Edit tour

Windows Analysis Report
https://www.temu.com/cmsg_transit.html?_cmsg_biz=9010&_cmsg_channel=mail&_cmsg_locale=100~ja~JPY&msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_p_landing=1&_x_src=mail

Overview

General Information

Sample URL:	https://www.temu.com/cmsg_transit.html?_cmsg_biz=9010&_cmsg_channel=mail&_cmsg_locale=100~ja~JPY&msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_p_landing=1&_x_src=mail
Analysis ID:	1525970
Tags:	urlscan
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

HTTP GET or POST without a user agent

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5980 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5412 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,16181275935131285914,386233227358033748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2916 --field-trial-handle=2016,i,16181275935131285914,386233227358033748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3652 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.temu.com/cmsg_transit.html?_cmsg_biz=9010&_cmsg_channel=mail&_cmsg_locale=100~ja~JPY&msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_p_landing=1&_x_src=mail" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: POST /x/migrate HTTP/1.1Host: x.comConnection: keep-aliveContent-Length: 604Cache-Control: max-age=0sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1Origin: https://twitter.comContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://twitter.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: guest_id_marketing=v1%3A172805223303549590; guest_id_ads=v1%3A172805223303549590; personalization_id="v1_MKXK6qq6Un/byoLxGCuenA=="; guest_id=v1%3A172805223303549590

Source: https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1	HTTP Parser: Number of links: 0
Source: https://x.com/i/flow/signup	HTTP Parser: Number of links: 0
Source: https://x.com/i/flow/login	HTTP Parser: Number of links: 0

Source: https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1	HTTP Parser: Title: Sign In - Google Accounts does not match URL
Source: https://x.com/i/flow/signup	HTTP Parser: Title: Sign In - Google Accounts does not match URL
Source: https://x.com/i/flow/login	HTTP Parser: Title: Sign In - Google Accounts does not match URL

Source: https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1	HTTP Parser: No favicon
Source: https://x.com/i/flow/signup	HTTP Parser: No favicon
Source: https://x.com/i/flow/login	HTTP Parser: No favicon

Source: https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1	HTTP Parser: No <meta name="author".. found
Source: https://x.com/i/flow/signup	HTTP Parser: No <meta name="author".. found
Source: https://x.com/i/flow/login	HTTP Parser: No <meta name="author".. found

Source: https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1	HTTP Parser: No <meta name="copyright".. found
Source: https://x.com/i/flow/signup	HTTP Parser: No <meta name="copyright".. found
Source: https://x.com/i/flow/login	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.5:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.5:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.109.210.53:443 -> 192.168.2.5:50282 version: TLS 1.2

Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/ces/p2
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/sso_init.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/task.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/task.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/ces/p2
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/task.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/sso_init.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/callback.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/onboarding/sso_init.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/client_event.json
Source: global traffic	HTTP traffic detected: GET is not allowed on path /1.1/jot/ces/p2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: www.temu.com
Source: global traffic	DNS traffic detected: DNS query: twitter.com
Source: global traffic	DNS traffic detected: DNS query: x.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: abs.twimg.com
Source: global traffic	DNS traffic detected: DNS query: api.twitter.com
Source: global traffic	DNS traffic detected: DNS query: t.co
Source: global traffic	DNS traffic detected: DNS query: pbs.twimg.com
Source: global traffic	DNS traffic detected: DNS query: api.x.com
Source: global traffic	DNS traffic detected: DNS query: video.twimg.com
Source: global traffic	DNS traffic detected: DNS query: abs-0.twimg.com
Source: global traffic	DNS traffic detected: DNS query: google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Fri, 04 Oct 2024 14:30:59 UTCperf: 7402827104server: tsa_bcache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 6f94dae55bdafe1bx-rate-limit-limit: 500x-rate-limit-reset: 1728053159x-rate-limit-remaining: 499strict-transport-security: max-age=631138519access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 5x-connection-hash: ee1440e74cc2186b9450f6eb253fff957cb20254c7e973d0bebe01756d91b38bconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 Forbiddenperf: 7402827104cache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 68e82c6a64b35073access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 3x-connection-hash: 30187059e583d0e30ada5f598f83755103b03714a05bf51c7a943b3649923045date: Fri, 04 Oct 2024 14:31:00 GMTserver: tsa_bconnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Fri, 04 Oct 2024 14:31:05 UTCperf: 7402827104server: tsa_bcache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 48dfdb4860468d07x-rate-limit-limit: 500x-rate-limit-reset: 1728053165x-rate-limit-remaining: 499strict-transport-security: max-age=631138519access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 6x-connection-hash: 2c63d242ef41f99dc23fabcbac5f86376736c1b3c74a214becd8bdae2dbd6ab6connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Fri, 04 Oct 2024 14:31:14 UTCperf: 7402827104server: tsa_bcache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 40bdfca8e3fa7a6dx-rate-limit-limit: 500x-rate-limit-reset: 1728053174x-rate-limit-remaining: 499strict-transport-security: max-age=631138519access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 5x-connection-hash: f51bf0ca83382af4ff85f8028874b8c8031b2251b7b6cb578e20a2722e7c61f3connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Fri, 04 Oct 2024 14:31:26 UTCperf: 7402827104server: tsa_bcache-control: no-cache, no-store, max-age=0content-length: 0x-transaction-id: 168d533e125928b3x-rate-limit-limit: 100x-rate-limit-reset: 1728053186x-rate-limit-remaining: 99strict-transport-security: max-age=631138519access-control-allow-origin: https://x.comaccess-control-allow-credentials: trueaccess-control-expose-headers: X-Twitter-Spotify-Access-Token,X-Twitter-Client-Version,X-Twitter-Diffy-Request-Key,X-Rate-Limit-Limit,X-TD-Mtime,X-Twitter-Client,Backoff-Policy,X-Rate-Limit-Remaining,Content-Length,X-Rate-Limit-Reset,X-Transaction-Id,X-Acted-As-User-Id,X-Twitter-Polling,X-Twitter-UTCOffset,X-Response-Timex-response-time: 5x-connection-hash: da1c7e962e81585d6670f19509ec0fa32aae557e5ac950b7eef05e15d6282e74connection: close

Source: chromecache_648.3.dr, chromecache_570.3.dr	String found in binary or memory: http://feross.org
Source: chromecache_607.3.dr, chromecache_381.3.dr	String found in binary or memory: http://git.io/TrdQbw
Source: chromecache_607.3.dr, chromecache_381.3.dr	String found in binary or memory: http://underscorejs.org
Source: chromecache_778.3.dr, chromecache_755.3.dr, chromecache_872.3.dr, chromecache_822.3.dr, chromecache_542.3.dr, chromecache_626.3.dr, chromecache_450.3.dr, chromecache_410.3.dr, chromecache_353.3.dr, chromecache_431.3.dr, chromecache_523.3.dr, chromecache_561.3.dr, chromecache_635.3.dr, chromecache_384.3.dr, chromecache_787.3.dr, chromecache_427.3.dr, chromecache_677.3.dr, chromecache_613.3.dr, chromecache_860.3.dr, chromecache_753.3.dr, chromecache_661.3.dr	String found in binary or memory: http://www.videolan.org/x264.html
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/100ThievesEmoji2024/100ThievesEmoji2024.png
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11480_Zenless_Zone_Zero_Launch_2024_Golden_Bangboo/BF-11480_Zenle
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11588_Loreal_Lancome_JP_Hashmoji2024/BF-11588_Loreal_Lancome_JP_H
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11611_MOC_Q324_Hashmoji/BF-11611_MOC_Q324_Hashmoji.png
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11618_SportsBoulevard_Q324_Hashmoji/BF-11618_SportsBoulevard_Q324
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11628_fgoproject_9thAnniversary_Hashmoji2024/BF-11628_fgoproject_
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11662_Com2us_summoners_STAFF_Branding_Q324_after/BF-11662_Com2us_
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11686_NetflixJP_Hashmoji_20240803-20241103_Jimenshi/BF-11686_Netf
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11687_NetflixJP_Gokuaku_Hashmoji2024/BF-11687_NetflixJP_Gokuaku_H
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11708_NetflixJP_Weare_Hashmoji2024/BF-11708_NetflixJP_Weare_Hashm
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11709_GenshinPaimon_Hashmoji2024/BF-11709_GenshinPaimon_Hashmoji2
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11710_GenshinKachina_Hashmoji2024/BF-11710_GenshinKachina_Hashmoj
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11711_GenshinKinich_Hashmoji2024/BF-11711_GenshinKinich_Hashmoji2
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11712_GenshinMualani_Hashmoji2024/BF-11712_GenshinMualani_Hashmoj
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11713_Genshin_NatlanSunSign_Hashmoji2024/BF-11713_Genshin_NatlanS
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11751_Global_miHoYo_Final_Hashmoji_v2/BF-11751_Global_miHoYo_Fina
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11770_RacingMaster_JPLaunch_Hashmoji2024/BF-11770_RacingMaster_JP
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11790_COLOPL_Hashmoji/BF-11790_COLOPL_Hashmoji.png
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11804_NetEase_RacingMaster_2024Hashmoji2/BF-11804_NetEase_RacingM
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11821_lake_official__Custom_Like_after/BF-11821_lake_official__Cu
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11868_Schick_Hashmoji2024_V2/BF-11868_Schick_Hashmoji2024_V2.png
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11871_FANCLNew_calolimit_Hashmoji2024/BF-11871_FANCLNew_calolimit
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11901_AlatTechIce_Hashmoji2024/BF-11901_AlatTechIce_Hashmoji2024.
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11949_GlicoThailandPockyBox_Hashmoji2024_/BF-11949_GlicoThailandP
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11950_Riyadhseason_Hashmoji2024_/BF-11950_Riyadhseason_Hashmoji20
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-11952_drama_wowow_GoldenKamuyDrama_Hashmoji2024/BF-11952_drama_wo
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-12013_SportsBlvdSA_SND24_HashmojiAfter/BF-12013_SportsBlvdSA_SND2
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-12041_ATLUS_stud_zero_launch_Hashmoji2024_V2/BF-12041_ATLUS_stud_
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-12061_iriam_official_Hashmoji2024_V2/BF-12061_iriam_official_Hash
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-12090_silenthill_jp_Hashmoji2024/BF-12090_silenthill_jp_Hashmoji2
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF-12168_Aljazeera_Hashmoji2024_v1/BF-12168_Aljazeera_Hashmoji2024_v
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF_11905_Hashmoji_Only_After_Aeromexico_90anos/BF_11905_Hashmoji_Onl
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF_11915_Sabic_Homeland_Hashmoji_24_/BF_11915_Sabic_Homeland_Hashmoj
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF_12012_KFSHRC_National_Day_Hashmoji_2024_/BF_12012_KFSHRC_National
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF_12060_MOC_2024_SND_Hashmoji/BF_12060_MOC_2024_SND_Hashmoji.png
Source: chromecache_800.3.dr	String found in binary or memory: https://abs.twimg.com/hashflags/BF_12081_Matarat_ksa_Hashmoji_2024_/BF_12081_Matarat_ksa_Hashmoji_20

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,16181275935131285914,386233227358033748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.temu.com/cmsg_transit.html?_cmsg_biz=9010&_cmsg_channel=mail&_cmsg_locale=100~ja~JPY&msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_p_landing=1&_x_src=mail"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2916 --field-trial-handle=2016,i,16181275935131285914,386233227358033748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=2016,i,16181275935131285914,386233227358033748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2916 --field-trial-handle=2016,i,16181275935131285914,386233227358033748,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.1.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~loader.DMDrawer~bundle.Grok~bundle.MultiAccount~bundle.ReaderMode~bundle.Articles~bun.f39400ca.js	0%	URL Reputation	safe
http://underscorejs.org	0%	URL Reputation	safe
https://abs.twimg.com/hashflags/BF-11662_Com2us_summoners_STAFF_Branding_Q324_after/BF-11662_Com2us_	0%	URL Reputation	safe
https://abs.twimg.com/hashflags/BF-11628_fgoproject_9thAnniversary_Hashmoji2024/BF-11628_fgoproject_	0%	URL Reputation	safe
https://abs.twimg.com/hashflags/BF-11712_GenshinMualani_Hashmoji2024/BF-11712_GenshinMualani_Hashmoj	0%	URL Reputation	safe
https://abs.twimg.com/hashflags/BF-11751_Global_miHoYo_Final_Hashmoji_v2/BF-11751_Global_miHoYo_Fina	0%	URL Reputation	safe
https://abs.twimg.com/hashflags/BF-11708_NetflixJP_Weare_Hashmoji2024/BF-11708_NetflixJP_Weare_Hashm	0%	URL Reputation	safe
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/i18n/emoji-en.3afd1e4a.j	0%	URL Reputation	safe
https://abs.twimg.com/responsive-web/client-web/shared~bundle.SettingsProfile~bundle.UserProfile.6ba4be2a.js	0%	URL Reputation	safe
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loader.AppModules	0%	URL Reputation	safe
https://meet.google.com	0%	URL Reputation	safe
https://abs.twimg.com/hashflags/BF-11713_Genshin_NatlanSunSign_Hashmoji2024/BF-11713_Genshin_NatlanS	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
twitter.com	104.244.42.193	true	false	unknown
google.com	216.58.206.78	true	false	unknown
dualstack.video.twitter.map.fastly.net	146.75.52.158	true	false	unknown
gw-c-eu-isp.temu.com	20.157.217.65	true	false	unknown
tpop-api.x.com	104.244.42.194	true	false	unknown
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	unknown
tpop-api.twitter.com	104.244.42.194	true	false	unknown
t.co	162.159.140.229	true	false	unknown
twimg.twitter.map.fastly.net	146.75.52.159	true	false	unknown
play.google.com	142.250.181.238	true	false	unknown
dualstack.twimg.twitter.map.fastly.net	146.75.52.159	true	false	unknown
abs-zero.twimg.com	104.244.43.131	true	false	unknown
www.google.com	216.58.206.68	true	false	unknown
x.com	104.244.42.1	true	false	unknown
abs.twimg.com	unknown	unknown	false	unknown
pbs.twimg.com	unknown	unknown	false	unknown
api.x.com	unknown	unknown	false	unknown
abs-0.twimg.com	unknown	unknown	false	unknown
api.twitter.com	unknown	unknown	false	unknown
www.temu.com	unknown	unknown	false	unknown
video.twimg.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://video.twimg.com/ext_tw_video/1806682318976778241/pu/aud/mp4a/9000/12000/128000/mLSkWooLwdVA4PdA.m4s	false		unknown
https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1&mx=2	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~loader.DMDrawer~bundle.Grok~bundle.MultiAccount~bundle.ReaderMode~bundle.Articles~bun.f39400ca.js	false	URL Reputation: safe	unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.AudioSpacePeek~bundle.Compose~bundle.Conversation~bundle.DMRichTextCompose~bund.2433e2ba.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/loader.NewTweetsPill.1180970a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/ondemand.LottieWeb.bcf9974a.js	false		unknown
https://video.twimg.com/amplify_video/1830436579938058240/vid/avc1/0/3000/720x1280/_KokoJLS0-4KMPDE.m4s	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loaders.video.VideoPlayerDefaultUI~loaders.video.VideoPlayerMiniUI~loaders.video.VideoPlayerEventsUI.81db582a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/ondemand.ProfileSidebar.2b5e5e2a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.Compose~bundle.Ocf~bundle.RichTextCompose.e5c7ed2a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.TwitterArticles~bundle.ComposeMedia~bundle.LiveEvent~loaders.video.PlayerBase~loader.MediaPrevi.cb6bf63a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.LiveEvent~bundle.Compose~bundle.DirectMessages~bundle.DMRichTextCompose~bundle..5b89ca6a.js	false		unknown
https://video.twimg.com/ext_tw_video/1804853923292790784/pu/vid/avc1/9000/13400/320x568/SykK7gSveUYhQfhV.m4s	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.WideLayout~loader.ProfileClusterFollow.d0bbc1ea.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.Bookmarks~bundle.Communities~bundle.TwitterArticles~bundle.DirectMessages~bundl.5455e27a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.ExtendedUserProfile~bundle.UserProfile.7c0c4f4a.js	false		unknown
https://abs-0.twimg.com/emoji/v2/svg/1f64c.svg	false		unknown
https://video.twimg.com/ext_tw_video/1757075145569533952/pu/pl/mp4a/32000/pevu-LSxqqRRu4cL.m3u8	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~ondemand.SettingsInternals~bundle.UserLists~loader.EventSummaryHandler~loader.topicHa.bbc1529a.js	false		unknown
https://x.com/x/migrate	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.AudioDock~loader.DashMenu~bundle.Account~bundle.ReaderMode~bundle.Articles~bundle.AudioSpacePee.8a7edc7a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~loader.DMDrawer~bundle.ReaderMode~bundle.AudioSpacePeek~bundle.Birdwatch~bundle.LiveE.d4c05fca.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.Articles~bundle.AudioSpaceDetail~bundle.AudioSpaceDiscovery~bundle.AudioSpacebarScreen~bundle.B.8d67843a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.Communities~bundle.SettingsProfessionalProfileProfileSpotlight~bundle.SettingsProfessionalProfi.20a474da.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.DirectMessages~bundle.LiveEvent~bundle.UserProfile~loader.TimelineRenderer.8137c55a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/bundle.NetworkInstrument.1004095a.js	false		unknown
https://abs-0.twimg.com/emoji/v2/svg/1f469-200d-1f373.svg	false		unknown
https://video.twimg.com/ext_tw_video/1806682318976778241/pu/pl/mrZ1G2Wgh5jh9UUH.m3u8?variant_version=1&tag=12&v=cfc	false		unknown
https://video.twimg.com/ext_tw_video/1806682318976778241/pu/pl/avc1/480x852/ZnkGD00uUivIqTXe.m3u8	false		unknown
https://video.twimg.com/ext_tw_video/1804853923292790784/pu/pl/_B4HmvWL6nKq2YsQ.m3u8?variant_version=1&tag=12&v=cfc	false		unknown
https://api.x.com/graphql/Yka-W8dz7RaEuQNkroPkYw/UserByScreenName?variables=%7B%22screen_name%22%3A%22shoptemu%22%2C%22withSafetyModeUserFields%22%3Afalse%7D&features=%7B%22hidden_profile_subscriptions_enabled%22%3Atrue%2C%22rweb_tipjar_consumption_enabled%22%3Atrue%2C%22responsive_web_graphql_exclude_directive_enabled%22%3Atrue%2C%22verified_phone_label_enabled%22%3Afalse%2C%22subscriptions_verification_info_is_identity_verified_enabled%22%3Atrue%2C%22subscriptions_verification_info_verified_since_enabled%22%3Atrue%2C%22highlights_tweets_tab_ui_enabled%22%3Atrue%2C%22responsive_web_twitter_article_notes_tab_enabled%22%3Atrue%2C%22subscriptions_feature_can_gift_premium%22%3Atrue%2C%22creator_subscriptions_tweet_preview_api_enabled%22%3Atrue%2C%22responsive_web_graphql_skip_user_profile_image_extensions_enabled%22%3Afalse%2C%22responsive_web_graphql_timeline_navigation_enabled%22%3Atrue%7D&fieldToggles=%7B%22withAuxiliaryUserLabels%22%3Afalse%7D	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.SettingsProfile~bundle.UserProfile.6ba4be2a.js	false	URL Reputation: safe	unknown
https://video.twimg.com/ext_tw_video/1806682318976778241/pu/vid/avc1/0/3000/720x1280/JaShnwyq44F_8SaZ.m4s	false		unknown
https://abs.twimg.com/responsive-web/client-web/loader.AudioOnlyVideoPlayer.f013ad8a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/loader.TimelineCardHandler.4010b5aa.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.ReaderMode~bundle.Articles~bundle.AudioSpacePeek~bundle.AudioSpaceDetail~bundle.3b27748a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.SettingsProfile~bundle.Ocf.d7cc349a.js	false		unknown
https://api.x.com/graphql/E3opETHurmVJflFsUBVuUQ/UserTweets?variables=%7B%22userId%22%3A%221557364292160090112%22%2C%22count%22%3A20%2C%22includePromotedContent%22%3Atrue%2C%22withQuickPromoteEligibilityTweetFields%22%3Atrue%2C%22withVoice%22%3Atrue%2C%22withV2Timeline%22%3Atrue%7D&features=%7B%22rweb_tipjar_consumption_enabled%22%3Atrue%2C%22responsive_web_graphql_exclude_directive_enabled%22%3Atrue%2C%22verified_phone_label_enabled%22%3Afalse%2C%22creator_subscriptions_tweet_preview_api_enabled%22%3Atrue%2C%22responsive_web_graphql_timeline_navigation_enabled%22%3Atrue%2C%22responsive_web_graphql_skip_user_profile_image_extensions_enabled%22%3Afalse%2C%22communities_web_enable_tweet_community_results_fetch%22%3Atrue%2C%22c9s_tweet_anatomy_moderator_badge_enabled%22%3Atrue%2C%22articles_preview_enabled%22%3Atrue%2C%22responsive_web_edit_tweet_api_enabled%22%3Atrue%2C%22graphql_is_translatable_rweb_tweet_is_translatable_enabled%22%3Atrue%2C%22view_counts_everywhere_api_enabled%22%3Atrue%2C%22longform_notetweets_consumption_enabled%22%3Atrue%2C%22responsive_web_twitter_article_tweet_consumption_enabled%22%3Atrue%2C%22tweet_awards_web_tipping_enabled%22%3Afalse%2C%22creator_subscriptions_quote_tweet_preview_enabled%22%3Afalse%2C%22freedom_of_speech_not_reach_fetch_enabled%22%3Atrue%2C%22standardized_nudges_misinfo%22%3Atrue%2C%22tweet_with_visibility_results_prefer_gql_limited_actions_policy_enabled%22%3Atrue%2C%22rweb_video_timestamps_enabled%22%3Atrue%2C%22longform_notetweets_rich_text_read_enabled%22%3Atrue%2C%22longform_notetweets_inline_media_enabled%22%3Atrue%2C%22responsive_web_enhance_cards_enabled%22%3Afalse%7D&fieldToggles=%7B%22withArticlePlainText%22%3Afalse%7D	false		unknown
https://abs-0.twimg.com/emoji/v2/svg/1f6cd.svg	false		unknown
https://video.twimg.com/ext_tw_video/1804853923292790784/pu/vid/avc1/0/0/320x568/IIDx8NwF6XS5dGzS.mp4	false		unknown
https://video.twimg.com/ext_tw_video/1757075145569533952/pu/pl/avc1/480x270/T1oB5bHpSzh1N0sf.m3u8	false		unknown
https://abs.twimg.com/responsive-web/client-web/loader.AppModules.d89da73a.js	false		unknown
https://api.x.com/graphql/dexO_2tohK86JDudXXG3Yw/UserMedia?variables=%7B%22userId%22%3A%221557364292160090112%22%2C%22count%22%3A20%2C%22includePromotedContent%22%3Afalse%2C%22withClientEventToken%22%3Afalse%2C%22withBirdwatchNotes%22%3Afalse%2C%22withVoice%22%3Atrue%2C%22withV2Timeline%22%3Atrue%7D&features=%7B%22rweb_tipjar_consumption_enabled%22%3Atrue%2C%22responsive_web_graphql_exclude_directive_enabled%22%3Atrue%2C%22verified_phone_label_enabled%22%3Afalse%2C%22creator_subscriptions_tweet_preview_api_enabled%22%3Atrue%2C%22responsive_web_graphql_timeline_navigation_enabled%22%3Atrue%2C%22responsive_web_graphql_skip_user_profile_image_extensions_enabled%22%3Afalse%2C%22communities_web_enable_tweet_community_results_fetch%22%3Atrue%2C%22c9s_tweet_anatomy_moderator_badge_enabled%22%3Atrue%2C%22articles_preview_enabled%22%3Atrue%2C%22responsive_web_edit_tweet_api_enabled%22%3Atrue%2C%22graphql_is_translatable_rweb_tweet_is_translatable_enabled%22%3Atrue%2C%22view_counts_everywhere_api_enabled%22%3Atrue%2C%22longform_notetweets_consumption_enabled%22%3Atrue%2C%22responsive_web_twitter_article_tweet_consumption_enabled%22%3Atrue%2C%22tweet_awards_web_tipping_enabled%22%3Afalse%2C%22creator_subscriptions_quote_tweet_preview_enabled%22%3Afalse%2C%22freedom_of_speech_not_reach_fetch_enabled%22%3Atrue%2C%22standardized_nudges_misinfo%22%3Atrue%2C%22tweet_with_visibility_results_prefer_gql_limited_actions_policy_enabled%22%3Atrue%2C%22rweb_video_timestamps_enabled%22%3Atrue%2C%22longform_notetweets_rich_text_read_enabled%22%3Atrue%2C%22longform_notetweets_inline_media_enabled%22%3Atrue%2C%22responsive_web_enhance_cards_enabled%22%3Afalse%7D&fieldToggles=%7B%22withArticlePlainText%22%3Afalse%7D	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~bundle.Communities~bundle.TwitterArticles~bundle.WorkHistory~bundle.Delegate~bundle.J.050b62ea.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~bundle.Birdwatch~loader.inlineTombstoneHandler~loader.tweetHandler~loader.TweetCurationActionMenu.a8fa54da.js	false		unknown
https://video.twimg.com/amplify_video/1830436579938058240/vid/avc1/0/0/720x1280/cStyad8o4T05_pxo.mp4	false		unknown
https://video.twimg.com/ext_tw_video/1804853923292790784/pu/aud/mp4a/0/3000/128000/IlbmRPy4nQEnlfRJ.m4s	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.DMRichTextCompose~bundle.DirectMessages~bundle.UserFollowLists~bundle.UserProfi.5af7a95a.js	false		unknown
https://pbs.twimg.com/profile_images/1594728438237118465/4MQ3o6xJ_normal.jpg	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.AppModules~bundle.LoggedOutHome~bundle.TV.d10fe44a.js	false		unknown
https://abs-0.twimg.com/emoji/v2/svg/1f45f.svg	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loaders.video.VideoPlayerDefaultUI~loaders.video.VideoPlayerEventsUI~loaders.video.VideoPlayerPrerollU.245797ea.js	false		unknown
https://video.twimg.com/ext_tw_video/1804853923292790784/pu/aud/mp4a/0/0/128000/c5jaXcrC6r-cXx0Z.mp4	false		unknown
https://abs.twimg.com/responsive-web/client-web/Chirp-Heavy.f44ae4ea.woff2	false		unknown
https://video.twimg.com/ext_tw_video/1757075145569533952/pu/pl/avc1/1280x720/ZMckTZBe2pUUPiqt.m3u8	false		unknown
https://api.x.com/graphql/Z2BA99jFw6TxaJM5v7Irmg/useFetchProfileBlocks_profileExistsQuery?variables=%7B%22screenName%22%3A%22shoptemu%22%7D	false		unknown
https://video.twimg.com/ext_tw_video/1806682318976778241/pu/aud/mp4a/0/0/128000/Ymf7IxqftPEUBxjy.mp4	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.DMDrawer~bundle.Grok~bundle.BrandedLikesPreview~bundle.TwitterArticles~bundle.Compose~bundle.Co.a5d0ffaa.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~ondemand.SettingsInternals~bundle.Ocf.2874365a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/bundle.Ocf.da47f7da.js	false		unknown
https://api.x.com/1.1/onboarding/sso_init.json	false		unknown
https://api.x.com/1.1/users/recommendations.json?include_profile_interstitial_type=1&include_blocking=1&include_blocked_by=1&include_followed_by=1&include_want_retweets=1&include_mute_edge=1&include_can_dm=1&include_can_media_tag=1&include_ext_is_blue_verified=1&include_ext_verified_type=1&include_ext_profile_image_shape=1&skip_status=1&&pc=true&display_location=profile_accounts_sidebar&limit=3&user_id=1557364292160090112	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loaders.video.VideoPlayerDefaultUI~loaders.video.VideoPlayerHashtagHighlightUI~loaders.video.VideoPlay.e34b9d6a.js	false		unknown
https://abs.twimg.com/responsive-web/client-web/shared~loader.Typeahead~loader.AppModules~bundle.AudioSpaceDiscovery.3123dafa.js	false		unknown
https://video.twimg.com/ext_tw_video/1757075145569533952/pu/aud/mp4a/3000/6000/32000/ifekSo-7cYmLPgx2.m4s	false		unknown

Name	Source	Malicious	Antivirus Detection	Reputation
http://underscorejs.org	chromecache_607.3.dr, chromecache_381.3.dr	false	URL Reputation: safe	unknown
https://support.x.com/articles/14016	chromecache_615.3.dr, chromecache_627.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.TimelineRenderer.	chromecache_685.3.dr, chromecache_690.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.SignupModule.b618	chromecache_754.3.dr, chromecache_821.3.dr	false		unknown
https://abs.twimg.com/hashflags/BF-11662_Com2us_summoners_STAFF_Branding_Q324_after/BF-11662_Com2us_	chromecache_800.3.dr	false	URL Reputation: safe	unknown
https://abs.twimg.com/hashflags/BF-11949_GlicoThailandPockyBox_Hashmoji2024_/BF-11949_GlicoThailandP	chromecache_800.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/bundle.Ocf.da47f7da.js.m	chromecache_670.3.dr, chromecache_443.3.dr	false		unknown
https://abs.twimg.com/hashflags/BF-11628_fgoproject_9thAnniversary_Hashmoji2024/BF-11628_fgoproject_	chromecache_800.3.dr	false	URL Reputation: safe	unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/ondemand.ProfileSidebar.	chromecache_438.3.dr, chromecache_644.3.dr	false		unknown
https://abs.twimg.com/hashflags/BF-11712_GenshinMualani_Hashmoji2024/BF-11712_GenshinMualani_Hashmoj	chromecache_800.3.dr	false	URL Reputation: safe	unknown
https://abs.twimg.com/hashflags/BF-11751_Global_miHoYo_Final_Hashmoji_v2/BF-11751_Global_miHoYo_Fina	chromecache_800.3.dr	false	URL Reputation: safe	unknown
https://abs.twimg.com/hashflags/BF-11708_NetflixJP_Weare_Hashmoji2024/BF-11708_NetflixJP_Weare_Hashm	chromecache_800.3.dr	false	URL Reputation: safe	unknown
https://abs.twimg.com/hashflags/BF-11950_Riyadhseason_Hashmoji2024_/BF-11950_Riyadhseason_Hashmoji20	chromecache_800.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/i18n/emoji-en.3afd1e4a.j	chromecache_479.3.dr, chromecache_357.3.dr	false	URL Reputation: safe	unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.DividerHandler.f6	chromecache_767.3.dr, chromecache_652.3.dr	false		unknown
https://x.com/en/privacy	chromecache_699.3.dr, chromecache_498.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/ondemand.LottieWeb.bcf99	chromecache_701.3.dr, chromecache_440.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loader.AppModules	chromecache_708.3.dr, chromecache_762.3.dr, chromecache_732.3.dr, chromecache_780.3.dr, chromecache_584.3.dr, chromecache_497.3.dr, chromecache_817.3.dr, chromecache_396.3.dr, chromecache_855.3.dr, chromecache_480.3.dr	false	URL Reputation: safe	unknown
https://x.com/i/broadcasts/$	chromecache_344.3.dr, chromecache_469.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.SideNav.e8d0899a.	chromecache_495.3.dr, chromecache_671.3.dr	false		unknown
https://abs.twimg.com/hashflags/BF_12060_MOC_2024_SND_Hashmoji/BF_12060_MOC_2024_SND_Hashmoji.png	chromecache_800.3.dr	false		unknown
https://meet.google.com	chromecache_535.3.dr, chromecache_779.3.dr	false	URL Reputation: safe	unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~bundle.Birdwatch~	chromecache_417.3.dr, chromecache_738.3.dr, chromecache_852.3.dr, chromecache_629.3.dr, chromecache_565.3.dr, chromecache_686.3.dr, chromecache_786.3.dr, chromecache_654.3.dr, chromecache_751.3.dr, chromecache_577.3.dr, chromecache_494.3.dr, chromecache_750.3.dr, chromecache_774.3.dr, chromecache_468.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~bundle.Communitie	chromecache_582.3.dr, chromecache_636.3.dr, chromecache_356.3.dr, chromecache_838.3.dr, chromecache_446.3.dr, chromecache_870.3.dr, chromecache_874.3.dr, chromecache_713.3.dr, chromecache_609.3.dr, chromecache_401.3.dr, chromecache_429.3.dr, chromecache_553.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~ondemand.InlinePl	chromecache_330.3.dr, chromecache_659.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.AppModules.d89da7	chromecache_745.3.dr, chromecache_464.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~bundle.Bookmarks~	chromecache_459.3.dr, chromecache_451.3.dr	false		unknown
https://abs.twimg.com/hashflags/BF-11871_FANCLNew_calolimit_Hashmoji2024/BF-11871_FANCLNew_calolimit	chromecache_800.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loaders.video.PlayerHls1	chromecache_486.3.dr, chromecache_673.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.tweetHandler.4a33	chromecache_409.3.dr, chromecache_807.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~ondemand.EmojiPic	chromecache_695.3.dr, chromecache_597.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/ondemand.Dropdown.78a54e	chromecache_814.3.dr, chromecache_352.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/loader.TweetCurationActi	chromecache_766.3.dr, chromecache_705.3.dr	false		unknown
https://ton.local.twitter.com/responsive-web-internal/sourcemaps/client-web/shared~loaders.video.Vid	chromecache_829.3.dr, chromecache_709.3.dr, chromecache_347.3.dr, chromecache_386.3.dr, chromecache_856.3.dr, chromecache_769.3.dr, chromecache_848.3.dr, chromecache_741.3.dr, chromecache_422.3.dr, chromecache_683.3.dr, chromecache_765.3.dr, chromecache_500.3.dr, chromecache_827.3.dr, chromecache_804.3.dr, chromecache_678.3.dr, chromecache_355.3.dr	false		unknown
https://abs.twimg.com/hashflags/BF-11713_Genshin_NatlanSunSign_Hashmoji2024/BF-11713_Genshin_NatlanS	chromecache_800.3.dr	false	URL Reputation: safe	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
146.75.52.159	twimg.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
216.58.206.78	google.com	United States	15169	GOOGLEUS	false
146.75.52.158	dualstack.video.twitter.map.fastly.net	Sweden	30051	SCCGOVUS	false
142.250.181.238	play.google.com	United States	15169	GOOGLEUS	false
20.157.217.65	gw-c-eu-isp.temu.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.244.43.131	abs-zero.twimg.com	United States	54113	FASTLYUS	false
142.250.186.132	unknown	United States	15169	GOOGLEUS	false
162.159.140.229	t.co	United States	13335	CLOUDFLARENETUS	false
142.250.184.196	unknown	United States	15169	GOOGLEUS	false
104.244.42.1	x.com	United States	13414	TWITTERUS	false
142.250.185.68	unknown	United States	15169	GOOGLEUS	false
142.250.185.110	unknown	United States	15169	GOOGLEUS	false
104.244.42.194	tpop-api.x.com	United States	13414	TWITTERUS	false
104.244.42.193	twitter.com	United States	13414	TWITTERUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1525970
Start date and time:	2024-10-04 16:29:01 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 51s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.temu.com/cmsg_transit.html?_cmsg_biz=9010&_cmsg_channel=mail&_cmsg_locale=100~ja~JPY&msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_p_landing=1&_x_src=mail
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@32/833@56/18
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://x.com/login Browse: https://x.com/i/flow/signup

Input	Output
URL: https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1&mx=2 Model: jbxai	{ "brand":[], "contains_trigger_text":false, "trigger_text":"", "prominent_button_name":"Log in Sign up", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://x.com/shoptemu?msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_x_src=mail&_p_landing=1 Model: jbxai	{ "brand":["Temu", "Klover"], "contains_trigger_text":true, "trigger_text":"Celebrate Temu's Big Game Ad Encore with us!", "prominent_button_name":"Log in", "text_input_field_labels":["unknown"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":true, "has_visible_qrcode":false}

URL: https://x.com/i/flow/signup Model: jbxai	{ "brand":["X", "Google", "Apple"], "contains_trigger_text":true, "trigger_text":"Sign up with Google", "prominent_button_name":"Create account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://x.com/i/flow/signup Model: jbxai	{ "brand":["X", "Google", "Apple"], "contains_trigger_text":true, "trigger_text":"Sign up with Google", "prominent_button_name":"Create account", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 13:30:29 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9731950377887215
Encrypted:	false
SSDEEP:	48:8md8TAgyH4idAKZdA19ehwiZUklqehSy+3:8xPVFy
MD5:	D3687A64F9EEFD6E0E6C6D78278C0D14
SHA1:	D15889478028E0D7CEADB2366A51E2AB30AD6002
SHA-256:	52CBDA88BC4934EE681BBA0839093E06A129E0B5915A872E3D886253CD432DCC
SHA-512:	9B50ADE09ADBEA6EC87ECD2DEC8C26E647F3F4BB46475CC275A20EEAA45A8A000C3976E23177AB49C848548985A79E9EC513958B494AD3098C7B7806CD102E0A
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....%'.i...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IDY.s....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDY.s....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VDY.s....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VDY.s..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDY.s...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............A......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 4, 2024 16:30:30.237869978 CEST	192.168.2.5	1.1.1.1	0xa53f	Standard query (0)	www.temu.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:30.237869978 CEST	192.168.2.5	1.1.1.1	0x170f	Standard query (0)	www.temu.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:31.209639072 CEST	192.168.2.5	1.1.1.1	0x801	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:31.210113049 CEST	192.168.2.5	1.1.1.1	0x958e	Standard query (0)	twitter.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:32.192826986 CEST	192.168.2.5	1.1.1.1	0xc40d	Standard query (0)	x.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:32.193682909 CEST	192.168.2.5	1.1.1.1	0xd7a0	Standard query (0)	x.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:32.953319073 CEST	192.168.2.5	1.1.1.1	0x5c70	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:32.953818083 CEST	192.168.2.5	1.1.1.1	0xefc1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:33.213746071 CEST	192.168.2.5	1.1.1.1	0x2131	Standard query (0)	abs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.213948965 CEST	192.168.2.5	1.1.1.1	0xb8b	Standard query (0)	abs.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:33.215205908 CEST	192.168.2.5	1.1.1.1	0xa9c5	Standard query (0)	api.twitter.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.215357065 CEST	192.168.2.5	1.1.1.1	0xf844	Standard query (0)	api.twitter.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:33.235074997 CEST	192.168.2.5	1.1.1.1	0x274c	Standard query (0)	t.co	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.235584021 CEST	192.168.2.5	1.1.1.1	0x2c20	Standard query (0)	t.co	65	IN (0x0001)	false
Oct 4, 2024 16:30:33.238431931 CEST	192.168.2.5	1.1.1.1	0x5558	Standard query (0)	pbs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.238897085 CEST	192.168.2.5	1.1.1.1	0xe92c	Standard query (0)	pbs.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:33.250520945 CEST	192.168.2.5	1.1.1.1	0x7676	Standard query (0)	api.x.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.250811100 CEST	192.168.2.5	1.1.1.1	0x5851	Standard query (0)	api.x.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:35.584862947 CEST	192.168.2.5	1.1.1.1	0x52e8	Standard query (0)	video.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:35.584862947 CEST	192.168.2.5	1.1.1.1	0xad74	Standard query (0)	video.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:38.075210094 CEST	192.168.2.5	1.1.1.1	0x175d	Standard query (0)	abs-0.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:38.075409889 CEST	192.168.2.5	1.1.1.1	0xaf3e	Standard query (0)	abs-0.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:38.093110085 CEST	192.168.2.5	1.1.1.1	0xeb1f	Standard query (0)	abs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:38.093111038 CEST	192.168.2.5	1.1.1.1	0x6c59	Standard query (0)	abs.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:38.763937950 CEST	192.168.2.5	1.1.1.1	0x88bd	Standard query (0)	abs-0.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:38.764178038 CEST	192.168.2.5	1.1.1.1	0xe9b9	Standard query (0)	abs-0.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:43.026573896 CEST	192.168.2.5	1.1.1.1	0x2c93	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:43.030039072 CEST	192.168.2.5	1.1.1.1	0x12c5	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:44.405859947 CEST	192.168.2.5	1.1.1.1	0x9a42	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:44.406127930 CEST	192.168.2.5	1.1.1.1	0x5783	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:45.561379910 CEST	192.168.2.5	1.1.1.1	0x3b27	Standard query (0)	api.x.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:45.562280893 CEST	192.168.2.5	1.1.1.1	0x1ae5	Standard query (0)	api.x.com	65	IN (0x0001)	false
Oct 4, 2024 16:30:58.189085007 CEST	192.168.2.5	1.1.1.1	0x2f7d	Standard query (0)	pbs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:58.189261913 CEST	192.168.2.5	1.1.1.1	0x14d5	Standard query (0)	pbs.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:16.263556004 CEST	192.168.2.5	1.1.1.1	0xff22	Standard query (0)	video.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:16.263719082 CEST	192.168.2.5	1.1.1.1	0x7c45	Standard query (0)	video.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:18.977015018 CEST	192.168.2.5	1.1.1.1	0xb59c	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:18.977255106 CEST	192.168.2.5	1.1.1.1	0x2d92	Standard query (0)	play.google.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:23.597903013 CEST	192.168.2.5	1.1.1.1	0x9e7	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:23.598258972 CEST	192.168.2.5	1.1.1.1	0x1182	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:25.320208073 CEST	192.168.2.5	1.1.1.1	0x9d58	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:25.320208073 CEST	192.168.2.5	1.1.1.1	0x1da1	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:33.450490952 CEST	192.168.2.5	1.1.1.1	0xeb28	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:33.450655937 CEST	192.168.2.5	1.1.1.1	0x4fea	Standard query (0)	twitter.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:34.291913986 CEST	192.168.2.5	1.1.1.1	0xde1d	Standard query (0)	twitter.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:34.292054892 CEST	192.168.2.5	1.1.1.1	0x9373	Standard query (0)	twitter.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:34.957441092 CEST	192.168.2.5	1.1.1.1	0x5636	Standard query (0)	abs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:34.959162951 CEST	192.168.2.5	1.1.1.1	0x93fa	Standard query (0)	abs.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:35.793320894 CEST	192.168.2.5	1.1.1.1	0x25f4	Standard query (0)	video.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:35.793448925 CEST	192.168.2.5	1.1.1.1	0xae3f	Standard query (0)	video.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:35.796705008 CEST	192.168.2.5	1.1.1.1	0xc388	Standard query (0)	pbs.twimg.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:35.796962023 CEST	192.168.2.5	1.1.1.1	0x8ca8	Standard query (0)	pbs.twimg.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:39.517122984 CEST	192.168.2.5	1.1.1.1	0x4234	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:39.517810106 CEST	192.168.2.5	1.1.1.1	0xc2c3	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 4, 2024 16:31:40.987974882 CEST	192.168.2.5	1.1.1.1	0x2663	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:40.988431931 CEST	192.168.2.5	1.1.1.1	0x3d26	Standard query (0)	www.google.com	65	IN (0x0001)	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.temu.com/cmsg_transit.html?_cmsg_biz=9010&_cmsg_channel=mail&_cmsg_locale=100~ja~JPY&msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_p_landing=1&_x_src=mail

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 329

Chrome Cache Entry: 330

Chrome Cache Entry: 331

Chrome Cache Entry: 332

Chrome Cache Entry: 333

Chrome Cache Entry: 334

Chrome Cache Entry: 335

Chrome Cache Entry: 336

Chrome Cache Entry: 337

Chrome Cache Entry: 338

Chrome Cache Entry: 339

Chrome Cache Entry: 340

Chrome Cache Entry: 341

Chrome Cache Entry: 342

Chrome Cache Entry: 343

Chrome Cache Entry: 344

Chrome Cache Entry: 345

Chrome Cache Entry: 346

Chrome Cache Entry: 347

Chrome Cache Entry: 348

Chrome Cache Entry: 349

Windows Analysis Report
https://www.temu.com/cmsg_transit.html?_cmsg_biz=9010&_cmsg_channel=mail&_cmsg_locale=100~ja~JPY&msgid=100-20241001-15-B-783239451837149184-427-qj36dSf3&_p_landing=1&_x_src=mail

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 4, 2024 16:30:14.752032042 CEST	1.1.1.1	192.168.2.5	0x66b6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:14.752032042 CEST	1.1.1.1	192.168.2.5	0x66b6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:30.245250940 CEST	1.1.1.1	192.168.2.5	0xa53f	No error (0)	www.temu.com	temu-gtm.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:30.245250940 CEST	1.1.1.1	192.168.2.5	0xa53f	No error (0)	gw-c-eu-isp.temu.com		20.157.217.65	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:30.245250940 CEST	1.1.1.1	192.168.2.5	0xa53f	No error (0)	gw-c-eu-isp.temu.com		20.157.119.2	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:30.245250940 CEST	1.1.1.1	192.168.2.5	0xa53f	No error (0)	gw-c-eu-isp.temu.com		20.47.117.32	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:30.245250940 CEST	1.1.1.1	192.168.2.5	0xa53f	No error (0)	gw-c-eu-isp.temu.com		20.157.217.118	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:30.246361971 CEST	1.1.1.1	192.168.2.5	0x170f	No error (0)	www.temu.com	temu-gtm.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:31.216336966 CEST	1.1.1.1	192.168.2.5	0x801	No error (0)	twitter.com		104.244.42.193	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:32.199553013 CEST	1.1.1.1	192.168.2.5	0xc40d	No error (0)	x.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:32.960689068 CEST	1.1.1.1	192.168.2.5	0x5c70	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:32.961750984 CEST	1.1.1.1	192.168.2.5	0xefc1	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 4, 2024 16:30:33.221021891 CEST	1.1.1.1	192.168.2.5	0xb8b	No error (0)	abs.twimg.com	twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:33.221127033 CEST	1.1.1.1	192.168.2.5	0x2131	No error (0)	abs.twimg.com	twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:33.221127033 CEST	1.1.1.1	192.168.2.5	0x2131	No error (0)	twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.224426985 CEST	1.1.1.1	192.168.2.5	0xa9c5	No error (0)	api.twitter.com	tpop-api.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:33.224426985 CEST	1.1.1.1	192.168.2.5	0xa9c5	No error (0)	tpop-api.twitter.com		104.244.42.194	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.224441051 CEST	1.1.1.1	192.168.2.5	0xf844	No error (0)	api.twitter.com	tpop-api.twitter.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:33.241756916 CEST	1.1.1.1	192.168.2.5	0x274c	No error (0)	t.co		162.159.140.229	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.245537996 CEST	1.1.1.1	192.168.2.5	0x5558	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:33.245537996 CEST	1.1.1.1	192.168.2.5	0x5558	No error (0)	dualstack.twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.245862961 CEST	1.1.1.1	192.168.2.5	0xe92c	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:33.257566929 CEST	1.1.1.1	192.168.2.5	0x7676	No error (0)	api.x.com	tpop-api.x.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:33.257566929 CEST	1.1.1.1	192.168.2.5	0x7676	No error (0)	tpop-api.x.com		104.244.42.194	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:33.257744074 CEST	1.1.1.1	192.168.2.5	0x5851	No error (0)	api.x.com	tpop-api.x.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:35.592015982 CEST	1.1.1.1	192.168.2.5	0xad74	No error (0)	video.twimg.com	dualstack.video.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:35.592065096 CEST	1.1.1.1	192.168.2.5	0x52e8	No error (0)	video.twimg.com	dualstack.video.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:35.592065096 CEST	1.1.1.1	192.168.2.5	0x52e8	No error (0)	dualstack.video.twitter.map.fastly.net		146.75.52.158	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:38.087100983 CEST	1.1.1.1	192.168.2.5	0xaf3e	No error (0)	abs-0.twimg.com	abs-zero.twimg.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:38.087352037 CEST	1.1.1.1	192.168.2.5	0x175d	No error (0)	abs-0.twimg.com	abs-zero.twimg.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:38.087352037 CEST	1.1.1.1	192.168.2.5	0x175d	No error (0)	abs-zero.twimg.com		104.244.43.131	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:38.103457928 CEST	1.1.1.1	192.168.2.5	0xeb1f	No error (0)	abs.twimg.com	twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:38.103457928 CEST	1.1.1.1	192.168.2.5	0xeb1f	No error (0)	twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:38.104322910 CEST	1.1.1.1	192.168.2.5	0x6c59	No error (0)	abs.twimg.com	twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:38.773267031 CEST	1.1.1.1	192.168.2.5	0x88bd	No error (0)	abs-0.twimg.com	abs-zero.twimg.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:38.773267031 CEST	1.1.1.1	192.168.2.5	0x88bd	No error (0)	abs-zero.twimg.com		104.244.43.131	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:38.773407936 CEST	1.1.1.1	192.168.2.5	0xe9b9	No error (0)	abs-0.twimg.com	abs-zero.twimg.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:43.040262938 CEST	1.1.1.1	192.168.2.5	0x2c93	No error (0)	google.com		216.58.206.78	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:43.045212984 CEST	1.1.1.1	192.168.2.5	0x12c5	No error (0)	google.com			65	IN (0x0001)	false
Oct 4, 2024 16:30:44.413450003 CEST	1.1.1.1	192.168.2.5	0x9a42	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:44.414117098 CEST	1.1.1.1	192.168.2.5	0x5783	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 4, 2024 16:30:45.569225073 CEST	1.1.1.1	192.168.2.5	0x3b27	No error (0)	api.x.com	tpop-api.x.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:45.569225073 CEST	1.1.1.1	192.168.2.5	0x3b27	No error (0)	tpop-api.x.com		104.244.42.194	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:45.569679976 CEST	1.1.1.1	192.168.2.5	0x1ae5	No error (0)	api.x.com	tpop-api.x.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:58.202136040 CEST	1.1.1.1	192.168.2.5	0x2f7d	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:30:58.202136040 CEST	1.1.1.1	192.168.2.5	0x2f7d	No error (0)	dualstack.twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:30:58.203481913 CEST	1.1.1.1	192.168.2.5	0x14d5	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:16.270788908 CEST	1.1.1.1	192.168.2.5	0xff22	No error (0)	video.twimg.com	dualstack.video.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:16.270788908 CEST	1.1.1.1	192.168.2.5	0xff22	No error (0)	dualstack.video.twitter.map.fastly.net		146.75.52.158	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:16.271688938 CEST	1.1.1.1	192.168.2.5	0x7c45	No error (0)	video.twimg.com	dualstack.video.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:19.066654921 CEST	1.1.1.1	192.168.2.5	0xb59c	No error (0)	play.google.com		142.250.181.238	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:23.605130911 CEST	1.1.1.1	192.168.2.5	0x1182	No error (0)	google.com			65	IN (0x0001)	false
Oct 4, 2024 16:31:23.605397940 CEST	1.1.1.1	192.168.2.5	0x9e7	No error (0)	google.com		142.250.185.110	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:25.329534054 CEST	1.1.1.1	192.168.2.5	0x9d58	No error (0)	www.google.com		142.250.186.132	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:25.330259085 CEST	1.1.1.1	192.168.2.5	0x1da1	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 4, 2024 16:31:33.458161116 CEST	1.1.1.1	192.168.2.5	0xeb28	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:34.299583912 CEST	1.1.1.1	192.168.2.5	0xde1d	No error (0)	twitter.com		104.244.42.1	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:34.968144894 CEST	1.1.1.1	192.168.2.5	0x5636	No error (0)	abs.twimg.com	twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:34.968144894 CEST	1.1.1.1	192.168.2.5	0x5636	No error (0)	twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:34.970598936 CEST	1.1.1.1	192.168.2.5	0x93fa	No error (0)	abs.twimg.com	twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:35.809189081 CEST	1.1.1.1	192.168.2.5	0x25f4	No error (0)	video.twimg.com	dualstack.video.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:35.809189081 CEST	1.1.1.1	192.168.2.5	0x25f4	No error (0)	dualstack.video.twitter.map.fastly.net		146.75.52.158	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:35.810877085 CEST	1.1.1.1	192.168.2.5	0xae3f	No error (0)	video.twimg.com	dualstack.video.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:35.810966015 CEST	1.1.1.1	192.168.2.5	0xc388	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:35.810966015 CEST	1.1.1.1	192.168.2.5	0xc388	No error (0)	dualstack.twimg.twitter.map.fastly.net		146.75.52.159	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:35.811577082 CEST	1.1.1.1	192.168.2.5	0x8ca8	No error (0)	pbs.twimg.com	dualstack.twimg.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 4, 2024 16:31:39.524190903 CEST	1.1.1.1	192.168.2.5	0x4234	No error (0)	google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:39.524574041 CEST	1.1.1.1	192.168.2.5	0xc2c3	No error (0)	google.com			65	IN (0x0001)	false
Oct 4, 2024 16:31:41.046969891 CEST	1.1.1.1	192.168.2.5	0x2663	No error (0)	www.google.com		142.250.185.68	A (IP address)	IN (0x0001)	false
Oct 4, 2024 16:31:41.046984911 CEST	1.1.1.1	192.168.2.5	0x3d26	No error (0)	www.google.com			65	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:15 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:15 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143015Z-15767c5fc55dtdv4d4saq7t47n0000000cdg00000000fqd3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:15 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-04 14:30:15 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:16 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:16 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143016Z-15767c5fc552g4w83buhsr3htc0000000cqg000000008t34 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:16 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:16 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:16 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 39d43082-801e-00ac-658c-15fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143016Z-15767c5fc55lghvzbxktxfqntw0000000ca000000000m5nc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:16 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:16 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:16 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143016Z-15767c5fc55gq5fmm10nm5qqr80000000cs000000000ewx8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:16 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:16 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:16 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:16 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9d87bc4-001e-008d-138c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143016Z-15767c5fc55sdcjq8ksxt4n9mc00000001y000000000kqe2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:16 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:16 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:16 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:16 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143016Z-15767c5fc55whfstvfw43u8fp40000000ct000000000dxv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:16 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:17 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:17 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143017Z-15767c5fc55n4msds84xh4z67w00000006dg000000005gkd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:17 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:17 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:17 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143017Z-15767c5fc55qkvj6n60pxm9mbw00000001tg00000000fsn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:17 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 14:30:17 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 14:30:17 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 14:30:17 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T143017Z-15767c5fc554w2fgapsyvy8ua00000000c1g00000000rmwm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 14:30:17 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru