{<Gy8k+z9z8`9!!/_ ;g4gU\<vDfU*1&ZTW\@7b1]4\/vC08$Lm}7@5[<;1#
2024-09-27 22:16:05 UTC	16384	IN	Data Raw: e4 cd 37 1c 7b eb 72 70 15 81 6f fc 51 d7 68 14 3e 0d ce 7f fb 61 ae e2 dd f8 dd f8 db 5c 40 1e f9 df 92 43 fd 85 e5 dc 64 5e 95 e7 ae 72 1e 8d c6 98 f3 21 ba 68 06 60 3d 39 26 88 af 8e f2 79 97 ba 2e f4 45 a4 27 de ff ba ec b8 2b 0d ba 98 a7 ef 67 71 ef b9 eb 3d af a9 bb f3 83 d3 ed 43 13 1d bc be 49 74 7a 2f 8d de 0c be 3c 23 11 03 3f 0d 8e c5 4f 4f 38 92 5f 6b af f6 18 c8 3f 93 fd e4 14 87 8f cd f8 97 87 f9 06 be 60 58 ef 7d ac 17 93 fd fe 6d e6 87 6c be 32 84 66 9c 75 f6 24 bb 6f 4d dd 12 2b 1e fb 3e 26 2e f4 9d ef 0e 03 9c 9f 02 a9 90 40 be a5 2e 61 0b c4 d2 19 ee 27 8d ee 45 f0 0a 0d 24 96 ff b0 b1 16 03 2a ac 75 14 14 14 b6 ea 25 39 10 aa 2c 68 2b 0b e1 05 45 96 c1 32 a8 d0 22 2b e4 4d 0c 51 88 91 da 11 ae 49 6b 78 21 35 74 e8 12 70 04 ae 85 69 90 Data Ascii: 7{rpoQh>a\@Cd^r!h`=9&y.E'+gq=CItz/<#?OO8_k?`X}ml2fu$oM+>&.@.a'E$*u%9,h+E2"+MQIkx!5tpi
2024-09-27 22:16:06 UTC	16384	IN	Data Raw: 27 be c6 75 97 d0 a8 25 8b 6b dc 1a 8e d6 bb a8 eb c0 d5 98 13 db e7 36 43 b6 7f 25 a4 38 53 f9 aa a1 6e 61 16 a1 ad 42 87 12 0b 0f ff 2c 86 77 6f f8 1d ce 6a 45 4a 53 23 74 80 8c 96 65 9c 70 cc eb a7 a0 72 b4 a8 b8 b8 6f 58 50 ab df 26 d0 15 b8 0e 96 93 71 00 f0 cd ca 76 75 c0 97 29 b0 6d 0f 65 86 0d 10 20 9e f2 ad 82 c3 12 ab 00 5a 4a f8 8a 68 1a 2e 8a 33 21 2a 2c 20 29 af 18 a6 dc 70 36 4c db 00 99 c1 21 1e 35 ec 51 b1 70 01 b1 24 e3 c4 2c be 25 83 85 1c 12 fe 76 93 04 00 48 40 02 04 9c 61 f6 d4 18 45 96 3b c3 02 74 6c d8 4a fc d6 be 72 45 a8 1d dd 21 02 2f f7 82 04 3a 22 41 0e c7 9c c7 15 17 19 b2 58 3a a6 bf a0 dc ce 0e 97 c1 00 ae d1 0a 8f f3 90 d0 33 13 47 53 91 f1 f2 9e 87 d0 3c 32 93 d9 08 14 10 f4 a0 8f 20 04 43 13 01 d0 5a 44 73 48 22 cb cb 21 Data Ascii: 'u%k6C%8SnaB,wojEJS#teproXP&qvu)me ZJh.3!*, )p6L!5Qp$,%vH@aE;tlJrE!/:"AX:3GS<2 CZDsH"!
2024-09-27 22:16:09 UTC	16384	IN	Data Raw: 4c a9 12 09 be 5d 24 35 61 34 52 64 63 a4 95 86 28 6a 41 f9 f1 e5 36 85 09 05 51 f1 66 73 a8 cd 90 3a 7d f9 24 d2 8f e6 93 70 44 4b 6e aa 28 a2 42 1c 9e 3d e9 08 cc 72 f4 29 d7 6c ff 14 75 35 b4 7a 29 29 91 27 11 86 30 3d 25 b6 eb 1a 79 70 0a b2 35 d3 6a 6b dc ba bd 42 5e b5 72 f6 6c 94 98 4e ed 42 29 88 d3 0b d5 8f 80 c7 98 94 7a 78 b1 2a 9c 0e d7 8e 8d 62 aa cf d9 7e 31 21 73 6d e9 70 27 51 b2 72 e3 31 0e 8d 29 1d 5e 6d 49 ff 14 c1 c8 97 09 20 d1 b8 06 0f 8b 84 79 31 36 ba ae 6f 93 c1 16 36 ef b1 23 31 85 94 95 82 0a 37 4b a9 b6 c3 3c 45 e3 d9 c8 f2 e2 a0 89 43 b7 f3 90 9d bf 64 c0 cd b2 46 f2 97 78 ae 9c 5a a7 ca 8e fe e9 7b 69 f1 e6 83 62 83 fb 8d ec 92 df 46 d0 22 c1 38 5c 3c de 86 56 d4 bb 2e 80 3f 49 f7 34 6e cf 03 98 84 66 f8 cc e3 19 53 ab bd 97 Data Ascii: L]$5a4Rdc(jA6Qfs:}$pDKn(B=r)lu5z))'0=%yp5jkB^rlNB)zx*b~1!smp'Qr1)^mI y16o6#17K<ECdFxZ{ibF"8\<V.?I4nfS
2024-09-27 22:16:12 UTC	16384	IN	Data Raw: 68 fb ed 90 5e e4 78 ff 8e a4 e7 c2 61 ea 8e f6 a8 db 6e 84 80 11 eb e1 bc 2c 4e eb ac b1 e0 e2 59 8f be f8 06 d5 25 68 01 13 07 f0 be f6 4e 78 d1 6c ec 16 dc 85 bc 4e 74 eb f0 c4 a9 66 11 13 c4 01 35 4c 31 16 7d 89 0b ea a0 07 3f 13 f2 aa e6 42 81 a0 14 78 62 9c f1 c6 ee 5e ea 31 50 fc ba 23 99 c6 2c 53 a1 e9 52 2a 9f 53 67 cd 3e 56 18 85 cf 3c b3 9c 70 ce fc ec fc ed c8 55 94 5c 6e d0 74 48 d5 d7 d0 0a 33 6d 91 d2 50 5c 3c 25 d2 52 1b ec 2f 97 40 67 1d 2d 62 e2 1e 81 b5 c8 41 8f 4d 6d ad 5c a6 4a b5 d7 8c 01 18 e7 cf f0 5a 64 34 b0 6b 73 d4 e8 63 cd 6a 86 91 d9 66 19 c4 37 5e dd 01 76 45 cc 6c ef ea 56 74 50 77 dd cd ad 75 17 ae 15 9e 44 9e 1c 12 cd 85 47 45 30 d7 58 36 5e 0d e5 d9 ca 11 77 d8 d9 bd f4 77 d0 84 a7 5d af e6 95 5f 84 56 c2 db 8e 8e 0d ea Data Ascii: h^xan,NY%hNxlNtf5L1}?Bxb^1P#,SR*Sg>V<pU\ntH3mP\<%R/@g-bAMm\JZd4kscjf7^vElVtPwuDGE0X6^ww]_V
2024-09-27 22:16:13 UTC	16384	IN	Data Raw: 4b fa c0 6f 16 2c 07 50 56 90 05 ed a0 d0 1e 67 d6 5e b0 16 c0 af e8 8a 50 04 0c 60 d1 de 49 08 3e c0 00 02 d0 16 04 4a 09 97 10 13 be 10 1e 24 60 0a 73 4f fc c4 4f fe e2 ef 16 70 09 0c 9f e1 40 c4 70 9b ac 20 01 70 a1 0c 3f 90 0a 89 60 04 99 00 0d cb 04 0e db 90 0d 90 ee fd 84 d0 f2 ac 70 08 30 ea a0 b4 f0 0e fd 30 5d 08 e0 16 00 90 f2 72 0f 12 e1 89 04 23 51 11 e5 a2 07 a9 60 0e ad 20 0f b7 eb 06 45 60 13 97 00 0a e7 8f f4 ac e0 f9 f6 b0 12 eb 66 fd 02 cf 0a ea 50 f8 68 90 0a 3e 31 f7 4c 90 63 2e 31 46 8a 2f 18 c8 f0 11 1d 91 12 a9 a0 f4 1c 50 4f 3c 86 16 a5 65 00 32 51 0e 30 40 cf d2 00 08 51 ff 4f 08 b9 b0 09 20 f0 14 7f b1 09 36 40 1a 91 c0 01 52 f1 08 60 71 00 d5 50 0a 0b 8f 10 d3 e0 e4 a0 90 52 82 91 63 8c 82 e2 18 71 0e 56 8a cd b6 28 f1 b0 ce 19 Data Ascii: Ko,PVg^P`I>J$`sOOp@p p?`p00]r#Q` E`fPh>1Lc.1F/PO<e2Q0@QO 6@R`qPRcqV(

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49788	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:45 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 32 32 33 55 5a 77 76 43 6b 69 72 38 68 79 6b 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 37 38 34 33 31 31 39 66 32 63 36 66 33 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4223UZwvCkir8hyk.1Context: 337843119f2c6f3f
2024-09-27 22:15:45 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:15:45 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 32 32 33 55 5a 77 76 43 6b 69 72 38 68 79 6b 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 37 38 34 33 31 31 39 66 32 63 36 66 33 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 4223UZwvCkir8hyk.2Context: 337843119f2c6f3f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-27 22:15:45 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 32 32 33 55 5a 77 76 43 6b 69 72 38 68 79 6b 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 33 37 38 34 33 31 31 39 66 32 63 36 66 33 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4223UZwvCkir8hyk.3Context: 337843119f2c6f3f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:15:45 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:15:45 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 58 33 52 68 30 59 36 78 79 30 75 68 4d 36 41 33 71 6d 78 32 72 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: X3Rh0Y6xy0uhM6A3qmx2rw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	49789	47.242.228.6	443	6336	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:15:56 UTC	1159	OUT	GET /TiGysceotsetup-m66.zip HTTP/1.1 Host: www.telegramrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: think_language=en-US; PHPSESSID=gsofitdtf1ft3fjua791821hl4; __vtins__3JoCylkCtUEHUnMX=%7B%22sid%22%3A%20%2218935f09-fb11-568d-991c-1eb3181b98b4%22%2C%20%22vd%22%3A%201%2C%20%22stt%22%3A%200%2C%20%22dr%22%3A%200%2C%20%22expires%22%3A%201727477125231%2C%20%22ct%22%3A%201727475325231%7D; __51uvsct__3JoCylkCtUEHUnMX=1; __51vcke__3JoCylkCtUEHUnMX=bf669242-6574-52b4-a956-712cbe123d25; __51vuft__3JoCylkCtUEHUnMX=1727475325237; _pk_id.19.5e9d=6eab26ea7524a273.1727475329.; _pk_ses.19.5e9d=1
2024-09-27 22:15:57 UTC	286	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 27 Sep 2024 22:15:56 GMT Content-Type: application/zip Content-Length: 57231003 Last-Modified: Fri, 27 Sep 2024 19:50:46 GMT Connection: close ETag: "66f70c96-369469b" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2024-09-27 22:15:57 UTC	16098	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 0c 1e 3c 59 e1 6f 62 96 e9 45 69 03 d2 64 69 03 16 00 00 00 54 69 47 79 73 63 65 6f 74 73 65 74 75 70 2d 6d 36 36 2e 65 78 65 bc f7 67 54 93 4f d4 3e 8c a6 17 12 42 80 00 01 02 04 08 45 6a e8 25 a0 a1 a3 14 43 0d bd 97 18 aa 90 00 4a 11 08 3d a0 88 88 60 a5 a9 80 a0 48 b7 80 34 29 82 0a 8a 08 02 1a 14 15 0d 28 28 0a 36 38 bf e7 ff 9c f3 be 67 9d f3 e1 7c 3b 7b ad 59 7b cf 3d d7 7d ed 6b f6 9a 7b ee 19 27 9f 52 00 18 00 00 40 fe 6b 7b 7b 00 40 0f e0 7f 8d 0a f8 ff 6d 99 ff 35 8c dc 5d 0c a0 03 f9 58 be 07 e8 f8 58 de 9d 71 24 91 18 9f 10 17 99 10 1c 43 0c 0d 8e 8d 8d 63 11 43 c2 89 09 ec 58 e2 91 58 a2 f5 61 37 62 4c 5c 58 b8 96 a0 a0 00 e9 ff c9 41 b3 01 00 1c 81 60 c0 89 98 fa 83 ff 2f 5e 1e 40 08 88 02 c2 00 00 32 f0 3f c0 Data Ascii: PK<YobEidiTiGysceotsetup-m66.exegTO>BEj%CJ=`H4)((68g\|;{Y{=}k{'R@k{{@m5]XXq$CcCXXa7bL\XA`/^@2?
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: 7b f3 fb 2a 5a 5a 49 a7 e3 6c 9f dc ca b1 a6 de a2 5d ce dd a6 71 36 bb 94 7a ea 04 3a 90 f9 69 57 05 97 14 66 48 9f 1f 03 8b 9a f0 8d 91 3d 56 47 6a 26 47 7a 07 25 1d 36 e5 de 7b 04 64 05 c0 b3 c6 c6 26 3d ee df eb 94 29 06 a5 93 f4 7a 81 cc 0d 31 59 3c c5 c8 c1 fe c3 98 26 3a 43 b4 42 64 4a 35 a8 6f c2 b2 d5 56 86 ad 0a a4 84 c6 29 f6 2b 1a 49 60 3c 18 41 1b f0 1c 66 1f 40 78 c3 e3 87 de fa 62 dc de 0b 13 cd 22 96 4a 61 ac 17 c8 6f d4 96 16 f6 9b 7c e3 f6 2b a4 7b 8d 47 ed a1 7c 99 6c 8f e6 58 f9 f1 c4 f9 f6 21 bb b5 08 21 0f 91 55 2b a5 54 f2 3c 1b e3 d1 b5 ab de 3a 40 2d b1 2f 2c 8c d6 05 5f 23 0e 57 e3 45 b6 98 53 f1 b5 ce 8c c3 9e 88 db 77 32 01 3a 41 a2 21 4b 90 02 77 10 1a 1b da 35 21 a0 fc 90 8d 8b 8f 7d 76 c9 a9 11 a4 14 ee 4a 52 b9 50 66 7d 5c Data Ascii: {*ZZIl]q6z:iWfH=VGj&Gz%6{d&=)z1Y<&:CBdJ5oV)+I`<Af@xb"Jao\|+{G\|lX!!U+T<:@-/,_#WESw2:A!Kw5!}vJRPf}\
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: 73 13 58 62 66 f1 5b 68 28 7d 2b d1 8d 26 ed 7e 71 a7 da e7 dd 7a 4c d7 01 79 04 6a 54 70 6b e0 83 18 75 e0 8b e7 9e f9 c8 c0 2a 4a 7c c0 44 96 73 fe d0 f4 21 a7 33 1b 57 9e 54 79 38 94 bf 92 80 ca 06 c1 97 5c 71 5a 77 a1 d1 b2 23 fd 97 b6 16 2c 45 c5 6a 16 69 7a f1 3c 7f 8b dc 43 8d 10 6c fa de d5 7b dd c3 de 69 26 7b 05 8a fe cd f8 db 08 35 a7 8e e7 5f b9 71 37 ff 25 43 de 81 ff 94 a0 4f 0c 2c 23 0f 9a 1a 6f c0 13 63 92 ea 32 63 2c c1 0b f5 35 8c f9 31 9f e1 8b 55 1e d5 9f 63 1f ee 0e 7c bd f8 ab 3e e8 d8 9a a7 f6 f6 83 ca 5f 03 5f 7f ad 67 2c 9c b3 04 f3 71 fb f0 dc 06 f5 31 4d f5 ed 26 10 b5 05 77 f8 df d1 6e ee 29 fd 0b 9d df f6 5d a5 38 cd ed ae 3f f0 84 8a 4a ef 29 a6 4f 65 a8 a7 cf 81 8f e3 ac 34 71 b4 b9 78 b4 dc 3c 38 ca f7 de 92 e9 74 78 cf be Data Ascii: sXbf[h(}+&~qzLyjTpku*J\|Ds!3WTy8\qZw#,Ejiz<Cl{i&{5_q7%CO,#oc2c,51Uc\|>__g,q1M&wn)]8?J)Oe4qx<8tx
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: 02 31 55 6a 81 80 af b4 1b ce c5 af 70 ea e1 ca d1 8d ed c4 ac 76 74 d5 76 2a 5f de 35 cc bc 10 3a 35 6b 51 9b 3e 36 0f 57 dd e1 ce 78 5b c0 f2 ac 03 7f bd e6 5c 5b 67 d0 c4 7a 8b 13 1c 9c a6 79 94 33 9f 1d 5d c7 51 c7 ac 15 87 33 aa 07 7e cd ac 4f 83 70 be d1 28 71 d6 96 02 3c 4e a5 17 d0 68 01 79 76 2f 78 f1 80 3a 31 35 3d 34 d0 df d6 d2 52 fd e0 61 72 5e 45 74 62 76 7c 73 db 10 35 2a aa 32 50 e1 39 11 8c b8 03 ef 79 af c1 bf 9b d8 2d a9 09 47 68 fd 4d 9d 9c 8a fa 26 48 6f 67 5f df a8 75 23 ea ef cc 70 ac f2 00 e1 8f 1b 9c 8a e0 3f 58 82 aa f1 8e 2a b4 e4 d3 48 e1 51 ce ea 62 c8 5f ec 4f e2 19 59 ec 8c 1c 37 ea 5d 58 25 b2 80 2d 27 ac 69 34 3f 89 a4 ce 72 b4 ad 24 68 c4 35 ed ba 8d 4d b2 44 e0 b5 d2 2f 65 e6 a2 45 a0 d7 64 1c 91 a8 22 cb b1 be b8 ef 05 Data Ascii: 1Ujpvtv_5:5kQ>6Wx[\[gzy3]Q3~Op(q<Nhyv/x:15=4Rar^Etbv\|s52P9y-GhM&Hog_u#p?X*HQb_OY7]X%-'i4?r$h5MD/eEd"
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: 54 3b 46 39 9b 32 0f 89 9f 69 f4 af 67 e2 be bc e6 18 a1 fd f1 36 86 f3 37 cd 56 0c c6 b5 a0 3e fc 2c 18 85 ab 47 71 1a 2e 88 27 b1 a1 22 90 01 ea 8e 4c c1 5b c9 75 ef 2a 4c b3 e3 fd 28 47 22 4c 1e 7c 60 2e 42 7b 90 14 b0 1c c1 be 80 83 6f fc 88 86 67 47 a5 6d fe a3 12 25 43 1f 6a da 92 0c dc 6f da c4 94 ea 79 75 0b 5d 82 23 d0 ff 7f fc cc 31 b0 7a d2 3d af 8d 90 de 1e 54 f7 32 bc 79 49 ce 29 e6 8e ad 20 f5 36 dd 46 00 92 6c bd 2f 71 4c a2 25 fb ba fa 41 d7 82 d1 6b 6e a6 ec 7f d2 14 8d 08 1b 1b 91 d7 a4 68 5c 02 36 c2 bd 00 9b f4 17 01 18 eb 46 24 3b 9b a7 a6 f1 ad cd 28 f6 ad 1b 6c 1b 2b 9b 25 9b 9c 5c 45 47 e0 4d 3c fb 66 1c db 56 fa e8 28 e3 64 5b 52 f3 b9 02 b9 72 59 f2 db db 5c 6f d3 4a 32 86 fe c7 de 5f c0 c5 b5 a4 fb 02 68 b3 70 77 77 0f c1 21 58 Data Ascii: T;F92ig67V>,Gq.'"L[u*L(G"L\|`.B{ogGm%Cjoyu]#1z=T2yI) 6Fl/qL%Aknh\6F$;(l+%\EGM<fV(d[RrY\oJ2_hpww!X
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: 59 9c ca fc 65 cf 67 9f ad 1c 6e f4 45 83 9d 8f ec 9e 25 86 1d e5 74 30 f4 77 b7 df 01 cf 30 a9 42 62 37 bf 84 ba 90 af 1d 0a 48 f7 37 76 8c 96 f9 55 85 ec fc 28 a0 73 3a 1f b3 24 b0 fb 06 5f 00 bc b3 6e fc 5c 3c d8 9f d4 fc ec 43 74 e1 83 e9 e7 8c 28 11 c7 07 5e 59 b1 b9 a7 ac cf eb 98 b0 ce ae 37 24 88 e6 58 c4 25 1e 61 0c 8e 13 0e 76 ef b4 ae a9 87 a4 5a bc ed 7d 01 89 a7 b0 fc d8 06 cf a2 15 eb 97 bb c1 ef c3 a6 2b c6 d7 a7 23 9b d8 66 c3 6f b1 da 6a 1c a1 20 b8 e3 41 72 ce bc c9 9a 44 75 83 f5 b9 24 76 71 b2 4e ad 2f b8 29 29 c6 2c 7f 24 7a d8 3b e5 43 5e fd 55 d1 68 6d 08 71 3f bc 5f fe c2 d8 43 da 8c 97 f5 42 b5 d2 0c da aa 8a 8f 15 cf 0d 20 4b 6e cc 01 45 ef 33 e6 ef 9b aa a8 a2 ce b7 87 e8 64 1f d8 93 3c 16 36 17 46 7a 92 8a e0 d1 82 92 4e 91 6d Data Ascii: YegnE%t0w0Bb7H7vU(s:$_n\<Ct(^Y7$X%avZ}+#foj ArDu$vqN/)),$z;C^Uhmq?_CB KnE3d<6FzNm
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: 8f 9c 08 f7 4e b5 87 26 29 11 07 7d b5 37 16 db 5c 4a f9 f2 06 14 82 61 71 d5 45 8e bd 2d 4c 57 ce 8b e0 f1 32 b7 78 35 e3 ab e9 fc 73 30 c3 3d 7b 8f d3 1a 4a ea fe ee eb f5 3a 63 ac 2e 5a 8c 0a 97 e5 cf ac 4e dc a4 fa 51 ab 75 df e6 dd 99 7e 04 3a f9 45 dd fb 96 d4 7c 75 7e a3 f8 79 2a 7a 09 55 f9 33 df 34 92 ac e8 fb c8 ed ef 96 52 6f b4 1c 4f 95 2a 68 49 8d a8 99 79 0d d5 d6 4b a9 e7 26 75 bb 2a b2 be d2 f7 57 d3 d5 6c cb 9c 84 be f7 97 0d a8 a1 56 32 7e 5d ac ab 82 8a b9 62 fa 50 00 f9 48 64 e4 61 27 8d a8 6a 7e d0 8a 51 ae f3 94 c2 68 77 7f d1 91 93 28 37 e6 43 8b ec 92 a1 97 1e 19 5f 7b 0f c0 a6 7a 4f ca c4 0b 62 ee bc 54 18 37 20 37 10 02 6d 3d a7 97 24 f0 bc 46 44 2b 77 42 cc a6 bd b8 33 4d 04 1f 45 27 22 79 d3 5b 33 41 7b b1 17 c9 49 d6 57 e9 35 Data Ascii: N&)}7\JaqE-LW2x5s0={J:c.ZNQu~:E\|u~yzU34RoOhIyK&u*WlV2~]bPHda'j~Qhw(7C_{zObT7 7m=$FD+wB3ME'"y[3A{IW5
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: bd 5a 8f 8a 8a 83 65 88 72 1c ec 17 4d 8b 4b e8 56 56 c1 88 83 fd d5 d4 31 0f a7 5b 87 88 2e eb f6 57 1b 3a 57 2e ec 97 b1 ac bc e6 bf 4e b1 9c d7 e8 ab 9d bc 58 06 ec 60 7c 44 2e 45 10 45 b1 11 bd f0 08 48 3f 2a 13 fe f1 d3 43 30 79 f1 ab 34 ec 5d 72 c8 fa 84 01 59 89 c5 b1 34 f2 36 da 03 fc c1 c2 ed ee 8e 61 4f 13 85 d5 0a 0c 90 51 21 c3 1b 07 7b 2f 8a 17 73 4f 27 1b ac 70 32 af a1 65 bb 08 b6 61 57 ea b6 75 31 c8 5b 06 33 e6 2b b0 cc cf 0d 8e b4 93 05 dd 7d c0 fb 30 f3 72 d6 35 a3 ca f2 8f 71 42 0d a6 d5 85 51 9c d5 da 54 88 92 9f 92 c1 0c c4 7c 0d 62 d7 27 2b 1f 97 c8 20 80 15 44 e7 0d 00 f7 8f 3b 95 8a 5f 1a 46 97 56 09 10 a0 58 5d 86 5d 03 78 af dc 6d 5e 96 72 c1 ca a3 c6 21 59 bb 2f 5c 66 fa 87 2c a2 ed bc 52 c5 5d 1a 38 27 af 3e a8 db 19 b3 1a 12 Data Ascii: ZerMKVV1[.W:W.NX`\|D.EEH?*C0y4]rY46aOQ!{/sO'p2eaWu1[3+}0r5qBQT\|b'+ D;_FVX]]xm^r!Y/\f,R]8'>
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: 69 73 66 b7 64 48 0c f7 04 f5 2d 8f 19 cf 5d 5a 57 cc ab 75 86 82 23 b8 82 b1 17 14 d0 dc 56 b6 17 98 24 dd 65 97 e6 7c a7 ad d7 40 c8 ac 8e e0 6d 7c b1 5f ec c8 8c c6 99 3b 72 08 23 96 9b 48 48 ab 03 d5 52 9a 36 fc 62 ac 21 42 c3 59 68 81 8d d9 9c 51 6b 19 26 46 c4 e0 0c 71 57 4e ab 78 b3 00 6b 39 c1 76 ac 30 cf a2 8b a1 9d 5f 51 58 18 e6 39 0f 42 cb 6a a5 94 1b 6d 91 92 cf 11 e1 66 7e 14 90 6d 22 cf c4 92 69 bf 66 c7 32 85 54 70 85 01 6b 2e 73 80 92 ca 40 f7 c6 4a d8 70 7f 55 cf 1e e0 1a e6 e1 5d f1 dd 19 bb 61 b2 2c ee e6 91 e1 33 5e 63 79 05 dc 7b 96 54 e0 e4 77 c4 59 41 28 ac ef de 23 22 90 89 bb f2 a4 86 65 f4 f1 08 d4 b6 60 49 40 b1 80 f5 fa 77 86 14 19 ea c9 d0 90 38 c1 40 b8 a0 06 a0 5a df 81 c5 97 f0 0a b7 3c e3 7d 51 a4 24 c2 eb 41 58 7d 74 66 Data Ascii: isfdH-]ZWu#V$e\|@m\|_;r#HHR6b!BYhQk&FqWNxk9v0_QX9Bjmf~m"if2Tpk.s@JpU]a,3^cy{TwYA(#"e`I@w8@Z<}Q$AX}tf
2024-09-27 22:15:57 UTC	16384	IN	Data Raw: aa ba 71 e1 2a c5 1b 14 08 07 5b f9 b8 a1 a5 2a 61 5c 2c 83 00 54 fb 97 eb c1 78 73 1a 5d 31 c6 cf 01 0f 06 ed c8 ff c2 2f 22 ab b0 52 1d 59 d4 8e fb 6a 81 bb 88 d9 eb a0 8d 2f c3 25 a0 86 eb 28 e3 87 1c 4d 24 de 3d 90 ee e8 22 c9 c5 49 e4 20 8f 57 11 84 be 7a b5 b6 53 57 2f 37 7d 9c b6 f3 bc b6 63 aa 90 b0 c3 47 a5 77 c5 af 93 23 d5 c4 ba 99 68 f6 8f da 6b 78 fb b5 18 9d 2a 70 5d 83 73 f5 a0 3a 92 f8 3b 20 09 cb 73 d8 81 70 37 60 18 7f 88 e8 6d b5 e6 b3 b1 17 e1 bf fe 50 ce b4 7f 66 26 bd 0a 40 88 31 06 c9 71 8d b3 69 27 a0 d3 31 1a e1 2e e0 86 3a e4 60 91 64 2d 02 03 81 9b e0 4c e7 d6 fe e1 8c a8 88 90 de 23 6a 10 e9 4b 86 a3 81 60 3c e5 79 47 18 c5 f9 25 85 0c 04 73 23 1f 9c bb 04 4a 96 55 14 43 01 63 c6 fd f7 fa 8f 28 cb 35 82 80 7e e7 1b 66 4e 70 0b Data Ascii: q[a\,Txs]1/"RYj/%(M$="I WzSW/7}cGw#hkx*p]s:; sp7`mPf&@1qi'1.:`d-L#jK`<yG%s#JUCc(5~fNp

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49792	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:16:06 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 34 58 4b 41 70 7a 62 43 68 45 57 79 78 41 57 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 34 63 64 34 32 30 35 63 61 32 62 66 39 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 4XKApzbChEWyxAWl.1Context: 434cd4205ca2bf93
2024-09-27 22:16:06 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:16:06 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 34 58 4b 41 70 7a 62 43 68 45 57 79 78 41 57 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 34 63 64 34 32 30 35 63 61 32 62 66 39 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 4XKApzbChEWyxAWl.2Context: 434cd4205ca2bf93<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-27 22:16:06 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 34 58 4b 41 70 7a 62 43 68 45 57 79 78 41 57 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 33 34 63 64 34 32 30 35 63 61 32 62 66 39 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 4XKApzbChEWyxAWl.3Context: 434cd4205ca2bf93<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:16:06 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:16:06 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 74 6c 51 56 74 31 4b 50 68 30 79 49 36 78 6c 36 65 4e 42 31 52 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: tlQVt1KPh0yI6xl6eNB1Rw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49794	40.115.3.253	443

Timestamp	Bytes transferred	Direction	Data
2024-09-27 22:16:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 42 53 72 4e 6a 6b 35 78 7a 55 75 77 33 63 6b 6e 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 39 33 31 66 39 63 30 31 61 32 61 35 34 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: BSrNjk5xzUuw3ckn.1Context: 3a931f9c01a2a54f
2024-09-27 22:16:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-09-27 22:16:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 42 53 72 4e 6a 6b 35 78 7a 55 75 77 33 63 6b 6e 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 39 33 31 66 39 63 30 31 61 32 61 35 34 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 57 78 6f 76 37 50 52 6f 72 79 58 63 6c 6c 59 63 63 79 52 59 4e 55 71 68 6b 2f 42 4f 31 58 41 71 4f 56 45 65 4b 6f 71 5a 53 42 7a 31 65 35 38 4a 2b 4b 33 52 55 69 71 6b 71 73 33 73 77 37 78 2b 37 4c 59 45 46 6d 77 70 63 4e 6c 31 62 34 55 6b 44 52 49 68 4c 45 30 44 37 73 43 63 4c 43 6e 41 31 31 56 6d 34 57 33 5a 6a 55 39 47 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: BSrNjk5xzUuw3ckn.2Context: 3a931f9c01a2a54f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWWxov7PRoryXcllYccyRYNUqhk/BO1XAqOVEeKoqZSBz1e58J+K3RUiqkqs3sw7x+7LYEFmwpcNl1b4UkDRIhLE0D7sCcLCnA11Vm4W3ZjU9G
2024-09-27 22:16:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 42 53 72 4e 6a 6b 35 78 7a 55 75 77 33 63 6b 6e 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 61 39 33 31 66 39 63 30 31 61 32 61 35 34 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: BSrNjk5xzUuw3ckn.3Context: 3a931f9c01a2a54f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-09-27 22:16:31 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-09-27 22:16:31 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 54 77 72 47 6c 43 66 69 62 45 57 69 35 6a 45 48 31 49 36 5a 73 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: TwrGlCfibEWi5jEH1I6Zsg.0Payload parsing failed.

Target ID:	0
Start time:	18:14:59
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	18:15:03
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2080 --field-trial-handle=2024,i,2749223173464164389,11508472724089143373,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	18:15:04
Start date:	27/09/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "http://www.telegramrm.com/"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253
Source: unknown	TCP traffic detected without corresponding DNS query: 40.115.3.253

Source: global traffic	DNS traffic detected: DNS query: www.telegramrm.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: sdk.51.la
Source: global traffic	DNS traffic detected: DNS query: collect-v6.51.la
Source: global traffic	DNS traffic detected: DNS query: web.dcobxs.com

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://www.telegramrm.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Malware Analysis System Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\Downloads\TiGysceotsetup-m66.zip.crdownload

C:\Users\user\Downloads\b221038d-b84f-4283-93e0-dddf1b702f7a.tmp

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 68

Chrome Cache Entry: 69

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Windows Analysis Report
http://www.telegramrm.com/