Edit tour

Windows Analysis Report
http://tretiktok.com/

Overview

General Information

Sample URL:	http://tretiktok.com/
Analysis ID:	1591492
Infos:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

AI detected suspicious URL

HTML body contains low number of good links

HTML body with high number of embedded images detected

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5940 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3840 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2172,i,10974819758829553068,1723501001303465625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3716 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://tretiktok.com/" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /wap/api/banner!bannerList.action?pageNum=1&pageSize=8&type=pc&imgType=1&lang=en HTTP/1.1Host: tretiktok.comConnection: keep-aliveContent-Length: 0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, */*Content-Type: application/x-www-form-urlencodedsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: http://tretiktok.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: http://tretiktok.com/js/app.e69ee347.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-4ed2022c.72467277.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-a481f6c2.461cae5d.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/img/TikTok-Wholesalelogo.e950f9dd.svg	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-6699a1ea.bdffbdcc.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-2e9544b4.4e8d2ecf.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-04d0d3d4.76c2e63a.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-487279fe.847fbadb.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-2d216994.706e13e0.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-533124bf.74a37e9c.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-6f60fb4c.f9bcf067.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-2d216070.9124b10d.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-b44cb87e.ed1c3227.js	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/banner!bannerList.action?pageNum=1&pageSize=8&type=pc&imgType=1&lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-813bed94.3cc9acb1.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-68f12e90.899c1691.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-2849664a.6778826c.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-000dfe6b.1a6d1746.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-637414aa.10f19374.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-6820d330.92319b2b.css	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/sellerGoods!recommend_new.action?type=0&pageSize=24&pageNum=1&lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-2d7a155f.8ed28816.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-ec5b203e.45f75ffc.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-5c861bdc.7817aba6.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-5a8a56f2.f23cb60b.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/img/banner_01.0c05748f.png	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/app.7301f093.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-ff2fdb80.373c9e7c.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-7809be7c.badabe5f.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-78328792.1a94a034.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-dcbc024c.b4863f7d.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-a481f6c2.64cc768e.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-b44cb87e.c2dcd608.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-6820d330.d88286b9.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-7bbab158.8631e82a.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/vendors~app.e68c9730.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-f43bced2.d5f3931e.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-43f51806.d5eeab2d.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-080bb2e0.615f6bf6.css	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/category!recommend.action?&pageSize=50&pageNum=1&lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-fe46833a.2b714c8c.js	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/seller!list.action?isRec=1&lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-7809be7c.72b7d984.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/fonts/iconfont.0080bb9b.woff2	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-24e95abb.f4060790.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-dcbc024c.a343950e.css	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/sellerGoods!recommend_new.action?type=1&pageSize=24&pageNum=1&lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-83fd3762.de13c570.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-356c00b0.ee0b96c4.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-78328792.e3aca6c5.js	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/syspara!getSyspara.action?code=customer_service_url&lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-000dfe6b.148f433f.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-83fd3762.bbf1f88d.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-b4023030.9621566e.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/img/logo.4c830710.svg	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-4ed2022c.1c551398.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-5c861bdc.fa565357.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-3805cfd3.f935cc1a.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-4007d5e3.c1afa8a8.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-91f4e7e8.054674a3.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-24e95abb.b2e5197a.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-ec5b203e.6dab27c0.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-3805cfd3.85ee17e2.css	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/index!download-url.action?lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/img/shoplogo.5dba109d.svg	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-6f60fb4c.4ea98c77.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-74926972.0bd1ca12.js	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/activity/lottery!getCurrentActivity.action?lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-487279fe.3b891b55.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-b4023030.20d1b0c1.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-377c362c.684410b2.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-574f8736.17e73482.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-04d0d3d4.d31236ee.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-2849664a.b30d78dd.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-4007d5e3.3ecf88fe.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-ff2fdb80.d40cf9e6.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-43f51806.0daa9b11.css	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/newOnlinechat!unread.action?lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-813bed94.d707c039.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-3bd464d9.8440b3fa.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-5a8a56f2.606de64f.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-7bbab158.e4b86363.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/vendors~app.31b97418.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-91f4e7e8.ba995d7c.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-fe46833a.f2bd8913.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-574f8736.7da50378.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-637414aa.c67f7842.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-377c362c.ad1b4093.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-f43bced2.c70dd4a7.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-533124bf.94e96180.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-68f12e90.27a370f9.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-4a688b54.fdd54ac3.js	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-3bd464d9.c47c7a52.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/js/chunk-356c00b0.d896e6f3.js	Avira URL Cloud: Label: phishing
Source: https://tretiktok.com/wap/api/syspara!getSyspara.action?code=mall_max_goods_number_in_order&lang=en	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-6699a1ea.cd704402.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/css/chunk-4a688b54.8fe95911.css	Avira URL Cloud: Label: phishing
Source: http://tretiktok.com/fonts/element-icons.535877f5.woff	Avira URL Cloud: Label: phishing

Source: URL	Joe Sandbox AI: AI detected Brand spoofing attempt in URL: http://tretiktok.com
Source: URL	Joe Sandbox AI: AI detected Typosquatting in URL: http://tretiktok.com

Source: http://tretiktok.com/#/index	HTTP Parser: No <meta name="author".. found
Source: http://tretiktok.com/#/index	HTTP Parser: No <meta name="author".. found
Source: http://tretiktok.com/#/index	HTTP Parser: No <meta name="author".. found

Source: http://tretiktok.com/#/index	HTTP Parser: No <meta name="copyright".. found
Source: http://tretiktok.com/#/index	HTTP Parser: No <meta name="copyright".. found
Source: http://tretiktok.com/#/index	HTTP Parser: No <meta name="copyright".. found

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: tretiktok.com

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2172,i,10974819758829553068,1723501001303465625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "http://tretiktok.com/"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2172,i,10974819758829553068,1723501001303465625,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Antivirus Detection	Reputation
tretiktok.com	47.91.24.166	true	true		unknown
www.google.com	142.250.185.164	true	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
239.255.255.250	unknown	Reserved	unknown	unknown	false
47.91.24.166	tretiktok.com	United States	45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	true
142.250.185.164	www.google.com	United States	15169	GOOGLEUS	false

IP
192.168.2.6
192.168.2.5

Source	Detection	Scanner	Label
http://tretiktok.com/js/app.e69ee347.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-4ed2022c.72467277.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-a481f6c2.461cae5d.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/img/TikTok-Wholesalelogo.e950f9dd.svg	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-6699a1ea.bdffbdcc.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-2e9544b4.4e8d2ecf.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-04d0d3d4.76c2e63a.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-487279fe.847fbadb.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-2d216994.706e13e0.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-533124bf.74a37e9c.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-6f60fb4c.f9bcf067.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-2d216070.9124b10d.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-b44cb87e.ed1c3227.js	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/banner!bannerList.action?pageNum=1&pageSize=8&type=pc&imgType=1&lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-813bed94.3cc9acb1.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-68f12e90.899c1691.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-2849664a.6778826c.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-000dfe6b.1a6d1746.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-637414aa.10f19374.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-6820d330.92319b2b.css	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/sellerGoods!recommend_new.action?type=0&pageSize=24&pageNum=1&lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-2d7a155f.8ed28816.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-ec5b203e.45f75ffc.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-5c861bdc.7817aba6.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-5a8a56f2.f23cb60b.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/img/banner_01.0c05748f.png	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/app.7301f093.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-ff2fdb80.373c9e7c.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-7809be7c.badabe5f.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-78328792.1a94a034.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-dcbc024c.b4863f7d.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-a481f6c2.64cc768e.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-b44cb87e.c2dcd608.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-6820d330.d88286b9.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-7bbab158.8631e82a.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/vendors~app.e68c9730.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-f43bced2.d5f3931e.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-43f51806.d5eeab2d.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-080bb2e0.615f6bf6.css	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/category!recommend.action?&pageSize=50&pageNum=1&lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-fe46833a.2b714c8c.js	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/seller!list.action?isRec=1&lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-7809be7c.72b7d984.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/fonts/iconfont.0080bb9b.woff2	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-24e95abb.f4060790.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-dcbc024c.a343950e.css	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/sellerGoods!recommend_new.action?type=1&pageSize=24&pageNum=1&lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-83fd3762.de13c570.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-356c00b0.ee0b96c4.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-78328792.e3aca6c5.js	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/syspara!getSyspara.action?code=customer_service_url&lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-000dfe6b.148f433f.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-83fd3762.bbf1f88d.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-b4023030.9621566e.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/img/logo.4c830710.svg	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-4ed2022c.1c551398.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-5c861bdc.fa565357.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-3805cfd3.f935cc1a.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-4007d5e3.c1afa8a8.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-91f4e7e8.054674a3.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-24e95abb.b2e5197a.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-ec5b203e.6dab27c0.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-3805cfd3.85ee17e2.css	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/index!download-url.action?lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/img/shoplogo.5dba109d.svg	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-6f60fb4c.4ea98c77.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-74926972.0bd1ca12.js	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/activity/lottery!getCurrentActivity.action?lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-487279fe.3b891b55.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-b4023030.20d1b0c1.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-377c362c.684410b2.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-574f8736.17e73482.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-04d0d3d4.d31236ee.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-2849664a.b30d78dd.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-4007d5e3.3ecf88fe.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-ff2fdb80.d40cf9e6.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-43f51806.0daa9b11.css	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/newOnlinechat!unread.action?lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-813bed94.d707c039.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-3bd464d9.8440b3fa.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-5a8a56f2.606de64f.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-7bbab158.e4b86363.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/vendors~app.31b97418.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-91f4e7e8.ba995d7c.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-fe46833a.f2bd8913.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-574f8736.7da50378.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-637414aa.c67f7842.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-377c362c.ad1b4093.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-f43bced2.c70dd4a7.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-533124bf.94e96180.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-68f12e90.27a370f9.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-4a688b54.fdd54ac3.js	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-3bd464d9.c47c7a52.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/js/chunk-356c00b0.d896e6f3.js	100%	Avira URL Cloud	phishing
https://tretiktok.com/wap/api/syspara!getSyspara.action?code=mall_max_goods_number_in_order&lang=en	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-6699a1ea.cd704402.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/css/chunk-4a688b54.8fe95911.css	100%	Avira URL Cloud	phishing
http://tretiktok.com/fonts/element-icons.535877f5.woff	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://tretiktok.com/js/chunk-6699a1ea.bdffbdcc.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/app.e69ee347.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-4ed2022c.72467277.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-487279fe.847fbadb.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/img/TikTok-Wholesalelogo.e950f9dd.svg	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-2d216994.706e13e0.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-533124bf.74a37e9c.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-04d0d3d4.76c2e63a.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-2e9544b4.4e8d2ecf.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-a481f6c2.461cae5d.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-2849664a.6778826c.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-637414aa.10f19374.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-2d216070.9124b10d.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-6f60fb4c.f9bcf067.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-813bed94.3cc9acb1.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-68f12e90.899c1691.js	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/banner!bannerList.action?pageNum=1&pageSize=8&type=pc&imgType=1&lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-b44cb87e.ed1c3227.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-000dfe6b.1a6d1746.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-6820d330.92319b2b.css	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/sellerGoods!recommend_new.action?type=0&pageSize=24&pageNum=1&lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-5a8a56f2.f23cb60b.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-2d7a155f.8ed28816.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-5c861bdc.7817aba6.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-ec5b203e.45f75ffc.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-ff2fdb80.373c9e7c.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/#/index	true		unknown
http://tretiktok.com/css/app.7301f093.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-78328792.1a94a034.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/img/banner_01.0c05748f.png	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-7809be7c.badabe5f.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-dcbc024c.b4863f7d.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-6820d330.d88286b9.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-a481f6c2.64cc768e.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-b44cb87e.c2dcd608.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-7bbab158.8631e82a.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/vendors~app.e68c9730.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-f43bced2.d5f3931e.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-43f51806.d5eeab2d.js	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/category!recommend.action?&pageSize=50&pageNum=1&lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-080bb2e0.615f6bf6.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-fe46833a.2b714c8c.js	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/seller!list.action?isRec=1&lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-7809be7c.72b7d984.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-24e95abb.f4060790.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-dcbc024c.a343950e.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/fonts/iconfont.0080bb9b.woff2	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-83fd3762.de13c570.js	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/sellerGoods!recommend_new.action?type=1&pageSize=24&pageNum=1&lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-000dfe6b.148f433f.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-78328792.e3aca6c5.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-356c00b0.ee0b96c4.css	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/syspara!getSyspara.action?code=customer_service_url&lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-83fd3762.bbf1f88d.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-b4023030.9621566e.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-4ed2022c.1c551398.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/img/logo.4c830710.svg	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-4007d5e3.c1afa8a8.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-5c861bdc.fa565357.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-3805cfd3.f935cc1a.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-3805cfd3.85ee17e2.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-91f4e7e8.054674a3.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-ec5b203e.6dab27c0.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-24e95abb.b2e5197a.css	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/index!download-url.action?lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/img/shoplogo.5dba109d.svg	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-6f60fb4c.4ea98c77.js	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/activity/lottery!getCurrentActivity.action?lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-74926972.0bd1ca12.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-b4023030.20d1b0c1.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/	true		unknown
http://tretiktok.com/css/chunk-487279fe.3b891b55.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-377c362c.684410b2.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-574f8736.17e73482.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-04d0d3d4.d31236ee.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-2849664a.b30d78dd.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-43f51806.0daa9b11.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-4007d5e3.3ecf88fe.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-ff2fdb80.d40cf9e6.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-813bed94.d707c039.css	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/newOnlinechat!unread.action?lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-3bd464d9.8440b3fa.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-5a8a56f2.606de64f.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/vendors~app.31b97418.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-91f4e7e8.ba995d7c.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-7bbab158.e4b86363.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-637414aa.c67f7842.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-574f8736.7da50378.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-fe46833a.f2bd8913.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-377c362c.ad1b4093.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-533124bf.94e96180.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-f43bced2.c70dd4a7.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-68f12e90.27a370f9.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-4a688b54.fdd54ac3.js	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-3bd464d9.c47c7a52.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-6699a1ea.cd704402.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/js/chunk-356c00b0.d896e6f3.js	true	Avira URL Cloud: phishing	unknown
https://tretiktok.com/wap/api/syspara!getSyspara.action?code=mall_max_goods_number_in_order&lang=en	false	Avira URL Cloud: phishing	unknown
http://tretiktok.com/css/chunk-4a688b54.8fe95911.css	true	Avira URL Cloud: phishing	unknown
http://tretiktok.com/fonts/element-icons.535877f5.woff	true	Avira URL Cloud: phishing	unknown

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1591492
Start date and time:	2025-01-15 01:32:58 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://tretiktok.com/
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.win@16/196@8/5
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Input	Output
URL: http://tretiktok.com Model: Joe Sandbox AI	{ "typosquatting": true, "unusual_query_string": false, "suspicious_tld": false, "ip_in_url": false, "long_subdomain": false, "malicious_keywords": false, "encoded_characters": false, "redirection": false, "contains_email_address": false, "known_domain": false, "brand_spoofing_attempt": true, "third_party_hosting": true }
URL: http://tretiktok.com
URL: http://tretiktok.com/js/app.e69ee347.js... Model: Joe Sandbox AI	{ "risk_score": 6, "reasoning": "This script exhibits several moderate-risk behaviors, including external data transmission, fallback domains, and aggressive DOM manipulation. While it does not contain any high-risk indicators like dynamic code execution or data exfiltration, the overall behavior is somewhat suspicious and requires further review. The use of obfuscated code and multiple fallback domains, some of which may be untrusted, contributes to the medium-risk assessment." }
!function(e){function a(a){for(var i,r,s=a[0],l=a[1],d=a[2],c=0,m=[];c<s.length;c++)r=s[c],Object.prototype.hasOwnProperty.call(t,r)&&t[r]&&m.push(t[r][0]),t[r]=0;for(i in l)Object.prototype.hasOwnProperty.call(l,i)&&(e[i]=l[i]);for(u&&u(a);m.length;)m.shift()();return o.push.apply(o,d\|\|[]),n()}function n(){for(var e,a=0;a<o.length;a++){for(var n=o[a],i=!0,r=1;r<n.length;r++){var l=n[r];0!==t[l]&&(i=!1)}i&&(o.splice(a--,1),e=s(s.s=n[0]))}return e}var i={},r={app:0},t={app:0},o=[];function s(a){var n;return(i[a]\|\|(n=i[a]={i:a,l:!1,exports:{}},e[a].call(n.exports,n,n.exports,s),n.l=!0,n)).exports}s.e=function(e){var a,n,i,o,l,d=[],c=(r[e]?d.push(r[e]):0!==r[e]&&{"chunk-080bb2e0":1,"chunk-24e95abb":1,"chunk-2849664a":1,"chunk-533124bf":1,"chunk-4a688b54":1,"chunk-a481f6c2":1,"chunk-5c861bdc":1,"chunk-ff2fdb80":1,"chunk-813bed94":1,"chunk-3805cfd3":1,"chunk-4007d5e3":1,"chunk-68f12e90":1,"chunk-000dfe6b":1,"chunk-ec5b203e":1,"chunk-7809be7c":1,"chunk-4ed2022c":1,"chunk-574f8736":1,"chunk-637414aa":1,"chunk-6699a1ea":1,"chunk-6820d330":1,"chunk-6f60fb4c":1,"chunk-04d0d3d4":1,"chunk-43f51806":1,"chunk-78328792":1,"chunk-83fd3762":1,"chunk-91f4e7e8":1,"chunk-b4023030":1,"chunk-b44cb87e":1,"chunk-f43bced2":1,"chunk-fe46833a":1,"chunk-356c00b0":1,"chunk-377c362c":1,"chunk-3bd464d9":1,"chunk-487279fe":1,"chunk-5a8a56f2":1,"chunk-7bbab158":1,"chunk-dcbc024c":1}[e]&&d.push(r[e]=new Promise((function(a,n){for(var i="css/"+({}[e]\|\|e)+"."+{"chunk-080bb2e0":"615f6bf6","chunk-24e95abb":"b2e5197a","chunk-2849664a":"b30d78dd","chunk-2d216070":"31d6cfe0","chunk-2d216994":"31d6cfe0","chunk-2d7a155f":"31d6cfe0","chunk-533124bf":"74a37e9c","chunk-2e9544b4":"31d6cfe0","chunk-4a688b54":"8fe95911","chunk-a481f6c2":"461cae5d","chunk-74926972":"31d6cfe0","chunk-5c861bdc":"7817aba6","chunk-ff2fdb80":"d40cf9e6","chunk-813bed94":"d707c039","chunk-3805cfd3":"85ee17e2","chunk-4007d5e3":"3ecf88fe","chunk-68f12e90":"27a370f9","chunk-000dfe6b":"148f433f","chunk-ec5b203e":"45f75ffc","chunk-7809be7c":"badabe5f","chunk-4ed2022c":"1c551398","chunk-574f8736":"7da50378","chunk-637414aa":"10f19374","chunk-6699a1ea":"cd704402","chunk-6820d330":"92319b2b","chunk-6f60fb4c":"f9bcf067","chunk-04d0d3d4":"76c2e63a","chunk-43f51806":"0daa9b11","chunk-78328792":"1a94a034","chunk-83fd3762":"bbf1f88d","chunk-91f4e7e8":"054674a3","chunk-b4023030":"9621566e","chunk-b44cb87e":"c2dcd608","chunk-f43bced2":"c70dd4a7","chunk-fe46833a":"f2bd8913","chunk-356c00b0":"ee0b96c4","chunk-377c362c":"684410b2","chunk-3bd464d9":"c47c7a52","chunk-487279fe":"3b891b55","chunk-5a8a56f2":"606de64f","chunk-7bbab158":"e4b86363","chunk-dcbc024c":"a343950e"}[e]+".css",t=s.p+i,o=document.getElementsByTagName("link"),l=0;l<o.length;l++){var d=(c=o[l]).getAttribute("data-href")\|\|c.getAttribute("href");if("stylesheet"===c.rel&&(d===i\|\|d===t))return a()}var c,u=document.getElementsByTagName("style");for(l=0;l<u.length;l++)if((d=(c=u[l]).getAttribute("data-href"))===i\|\|d===t)return a();var m=document.createElement("link");m.rel="stylesheet",m.type="text/css",m.onload=a,m.onerror=function(a){a=a&&a.target&&a.target.src\|\|t;var i=new Error("Loading CSS chunk "+e+" failed.\n("+a+")");i.code="CSS_CHUNK_LOAD_FAILED",i.request=a,delete r[e],m.parentNode.removeChild(m),n(i)},m.href=t,document.getElementsByTagName("head")[0].appendChild(m)})).then((function(){r[e]=0}))),t[e]);return 0!==c&&(c?d.push(c[2]):(l=new Promise((function(a,n){c=t[e]=[a,n]})),d.push(c[2]=l),(a=document.createElement("script")).charset="utf-8",a.timeout=120,s.nc&&a.setAttribute("nonce",s.nc),a.src=s.p+"js/"+({}[l=e]\|\|l)+"."+{"chunk-080bb2e0":"29e11e35","chunk-24e95abb":"f4060790","chunk-2849664a":"6778826c","chunk-2d216070":"9124b10d","chunk-2d216994":"706e13e0","chunk-2d7a155f":"8ed28816","chunk-533124bf":"94e96180","chunk-2e9544b4":"4e8d2ecf","chunk-4a688b54":"fdd54ac3","chunk-a481f6c2":"64cc768e","chunk-74926972":"0bd1ca12","chunk-5c861bdc":"fa565357","chunk-ff2fdb80":"373c9e7c","chunk-813bed94":"3cc9acb1","chunk-3805cfd3":"f935cc1a","chunk-4007d5e
URL: http://tretiktok.com/js/chunk-ff2fdb80.373c9e7c.js... Model: Joe Sandbox AI	{ "risk_score": 4, "reasoning": "The provided JavaScript snippet exhibits some moderate-risk behaviors, such as external data transmission and aggressive DOM manipulation. However, it does not contain any high-risk indicators like dynamic code execution or data exfiltration. The script appears to be related to product details and shopping cart functionality, which is a common use case. Further review may be necessary to ensure the script is not exhibiting any suspicious or inconsistent behavior." }
(window.webpackJsonp=window.webpackJsonp\|\|[]).push([["chunk-ff2fdb80"],{2650:function(t,e,s){"use strict";s("14d9");var i=s("2f62"),a=s("8c1b"),r=s("7035"),o=s("4260"),l=s("6ad0"),n=s("b463");s("a16c"),n={name:"EsProductionInfo",props:{id:{type:String,default:"0"}},components:{vuePhotoZoomPro:n.c,ImgZoomer:n.b,ImgPreview:n.a},data(){return{itemname:"TikTok-Wholesale",currentIndex:0,swiperOptionTop:{centeredSlides:!0,spaceBetween:10,autoplay:{delay:2500,disableOnInteraction:!1},thumbs:{swiper:{el:".gallery-thumbs",spaceBetween:10,slidesPerView:"auto",slideToClickedSlide:!0,watchSlidesVisibility:!0},slideThumbActiveClass:"slide-thumb-active"}},num:1,minbuy:1,goodsAttrObj:{},showOnlieService:!1,loading:!1,isCollect:!1,canSelectAttributes:[],price:null,curIndex:0,currentSkuTitle:[],imgList:"",skuPrice:null,maxNum:100,isIntDis:!0,show:!0,min:1}},computed:{...Object(i.c)({productDetails:"productDetails/productDetails"}),...Object(i.c)(["isLogin"]),totalPrice(){var t;return this.price?Object(o.f)(this.$big(this.num).times(this.price)):Object(o.f)(this.$big(this.num).times(null!=(t=null!=(t=this.productDetails.discountPrice)?t:this.productDetails.sellingPrice)?t:0))},productImgs(){return new Array(10).fill("").map((t,e)=>this.productDetails["imgUrl"+(e+1)]).filter(t=>!!t)}},watch:{productDetails:{handler(t,e){var s;this.minbuy=null!=(s=t.minbuy)?s:"1",t.canSelectAttributes?null!=(s=t.canSelectAttributes)&&s.goodAttrs.length&&(null!=(s=t.canSelectAttributes)&&s.goodAttrs.forEach(t=>{this.goodsAttrObj[t.attrId]=t.attrValues[0].attrValueId}),this.getAttrNameAndSkuId()):this.isIntDis=!1},deep:!0,immediate:!0}},async mounted(){if(sessionStorage.setItem("path","1"),this.maxNum=Number(localStorage.getItem("maxBuy")\|\|100),this.id&&"0"!==this.id)try{this.loading=!0,await this.requestProductDetails({sellerGoodsId:this.id})}finally{this.loading=!1}l.a.$on("cancelKeep",t=>{this.productDetails.id==t&&this.info()}),l.a.$on("keepProduct",t=>{this.productDetails.id==t&&this.info()})},beforeDestroy(){localStorage.setItem("seller_cache",JSON.stringify({id:this.productDetails.seller.id,name:this.productDetails.seller.name})),this.updateProductDetails({seller:{}})},methods:{numberFormatA:o.g,async info(){await this.requestProductDetails({sellerGoodsId:this.id,token:localStorage.getItem(a.h)})},mouseEnter(){this.$refs.swiperTop.$swiper.autoplay.stop()},mouseLeave(){this.$refs.swiperTop.$swiper.autoplay.start()},changeColor(t,e){this.currentIndex=t},numberFormatFn(t){return Object(o.f)(t)},inputNumBlur(){var t=localStorage.getItem("maxBuy");/^[1-9][0-9]*$/.test(this.num)?(null==this.num&&(this.num="1"),this.num>t&&(this.num=t)):this.num="1"},...Object(i.b)({requestProductDetails:"productDetails/requestProductDetails",requestCollectGoods:"user/requestCollectGoods",requestCollectGoodsDel:"user/requestCollectGoodsDel"}),...Object(i.d)({updateCheckProductPay:"shopCart/updateCheckProductPay",updateProductDetails:"productDetails/updateProductDetails"}),onSlideChange(){this.curIndex=this.$refs.swiperTop.$swiper.activeIndex},change(t){this.$refs.swiperTop.$swiper.slideTo(t),this.curIndex=t},changeGoodAttr(t,e,s,i){var a={...this.goodsAttrObj};a[t]=e,this.goodsAttrObj=a;const r=new Set;a=null==(a=this.productDetails)\|\|null==(a=a.canSelectAttributes)?void 0:a.goodAttrs;const o=JSON.parse(JSON.stringify(this.goodsAttrObj));a.length===Object.keys(this.goodsAttrObj).length&&a.forEach((t,e)=>{e!=s&&t.attrValues.forEach((e,s)=>{o[t.attrId]=e.attrValueId;var i=this.getAttrNameAndSkuId(!0,o)["skuId"];-1==i&&r.add(e.attrValueId)})}),null!=(a=this.productDetails)&&null!=(a=a.canSelectAttributes)&&a.goodAttrs.forEach(t=>{t.attrValues.forEach(t=>{t.disabled=r.has(t.attrValueId)})}),this.getAttrNameAndSkuId(),i\|\|this.changeGoodAttr(t,e,s,!0)},getAttrNameAndSkuId(t,e){var s=(null!=(s=this.productDetails.canSelectAttributes)?s:{})["skus"];e&&"undefined"in e&&delete e[void 0];const i=t?Object.keys(e):Object.keys(this.goodsAttrObj),a=t?e:this.goodsAttrObj;t=(null==s?void 0:s.find(t=>{l
URL: http://tretiktok.com/#/index Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://tretiktok.com/js/chunk-dcbc024c.b4863f7d.js... Model: Joe Sandbox AI	```json { "risk_score": 1, "reasoning": "The script primarily involves image loading and UI component rendering with no high-risk behaviors such as dynamic code execution or data exfiltration. It does not interact with external domains or perform aggressive DOM manipulation." }
(window.webpackJsonp=window.webpackJsonp\|\|[]).push([["chunk-dcbc024c"],{"095e":function(e,t,n){e.exports=n.p+"img/right3.9c862538.jpeg"},"0a2c":function(e,t,n){},"114f":function(e,t,n){"use strict";n("24a3")},"1b16":function(e,t,n){e.exports=n.p+"img/right6.b8bac159.jpeg"},2054:function(e,t,n){},"22b9":function(e,t,n){},"24a3":function(e,t,n){},"26b1":function(e,t,n){"use strict";n("4eef")},"26ec":function(e,t,n){e.exports=n.p+"img/right1.57c427fc.jpeg"},"2c03":function(e,t){e.exports="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABIAAAASCAMAAABhEH5lAAAATlBMVEVMaXE0NDQyMjIzMzMxMTEyMjIzMzMwMDAwMDAwMDAwMDAxMTEwMDAzMzMzMzM1NTUzMzMyMjIyMjIyMjIzMzM0NDQyMjIyMjIyMjIzMzMfAHp8AAAAGXRSTlMAQGDvH9+fIGAQMD9Av98wUO9wj6/Pn4CQzAMKwQAAAHhJREFUGNOl0LsSgzAMRNELRlZEMIS89/9/NAUDdkGXLc/saCQBQLcA+EKTd7FUcgP+yibZc/aDsvIspYfKLqEjAwDTGJcjMY0Q0lhbN2nApWul/i+KtLbj0xrg4ZU6j+2ehvb1+yx9P1K+17snaaDpnFOYgdn2mx9H1w+yh2Q7TAAAAABJRU5ErkJggg=="},"2d7b":function(e,t,n){e.exports=n.p+"img/right5.1ea7fcc6.jpeg"},"30e7":function(e,t,n){"use strict";n("2054")},"3ae2":function(e,t,n){e.exports=n.p+"img/right2.23d3e322.jpeg"},"3d19":function(e,t,n){"use strict";n("c2b6")},"490a":function(e,t,n){"use strict";n("d4d0")},"4b18":function(e,t,n){"use strict";n("acbf")},"4d97":function(e,t,n){"use strict";var i={name:"EsIconTips",data(){return{}}};n("5734"),n=n("2877"),n=Object(n.a)(i,(function(){var e=this,t=e._self._c;return t("div",{staticClass:"icon-tips"},[t("div",{staticClass:"icon-tips-bottom flex-between"},[t("div",{staticClass:"icon-tips-bottom-item flex-center"},[t("span",{staticClass:"iconfont icon-aixin icon_span"}),t("span",[e._v(e._s(this.$t("message.home.authentic")))])]),t("div",{staticClass:"icon-tips-bottom-item flex-center"},[t("span",{staticClass:"iconfont icon-control-backward icon_span"}),t("span",[e._v(e._s(this.$t("message.home.dayReturns7")))])]),t("div",{staticClass:"icon-tips-bottom-item flex-center"},[t("span",{staticClass:"iconfont icon-yunfei icon_span"}),t("span",[e._v(" "+e._s(this.$t("message.home.shippingDiscounts"))+" ")])]),t("div",{staticClass:"icon-tips-bottom-item flex-center"},[t("span",{staticClass:"iconfont icon-qianbao icon_span"}),t("span",[e._v(e._s(this.$t("message.home.safePayment")))])])])])}),[],!1,null,null,null);t.a=n.exports},"4eef":function(e,t,n){},"523b":function(e,t,n){e.exports=n.p+"img/banner_02.3bb4b40a.png"},"551b":function(e,t,n){},5734:function(e,t,n){"use strict";n("22b9")},"57be":function(e,t,n){e.exports=n.p+"img/banner3.0599ad57.jpeg"},"5df5":function(e,t,n){"use strict";n("ca840")},"60d71":function(e,t,n){"use strict";n("14d9");var i=n("2650"),s=n("4260"),a=n("2f62"),o=n("8c1b"),r=n("7035"),l=n("6ad0");i={name:"EsProduct",components:{EsProductInfo:i.a},props:{item:{type:Object,default:()=>{}},belike:{type:Boolean,default:!1}},data(){return{dialogVisible:!1,currentId:"",keep:!1}},mounted(){this.keep=this.item.isKeep},methods:{onEnterTd(e){this.$Gsap.to(e,{delay:0,duration:.5,scale:1.1,ease:"back.outIn(1.7)"})},onLeave(e){this.$Gsap.to(e,{delay:0,duration:.5,scale:1,ease:"back.outIn(1.7)"})},...Object(a.b)({requestProductDetails:"productDetails/requestProductDetails",requestCollectGoods:"user/requestCollectGoods",requestCollectGoodsDel:"user/requestCollectGoodsDel"}),gotoDetails(){localStorage.setItem("scroll",document.documentElement.scrollTop),this.$Gsap.to(".product",{delay:0,duration:.5,scale:1,ease:"back.outIn(1.7)"}),this.$router.push({name:"productDetails",query:{id:this.item.id}})},buyNow(){this.currentId=this.item.id,this.$nextTick(()=>{this.dialogVisible=!0})},async collect(){if(!Object(r.a)())try{this.keep?(await this.requestCollectGoodsDel({sellerGoodsId:this.item.id,token:localStorage.getItem(o.h)}),l.a.$emit("cancelKeep",this.item.id),this.$message.warning(this.$t("message.home.cancelSuccess"))):(await this.requestCollectGoods({sellerGoodsId:this.item.id,token:localStorage.getItem(o.h)}),l.a.$emit("keepProduct",this.item.id),this.$message.success(this.$t("message.home.collectionSuccess")))}finally{thi
URL: http://tretiktok.com/#/index Model: Joe Sandbox AI	{ "brands": [ "Sequoia" ] }
	{ "brands": [ "Sequoia" ] }
URL: http://tretiktok.com/#/index Model: Joe Sandbox AI	{ "contains_trigger_text": false, "trigger_text": "unknown", "prominent_button_name": "unknown", "text_input_field_labels": "unknown", "pdf_icon_visible": false, "has_visible_captcha": false, "has_urgent_text": false, "has_visible_qrcode": false, "contains_chinese_text": false, "contains_fake_security_alerts": false }

URL: http://tretiktok.com/#/index Model: Joe Sandbox AI	{ "brands": [ "Sequoia" ] }
	{ "brands": [ "Sequoia" ] }

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Tue Jan 14 23:33:55 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9818981519499568
Encrypted:	false
SSDEEP:	48:8udWTSquHaidAKZdA19ehwiZUklqehgy+3:8XTb3y
MD5:	94E20BB0DCC70D23EFF346E396C8B4E6
SHA1:	A25A7586141B4FEC7031988F4188CAC707213975
SHA-256:	4DB7F878472CE4042C224B65217FF6C732FF2A807B4899CF09F93ACC7D6FA74E
SHA-512:	D5BC19F9EC907B9E6623E652E5626F6A16B3C333421725979BAAA3950F76CC343AA4BDE7AB9F4C7AEB903712104C79D7DE44AB5C9C4B321A04C1E66AAEE75AAB
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......(.f..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I/Z:.....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V/Z:.....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V/Z:.....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V/Z:............................"&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V/Z<............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........q........C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 15, 2025 01:33:53.882042885 CET	53	52584	1.1.1.1	192.168.2.5
Jan 15, 2025 01:33:53.955475092 CET	53	60375	1.1.1.1	192.168.2.5
Jan 15, 2025 01:33:54.952930927 CET	53	52413	1.1.1.1	192.168.2.5
Jan 15, 2025 01:33:58.396770954 CET	50720	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:33:58.396888971 CET	63448	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:33:58.542251110 CET	53	50720	1.1.1.1	192.168.2.5
Jan 15, 2025 01:33:58.542289019 CET	53	63448	1.1.1.1	192.168.2.5
Jan 15, 2025 01:33:59.078213930 CET	51131	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:33:59.078676939 CET	59095	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:33:59.091084003 CET	53	59095	1.1.1.1	192.168.2.5
Jan 15, 2025 01:33:59.235346079 CET	53	51131	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:01.592612982 CET	59898	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:34:01.592824936 CET	64188	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:34:01.608933926 CET	53	64188	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:01.634826899 CET	53	59898	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:02.284537077 CET	62755	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:34:02.284857035 CET	63383	53	192.168.2.5	1.1.1.1
Jan 15, 2025 01:34:02.296363115 CET	53	63383	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:02.297034025 CET	53	62755	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:03.417962074 CET	53	61528	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:11.969017029 CET	53	53867	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:31.093060017 CET	53	53596	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:53.737047911 CET	53	56535	1.1.1.1	192.168.2.5
Jan 15, 2025 01:34:53.936126947 CET	53	49537	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 01:34:01.640492916 CET	284	OUT	GET /js/app.e69ee347.js HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:02.626974106 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:02 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"1381427-1732701439327" Last-Modified: Wed, 27 Nov 2024 09:57:19 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 38 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 93 e3 48 8e 28 f8 57 b2 b5 66 35 19 a6 a8 e0 7d 65 4d 4c 1b 49 1d d4 4d 89 ba eb 95 b5 f1 3e c4 43 e2 2d 56 e5 fe f6 85 53 11 21 65 56 76 75 bf dd 99 2f 6b af ba 95 12 e8 70 38 1c 0e 87 c3 9d 70 c4 df 9c 22 36 73 3f 89 3f db 4f bf bf ff fe a4 7f d6 01 4a d2 cf a5 9e 7e f2 9f d3 e7 ec 55 ff 15 ff ed 39 84 2f e2 b7 67 0b be c8 df 9e cd 57 fc 39 7a fd f5 b7 5f cc ff cc 5e 42 3b 76 73 ef 17 b3 db 7d 4a 5f b3 5f cd df 9e 17 46 60 9b f9 cb 39 4d f2 24 bf 9e ed 17 4f cf 16 55 ac a6 c9 d9 4e f3 eb 8b a9 87 e1 e7 fc 39 7d fa e9 a7 fc d7 f4 b7 9f 7e 8a 5e ce 45 e6 7d 46 00 34 f6 f4 8c 7e bc e2 bf 20 3e fc 4f 7e fc 29 7c fa b7 48 86 cf 3e 90 fc 6c ff ea ff f6 1a c2 3f 4f 2d 85 e2 a7 9f 0a e8 d5 2f d1 3b a7 4f d1 4b e6 f9 4e fe f9 e9 f3 d3 2f a9 9d 17 69 fc 29 69 39 78 d1 cf e7 f0 fa 39 79 b6 fe f8 e3 57 e0 23 fe fc f4 f5 43 34 00 7c 48 c6 7e d6 81 3f fd 3f 93 77 9a 3a f4 fe a3 34 7e 4d 7e d5 7f 7b f6 5f ff 86 3f a7 af c4 2f e9 7f c6 ef 78 29 c2 43 b2 0d [TRUNCATED] Data Ascii: 8000iH(Wf5}eMLIM>C-VS!eVvu/kp8p"6s??OJ~U9/gW9z_^B;vs}J__F`9M$OUN9}~^E}F4~ >O~)\|H>l?O-/;OKN/i)i9x9yW#C4\|H~??w:4~M~{_?/x)C_c/^__Cg@'+yo~&sA78}?~%h\|>"}`?>97Ig_~h/oDnOO_QP:TW@_n~d~+8i/#F7G<-,?<b( iyxD,HyaMat,d'(GZ3cQ-8g1#wi8n96!dZ=E#,?eA'o$nQ#_A?in<"S$R)>>9`qaiGI84eiQk!LF^a,ms$'8-2:3"gA0[ad+?klWE~f17`R<eXwT?n\v<):0]B{nqe,`q5j4QtGeN0
Jan 15, 2025 01:34:02.627140999 CET	1236	IN	Data Raw: 4c af 3f 97 dd a7 5e 87 a3 75 8a b3 05 f3 4e 13 e6 2e 4d 1b 3f a4 79 9f 9f 1d de 01 3c 81 20 3e ea dd 27 6a 87 66 09 53 b7 99 7b 1f 38 5a 20 59 81 83 d1 f9 01 2f 1f b3 b9 c3 f1 04 a7 1b fa 5d 66 f7 69 dd b1 68 dc 74 04 fb 5e 76 9f df 1d 8b c3 39 Data Ascii: L?^uN.M?y< >'jfS{8Z Y/]fiht^v9^3Mp6QFe(O\pNn:SG11s*t}CCPQvew!p~a9:&wH}#Gt86[.
Jan 15, 2025 01:34:02.627160072 CET	1236	IN	Data Raw: 63 3d 8c fb 83 23 01 5e 11 61 e0 e6 7d 8c 1e 1c 09 1b d4 8c 22 c9 07 5d fa d8 dc 00 9f 0e 25 50 c4 bd 0f 0f 8e 04 0c 11 41 9b fc 5d 66 0f 8e 04 78 18 ac cd 3a 0f 4e c6 c7 be a7 a3 03 2b 34 2e 3c 94 7d 6c 80 3a e0 63 e0 06 e5 3c e8 e0 dd 91 e0 69 Data Ascii: c=#^a}"]%PA]fx:N+4.<}l:c<iDPG;G,p$BH~NO>I>,\qqfhf)?'OAnW20\];Y\4xq2U}agb\|Gk#
Jan 15, 2025 01:34:02.627172947 CET	1236	IN	Data Raw: b7 39 8b 77 78 c2 4c 72 ae e0 dd 5e 52 2a 7e b6 1a 97 1c 17 ed bb f2 e4 b4 c4 4f 58 3f 4b 98 d5 65 d6 35 f2 6a bc 1a 93 72 61 b3 ca 2e dc a5 a3 32 1d ce 96 2b 83 1d 60 ab 32 e3 b9 d4 1c f8 f4 68 b6 d8 f6 87 fe f2 52 2c 2e c3 42 52 2f 13 d6 56 18 Data Ascii: 9wxLr^R~OX?Ke5jra.2+`2hR,.BR/VAP\^ My\bp1k3hmHN$}G3g]Gf/*r_o2]FD?2~HD~nDv]f=xu\.[om&<\/$Zb.%7t$
Jan 15, 2025 01:34:02.627191067 CET	1236	IN	Data Raw: a4 d9 6f 46 2b d9 c3 62 d7 a5 26 cc 82 ec 5e 25 9c 0a fc dd 7c cf 76 19 c6 ed b2 d8 4c 99 51 8b 66 c6 ae 58 dc 5d 70 6b 86 33 e4 35 3f 3a 1d 6c 2c 28 2c 75 21 c0 f2 50 1e c3 e5 f0 64 fa 1b 72 15 51 ee 79 5c b3 f4 8e 3a c6 43 12 0e 37 d6 bc a0 d7 Data Ascii: oF+b&^%\|vLQfX]pk35?:l,(,u!PdrQy\:C7pfNd'k*\|uE}I_vfW6blZ8$8\VZYTY'q<:d5&=;Xe;[;D'cgb?Zn.Sn>K)1_MkVj
Jan 15, 2025 01:34:02.627202988 CET	1236	IN	Data Raw: d7 75 5f 5f 5b 83 ca d2 10 2c f4 6f ec bc 33 2f 39 b7 fb 6e 8b b2 75 9d 63 e1 94 e1 6d ef 2e f0 ff 1e 85 b6 b6 c9 5b 26 61 98 cc 47 6d 08 7d f9 73 fb 9d 22 b3 3f a1 d3 24 38 de fa 05 ce 33 51 c4 dd db eb c4 cf 1d 1b 27 e0 cc 01 c2 d4 20 c8 0d 0e Data Ascii: u__[,o3/9nucm.[&aGm}s"?$83Q' CN_d_Zl&aN?=@+)tO'BDA9Zg^>Qg_0LzIR#e$^?zMgF/D/<`
Jan 15, 2025 01:34:02.627214909 CET	1236	IN	Data Raw: 0c 21 4e 06 bc 35 04 03 39 a4 00 04 a0 01 78 b3 c2 10 c0 81 20 16 bf 0d 30 58 eb 1b 6d c4 3c a8 03 a8 5d 5b 4c 50 6d 65 f0 1a 80 26 82 d9 b6 1c 8c 5b eb 56 82 9a df ca 79 16 44 fd a3 72 e4 40 72 e0 35 81 52 32 60 a4 d8 9b 92 e2 30 49 60 e9 80 c0 Data Ascii: !N59x 0Xm<][LPme&[VyDr@r5R2`0I`}T8EK37+TrPb$znh0ThD@5.##4(]TNzn='40fIUoV@Cxx0Q'p#MiQmY`[VkaD(
Jan 15, 2025 01:34:02.627228022 CET	1236	IN	Data Raw: a9 00 5f 03 de 53 d6 fb c8 55 e1 9d 6a 3a 4e 6a a8 0f af ff c2 86 2b 8a 4a e7 3c b1 d6 ad 44 c8 dd a4 eb 85 9e 31 bc 48 47 cd 1a cb 17 af 5f 6e 2f f0 de b3 70 83 32 af f6 fb 4b 65 58 b9 c4 e1 95 18 75 c3 55 e3 a7 22 81 6d c4 4b 72 f2 22 f7 7c c0 Data Ascii: _SUj:Nj+J<D1HG_n/p2KeXuU"mKr"\|r;%VEt(FriZjJ];YV=;pYFpZor9I=]}}]tOw"4knY#d3mSbdr]Kk-N.jnMlN@,=-
Jan 15, 2025 01:34:02.627239943 CET	1236	IN	Data Raw: c6 5a 70 8b 83 38 71 69 46 5a 79 ab b8 3f 13 c7 78 c5 1b 0e 04 b5 0d 34 34 3f fe 14 01 61 c1 ad 98 ff e9 08 88 c5 47 04 84 a2 8e 20 e4 68 22 f7 f4 f1 8a 82 4f b3 87 c8 02 f8 e6 10 7c bc 3d 43 cf 29 73 ec bd 3d f3 b8 3d c0 fb 91 14 ec 27 f0 41 41 Data Ascii: Zp8qiFZy?x44?aG h"O\|=C)s=='AA-.w"ZXB8l~[Cup#\|gul/++,\y)2DxNQ/\]U:WJAh'4x^/YJ1^-q42My{M
Jan 15, 2025 01:34:02.627250910 CET	1236	IN	Data Raw: e8 f1 b9 c9 dd 38 43 cf bf 23 07 09 92 6e 16 67 66 14 57 0c fd f3 d8 63 c6 ba 11 6c 0b 1f 0a 58 94 bd 0a b5 d4 16 7c 47 92 31 db d4 36 50 68 e7 7a 2b 87 f7 1f 0f 14 20 f8 e3 36 10 1f 48 8f e4 59 fd a6 b1 1f 85 df 35 01 41 44 37 53 a5 cd 7e 86 30 Data Ascii: 8C#ngfWclX\|G16Phz+ 6HY5AD7S~0;G:=?#=vd0?v0exzl%nG_w9f+fVocs+yM;y+4iQEsmis#2:)\|:9{?=x jC+= KB;L
Jan 15, 2025 01:34:02.627264023 CET	1236	IN	Data Raw: da 2b 1b aa 07 17 43 e1 06 20 d3 53 4f 70 b8 b8 1c 63 2a c5 76 b1 64 dc 2d 47 53 19 6b e0 8d 4d 43 c0 35 18 06 9d 36 f5 3e de d0 84 d6 7a df 4f 46 55 5f dc 2f fd ab ec ed 66 8a 5d 90 cc 0e ee 71 51 ce 40 8a 44 ff 98 51 0b b3 21 0d 4d 70 07 03 26 Data Ascii: +C SOpc*vd-GSkMC56>zOFU_/f]qQ@DQ!Mp&/]s3+}E5?"#oc>7Z`bIQ^\|}i"p..A([gqb(N6+)an7uG!\qn:q:>Yd\lf3.
Jan 15, 2025 01:34:02.825664043 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:02 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"1381427-1732701439327" Last-Modified: Wed, 27 Nov 2024 09:57:19 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 38 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 93 e3 48 8e 28 f8 57 b2 b5 66 35 19 a6 a8 e0 7d 65 4d 4c 1b 49 1d d4 4d 89 ba eb 95 b5 f1 3e c4 43 e2 2d 56 e5 fe f6 85 53 11 21 65 56 76 75 bf dd 99 2f 6b af ba 95 12 e8 70 38 1c 0e 87 c3 9d 70 c4 df 9c 22 36 73 3f 89 3f db 4f bf bf ff fe a4 7f d6 01 4a d2 cf a5 9e 7e f2 9f d3 e7 ec 55 ff 15 ff ed 39 84 2f e2 b7 67 0b be c8 df 9e cd 57 fc 39 7a fd f5 b7 5f cc ff cc 5e 42 3b 76 73 ef 17 b3 db 7d 4a 5f b3 5f cd df 9e 17 46 60 9b f9 cb 39 4d f2 24 bf 9e ed 17 4f cf 16 55 ac a6 c9 d9 4e f3 eb 8b a9 87 e1 e7 fc 39 7d fa e9 a7 fc d7 f4 b7 9f 7e 8a 5e ce 45 e6 7d 46 00 34 f6 f4 8c 7e bc e2 bf 20 3e fc 4f 7e fc 29 7c fa b7 48 86 cf 3e 90 fc 6c ff ea ff f6 1a c2 3f 4f 2d 85 e2 a7 9f 0a e8 d5 2f d1 3b a7 4f d1 4b e6 f9 4e fe f9 e9 f3 d3 2f a9 9d 17 69 fc 29 69 39 78 d1 cf e7 f0 fa 39 79 b6 fe f8 e3 57 e0 23 fe fc f4 f5 43 34 00 7c 48 c6 7e d6 81 3f fd 3f 93 77 9a 3a f4 fe a3 34 7e 4d 7e d5 7f 7b f6 5f ff 86 3f a7 af c4 2f e9 7f c6 ef 78 29 c2 43 b2 0d [TRUNCATED] Data Ascii: 8000iH(Wf5}eMLIM>C-VS!eVvu/kp8p"6s??OJ~U9/gW9z_^B;vs}J__F`9M$OUN9}~^E}F4~ >O~)\|H>l?O-/;OKN/i)i9x9yW#C4\|H~??w:4~M~{_?/x)C_c/^__Cg@'+yo~&sA78}?~%h\|>"}`?>97Ig_~h/oDnOO_QP:TW@_n~d~+8i/#F7G<-,?<b( iyxD,HyaMat,d'(GZ3cQ-8g1#wi8n96!dZ=E#,?eA'o$nQ#_A?in<"S$R)>>9`qaiGI84eiQk!LF^a,ms$'8-2:3"gA0[ad+?klWE~f17`R<eXwT?n\v<):0]B{nqe,`q5j4QtGeN0
Jan 15, 2025 01:34:03.769727945 CET	291	OUT	GET /img/shoplogo.5dba109d.svg HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:04.021801949 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:03 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"11714-1732543590681" Last-Modified: Mon, 25 Nov 2024 14:06:30 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 31 33 37 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 9a 4b af dc c6 11 85 f7 f9 15 83 c9 26 01 ee 50 fd 7e 04 be 36 a4 b1 b4 f3 2e d9 78 67 c4 b2 24 40 96 0c 49 b0 f2 f3 f3 9d 6a 92 43 cd 25 03 44 86 a5 61 b1 d9 ec ae c7 a9 53 d5 fc ee 87 ff fc fe fe f4 e7 eb 4f 9f df 7d fc f0 78 f6 93 3b 9f 5e 7f f8 f7 c7 5f df 7d 78 f3 78 fe d7 3f 5f 5d da f9 87 ef ff f2 dd e7 3f df 6c 47 f9 f3 89 e7 3e 7c 7e 3c bf fd f2 e5 8f 7f 3c 7b f6 f5 eb d7 e9 6b 9c 3e 7e 7a f3 2c 38 e7 9e 31 fe 7c fa fa ee d7 2f 6f 1f cf 08 ce a7 b7 af df bd 79 fb e5 f1 5c dd 99 e9 fe f8 e5 cb db d3 af 8f e7 9f dc c9 9d ae 7e 8a 35 bb 14 7d 3e b9 c9 f9 5a 73 6b e5 14 26 84 2e 87 9e 24 8d 2d 85 ec f2 29 4d 3e d8 b0 c2 3f d7 32 f1 32 ef 73 b5 31 12 d5 a9 d5 9c 7c ce 51 92 94 4a 0c bd 9c 3a 73 d9 9b c2 f6 f1 bb ab 68 f7 50 81 4d ed b9 ec b5 f5 ec 23 4b 69 39 34 56 d8 4e 88 83 6b a5 f8 58 59 4b 49 b9 c5 ea 4d ec 79 f1 a9 4c 89 bd 8c a7 6b 4b b5 e4 c2 92 92 4f c5 f5 f1 b4 2f 3d e5 e8 c3 a9 4d b1 7b 9e 65 b8 9e 2e ce 67 bd b8 23 6e b7 49 52 cb 39 [TRUNCATED] Data Ascii: 137dK&P~6.xg$@IjC%DaSO}x;^_}xx?_]?lG>\|~<<{k>~z,81\|/oy\~5}>Zsk&.$-)M>?22s1\|QJ:shPM#Ki94VNkXYKIMyLkKO/=M{e.g#nIR9~n(6XsiToGYG?>OV+ur1QgLg^P\|2zc'<M#;>!c?]$TZ\|K^r<c6lMx}4y.=/YZbN4mSj8)a:1qxZcYQ"TkKkibyoc5\GT_p{_L"pEIkR\|?iO+BA2srbc=eb#MJaQr:`DlCz.\kC$J,FefFd^})y"c\ZksTw<}m6he?~lm=:#0^3@+7+SNK\qSj[enf\|l_>\|/_^W+N'VZTkF@bxc@y8_,!BuE

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 01:34:02.032066107 CET	292	OUT	GET /js/vendors~app.e68c9730.js HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:02.826014996 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:02 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"3556889-1731384874000" Last-Modified: Tue, 12 Nov 2024 04:14:34 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cc bd 6b 93 5c d7 79 df fb 3e 9f 62 a6 23 c1 dd 9c 3d 8d ee 01 40 00 3d b3 39 05 10 a0 48 1b 43 f0 00 b0 68 79 34 ee ec e9 de 33 b3 89 9e de cd be 00 18 0c 26 25 c9 91 4c cb 51 72 9c 54 62 27 c7 27 29 95 2f 52 2c cb 96 4d d0 b1 24 cb aa 0a be 00 69 bd 01 df a1 4e 22 e6 f8 5b 9c df ff 59 6b 5f fa 32 20 24 cb 55 87 45 4c ef bd f6 ba af 67 3d eb 59 cf b5 7a 3f e9 77 d3 fb f5 fb f1 ee 20 ea dc fd e5 51 da 1f 84 0b d2 1e 3d da de a9 d5 07 93 d1 41 75 7b bb 72 2f a6 d0 70 f4 2f a3 c1 a0 b2 13 1c 57 1a 8d f3 2f 57 5a 7b 93 7e 67 9c a4 fd 6a 1c 8c 83 7e ed f8 5e 34 5c 4a c2 7e b5 f2 72 f7 d2 6e a5 16 a4 61 52 8f a3 ce 41 30 e4 a1 33 8c a3 71 fc 7a 34 3a d8 8a 06 41 14 56 2d e7 f9 bd 4b 17 c8 c9 d3 b9 73 8d 66 a5 56 5b ef ab d0 83 31 0d 56 8f c7 47 83 b8 55 19 c5 c3 24 1e d5 07 d1 30 ea f5 e2 5e 25 e8 c6 03 3e c7 fd 0e c9 ad ed 4a fe 61 27 b8 97 8c 26 51 ef d5 b4 97 0e af 74 3a f1 68 f4 56 34 3e 68 55 7a 49 3f be 3d 3e ea c5 f5 8e 3e 55 82 fd 78 fc 46 3f 19 27 [TRUNCATED] Data Ascii: 4000k\y>b#=@=9HChy43&%LQrTb'')/R,M$iN"[Yk_2 $UELg=Yz?w Q=Au{r/p/W/WZ{~gj~^4\J~rnaRA03qz4:AV-KsfV[1VGU$0^%>Ja'&Qt:hV4>hUzI?=>>UxF?'QZ4`tA2v:vjm}'>;:=Ixf=b`EROE_Mi?EOD_7F_;s:S5SYM0o-wa<EBJPG<j'Pk'[}MGWX{KTnNIF0IIMVTm_8Hkq3ge}R 9aIo\|s Hk?^<l]jf8Z]IHl7Uo\SA7IHjigK >Dd:i$!HsF0:LSj[nQ?94;Pz>1qhc+]\}M5[;sy!N}t*V.;O; 3-6o}~2-ma4fbt2aUyzS^p@8vb\402ec rc{C$\mmqJ/<8UV'I\|C0cwGt
Jan 15, 2025 01:34:02.826024055 CET	224	IN	Data Raw: ec 76 70 cf bd b8 ea bb 26 e8 b9 21 40 aa 04 cb 8d 5a b0 3c a8 ad 0f ce 9c 71 35 0d 6d 22 ae fb f2 6c ba c1 76 63 27 98 04 dd 80 c1 39 44 58 4d 19 75 7c ff 2d cd df 8d 64 34 2e ed 08 f6 83 d0 e7 88 01 d9 f4 d2 c7 7e 7c 7f 69 58 ff 9c a6 70 7d 50 Data Ascii: vp&!@Z<q5m"lvc'9DXMu\|-d4.~\|iXp}PO^KvUf_`'^:S>VAZ\Md7{O}>Mp[8QUv#hvsgs9^XhQ[uTWGZVe+ jV
Jan 15, 2025 01:34:02.826034069 CET	1236	IN	Data Raw: c1 11 0f cd 9d b3 6b 81 60 a1 35 32 90 b0 e7 cf c7 c3 71 d2 89 7a b6 c8 ad ca 61 d2 ed f6 00 4a 7d 72 49 3d 7b 16 b0 b4 22 f7 98 f4 7a ad 4e be 8b 2b e9 64 7c 73 ef 56 d4 df 8f d5 68 ba 59 bf d0 6a b2 f7 40 3d b1 f5 72 00 1a 72 28 33 78 de 42 37 Data Ascii: k`52qzaJ}rI={"zN+d\|sVhYj@=rr(3xB7wO l:9I:0HGOi`vIgNDX8gXSC6<G1A4vxsqV~_gWV9w!=*mrNF\|\+Z)
Jan 15, 2025 01:34:02.826045036 CET	1236	IN	Data Raw: a3 01 3d 76 db c3 93 dd 19 75 30 75 ed 6d 04 19 05 db 12 91 0d f5 70 e2 ae e0 02 8c ec 1a ae 0e f7 f7 b9 09 af f1 94 f1 68 8a bb f6 d4 fd 9a 1b bb ae 20 ee a6 b0 0b 04 c7 43 23 30 5a 95 7f be b7 b7 57 61 88 4a 7a db 5d d3 4f bd 8d 37 4e f8 af 7c Data Ascii: =vu0umph C#0ZWaJz]O7N\|~^z~r8i='Scxj+:23'nAvG?aC%c2$=LV 4n7Wy~-8ZhwH}t'}+Mk\#)9@g\y@Wuaoq>/4`Ak\A9A2op
Jan 15, 2025 01:34:02.826054096 CET	1236	IN	Data Raw: 54 cf 00 6e 18 dd bf 93 f5 40 5c 67 c9 9d f2 2e a9 92 a8 d7 99 30 25 71 9e cb b8 bf 46 47 05 48 da b8 87 42 b2 c4 1d 09 ca 46 a5 4c ae 59 fa 81 18 4b f8 b1 06 2b 83 1e f0 57 05 dc 4d b4 a8 32 eb cd 5c ba 13 76 19 c8 4f ad 82 bf 16 b9 f1 17 bb c0 Data Ascii: Tn@\g.0%qFGHBFLYK+WM2\vOBNuJ]='Y%,P8mAYy<r+R[qibNfl8@to)`- ="7U+8's&o+ mTJ}\|9i\|'B()#.\|
Jan 15, 2025 01:34:02.826064110 CET	1236	IN	Data Raw: 7d 66 3e a7 8a 32 ff 40 ca b7 ac 7f 53 1f 5c 76 1a b3 d4 b9 6f 2c e6 fb 56 21 8d d1 76 96 cf 20 88 1e fd b5 55 38 fb 61 21 c3 c6 f3 7a 8a e1 19 40 4c 0f e9 83 bf 23 69 6a 18 bc 67 5d ff e0 87 bc cc 74 f7 2b 2e 69 aa 97 45 b7 16 f6 c3 18 47 ae 17 Data Ascii: }f>2@S\vo,V!v U8a!z@L#ijg]t+.iEG}oj_TJKn[zKTJL\q'(X2.=={s+.S[\|,lNRo2h~iW\U/k4_UeL'~1=8:8"<l;
Jan 15, 2025 01:34:02.826072931 CET	1236	IN	Data Raw: ef 9c 4d 86 a2 74 a5 96 d8 5b 7f c3 a6 05 15 e5 04 64 39 09 92 d1 67 2c c6 93 53 88 e5 24 68 c2 ac 46 b7 4f 33 b9 a8 df b6 12 8d 66 35 79 d0 ce 65 a4 19 ac 9b a4 d4 67 72 d3 93 93 7a fe 55 52 83 a3 9b 7b 5b d2 5e b8 69 46 43 3d 4f ed 7d b1 7b dc Data Ascii: Mt[d9g,S$hFO3f5yegrzUR{[^iFC=O}{N69}U^HzZguLdL:rHRjrx6c;Tyz65rWdh:CPGu\'nGDmGTd;''1F8k3UC
Jan 15, 2025 01:34:02.826083899 CET	1236	IN	Data Raw: 35 69 e8 57 29 a1 96 0c 68 18 4e b9 84 df 5b d7 1f 5d ad 6d bc 69 d0 f2 d6 fc de ba ce 28 47 40 b6 fa 15 3c 08 de 0e 34 ef f9 fe 7a 7b 35 bc ce 9c bb e9 b9 5e 4c 0f 8f b7 c3 eb a7 4f 8f 07 9b 99 21 14 0b e7 7b bf a0 d7 2a a9 3d 7f 95 a5 17 36 be Data Ascii: 5iW)hN[]mi(G@<4z{5^LO!{*=6]n_7Vy~!1[W~zt0-7niMm7wnvIa&Q!5y3'b5MbsC[48&78lp@?zZ+}Qs^q<\|N
Jan 15, 2025 01:34:02.826092958 CET	1236	IN	Data Raw: b1 cf 67 01 77 c7 b2 df 3b 1a da fb 92 ab d6 ec 91 10 8d ea cf a1 fe e9 0f 6c f6 32 fe 92 b1 51 1f 23 23 fe e9 cf 96 fe e9 8f 64 c7 e8 3e c8 7c f7 f9 6c f0 2f d6 a7 38 e0 f5 79 de f7 f9 05 32 f4 0b 7b 17 e6 c9 94 fc cc be 18 61 89 e4 cf ec 78 af Data Ascii: gw;l2Q##d>\|l/8y2{axqIViL?X_Kr(sr~oM/_x^o.]\PxRQ3^]^}nk83w"!<a] iW~<l>7\0R44U?=}b4S
Jan 15, 2025 01:34:02.826103926 CET	1000	IN	Data Raw: c0 30 b6 42 6f 84 63 9b 13 f8 0d e1 bb db d5 b7 00 41 98 95 ab 2a a5 8e 42 3f d8 d9 74 2b 04 6d 59 55 67 d3 e0 a1 52 ae b1 62 b8 04 79 95 1f f1 32 30 90 6e f5 25 1a 7c d3 56 72 6d a3 bf 49 e7 5b 7d c9 28 af 5b d2 b9 3c 09 61 e4 bd 5a b7 9a 2d c2 Data Ascii: 0BocA*B?t+mYUgRby20n%\|VrmI[}([<aZ-KB?,e+$\j &nvsCq7[NN&Cz3y>j3&J8fJQM{a~ofW}kCG.#\|:s^qW`I
Jan 15, 2025 01:34:02.830987930 CET	1236	IN	Data Raw: eb fa 0d 20 4b ae f4 35 c5 53 c8 47 8c 9a 4a b6 7c 5c ff 32 ef 1b ec 54 ec 30 84 d5 70 12 a1 35 71 04 77 02 f7 8f 1b 11 5e c0 47 de 9f 99 2d 31 d6 e0 9b c7 e6 3a 0f 43 23 9c 74 e0 07 99 67 96 1e f7 62 f6 88 67 4b db 54 db b8 9e 1d 8f f5 25 9b 8c Data Ascii: K5SGJ\|\2T0p5qw^G-1:C#tgbgKT%zSrhn.GUCXq]xGWH\_c}\|.3\| oS:XrVQ,m8(2/e=`Sw^4
Jan 15, 2025 01:34:04.617103100 CET	287	OUT	GET /img/logo.4c830710.svg HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:04.873157024 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:04 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"2975-1732697222898" Last-Modified: Wed, 27 Nov 2024 08:47:02 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 34 39 37 0d 0a 1f 8b 08 00 00 00 00 00 00 03 9d 56 db 6e 22 47 10 7d df af e8 4c 5e f1 4c df a6 2f b6 f1 4a 61 37 ab 95 72 71 14 6f a2 e4 8d 85 01 46 c1 80 60 d6 f6 e6 eb 73 aa ba 07 03 b6 94 90 17 ab 8f a7 ba 2e a7 4e 55 73 fd f6 e9 7e 29 1e 9a ed ae 5d af 86 85 2a 65 21 9a d5 64 3d 6d 57 f3 61 f1 e9 ee fb 8b 50 bc bd 79 73 fd cd bb 9f 47 77 7f dc be 17 bb 87 b9 b8 fd f4 dd 0f 1f 47 a2 b8 a8 aa df cd a8 aa de dd bd 13 bf fe f6 41 a8 52 55 d5 fb 9f 0a 51 2c ba 6e 73 59 55 8f 8f 8f e5 a3 29 d7 db 79 f5 61 3b de 2c da c9 ae 82 61 45 86 b8 54 c1 99 52 e5 b4 9b 16 08 41 9e 91 cc 6a 37 7c e5 ba 96 52 92 79 71 98 ab 2a c4 63 3b ed 16 c3 c2 d8 cd 53 21 16 4d 3b 5f 74 3d da 75 5f 97 cd b0 d8 2d c6 9b e6 62 db ac a6 cd 16 45 5d ce 9b f5 7d d3 6d db c9 ed b6 99 b4 54 f6 95 e8 9a a7 ee 5f 4c da fb f1 fc d0 cd 7a d3 b5 f7 ed df cd 2f 5f c6 cb b6 fb 7a 25 66 ed 72 79 b1 fd b2 6c 2e 9b 87 66 b5 9e 4e af c4 64 d9 6e 8e fe 55 a4 02 2f 9f 96 ed ea af d7 ca 54 31 c6 8a bf 12 23 f3 9b eb cd b8 5b 88 5c c9 7a 33 9e 20 [TRUNCATED] Data Ascii: 497Vn"G}L^L/Ja7rqoF`s.NUs~)]e!d=mWaPysGwGARUQ,nsYU)ya;,aETRAj7\|Ryqc;S!M;_t=u_-bE]}mT_Lz/_z%fryl.fNdnU/T1#[\z3 %`[icae=?b$,1&AKOl5\|dH2xe,j_d,m.pU. "6~BE#4LG9yseiRxRErGirrSG0,3@Y-Hq--dU(8&hG){u2#D70s/jdai fLk\|p.mZYKE"j++}3V/Tm"k(nWlFX<&CDX[jDQdVI^Ys(\|jf&H1Q{"@O9#Y!uP{G9\.,O$A4Z5TIEJ!r!iK[AWRlR3xJ`}}m;Q-K%\|]VCg#<D&C1i,bOJ#.DWQ9K-Q&3<S$>}'bx4Ngw
Jan 15, 2025 01:34:05.400160074 CET	292	OUT	GET /img/banner_01.0c05748f.png HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:05.657073021 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:05 GMT Content-Type: image/png Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"90989-1731384874000" Last-Modified: Tue, 12 Nov 2024 04:14:34 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 34 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 00 65 40 9a bf 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 04 b0 00 00 01 60 08 03 00 00 00 9c f9 70 75 00 00 03 00 50 4c 54 45 f8 da c2 e4 bd 9a e5 bf 9d d3 ab 99 f6 d8 bf e3 bb 97 e9 c3 a3 e1 b8 93 de b4 8e f8 da c1 d6 a2 7b e7 c1 a0 ec c9 aa ea c6 a7 eb c7 a9 f5 d6 bd ec c9 ad ee cb ad f8 db c4 ef cc b0 e3 ab 89 fb fb fb f0 ce b2 f4 d5 bb f2 d2 b7 f3 d4 ba f3 d2 b9 ef cd b2 15 15 15 f0 cf b5 f1 d0 b6 f1 d0 b4 f1 b0 89 fb bd 66 ff bb 01 ff be 03 f3 bd 96 fe cb 96 f3 bf ac f4 c2 b0 fb ca 90 f3 bc a9 ff b8 02 f5 ca bb fe b8 78 f4 ce bf f4 d2 c5 f7 c6 b7 fe c0 86 f3 ba a3 fe d0 9f 1f 16 13 fe cf 99 fe c0 80 f4 c5 b3 fe bb 7e 1b 1a 1b fe c7 8f 13 13 10 ef b0 9a fe b1 72 df 87 6f fd ad 6c d9 80 67 ee ac 95 f2 b5 9f d4 7c 62 ed a2 8f e2 98 80 ce 73 59 fe c5 88 fc f4 ee c8 6e 55 ec a9 90 f9 e8 e2 11 16 1b d0 78 5e ee ee ef f9 d8 cf e8 98 80 e1 8d 74 fe c4 8d ea 9d 86 f9 cb be e5 9f 88 fb f0 ea c1 69 51 fd a7 65 fb ec e6 f2 c7 b9 f9 cf c4 d9 87 6b [TRUNCATED] Data Ascii: 4000e@PNGIHDR`puPLTE{fx~rolg\|bsYnUx^tiQekI4uO#aJ_\|;'P=$z+&%y-\+D2_Gi0 kWsZ?R<>SRPA@>QdGKHFZB3.+s6\|dI=&{\[Z\?M0wW[<1w=r>1L2;64,lM@K>$SEV4p_0yO@D%.r<eedq\xP`!gLAs`zOiam-Q\|st\|meTunkO'icUIz[QcdM5yyx;Sg,\L_'M,fWF~28^zZqfpgwp:PQ#?/{jjOKd`a`(IDATxpVU6%{KnTxI@$1@$/1:!.&&!*Q$4P

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 01:34:02.827991962 CET	295	OUT	GET /js/chunk-ff2fdb80.373c9e7c.js HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:03.627921104 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:03 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"13681-1731384874000" Last-Modified: Tue, 12 Nov 2024 04:14:34 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 31 31 37 65 0d 0a 1f 8b 08 00 00 00 00 00 00 03 cd 5b 5b 6f e3 48 76 fe 2b 72 c1 10 c8 34 c5 96 3c d3 3d b3 f4 72 8c 9e be 04 de cc 74 37 e0 de 09 10 41 99 2d 91 25 ab d6 14 a9 25 4b 76 7b 65 3d e4 25 bf 20 f9 1b 79 09 90 97 fc 9e 45 f2 33 f2 9d ba 90 94 44 f9 d2 49 07 fb 62 f3 52 55 3c e7 d4 b9 7e a7 e4 dd c8 3c 2d 6e c2 1b 31 5d f2 e4 ea 77 55 91 2f e3 8e 67 77 77 e3 89 1f 2e 57 d5 dc 1b 8f 59 32 5f e5 57 83 d9 ec 64 96 4e bf 1f b2 49 b0 3e 79 f9 62 18 cd 56 79 a2 64 91 7b 2a 10 41 e5 af d9 aa 12 bd 4a 95 32 51 ec b4 f2 d8 e8 db f4 37 cc 3f bd e6 65 4f c6 b8 3f 99 bd 3c 61 7e c0 e9 fa fb 64 34 c5 75 49 d7 df 0d bf 79 81 eb 82 ae bf 3d 79 39 c4 75 46 d7 2f 79 4a d7 39 5d 4f bf 7d f9 0d d6 c2 15 1f bd 4c f4 d3 75 ce 17 22 62 6f ab 8f 65 91 ae 34 25 e7 f9 ac 60 c1 b2 2c 96 55 b4 96 69 b4 56 b7 4b 11 5d 80 a4 fc 32 48 c5 8c af 32 15 b1 21 db 6c 82 a4 58 2c 8b 5c e4 0a 23 af 57 e2 e3 bc 50 c5 3f 14 c5 02 8b 45 79 98 04 e7 8b 4b ba 15 25 ee a6 74 f7 b1 14 d7 52 dc e0 96 6f 82 94 2b ee f9 eb 52 a8 55 99 [TRUNCATED] Data Ascii: 117e[[oHv+r4<=rt7A-%%Kv{e=% yE3DIbRU<~<-n1]wU/gww.WY2_WdNI>ybVyd{AJ2Q7?eO?<a~d4uIy=y9uF/yJ9]O}Lu"boe4%`,UiVK]2H2!lX,\#WP?EyK%tRo+RUC'yD3dUy0nRDbH/2:Q!h4JFTaO3,c:GGM<EkE,Y&y>Q/!/b=Tdre#nJ_d%2/6v}3^UOkAWh,d>](R57LQ^D +xKY.R&/+9'P6m'2A'YA1c3m?'2!oYAo F>uOo2(o,0f94u<2uj5gE8=x/$J.De7x{/WPXJkP%XDCj,7Lf.#?t-._f'\|1L:nzvNFKU{:b;Tw*$'Lj{O5+<gkMi
Jan 15, 2025 01:34:03.628000021 CET	1236	IN	Data Raw: 8c c6 2a e4 58 fb 3c 9d 80 02 ba fa 85 67 2b 51 8d 87 93 e6 ee 3c 85 d2 99 99 42 9b cf 7b f8 d4 57 79 0a f3 38 4f 3d 28 87 7e e7 94 3f 26 07 93 0a b1 24 ed 97 8b 85 48 25 57 30 cd 21 44 ca ab db 3c e9 2d 68 f3 05 66 ae e5 cc ab 44 55 c1 2d 5d a8 Data Ascii: *X<g+Q<B{Wy8O=(~?&$H%W0!D<-hfDU-]":9 8icf1LmgE37W5y2P5r"KeLm[@rdh<<FcDd@lu(S<W\KSoOYB[r
Jan 15, 2025 01:34:03.628010035 CET	448	IN	Data Raw: e6 fe b0 a4 b8 16 25 8a 57 53 30 76 e6 07 de 78 ad 34 e4 d0 25 0a 4a a4 0d e3 1a 8a 18 7b 14 2b df 20 9d f6 43 b8 c0 4f a8 da 3d 7f 62 25 93 65 ba fe c2 36 a7 f0 53 25 aa 53 5d 85 01 20 d1 53 eb f8 bc 2d 6d 33 f9 13 81 08 86 02 24 6c 84 77 a0 06 Data Ascii: %WS0vx4%J{+ CO=b%e6S%S] S-m3$lw8(<<%g0XEH1l0)uD4"{r/3c 16"\|hfP2zc7a>~n?\| s`cX?mZni\ONdGVG0jD5i(a
Jan 15, 2025 01:34:03.628021955 CET	1236	IN	Data Raw: 4e c5 44 9c 1d 93 24 2c 08 01 b0 5b 51 2a 02 6d ce bc 7d 98 a1 5d 68 a2 38 ec 04 87 76 a3 58 fa 30 ec 60 bd a2 73 57 d6 a1 59 84 76 d7 8f 19 58 e9 c2 4a 12 e8 8a 86 8b 8c 87 b2 91 c5 30 8f 5d eb b6 02 e8 dc fd ac 7d 25 be ec ee 1f e2 cb 50 4d 90 Data Ascii: ND$,[Q*m}]h8vX0`sWYvXJ0]}%PM=>{x6T9#=,8wwEv-(Ql{C{lS4-l@YViC3kSY~H+~CskJ#
Jan 15, 2025 01:34:03.628031969 CET	656	IN	Data Raw: bf 47 0a ff 57 66 4c 7f 5a 71 b4 2c 14 3a 0a 3b 0a a7 8f cc 0c 8c 06 83 31 5d 55 ee 56 04 68 5f fd 2c 73 57 a0 a3 b3 a2 cf 8f ea 73 8f 07 c6 d2 21 47 9c 63 e5 9f b1 98 39 c8 66 aa f7 29 0e e6 e0 51 fb 9c 0e 1d 20 42 86 89 f3 c6 16 16 a1 0e 0c 0e Data Ascii: GWfLZq,:;1]UVh_,sWs!Gc9f)Q BeSy6`GziVw*xjHHx\|1$1g=5dw}I>IiflmUD[0F{xxPKF<}V$nKEuwL=,:.qI
Jan 15, 2025 01:34:03.733361006 CET	303	OUT	GET /img/TikTok-Wholesalelogo.e950f9dd.svg HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:03.991240025 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:03 GMT Content-Type: image/svg+xml Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"11714-1732543338884" Last-Modified: Mon, 25 Nov 2024 14:02:18 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 31 33 37 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 95 9a 4b af dc c6 11 85 f7 f9 15 83 c9 26 01 ee 50 fd 7e 04 be 36 a4 b1 b4 f3 2e d9 78 67 c4 b2 24 40 96 0c 49 b0 f2 f3 f3 9d 6a 92 43 cd 25 03 44 86 a5 61 b1 d9 ec ae c7 a9 53 d5 fc ee 87 ff fc fe fe f4 e7 eb 4f 9f df 7d fc f0 78 f6 93 3b 9f 5e 7f f8 f7 c7 5f df 7d 78 f3 78 fe d7 3f 5f 5d da f9 87 ef ff f2 dd e7 3f df 6c 47 f9 f3 89 e7 3e 7c 7e 3c bf fd f2 e5 8f 7f 3c 7b f6 f5 eb d7 e9 6b 9c 3e 7e 7a f3 2c 38 e7 9e 31 fe 7c fa fa ee d7 2f 6f 1f cf 08 ce a7 b7 af df bd 79 fb e5 f1 5c dd 99 e9 fe f8 e5 cb db d3 af 8f e7 9f dc c9 9d ae 7e 8a 35 bb 14 7d 3e b9 c9 f9 5a 73 6b e5 14 26 84 2e 87 9e 24 8d 2d 85 ec f2 29 4d 3e d8 b0 c2 3f d7 32 f1 32 ef 73 b5 31 12 d5 a9 d5 9c 7c ce 51 92 94 4a 0c bd 9c 3a 73 d9 9b c2 f6 f1 bb ab 68 f7 50 81 4d ed b9 ec b5 f5 ec 23 4b 69 39 34 56 d8 4e 88 83 6b a5 f8 58 59 4b 49 b9 c5 ea 4d ec 79 f1 a9 4c 89 bd 8c a7 6b 4b b5 e4 c2 92 92 4f c5 f5 f1 b4 2f 3d e5 e8 c3 a9 4d b1 7b 9e 65 b8 9e 2e ce 67 bd b8 23 6e b7 49 52 cb 39 [TRUNCATED] Data Ascii: 137dK&P~6.xg$@IjC%DaSO}x;^_}xx?_]?lG>\|~<<{k>~z,81\|/oy\~5}>Zsk&.$-)M>?22s1\|QJ:shPM#Ki94VNkXYKIMyLkKO/=M{e.g#nIR9~n(6XsiToGYG?>OV+ur1QgLg^P\|2zc'<M#;>!c?]$TZ\|K^r<c6lMx}4y.=/YZbN4mSj8)a:1qxZcYQ"TkKkibyoc5\GT_p{_L"pEIkR\|?iO+BA2srbc=eb#MJaQr:`DlCz.\kC$J,FefFd^})y"c\ZksTw<}m6he?~lm=:#0^3@+7+SNK\qSj[enf\|l_>\|/_^W+N'VZTkF@bxc@y8_,!BuE
Jan 15, 2025 01:34:03.991250038 CET	224	IN	Data Raw: 2f 30 c5 87 8e 75 14 51 bb 62 34 21 ab 65 5c 87 80 8f 04 40 9c 8a 73 31 44 ac 79 24 06 2e 0d 59 c1 26 f4 73 bd a0 46 82 9b a7 71 0c 5f 26 a2 80 b7 06 9c 44 fa ed 55 79 c6 b0 14 44 69 44 11 2e 09 ec 17 3d 88 52 63 8b c4 27 2f c6 71 82 d0 07 cf e4 Data Ascii: /0uQb4!e\@s1Dy$.Y&sFq_&DUyDiD.=Rc'/q0E/m8,P/mc%V$4bA!_kpI?;+sp%BzE$*@K5ubt l 5 %S`CZO!U>I]aJPg'1ya`:
Jan 15, 2025 01:34:03.991266012 CET	1236	IN	Data Raw: 05 82 da 11 98 65 ee 68 50 a8 e7 2b 61 16 5d 62 11 c4 4a ed 04 19 6a fb 5f f2 91 dd b2 5c ab b0 d9 75 1e 69 2d 30 4f c6 9c ca f2 52 2c d3 ef 89 a3 69 51 0e c9 0f 05 7d d3 bf d2 ed 26 24 dc 0b fe 3b 0a 89 1a 1e c2 6e 20 38 4d 8a 8d c9 a1 9a d6 a1 Data Ascii: ehP+a]bJj_\ui-0OR,iQ}&$;n 8M>0gFFVh-yS'wMF#)(1a. b<YSb gzB0!`a1#Ml!VPs'8J`]EGz`E_ gX2uFVO?0;^a6PR!
Jan 15, 2025 01:34:03.991278887 CET	1236	IN	Data Raw: 31 4e d2 97 fa 36 0d 7f a8 c1 68 72 a6 b2 d4 ba ad e2 1f 7e 60 55 fe dc 3b 6b 50 35 1b 80 4d 2b d5 31 bc 87 76 99 12 4b a6 9b 05 a0 aa 2b 47 26 56 5a 34 c7 68 c4 82 d6 2e 1c 94 c0 5c 1b c6 4a 5a 6e 6a 0a 59 75 5d 08 fc 4c f5 41 b2 c3 39 e5 cf f2 Data Ascii: 1N6hr~`U;kP5M+1vK+G&VZ4h.\JZnjYu]LA9BBB\u/Nn:0DZ^z5iu!2:RI%#dnDXVH Ug\70Ray IU5vm'n0K`q{dwX${ht[
Jan 15, 2025 01:34:03.991290092 CET	1236	IN	Data Raw: 15 d4 29 d2 48 3b 85 06 d4 38 52 13 05 1f bd be 3d a9 d2 ad 48 c6 9c bf ed e8 7c a4 60 a1 e4 9c de 11 11 ff f3 d1 9d 7a 62 e3 e8 6e 80 c1 7a 74 07 91 1e 47 77 33 1e e8 cc f8 1e 0f a0 cf f4 1e c7 d9 dd 06 0e 00 26 81 ae 9d dd 6d e0 80 50 1e e7 ac Data Ascii: )H;8R=H\|`zbnztGw3&mP2rvGwiIJtP;K<Pe8?J"Fos42d}*Ututd^i}:>RM-uj:J $Mi4+@F;p]ut;x4L!A
Jan 15, 2025 01:34:03.991300106 CET	153	IN	Data Raw: 3d c1 79 a9 cf 04 0e cd d8 0f 0f 5b 8d 62 b2 0a 6b 4a d8 22 d4 02 1e b0 3e 63 ba de 8c 48 1f d1 88 66 a8 f5 0a 19 b4 cf b1 0c e7 46 b3 4f 46 d7 de 6c a9 c3 4d e5 8a a3 e3 38 52 03 4d 95 bb 65 03 d5 74 bd 0e 96 1d dc 43 f2 7b ce 37 dc 87 97 8f 6f Data Ascii: =y[bkJ">cHfFOFlM8RMetC{7o\$j#`5;hRbbqku?ey?y$m-0
Jan 15, 2025 01:34:49.005203962 CET	6	OUT	Data Raw: 00 Data Ascii:

Timestamp	Bytes transferred	Direction	Data
Jan 15, 2025 01:34:03.116868019 CET	295	OUT	GET /js/chunk-dcbc024c.b4863f7d.js HTTP/1.1 Host: tretiktok.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9
Jan 15, 2025 01:34:03.892160892 CET	1236	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:03 GMT Content-Type: text/javascript Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding ETag: W/"26857-1731384874000" Last-Modified: Tue, 12 Nov 2024 04:14:34 GMT Strict-Transport-Security: max-age=31536000 Content-Encoding: gzip Data Raw: 32 34 39 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 d5 7d d9 8e e3 58 96 d8 af 64 c9 e5 82 c2 52 48 5c b4 51 d9 d1 09 6a df f7 bd 50 48 70 17 25 8a 94 48 8a 5a b2 12 18 60 00 03 7e f0 06 8c df fc 01 7e f1 a3 1f ec ff e9 19 fb 2f 7c ee 25 29 51 5b 64 46 56 66 4f 77 15 22 83 bc bc fb 3d f7 ec e7 44 78 a7 ea a2 b1 8b ed 24 7e cd 09 cb 9a 65 e8 eb 97 3b 65 bf ff fe eb 6f 4f b1 f5 d6 9a 87 7f fd 35 24 cc b7 fa f2 59 14 78 81 a0 12 42 e8 b7 e8 a7 10 c1 24 a5 50 56 de ea 82 ad 1a 7a 58 8a da 51 fd e9 93 14 93 f6 6b c3 b4 ad 17 3d b6 8e 84 d4 95 12 37 55 65 6e d3 31 46 c8 a4 a8 24 9d 89 2d d6 92 12 fa 1c 0d 11 1c 25 dc 76 00 1f 48 32 21 df 7e 08 6d 2d e9 9d 65 9b aa 60 87 de eb e1 10 95 e0 e8 d0 13 aa ce 93 a9 db ea 8f 26 92 8a f1 19 9e 13 c8 24 e3 4f 84 22 92 89 9b 75 40 bf 14 c5 33 b7 fd a2 0f 68 e4 bb 2d 52 3c 79 fb e1 7a e2 09 49 92 f1 c4 a9 94 74 67 03 1e 4d 9c 8c 25 d3 42 82 4a cb c2 69 07 29 81 b8 9a 48 f0 00 42 22 67 73 59 75 c5 29 52 7c ad 2b ef 79 ce 92 52 89 a8 3a ca b5 7b 3b a2 5e 56 0c 16 fe 6b f5 [TRUNCATED] Data Ascii: 2490}XdRH\QjPHp%HZ`~~/\|%)Q[dFVfOw"=Dx$~e;eoO5$YxB$PVzXQk=7Uen1F$-%vH2!~m-e`&$O"u@3h-R<yzItgM%BJi)HB"gsYu)R\|+yR:{;^VkP\lZ9HCsQ=6}sPwA;'[!?/X&u[vDj60xGOGYuAe^Kr^ib0q&bqY4nC`#@LT~&TT76+5a]B-JgW#u/$f"BIs'#=!2mWXTujg.rS-zd\EyyAW-=d8!u\C x4'QG(Z%;r=@)<^!pd9wSBdx3/tn%eCE@][(+OdoMIiM&m~!vXqOa5>!OsV~b-IcnpHTPes5!l9\|*aIg^w}g5~oV8u#)3uuhae%Y`XI1nka8U===
Jan 15, 2025 01:34:03.892173052 CET	1236	IN	Data Raw: a3 b6 af 6d 84 b7 ca 6f 9f 2e cc d3 36 0d ed 19 d0 fc 72 c7 99 e2 b7 ce 5c e4 0e 3d 0c 0f 16 9c fc 5f 69 ee 87 ad 2e 4b ea ab 33 0e bd 0b 45 5e d9 6f 6b ae ae d7 aa ae 14 54 4b 30 b6 ba 6d c1 dc 23 d0 e6 af b3 f7 1b 95 d3 79 ce 78 75 01 af 4d 9e Data Ascii: mo.6r\=_i.K3E^okTK0m#yxuMwX[@?Q}i1@{9I_YyN%#AhOD9$t983&MDdNLO87)5^(pESzzbHRIhF.JP){rg=g
Jan 15, 2025 01:34:03.892183065 CET	1236	IN	Data Raw: 83 5c 78 1f 82 ec 98 cb 7f 7d b0 63 17 64 1a f6 dd a7 69 08 7d dc 2c f2 66 23 dd da 17 22 ca f5 62 04 2c 28 db 98 15 fb 10 3a ad 06 ae f2 b3 a1 87 b2 57 25 b2 1c 8a 5a f6 01 58 2c bf 05 10 43 c3 cc 02 5f 1b 7e 06 14 03 cf cf 2b c0 32 4f d0 f2 d1 Data Ascii: \x}cdi},f#"b,(:W%ZX,C_~+2O\|=v,?b0u(]9-3FmD_~Sx+p9Af6J?x:8<aJ>/=VqPC5pR5(Q'{\H4;a@3l-.C@gr
Jan 15, 2025 01:34:03.892194033 CET	1236	IN	Data Raw: a5 4e c5 08 8e a1 08 3e 73 32 63 32 e9 54 e6 86 e3 7a d8 fe 23 41 c6 08 81 48 a6 13 19 d9 b7 0d 30 52 fa ce 1a ae 75 f2 d8 82 80 94 74 64 26 a8 76 88 da 3f 16 c9 20 84 82 10 84 7f c9 d1 6f 84 70 7c 24 82 90 0e 42 16 08 41 a0 72 84 48 10 02 41 df Data Ascii: N>s2c2Tz#AH0Rutd&v? op\|$BArHAAH!D>\HGuk"@6^?>>KH#qtGV!sn-,'rrdG9jBKCP#j\7sRPVwxd5nMTA~Jw!{-FSdk.2
Jan 15, 2025 01:34:03.892214060 CET	1236	IN	Data Raw: 34 54 7d 89 0c 76 d2 2f bf 78 3e bb 06 a8 8e c1 d5 20 84 bd cd 30 73 89 2d c0 81 0e 5c 6b af 77 20 80 af b1 8b 87 f4 e2 62 6d cf 34 28 c4 44 70 0a 38 21 e4 33 9a ce 44 b1 13 46 68 2d 84 a2 a0 ea 1a a0 17 c0 d7 ef c9 3f 81 87 1b f2 b0 80 5b 65 81 Data Ascii: 4T}v/x> 0s-\kw bm4(Dp8!3DFh-?[e_G>`\e5z\|O/O){jljGuo-V;Rn)I9x^a<W@6$"`~9[gV%QMA5kn
Jan 15, 2025 01:34:03.892220020 CET	1236	IN	Data Raw: 08 c9 e8 21 1b 8a 80 c3 1e 60 08 e0 16 58 6d 3d e7 20 ce f0 32 a2 d0 8f 27 74 75 bf 97 46 55 a4 ff 7d 83 e5 d4 3b b1 ef 68 33 7d 6b 8f d7 d6 d2 27 14 a0 8f d3 1d 20 5a 1a 54 5d 6f ff 3e a8 a7 88 ce f6 4d 44 13 b7 f8 1a 5a 89 51 c2 1d 47 49 dc 01 Data Ascii: !`Xm= 2'tuFU};h3}k' ZT]o>MDZQGIYT1>2f_EWNOOfwk> ;"<\|9BBdAE0E7yU\@<)2qex}dkWxqL)xP%NE_nDHs+:O
Jan 15, 2025 01:34:03.892225981 CET	1236	IN	Data Raw: 2a 94 a9 c3 8b 8e 86 0c 15 b0 0b 28 09 8c 77 8a 27 a9 c2 0b cd 75 23 28 ce b1 34 38 f8 ec 7c 90 28 8f 94 17 ae 7e 2b 93 bc d6 45 90 57 f1 3b 09 dd 30 38 37 d0 78 07 68 fc 9e 4e 5a f3 28 56 de 83 2f 36 0e 5f 80 f5 05 c7 02 cb 26 4e f7 f1 15 40 45 Data Ascii: *(w'u#(48\|(~+EW;087xhNZ(V/6_&N@ET~nHw\|<8/#p_?_H#l'ZoJp>Fwq~ p;n>.PLwn4@%]2W!BRWC_[
Jan 15, 2025 01:34:03.892230988 CET	1042	IN	Data Raw: 10 6a 5b 5e 2c ae 47 a5 2e c4 b9 cf 96 73 d1 69 8d 46 36 5b 4d 49 2b 27 95 61 46 23 a6 34 4f 14 c4 d6 1c 10 e6 94 de 2c 5b 66 a2 31 5e 69 8e b3 4b 27 23 f3 c9 d1 69 66 f4 d1 b4 9d 1e e9 c9 bd 05 58 34 d2 57 9a c5 fd a0 4a b7 06 e2 b8 a3 30 4e b5 Data Ascii: j[^,G.siF6[MI+'aF#4O,[f1^iK'#ifX4WJ0NiVz?kt@kz)!@9a(4e)IZ8Y@yUsD^56HCUXqtVEgCD`Zx\|d(Z-9Z(>*;>-ARm`;'Yh)jTJ
Jan 15, 2025 01:34:48.898106098 CET	6	OUT	Data Raw: 00 Data Ascii:

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report http://tretiktok.com/

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Software Vulnerabilities

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 100

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Windows Analysis Report
http://tretiktok.com/

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:03 UTC	591	OUT	GET /wap/api/activity/lottery!getCurrentActivity.action?lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:03 UTC	172	IN	HTTP/1.1 404 Server: nginx Date: Wed, 15 Jan 2025 00:34:03 GMT Content-Type: text/html;charset=UTF-8 Content-Length: 1067 Connection: close Vary: Accept-Encoding
2025-01-15 00:34:03 UTC	1067	IN	Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 68 65 69 67 68 74 3d 64 65 76 69 63 65 2d 68 65 69 67 68 74 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 2c 76 69 65 77 70 6f 72 74 2d Data Ascii: <!doctype html><html lang=""><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width,height=device-height,initial-scale=1,minimum-scale=1,maximum-scale=1,user-scalable=no,viewport-

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:04 UTC	681	OUT	POST /wap/api/banner!bannerList.action?pageNum=1&pageSize=8&type=pc&imgType=1&lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:04 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:04 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:04 UTC	318	IN	Data Raw: 31 33 32 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 72 65 73 75 6c 74 22 3a 5b 7b 22 69 64 22 3a 22 65 37 61 35 61 38 38 32 38 62 61 35 35 33 63 31 30 31 38 62 61 35 37 34 32 39 62 64 30 30 30 30 22 2c 22 65 6e 74 69 74 79 56 65 72 73 69 6f 6e 22 3a 30 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 6e 75 6c 6c 2c 22 69 6d 67 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 74 6b 68 6f 75 64 75 61 6e 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 74 79 70 65 2f 32 30 32 34 2d 30 39 2d 31 39 2f 30 62 66 36 37 65 35 31 2d 61 61 62 30 2d 34 64 65 36 2d 38 38 38 32 2d 31 36 39 36 39 62 66 66 38 35 36 63 2e 6a 70 67 22 2c 22 73 6f 72 74 22 3a 30 2c 22 74 79 70 65 22 3a 22 70 63 22 2c 22 6c 69 6e 6b 22 3a 22 22 Data Ascii: 132{"code":"0","msg":null,"data":{"result":[{"id":"e7a5a8828ba553c1018ba57429bd0000","entityVersion":0,"timestamp":null,"imgUrl":"https://tkhouduan.s3.amazonaws.com/type/2024-09-19/0bf67e51-aab0-4de6-8882-16969bff856c.jpg","sort":0,"type":"pc","link":""

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:04 UTC	666	OUT	POST /wap/api/category!recommend.action?&pageSize=50&pageNum=1&lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:04 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:04 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:04 UTC	7246	IN	Data Raw: 31 63 34 31 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 70 61 67 65 49 6e 66 6f 22 3a 7b 22 65 6c 65 6d 65 6e 74 73 22 3a 5b 5d 2c 22 70 61 67 65 53 69 7a 65 22 3a 35 30 2c 22 70 61 67 65 4e 75 6d 22 3a 31 2c 22 74 6f 74 61 6c 45 6c 65 6d 65 6e 74 73 22 3a 30 2c 22 74 6f 74 61 6c 50 61 67 65 22 3a 30 2c 22 66 69 72 73 74 45 6c 65 6d 65 6e 74 4e 75 6d 62 65 72 22 3a 30 2c 22 66 69 72 73 74 50 61 67 65 22 3a 31 2c 22 6c 61 73 74 50 61 67 65 22 3a 74 72 75 65 2c 22 6c 61 73 74 45 6c 65 6d 65 6e 74 4e 75 6d 62 65 72 22 3a 30 2c 22 6e 65 78 74 50 61 67 65 4e 75 6d 62 65 72 22 3a 32 2c 22 70 72 65 76 69 6f 75 73 50 61 67 65 4e 75 6d 62 65 72 22 3a 30 7d 2c 22 70 61 67 65 4c 69 73 74 22 3a 5b 7b 22 64 65 Data Ascii: 1c41{"code":"0","msg":null,"data":{"pageInfo":{"elements":[],"pageSize":50,"pageNum":1,"totalElements":0,"totalPage":0,"firstElementNumber":0,"firstPage":1,"lastPage":true,"lastElementNumber":0,"nextPageNumber":2,"previousPageNumber":0},"pageList":[{"de

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:04 UTC	679	OUT	POST /wap/api/sellerGoods!recommend_new.action?type=1&pageSize=24&pageNum=1&lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:04 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:04 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:04 UTC	16065	IN	Data Raw: 37 66 33 30 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 72 65 73 75 6c 74 22 3a 5b 7b 22 69 64 22 3a 22 32 33 31 31 30 39 31 32 35 30 31 36 32 34 36 22 2c 22 65 6e 74 69 74 79 56 65 72 73 69 6f 6e 22 3a 30 2c 22 74 69 6d 65 73 74 61 6d 70 22 3a 6e 75 6c 6c 2c 22 67 6f 6f 64 73 49 64 22 3a 22 42 30 38 31 5a 4d 31 57 43 58 22 2c 22 73 65 6c 6c 65 72 49 64 22 3a 22 65 37 61 35 61 38 38 32 38 62 61 35 35 33 35 61 30 31 38 62 61 35 61 34 30 37 37 62 30 30 31 66 22 2c 22 63 61 74 65 67 6f 72 79 49 64 22 3a 22 30 62 33 34 33 38 65 35 38 39 36 63 64 61 66 31 30 31 38 39 36 63 65 38 30 64 34 61 30 30 30 30 22 2c 22 63 61 74 65 67 6f 72 79 4e 61 6d 65 22 3a 6e 75 6c 6c 2c 22 73 65 63 6f 6e 64 61 72 79 43 61 Data Ascii: 7f30{"code":"0","msg":null,"data":{"result":[{"id":"231109125016246","entityVersion":0,"timestamp":null,"goodsId":"B081ZM1WCX","sellerId":"e7a5a8828ba5535a018ba5a4077b001f","categoryId":"0b3438e5896cdaf101896ce80d4a0000","categoryName":null,"secondaryCa
2025-01-15 00:34:04 UTC	16384	IN	Data Raw: 5c 22 63 6f 6c 6f 72 3a 20 72 67 62 28 31 35 2c 20 31 37 2c 20 31 37 29 3b 5c 22 3e 48 61 70 70 79 20 46 61 6d 69 6c 79 20 4f 72 67 61 6e 69 63 73 3a 20 57 65 20 61 72 65 20 6f 6e 20 61 20 6d 69 73 73 69 6f 6e 20 74 6f 20 63 68 61 6e 67 65 20 74 68 65 20 74 72 61 6a 65 63 74 6f 72 79 20 6f 66 20 63 68 69 6c 64 72 65 6e 27 73 20 68 65 61 6c 74 68 20 74 68 72 6f 75 67 68 20 6e 75 74 72 69 74 69 6f 6e 3b 20 57 65 20 70 72 6f 76 69 64 65 20 61 67 65 20 61 6e 64 20 73 74 61 67 65 20 61 70 70 72 6f 70 72 69 61 74 65 20 70 72 65 6d 69 75 6d 20 6f 72 67 61 6e 69 63 20 66 6f 6f 64 20 70 72 6f 64 75 63 74 73 20 66 6f 72 20 62 61 62 79 2c 20 74 6f 74 2c 20 6b 69 64 2c 20 61 6e 64 20 6d 61 6d 61 3c 2f 73 70 61 6e 3e 3c 2f 6c 69 3e 3c 6c 69 20 73 74 79 6c 65 3d 5c 22 Data Ascii: \"color: rgb(15, 17, 17);\">Happy Family Organics: We are on a mission to change the trajectory of children's health through nutrition; We provide age and stage appropriate premium organic food products for baby, tot, kid, and mama</span></li><li style=\"

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:04 UTC	644	OUT	POST /wap/api/seller!list.action?isRec=1&lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:13 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:12 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:13 UTC	16065	IN	Data Raw: 36 38 63 30 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 70 61 67 65 49 6e 66 6f 22 3a 7b 22 65 6c 65 6d 65 6e 74 73 22 3a 5b 5d 2c 22 70 61 67 65 53 69 7a 65 22 3a 32 30 2c 22 70 61 67 65 4e 75 6d 22 3a 31 2c 22 74 6f 74 61 6c 45 6c 65 6d 65 6e 74 73 22 3a 33 31 2c 22 74 6f 74 61 6c 50 61 67 65 22 3a 32 2c 22 66 69 72 73 74 45 6c 65 6d 65 6e 74 4e 75 6d 62 65 72 22 3a 30 2c 22 66 69 72 73 74 50 61 67 65 22 3a 31 2c 22 6c 61 73 74 50 61 67 65 22 3a 66 61 6c 73 65 2c 22 6c 61 73 74 45 6c 65 6d 65 6e 74 4e 75 6d 62 65 72 22 3a 31 39 2c 22 6e 65 78 74 50 61 67 65 4e 75 6d 62 65 72 22 3a 32 2c 22 70 72 65 76 69 6f 75 73 50 61 67 65 4e 75 6d 62 65 72 22 3a 30 7d 2c 22 70 61 67 65 4c 69 73 74 22 3a 5b 7b Data Ascii: 68c0{"code":"0","msg":null,"data":{"pageInfo":{"elements":[],"pageSize":20,"pageNum":1,"totalElements":31,"totalPage":2,"firstElementNumber":0,"firstPage":1,"lastPage":false,"lastElementNumber":19,"nextPageNumber":2,"previousPageNumber":0},"pageList":[{
2025-01-15 00:34:13 UTC	10764	IN	Data Raw: 63 65 62 6f 6f 6b 22 3a 6e 75 6c 6c 2c 22 69 6e 73 74 61 67 72 61 6d 22 3a 6e 75 6c 6c 2c 22 74 77 69 74 74 65 72 22 3a 6e 75 6c 6c 2c 22 67 6f 6f 67 6c 65 22 3a 6e 75 6c 6c 2c 22 79 6f 75 74 75 62 65 22 3a 6e 75 6c 6c 2c 22 73 74 61 74 75 73 22 3a 31 2c 22 72 65 63 54 69 6d 65 22 3a 31 36 39 39 38 35 31 34 33 35 37 34 34 2c 22 63 72 65 61 74 65 54 69 6d 65 22 3a 31 36 37 39 35 30 37 37 36 31 30 30 30 2c 22 62 61 73 65 54 72 61 66 66 69 63 22 3a 31 2c 22 61 75 74 6f 53 74 61 72 74 22 3a 34 31 32 2c 22 61 75 74 6f 45 6e 64 22 3a 38 33 33 2c 22 61 75 74 6f 56 61 6c 69 64 22 3a 31 2c 22 66 72 65 65 7a 65 22 3a 6e 75 6c 6c 2c 22 72 65 61 6c 73 22 3a 6e 75 6c 6c 2c 22 66 61 6b 65 22 3a 36 38 37 34 2c 22 63 72 65 64 69 74 53 63 6f 72 65 22 3a 31 30 30 2c 22 62 Data Ascii: cebook":null,"instagram":null,"twitter":null,"google":null,"youtube":null,"status":1,"recTime":1699851435744,"createTime":1679507761000,"baseTraffic":1,"autoStart":412,"autoEnd":833,"autoValid":1,"freeze":null,"reals":null,"fake":6874,"creditScore":100,"b

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:04 UTC	643	OUT	POST /wap/api/index!download-url.action?lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:04 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:04 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:04 UTC	57	IN	Data Raw: 32 65 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 22 77 77 77 2e 62 61 69 64 75 2e 63 6f 6d 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 2e{"code":"0","msg":null,"data":"www.baidu.com"}0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:05 UTC	679	OUT	POST /wap/api/syspara!getSyspara.action?code=mall_max_goods_number_in_order&lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive Content-Length: 0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / Content-Type: application/x-www-form-urlencoded sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:05 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:05 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:05 UTC	82	IN	Data Raw: 34 37 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 6d 61 6c 6c 5f 6d 61 78 5f 67 6f 6f 64 73 5f 6e 75 6d 62 65 72 5f 69 6e 5f 6f 72 64 65 72 22 3a 22 39 39 39 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 47{"code":"0","msg":null,"data":{"mall_max_goods_number_in_order":"999"}}0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:05 UTC	600	OUT	GET /wap/api/syspara!getSyspara.action?code=customer_service_url&lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:05 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:05 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:05 UTC	69	IN	Data Raw: 33 61 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 65 72 5f 73 65 72 76 69 63 65 5f 75 72 6c 22 3a 22 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a{"code":"0","msg":null,"data":{"customer_service_url":""}}0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:05 UTC	576	OUT	GET /wap/api/newOnlinechat!unread.action?lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:05 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:05 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:05 UTC	43	IN	Data Raw: 32 30 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 30 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 20{"code":"0","msg":null,"data":0}0

Timestamp	Bytes transferred	Direction	Data
2025-01-15 00:34:06 UTC	600	OUT	GET /wap/api/syspara!getSyspara.action?code=customer_service_url&lang=en HTTP/1.1 Host: tretiktok.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: http://tretiktok.com Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-15 00:34:07 UTC	319	IN	HTTP/1.1 200 Server: nginx Date: Wed, 15 Jan 2025 00:34:06 GMT Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Origin Vary: Access-Control-Request-Method Vary: Access-Control-Request-Headers Strict-Transport-Security: max-age=31536000
2025-01-15 00:34:07 UTC	69	IN	Data Raw: 33 61 0d 0a 7b 22 63 6f 64 65 22 3a 22 30 22 2c 22 6d 73 67 22 3a 6e 75 6c 6c 2c 22 64 61 74 61 22 3a 7b 22 63 75 73 74 6f 6d 65 72 5f 73 65 72 76 69 63 65 5f 75 72 6c 22 3a 22 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 3a{"code":"0","msg":null,"data":{"customer_service_url":""}}0