e9a7dfaaf5efed3fa1477579d352301f3aa0a2a8615771524e6e26f59fbeb201

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/12/2023, 09:49 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64f5cb82d223690f685b0ceeebe12a17.html
Size

53KB
MD5

64f5cb82d223690f685b0ceeebe12a17
SHA1

d8590ccadbfca200b4db23fac9c5c7c7681c2ba4
SHA256

e9a7dfaaf5efed3fa1477579d352301f3aa0a2a8615771524e6e26f59fbeb201
SHA512

075f3b490bd5b49f178ad7ecefc9b683f988cf8aca005cafceb4140837b4669b5bd1c7e1ff9bdac998915b8894c757c0fcd85528438ce3b32d74b563c451de40
SSDEEP

1536:CkgUiIakTqGivi+PyUDrunlYP63Nj+q5VyvR0w2AzTICbbwoE/t9M/dNwIUTDmD1:CkgUiIakTqGivi+PyUDrunlYP63Nj+qS

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "720601864"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "720601864"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "727945753"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078628"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410460502"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31078628"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{569843B4-A4D7-11EE-8184-CAE9171F1CAB} = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31078628"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1828	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1828	iexplore.exe
1828	iexplore.exe
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE
1860	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1860	1828	iexplore.exe	88
PID 1828 wrote to memory of 1860	1828	iexplore.exe	88
PID 1828 wrote to memory of 1860	1828	iexplore.exe	88

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\64f5cb82d223690f685b0ceeebe12a17.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1828 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1860

Network

DNS

wintotal.de.intellitxt.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

wintotal.de.intellitxt.com

IN A

Response
DNS

www.wintotal-forum.de

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

www.wintotal-forum.de

IN A

Response

www.wintotal-forum.de

IN A

195.15.233.57
GET

http://www.wintotal-forum.de/Themes/WT2/style.css?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/style.css?fin11 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/style.css?fin11
GET

http://www.wintotal-forum.de/Themes/WT2/images/post/solved.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/post/solved.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:30 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/post/solved.gif
GET

http://www.wintotal-forum.de/Glossar/glossar-js.php

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Glossar/glossar-js.php HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Glossar/glossar-js.php
GET

http://www.wintotal-forum.de/Themes/WT2/images/useroff.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/useroff.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:30 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/useroff.gif
GET

http://www.wintotal-forum.de/Themes/default/print.css?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/default/print.css?fin11 HTTP/1.1
Accept: text/css, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/default/print.css?fin11
GET

http://www.wintotal-forum.de/Themes/WT2/images/filter.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/filter.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/filter.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/star.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/star.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:30 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/star.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/WT/wt-logo.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/topic_starter.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/topic_starter.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/topic_starter.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/upshrink.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/upshrink.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/upshrink.gif
GET

http://www.wintotal-forum.de/Themes/default/sha1.js

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/default/sha1.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/default/sha1.js
GET

http://www.wintotal-forum.de/Themes/default/script.js?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/default/script.js?fin11 HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/default/script.js?fin11
GET

http://www.wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/topic/normal_post.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:29 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif
GET

https://www.wintotal-forum.de/Themes/default/print.css?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/print.css?fin11 HTTP/2.0
host: www.wintotal-forum.de
accept: text/css, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:24:04 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/default/print.css?fin11
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET

https://www.wintotal-forum.de/Themes/default/script.js?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/script.js?fin11 HTTP/2.0
host: www.wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:24:04 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/default/script.js?fin11
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET

https://www.wintotal-forum.de/Themes/default/sha1.js

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/sha1.js HTTP/2.0
host: www.wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:10 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/default/sha1.js
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET

https://www.wintotal-forum.de/Themes/WT2/style.css?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/style.css?fin11 HTTP/2.0
host: www.wintotal-forum.de
accept: text/css, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:10 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/style.css?fin11
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/WT/wt-logo.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 16:51:42 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/filter.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/filter.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:24:04 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/filter.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/topic/normal_post.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:10 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/star.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/star.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:24:05 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/star.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/useroff.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/useroff.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:10 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/useroff.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/post/solved.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/post/solved.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:10 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/post/solved.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Glossar/glossar-js.php

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Glossar/glossar-js.php HTTP/2.0
host: www.wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:10 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Glossar/glossar-js.php
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:30 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/upshrink.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/upshrink.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 16:51:43 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/upshrink.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/topic_starter.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/topic_starter.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/topic_starter.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/post/xx.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/post/xx.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/post/xx.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Smileys/smilies_smf/shocked.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Smileys/smilies_smf/shocked.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:24:05 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Smileys/smilies_smf/shocked.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/default/xml_topic.js

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/xml_topic.js HTTP/2.0
host: www.wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/default/xml_topic.js
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/stargmod.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/stargmod.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/stargmod.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/Female.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/Female.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/Female.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/www_sm.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/www_sm.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/www_sm.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Smileys/smilies_smf/cry.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Smileys/smilies_smf/cry.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:24:06 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Smileys/smilies_smf/cry.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/default/spellcheck.js

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/spellcheck.js HTTP/2.0
host: www.wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:12 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/default/spellcheck.js
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/Male.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/Male.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/Male.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Smileys/smilies_smf/cool.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Smileys/smilies_smf/cool.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:24:05 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Smileys/smilies_smf/cool.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://www.wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/WT/nav_unten.gif HTTP/2.0
host: www.wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 301

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 27 Dec 2023 17:03:11 GMT
cache-control: max-age=3600
x-redirect-by: WordPress
location: https://wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif
x-litespeed-cache: hit
content-length: 0
date: Wed, 27 Dec 2023 16:45:34 GMT
server: LiteSpeed
DNS

59.128.231.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

59.128.231.4.in-addr.arpa

IN PTR

Response
DNS

59.128.231.4.in-addr.arpa

Remote address:

8.8.8.8:53

Request

59.128.231.4.in-addr.arpa

IN PTR
DNS

57.233.15.195.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.233.15.195.in-addr.arpa

IN PTR

Response
DNS

57.233.15.195.in-addr.arpa

Remote address:

8.8.8.8:53

Request

57.233.15.195.in-addr.arpa

IN PTR
DNS

23.177.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.177.190.20.in-addr.arpa

IN PTR

Response
DNS

23.177.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

23.177.190.20.in-addr.arpa

IN PTR
DNS

19.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.134.221.88.in-addr.arpa

IN PTR

Response

19.134.221.88.in-addr.arpa

IN PTR

a88-221-134-19deploystaticakamaitechnologiescom
DNS

19.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

19.134.221.88.in-addr.arpa

IN PTR
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR

Response
DNS

95.221.229.192.in-addr.arpa

Remote address:

8.8.8.8:53

Request

95.221.229.192.in-addr.arpa

IN PTR
DNS

40.13.222.173.in-addr.arpa

Remote address:

8.8.8.8:53

Request

40.13.222.173.in-addr.arpa

IN PTR

Response

40.13.222.173.in-addr.arpa

IN PTR

a173-222-13-40deploystaticakamaitechnologiescom
DNS

40.13.222.173.in-addr.arpa

Remote address:

8.8.8.8:53

Request

40.13.222.173.in-addr.arpa

IN PTR
DNS

wintotal-forum.de

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

wintotal-forum.de

IN A

Response

wintotal-forum.de

IN A

195.15.233.57
GET

https://wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/topic/normal_post.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
alt-svc: quic=":443"; ma=2592000; v="43,46", h3-Q043=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-25=":443"; ma=2592000, h3-27=":443"; ma=2592000
GET

https://wintotal-forum.de/Themes/default/script.js?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/script.js?fin11 HTTP/2.0
host: wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12826
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/filter.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/filter.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12826
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/default/sha1.js

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/sha1.js HTTP/2.0
host: wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12795
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/WT/wt-logo.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12795
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/style.css?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/style.css?fin11 HTTP/2.0
host: wintotal-forum.de
accept: text/css, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12801
date: Wed, 27 Dec 2023 16:45:31 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/default/print.css?fin11

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/print.css?fin11 HTTP/2.0
host: wintotal-forum.de
accept: text/css, */*
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12826
date: Wed, 27 Dec 2023 16:45:32 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Glossar/glossar-js.php

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Glossar/glossar-js.php HTTP/2.0
host: wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
content-type: text/html; charset=UTF-8
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12826
date: Wed, 27 Dec 2023 16:45:32 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/post/solved.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/post/solved.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:32 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/useroff.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/useroff.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:32 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/star.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/star.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:32 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/upshrink.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/upshrink.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:32 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/topic_starter.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/topic_starter.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12795
date: Wed, 27 Dec 2023 16:45:32 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/post/xx.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/post/xx.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12795
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Smileys/smilies_smf/shocked.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Smileys/smilies_smf/shocked.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12826
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/default/xml_topic.js

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/xml_topic.js HTTP/2.0
host: wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/stargmod.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/stargmod.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/www_sm.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/www_sm.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12826
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/Female.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/Female.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Smileys/smilies_smf/cry.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Smileys/smilies_smf/cry.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12826
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/default/spellcheck.js

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/default/spellcheck.js HTTP/2.0
host: wintotal-forum.de
accept: application/javascript, */*;q=0.8
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/Male.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/Male.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12827
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Smileys/smilies_smf/cool.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Smileys/smilies_smf/cool.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12802
date: Wed, 27 Dec 2023 16:45:33 GMT
server: LiteSpeed
GET

https://wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:443

Request

GET /Themes/WT2/images/WT/nav_unten.gif HTTP/2.0
host: wintotal-forum.de
accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
accept-encoding: gzip, deflate

Response

HTTP/2.0 404

x-powered-by: PHP/7.4.10
expires: Wed, 11 Jan 1984 05:00:00 GMT
cache-control: no-cache, must-revalidate, max-age=0
content-type: text/html; charset=UTF-8
link: <https://wintotal-forum.de/wp-json/>; rel="https://api.w.org/"
x-litespeed-cache: hit
content-encoding: gzip
vary: Accept-Encoding
content-length: 12827
date: Wed, 27 Dec 2023 16:45:34 GMT
server: LiteSpeed
DNS

201.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

201.179.17.96.in-addr.arpa

IN PTR

Response

201.179.17.96.in-addr.arpa

IN PTR

a96-17-179-201deploystaticakamaitechnologiescom
DNS

adsrv.wintotal-forum.de

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

adsrv.wintotal-forum.de

IN A

Response
GET

http://www.wintotal-forum.de/Themes/WT2/images/post/xx.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/post/xx.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/post/xx.gif
GET

http://www.wintotal-forum.de/Themes/default/spellcheck.js

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/default/spellcheck.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/default/spellcheck.js
GET

http://www.wintotal-forum.de/Smileys/smilies_smf/cool.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Smileys/smilies_smf/cool.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:33 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Smileys/smilies_smf/cool.gif
GET

http://www.wintotal-forum.de/Smileys/smilies_smf/shocked.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Smileys/smilies_smf/shocked.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Smileys/smilies_smf/shocked.gif
GET

http://www.wintotal-forum.de/Themes/default/xml_topic.js

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/default/xml_topic.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/default/xml_topic.js
GET

http://www.wintotal-forum.de/Themes/WT2/images/stargmod.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/stargmod.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/stargmod.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/Female.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/Female.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/Female.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/www_sm.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/www_sm.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/www_sm.gif
GET

http://www.wintotal-forum.de/Smileys/smilies_smf/cry.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Smileys/smilies_smf/cry.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:32 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Smileys/smilies_smf/cry.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/Male.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/Male.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:33 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/Male.gif
GET

http://www.wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

IEXPLORE.EXE

Remote address:

195.15.233.57:80

Request

GET /Themes/WT2/images/WT/nav_unten.gif HTTP/1.1
Accept: image/png, image/svg+xml, image/jxr, image/*;q=0.8, */*;q=0.5
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
Host: www.wintotal-forum.de
Connection: Keep-Alive

Response

HTTP/1.1 301 Moved Permanently

Connection: Keep-Alive
Content-Type: text/html
Content-Length: 706
Date: Wed, 27 Dec 2023 16:45:33 GMT
Server: LiteSpeed
Location: https://www.wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif
DNS

241.154.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.154.82.20.in-addr.arpa

IN PTR

Response
DNS

241.154.82.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

241.154.82.20.in-addr.arpa

IN PTR
DNS

3.181.190.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

3.181.190.20.in-addr.arpa

IN PTR

Response
DNS

208.194.73.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

208.194.73.20.in-addr.arpa

IN PTR

Response
DNS

208.194.73.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

208.194.73.20.in-addr.arpa

IN PTR
DNS

195.233.44.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

195.233.44.23.in-addr.arpa

IN PTR

Response

195.233.44.23.in-addr.arpa

IN PTR

a23-44-233-195deploystaticakamaitechnologiescom
DNS

178.223.142.52.in-addr.arpa

Remote address:

8.8.8.8:53

Request

178.223.142.52.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR

Response
DNS

50.23.12.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.23.12.20.in-addr.arpa

IN PTR
DNS

158.240.127.40.in-addr.arpa

Remote address:

8.8.8.8:53

Request

158.240.127.40.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR

Response
DNS

56.126.166.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

56.126.166.20.in-addr.arpa

IN PTR
DNS

183.1.37.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

183.1.37.23.in-addr.arpa

IN PTR

Response

183.1.37.23.in-addr.arpa

IN PTR

a23-37-1-183deploystaticakamaitechnologiescom
DNS

119.110.54.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

119.110.54.20.in-addr.arpa

IN PTR

Response
DNS

161.19.199.152.in-addr.arpa

Remote address:

8.8.8.8:53

Request

161.19.199.152.in-addr.arpa

IN PTR

Response
DNS

217.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

217.135.221.88.in-addr.arpa

IN PTR

Response

217.135.221.88.in-addr.arpa

IN PTR

a88-221-135-217deploystaticakamaitechnologiescom
DNS

33.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

33.134.221.88.in-addr.arpa

IN PTR

Response

33.134.221.88.in-addr.arpa

IN PTR

a88-221-134-33deploystaticakamaitechnologiescom
DNS

211.135.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

211.135.221.88.in-addr.arpa

IN PTR

Response

211.135.221.88.in-addr.arpa

IN PTR

a88-221-135-211deploystaticakamaitechnologiescom
DNS

18.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.134.221.88.in-addr.arpa

IN PTR

Response

18.134.221.88.in-addr.arpa

IN PTR

a88-221-134-18deploystaticakamaitechnologiescom
DNS

16.234.44.23.in-addr.arpa

Remote address:

8.8.8.8:53

Request

16.234.44.23.in-addr.arpa

IN PTR

Response

16.234.44.23.in-addr.arpa

IN PTR

a23-44-234-16deploystaticakamaitechnologiescom
DNS

83.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

83.179.17.96.in-addr.arpa

IN PTR

Response

83.179.17.96.in-addr.arpa

IN PTR

a96-17-179-83deploystaticakamaitechnologiescom
DNS

60.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

60.179.17.96.in-addr.arpa

IN PTR

Response

60.179.17.96.in-addr.arpa

IN PTR

a96-17-179-60deploystaticakamaitechnologiescom
DNS

60.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

60.179.17.96.in-addr.arpa

IN PTR
DNS

60.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

60.179.17.96.in-addr.arpa

IN PTR
DNS

60.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

60.179.17.96.in-addr.arpa

IN PTR
DNS

60.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

60.179.17.96.in-addr.arpa

IN PTR
DNS

88.156.103.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

88.156.103.20.in-addr.arpa

IN PTR

Response
DNS

18.31.95.13.in-addr.arpa

Remote address:

8.8.8.8:53

Request

18.31.95.13.in-addr.arpa

IN PTR

Response
DNS

48.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

48.179.17.96.in-addr.arpa

IN PTR

Response

48.179.17.96.in-addr.arpa

IN PTR

a96-17-179-48deploystaticakamaitechnologiescom
DNS

24.134.221.88.in-addr.arpa

Remote address:

8.8.8.8:53

Request

24.134.221.88.in-addr.arpa

IN PTR

Response

24.134.221.88.in-addr.arpa

IN PTR

a88-221-134-24deploystaticakamaitechnologiescom
DNS

50.179.17.96.in-addr.arpa

Remote address:

8.8.8.8:53

Request

50.179.17.96.in-addr.arpa

IN PTR

Response

50.179.17.96.in-addr.arpa

IN PTR

a96-17-179-50deploystaticakamaitechnologiescom
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A

Response

tse1.mm.bing.net

IN CNAME

mm-mm.bing.net.trafficmanager.net

mm-mm.bing.net.trafficmanager.net

IN CNAME

dual-a-0001.a-msedge.net

dual-a-0001.a-msedge.net

IN A

204.79.197.200

dual-a-0001.a-msedge.net

IN A

13.107.21.200
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A
DNS

tse1.mm.bing.net

Remote address:

8.8.8.8:53

Request

tse1.mm.bing.net

IN A
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317300988_17HJ37E2JP0ASFIUD&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317300988_17HJ37E2JP0ASFIUD&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 494171
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8FE95A89E9E644E2833B0A7113588AC8 Ref B: LON04EDGE0715 Ref C: 2023-12-27T16:47:16Z
date: Wed, 27 Dec 2023 16:47:15 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301357_1M7VV0SOSJXWEGMMP&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301357_1M7VV0SOSJXWEGMMP&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 367882
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B2751AFDE16640EFA4A331A602A869C6 Ref B: LON04EDGE0715 Ref C: 2023-12-27T16:47:16Z
date: Wed, 27 Dec 2023 16:47:15 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317300979_17O5GM9WHR1UQCX2Q&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317300979_17O5GM9WHR1UQCX2Q&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 430642
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3E76D8467874477797AFEA061A369F13 Ref B: LON04EDGE0715 Ref C: 2023-12-27T16:47:16Z
date: Wed, 27 Dec 2023 16:47:15 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&w=1920&h=1080&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 418046
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 96183DBC665447CBA21B2B159CA43C5B Ref B: LON04EDGE0715 Ref C: 2023-12-27T16:47:16Z
date: Wed, 27 Dec 2023 16:47:15 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301412_1567NHQK9I5N2BTRV&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301412_1567NHQK9I5N2BTRV&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041

Response

HTTP/2.0 200

cache-control: public, max-age=2592000
content-length: 434630
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 50527FEC37D347F6AD68D210D98E011A Ref B: LON04EDGE0715 Ref C: 2023-12-27T16:47:16Z
date: Wed, 27 Dec 2023 16:47:15 GMT
GET

https://tse1.mm.bing.net/th?id=OADD2.10239317301421_1O9QSVM80YG18KICT&pid=21.2&w=1080&h=1920&c=4

Remote address:

204.79.197.200:443

Request

GET /th?id=OADD2.10239317301421_1O9QSVM80YG18KICT&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
DNS

84.65.42.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

84.65.42.20.in-addr.arpa

IN PTR

Response

195.15.233.57:80

http://www.wintotal-forum.de/Themes/WT2/images/useroff.gif

http

IEXPLORE.EXE

1.6kB
2.1kB
10
5

HTTP Request

GET http://www.wintotal-forum.de/Glossar/glossar-js.php

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/useroff.gif

HTTP Response

301
195.15.233.57:80

http://www.wintotal-forum.de/Themes/WT2/images/post/solved.gif

http

IEXPLORE.EXE

1.6kB
2.1kB
11
5

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/style.css?fin11

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/post/solved.gif

HTTP Response

301
195.15.233.57:80

http://www.wintotal-forum.de/Themes/WT2/images/star.gif

http

IEXPLORE.EXE

1.7kB
4.0kB
12
7

HTTP Request

GET http://www.wintotal-forum.de/Themes/default/print.css?fin11

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/filter.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/star.gif

HTTP Response

301
195.15.233.57:80

http://www.wintotal-forum.de/Themes/WT2/images/topic_starter.gif

http

IEXPLORE.EXE

1.1kB
3.1kB
10
6

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/topic_starter.gif

HTTP Response

301
195.15.233.57:80

http://www.wintotal-forum.de/Themes/default/sha1.js

http

IEXPLORE.EXE

1.0kB
3.0kB
10
6

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/upshrink.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/default/sha1.js

HTTP Response

301
195.15.233.57:80

http://www.wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif

http

IEXPLORE.EXE

1.1kB
3.1kB
10
6

HTTP Request

GET http://www.wintotal-forum.de/Themes/default/script.js?fin11

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif

HTTP Response

301
195.15.233.57:443

www.wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.4kB
3.9kB
18
13
195.15.233.57:443

www.wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.4kB
4.0kB
18
14
195.15.233.57:443

www.wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.4kB
4.0kB
18
14
195.15.233.57:443

www.wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.1kB
3.9kB
15
12
195.15.233.57:443

https://www.wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

tls, http2

IEXPLORE.EXE

5.1kB
7.5kB
53
32

HTTP Request

GET https://www.wintotal-forum.de/Themes/default/print.css?fin11

HTTP Request

GET https://www.wintotal-forum.de/Themes/default/script.js?fin11

HTTP Request

GET https://www.wintotal-forum.de/Themes/default/sha1.js

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/style.css?fin11

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/filter.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/star.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/useroff.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/post/solved.gif

HTTP Request

GET https://www.wintotal-forum.de/Glossar/glossar-js.php

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/upshrink.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/topic_starter.gif

HTTP Response

301

HTTP Response

301

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/post/xx.gif

HTTP Request

GET https://www.wintotal-forum.de/Smileys/smilies_smf/shocked.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/default/xml_topic.js

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/stargmod.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/Female.gif

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/www_sm.gif

HTTP Request

GET https://www.wintotal-forum.de/Smileys/smilies_smf/cry.gif

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Request

GET https://www.wintotal-forum.de/Themes/default/spellcheck.js

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/Male.gif

HTTP Response

301

HTTP Request

GET https://www.wintotal-forum.de/Smileys/smilies_smf/cool.gif

HTTP Response

301

HTTP Response

301

HTTP Response

301

HTTP Request

GET https://www.wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

HTTP Response

301
195.15.233.57:443

www.wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.2kB
691 B
14
10
195.15.233.57:443

www.wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.5kB
3.9kB
18
12
195.15.233.57:443

www.wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.5kB
3.9kB
18
12
195.15.233.57:443

wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.1kB
3.9kB
15
12
195.15.233.57:443

https://wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

tls, http2

IEXPLORE.EXE

17.2kB
324.8kB
293
269

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/topic/normal_post.gif

HTTP Request

GET https://wintotal-forum.de/Themes/default/script.js?fin11

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/filter.gif

HTTP Request

GET https://wintotal-forum.de/Themes/default/sha1.js

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/WT/wt-logo.gif

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/style.css?fin11

HTTP Request

GET https://wintotal-forum.de/Themes/default/print.css?fin11

HTTP Request

GET https://wintotal-forum.de/Glossar/glossar-js.php

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/post/solved.gif

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/useroff.gif

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/star.gif

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/upshrink.gif

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/topic_starter.gif

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/post/xx.gif

HTTP Request

GET https://wintotal-forum.de/Smileys/smilies_smf/shocked.gif

HTTP Request

GET https://wintotal-forum.de/Themes/default/xml_topic.js

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/stargmod.gif

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/www_sm.gif

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/Female.gif

HTTP Request

GET https://wintotal-forum.de/Smileys/smilies_smf/cry.gif

HTTP Response

404

HTTP Request

GET https://wintotal-forum.de/Themes/default/spellcheck.js

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/Male.gif

HTTP Request

GET https://wintotal-forum.de/Smileys/smilies_smf/cool.gif

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Response

404

HTTP Request

GET https://wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

HTTP Response

404
195.15.233.57:443

wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.1kB
3.9kB
15
12
195.15.233.57:443

wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.1kB
3.9kB
15
12
195.15.233.57:443

wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.1kB
3.9kB
15
13
195.15.233.57:443

wintotal-forum.de

tls, http2

IEXPLORE.EXE

1.1kB
3.9kB
15
12
195.15.233.57:80

http://www.wintotal-forum.de/Smileys/smilies_smf/cool.gif

http

IEXPLORE.EXE

2.1kB
6.0kB
20
9

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/post/xx.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/default/spellcheck.js

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Smileys/smilies_smf/cool.gif

HTTP Response

301
195.15.233.57:80

http://www.wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

http

IEXPLORE.EXE

4.4kB
9.9kB
29
13

HTTP Request

GET http://www.wintotal-forum.de/Smileys/smilies_smf/shocked.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/default/xml_topic.js

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/stargmod.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/Female.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/www_sm.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Smileys/smilies_smf/cry.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/Male.gif

HTTP Response

301

HTTP Request

GET http://www.wintotal-forum.de/Themes/WT2/images/WT/nav_unten.gif

HTTP Response

301
204.79.197.200:443

ieonline.microsoft.com

tls, http2

iexplore.exe

1.4kB
8.3kB
16
14
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.1kB
8.2kB
13
12
204.79.197.200:443

https://tse1.mm.bing.net/th?id=OADD2.10239317301421_1O9QSVM80YG18KICT&pid=21.2&w=1080&h=1920&c=4

tls, http2

62.7kB
1.8MB
1302
1296

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317300988_17HJ37E2JP0ASFIUD&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301357_1M7VV0SOSJXWEGMMP&pid=21.2&w=1080&h=1920&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317300979_17O5GM9WHR1UQCX2Q&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317300924_1N7S5A2UISE5XQ4TY&pid=21.2&w=1920&h=1080&c=4

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301412_1567NHQK9I5N2BTRV&pid=21.2&w=1080&h=1920&c=4

HTTP Response

200

HTTP Response

200

HTTP Response

200

HTTP Request

GET https://tse1.mm.bing.net/th?id=OADD2.10239317301421_1O9QSVM80YG18KICT&pid=21.2&w=1080&h=1920&c=4

HTTP Response

200

HTTP Response

200
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.1kB
8.2kB
13
12
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.3kB
8.4kB
17
16
204.79.197.200:443

tse1.mm.bing.net

tls, http2

1.3kB
8.4kB
17
16

8.8.8.8:53

wintotal.de.intellitxt.com

dns

IEXPLORE.EXE

72 B
72 B
1
1

DNS Request

wintotal.de.intellitxt.com
8.8.8.8:53

www.wintotal-forum.de

dns

IEXPLORE.EXE

67 B
83 B
1
1

DNS Request

www.wintotal-forum.de

DNS Response

195.15.233.57
8.8.8.8:53

59.128.231.4.in-addr.arpa

dns

142 B
157 B
2
1

DNS Request

59.128.231.4.in-addr.arpa

DNS Request

59.128.231.4.in-addr.arpa
8.8.8.8:53

57.233.15.195.in-addr.arpa

dns

144 B
136 B
2
1

DNS Request

57.233.15.195.in-addr.arpa

DNS Request

57.233.15.195.in-addr.arpa
8.8.8.8:53

23.177.190.20.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

23.177.190.20.in-addr.arpa

DNS Request

23.177.190.20.in-addr.arpa
8.8.8.8:53

19.134.221.88.in-addr.arpa

dns

144 B
137 B
2
1

DNS Request

19.134.221.88.in-addr.arpa

DNS Request

19.134.221.88.in-addr.arpa
8.8.8.8:53

95.221.229.192.in-addr.arpa

dns

146 B
144 B
2
1

DNS Request

95.221.229.192.in-addr.arpa

DNS Request

95.221.229.192.in-addr.arpa
8.8.8.8:53

40.13.222.173.in-addr.arpa

dns

144 B
137 B
2
1

DNS Request

40.13.222.173.in-addr.arpa

DNS Request

40.13.222.173.in-addr.arpa
8.8.8.8:53

wintotal-forum.de

dns

IEXPLORE.EXE

63 B
79 B
1
1

DNS Request

wintotal-forum.de

DNS Response

195.15.233.57
8.8.8.8:53

201.179.17.96.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

201.179.17.96.in-addr.arpa
8.8.8.8:53

adsrv.wintotal-forum.de

dns

IEXPLORE.EXE

69 B
132 B
1
1

DNS Request

adsrv.wintotal-forum.de
8.8.8.8:53

241.154.82.20.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

241.154.82.20.in-addr.arpa

DNS Request

241.154.82.20.in-addr.arpa
8.8.8.8:53

3.181.190.20.in-addr.arpa

dns

71 B
157 B
1
1

DNS Request

3.181.190.20.in-addr.arpa
8.8.8.8:53

208.194.73.20.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

208.194.73.20.in-addr.arpa

DNS Request

208.194.73.20.in-addr.arpa
8.8.8.8:53

195.233.44.23.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

195.233.44.23.in-addr.arpa
8.8.8.8:53

178.223.142.52.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

178.223.142.52.in-addr.arpa
8.8.8.8:53

50.23.12.20.in-addr.arpa

dns

140 B
156 B
2
1

DNS Request

50.23.12.20.in-addr.arpa

DNS Request

50.23.12.20.in-addr.arpa
8.8.8.8:53

158.240.127.40.in-addr.arpa

dns

73 B
147 B
1
1

DNS Request

158.240.127.40.in-addr.arpa
8.8.8.8:53

56.126.166.20.in-addr.arpa

dns

144 B
158 B
2
1

DNS Request

56.126.166.20.in-addr.arpa

DNS Request

56.126.166.20.in-addr.arpa
8.8.8.8:53

183.1.37.23.in-addr.arpa

dns

70 B
133 B
1
1

DNS Request

183.1.37.23.in-addr.arpa
8.8.8.8:53

119.110.54.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

119.110.54.20.in-addr.arpa
8.8.8.8:53

161.19.199.152.in-addr.arpa

dns

73 B
144 B
1
1

DNS Request

161.19.199.152.in-addr.arpa
8.8.8.8:53

217.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

217.135.221.88.in-addr.arpa
8.8.8.8:53

33.134.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

33.134.221.88.in-addr.arpa
8.8.8.8:53

211.135.221.88.in-addr.arpa

dns

73 B
139 B
1
1

DNS Request

211.135.221.88.in-addr.arpa
8.8.8.8:53

18.134.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

18.134.221.88.in-addr.arpa
8.8.8.8:53

16.234.44.23.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

16.234.44.23.in-addr.arpa
8.8.8.8:53

83.179.17.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

83.179.17.96.in-addr.arpa
8.8.8.8:53

60.179.17.96.in-addr.arpa

dns

355 B
135 B
5
1

DNS Request

60.179.17.96.in-addr.arpa

DNS Request

60.179.17.96.in-addr.arpa

DNS Request

60.179.17.96.in-addr.arpa

DNS Request

60.179.17.96.in-addr.arpa

DNS Request

60.179.17.96.in-addr.arpa
8.8.8.8:53

88.156.103.20.in-addr.arpa

dns

72 B
158 B
1
1

DNS Request

88.156.103.20.in-addr.arpa
8.8.8.8:53

18.31.95.13.in-addr.arpa

dns

70 B
144 B
1
1

DNS Request

18.31.95.13.in-addr.arpa
8.8.8.8:53

48.179.17.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

48.179.17.96.in-addr.arpa
8.8.8.8:53

24.134.221.88.in-addr.arpa

dns

72 B
137 B
1
1

DNS Request

24.134.221.88.in-addr.arpa
8.8.8.8:53

50.179.17.96.in-addr.arpa

dns

71 B
135 B
1
1

DNS Request

50.179.17.96.in-addr.arpa
8.8.8.8:53

tse1.mm.bing.net

dns

186 B
173 B
3
1

DNS Request

tse1.mm.bing.net

DNS Request

tse1.mm.bing.net

DNS Request

tse1.mm.bing.net

DNS Response

204.79.197.200

13.107.21.200
8.8.8.8:53

84.65.42.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

84.65.42.20.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ALL181V\topic_starter[1].htm

Filesize
706B

MD5
67f3a5933c17b3ab044826d3927d0ba9

SHA1
5957076d09bacaa6db8ddc832b4fd87ed8f05f8a

SHA256
97e800f4836b7030dd58fe6296294b7ff5ef1b5eb0e88353f230ea1608d2bb64

SHA512
03ba224055ffdbf32b7eea30c764dc18d66cc6d8707dc5fafab74e155b0bb3d4d691c5788b033a68f05299547297125122778fa7e3252f93e7343d918936643e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Q15AV1NQ\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Response

HTTP Request

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Response

HTTP Response

HTTP Request