Edit tour

Windows Analysis Report
https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail

Overview

General Information

Sample URL:	https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail
Analysis ID:	1526250
Tags:	urlscan
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Detected non-DNS traffic on DNS port

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 3448 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2308,i,10225085181924830579,4194509225090061079,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 6504 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail" MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

cleanup

HTTP traffic detected: POST /pmm/api/pmm/defined HTTP/1.1Host: us.pftk.temu.comConnection: keep-aliveContent-Length: 557sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://www.temu.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://www.temu.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: api_uid=Cmy4GmcAbbNilQBc5yPeAg==

Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=-WrNbBA0U_R9RCsi4EyLaQ6bc8a4895cb6c3c66&from=https%3A%2F%2Fwww.temu.com%2Fcommitments.html%3Frefer_page_name%3Dhome%26refer_page_id%3D10005_1728081339569_rsx7nr56pk%26refer_page_sn%3D10005&_x_msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_x_src=mail&_x_sessn_id=uou09mbt6g&refer_page_name=commitments&refer_page_id=10210_1728081345005_woj7jbqmm2&refer_page_sn=10210	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=4rmwA1mqXgqKpYY8hEH55Qa83939501e6fdae72&from=https%3A%2F%2Fwww.temu.com%2F%3Fmsgid%3D100-20241001-15-B-783234786743422976-427-orGMX05z%26_p_landing%3D1%26is_back%3D1&_x_msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_x_src=mail&refer_page_name=home&refer_page_id=10005_1728081339569_rsx7nr56pk&refer_page_sn=10005&_x_sessn_id=uou09mbt6g	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=-WrNbBA0U_R9RCsi4EyLaQ6bc8a4895cb6c3c66&from=https%3A%2F%2Fwww.temu.com%2Fcommitments.html%3Frefer_page_name%3Dhome%26refer_page_id%3D10005_1728081339569_rsx7nr56pk%26refer_page_sn%3D10005&_x_msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_x_src=mail&_x_sessn_id=uou09mbt6g&refer_page_name=commitments&refer_page_id=10210_1728081345005_woj7jbqmm2&refer_page_sn=10210	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=4rmwA1mqXgqKpYY8hEH55Qa83939501e6fdae72&from=https%3A%2F%2Fwww.temu.com%2F%3Fmsgid%3D100-20241001-15-B-783234786743422976-427-orGMX05z%26_p_landing%3D1%26is_back%3D1&_x_msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_x_src=mail&refer_page_name=home&refer_page_id=10005_1728081339569_rsx7nr56pk&refer_page_sn=10005&_x_sessn_id=uou09mbt6g	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=1p-_linba1ArKZFFSeGwmQdb5678e905587ffe1&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Flightning-deals.html&refer_page_name=lightning-deals&refer_page_id=10132_1728081362004_3pocx1fmym&refer_page_sn=10132&_x_sessn_id=7kk2edgwwz	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=1p-_linba1ArKZFFSeGwmQdb5678e905587ffe1&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Flightning-deals.html&refer_page_name=lightning-deals&refer_page_id=10132_1728081362004_3pocx1fmym&refer_page_sn=10132&_x_sessn_id=7kk2edgwwz	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=IAUIXK27Pd0VqSBkCGLswwb91d4c706fc35bd19&from=https%3A%2F%2Fwww.temu.com%2Fsearch_result.html%3Fsearch_key%3Dwomens%2520tops%26search_method%3Dshade%26refer_page_el_sn%3D200010&refer_page_name=search_result&refer_page_id=10009_1728081373678_r3lsq5mhhx&refer_page_sn=10009&_x_sessn_id=2gf1ozf0ya	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=IAUIXK27Pd0VqSBkCGLswwb91d4c706fc35bd19&from=https%3A%2F%2Fwww.temu.com%2Fsearch_result.html%3Fsearch_key%3Dwomens%2520tops%26search_method%3Dshade%26refer_page_el_sn%3D200010&refer_page_name=search_result&refer_page_id=10009_1728081373678_r3lsq5mhhx&refer_page_sn=10009&_x_sessn_id=2gf1ozf0ya	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=Eb9emIGgYzmIvQuFdpG4Ug084155161bf53338f&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Flocal-warehouse.html&refer_page_name=Local%20Warehouse&refer_page_id=20130_1728081375097_wrwfp3nnpt&refer_page_sn=20130&_x_sessn_id=vp3skpeazn	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=Eb9emIGgYzmIvQuFdpG4Ug084155161bf53338f&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Flocal-warehouse.html&refer_page_name=Local%20Warehouse&refer_page_id=20130_1728081375097_wrwfp3nnpt&refer_page_sn=20130&_x_sessn_id=vp3skpeazn	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=Eb9emIGgYzmIvQuFdpG4Ug084155161bf53338f&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Flocal-warehouse.html&refer_page_name=Local%20Warehouse&refer_page_id=20130_1728081375097_wrwfp3nnpt&refer_page_sn=20130&_x_sessn_id=vp3skpeazn	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=L52SVeOL1wIbqofOXS37yQ78771f2af9ea3ff47&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Ffull-star.html&refer_page_name=5-Star%20Rated&refer_page_id=10443_1728081389402_63lmfjljk2&refer_page_sn=10443&_x_sessn_id=yrxdjw3dsy	HTTP Parser: No favicon
Source: https://www.temu.com/attendance/us-temufest-20278-1-a-psurl.html	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=L52SVeOL1wIbqofOXS37yQ78771f2af9ea3ff47&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Ffull-star.html&refer_page_name=5-Star%20Rated&refer_page_id=10443_1728081389402_63lmfjljk2&refer_page_sn=10443&_x_sessn_id=yrxdjw3dsy	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=RmFX-ruaF4cvWJ-jFm9jvg2911d5b29aff70265&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Fbest-sellers.html&refer_page_name=best_sellers&refer_page_id=10125_1728081399657_omro80u6tq&refer_page_sn=10125&_x_sessn_id=4gj0grva3p	HTTP Parser: No favicon
Source: https://www.temu.com/attendance/price-drop-new-15730-2-a-psurl.html	HTTP Parser: No favicon
Source: https://www.temu.com/attendance/us-temufest-20278-1-a-psurl.html	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=RmFX-ruaF4cvWJ-jFm9jvg2911d5b29aff70265&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Fbest-sellers.html&refer_page_name=best_sellers&refer_page_id=10125_1728081399657_omro80u6tq&refer_page_sn=10125&_x_sessn_id=4gj0grva3p	HTTP Parser: No favicon
Source: https://www.temu.com/attendance/price-drop-new-15730-2-a-psurl.html	HTTP Parser: No favicon
Source: https://www.temu.com/attendance/us-temufest-20278-1-a-psurl.html	HTTP Parser: No favicon
Source: https://www.temu.com/bgn_verification.html?VerifyAuthToken=RmFX-ruaF4cvWJ-jFm9jvg2911d5b29aff70265&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Fbest-sellers.html&refer_page_name=best_sellers&refer_page_id=10125_1728081399657_omro80u6tq&refer_page_sn=10125&_x_sessn_id=4gj0grva3p	HTTP Parser: No favicon
Source: https://www.temu.com/attendance/price-drop-new-15730-2-a-psurl.html	HTTP Parser: No favicon
Source: https://www.temu.com/attendance/us-temufest-20278-1-a-psurl.html	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.10:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 173.222.162.55:443 -> 192.168.2.10:50158 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.10:58225 version: TLS 1.2

Source: global traffic	TCP traffic: 192.168.2.10:57757 -> 1.1.1.1:53
Source: global traffic	TCP traffic: 192.168.2.10:55955 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 20.42.65.85
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.246.45

Source: global traffic	DNS traffic detected: DNS query: www.temu.com
Source: global traffic	DNS traffic detected: DNS query: img.kwcdn.com
Source: global traffic	DNS traffic detected: DNS query: aimg.kwcdn.com
Source: global traffic	DNS traffic detected: DNS query: static.kwcdn.com
Source: global traffic	DNS traffic detected: DNS query: dl.kwcdn.com
Source: global traffic	DNS traffic detected: DNS query: us.pftk.temu.com
Source: global traffic	DNS traffic detected: DNS query: commimg-us.kwcdn.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: static-2.kwcdn.com
Source: global traffic	DNS traffic detected: DNS query: us.thtk.temu.com
Source: global traffic	DNS traffic detected: DNS query: rewimg-us.kwcdn.com
Source: global traffic	DNS traffic detected: DNS query: google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:35:44 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingVary: Accept-EncodingVary: Accept-Encodingx-yak-request-id: 1728081344243-9e959fdf99228b991f8370d9561edfa7strict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081344243\|69cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:35:48 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingVary: Accept-EncodingVary: Accept-Encodingx-yak-request-id: 1728081348752-2e3b62e6622a6066608c54d6e48d76cfstrict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081348752\|75cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:35:50 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingVary: Accept-EncodingVary: Accept-Encodingx-yak-request-id: 1728081350064-c1ceb8a83f7af70c73b3cb2bc231f26dstrict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081350064\|72cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:35:51 GMTContent-Type: application/jsonTransfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingVary: Accept-EncodingVary: Accept-Encodingx-yak-request-id: 1728081351035-32393d5c5cdd099307287121ace79c4dstrict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081351035\|70cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:36:27 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingVary: Accept-EncodingVary: Accept-Encodingx-yak-request-id: 1728081387635-437e70e3226a780405ac08cf754bc5b1strict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081387635\|70cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:36:37 GMTContent-Type: application/json; charset=utf-8Transfer-Encoding: chunkedConnection: closeVary: Accept-EncodingVary: Accept-EncodingVary: Accept-EncodingVary: Accept-Encodingx-yak-request-id: 1728081397292-a4524036601ec8220f3f57f79df2752dstrict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081397292\|70cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:36:37 GMTContent-Type: application/json;charset=utf-8Content-Length: 48Connection: closex-yak-request-id: 1728081397270-9408328668bbdacf514ccb58e7dfb481strict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081397270\|103cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800
Source: global traffic	HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Fri, 04 Oct 2024 22:36:53 GMTContent-Type: application/json;charset=utf-8Content-Length: 48Connection: closex-yak-request-id: 1728081413646-b03f09e13ad2ca2c077a8872c5ad0795strict-transport-security: max-age=31536000content-security-policy-report-only: default-src 'none';script-src 'report-sample';report-uri /api/sec-csp/110000007/sec-gifyak-timeinfo: 1728081413646\|97cip: 8.46.123.33Alt-Svc: h3=":443"; ma=604800

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2308,i,10225085181924830579,4194509225090061079,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 --field-trial-handle=2308,i,10225085181924830579,4194509225090061079,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.2.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	1 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source: chromecache_474.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/1077_60cd8ab6cbd3b66818b6.js.map
Source: chromecache_612.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/1131_c7ad81196c2b7538fd1a.js.map
Source: chromecache_514.4.dr, chromecache_425.4.dr, chromecache_696.4.dr, chromecache_318.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/1236_52475df590a8def1d53e.js.map
Source: chromecache_542.4.dr, chromecache_661.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/1697_c2cc093fc65520402636.js.map
Source: chromecache_471.4.dr, chromecache_530.4.dr, chromecache_577.4.dr, chromecache_740.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/1962_a59cf0a0432d44f0d28e.js.map
Source: chromecache_399.4.dr, chromecache_573.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/20_81a566316b9785b3f7f7.js.map
Source: chromecache_587.4.dr, chromecache_749.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/2142_15ba23cbc1a3722ff4ef.js.map
Source: chromecache_371.4.dr, chromecache_524.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/2432_dc8dd87df7393b7ee1db.js.map
Source: chromecache_627.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/2541_ccec17becda741021c4d.js.map
Source: chromecache_411.4.dr, chromecache_496.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/2587_5363edf0b74761b3e5d5.js.map
Source: chromecache_558.4.dr, chromecache_751.4.dr, chromecache_593.4.dr, chromecache_662.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/2634_fcd15f32348b8218fa41.js.map
Source: chromecache_516.4.dr, chromecache_339.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/303_cb15ff493dab6beb3d09.js.map
Source: chromecache_668.4.dr, chromecache_421.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/323_a99c1f94b3c1e86a3551.js.map
Source: chromecache_646.4.dr, chromecache_715.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/3820_ddcdbb04a3ac0dae01a1.js.map
Source: chromecache_745.4.dr, chromecache_631.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/3968_d2f8dd56b6639c29a9e0.js.map
Source: chromecache_342.4.dr, chromecache_571.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/503_3942d836d7336413da47.js.map
Source: chromecache_641.4.dr, chromecache_564.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/5598_a1518e2e674f3a224a20.js.map
Source: chromecache_336.4.dr, chromecache_690.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/6503_4419ab33762737eab788.js.map
Source: chromecache_548.4.dr, chromecache_586.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/6848_fac221edde8cb308f084.js.map
Source: chromecache_595.4.dr, chromecache_551.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/6905_6aa22b1da20aa5c1b187.js.map
Source: chromecache_555.4.dr, chromecache_685.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/7194_daf0d7c2acb981b77a53.js.map
Source: chromecache_748.4.dr, chromecache_479.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/73_81d4843eb041e335753b.js.map
Source: chromecache_495.4.dr, chromecache_605.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/7523_8a313bed937e964b268d.js.map
Source: chromecache_333.4.dr, chromecache_517.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/7523_9ce63a9d092ac217e097.js.map
Source: chromecache_634.4.dr, chromecache_633.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/7671_8c83443bf1f5bb95f002.js.map
Source: chromecache_613.4.dr, chromecache_523.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/7940_11a8d1da764b1b9d7857.js.map
Source: chromecache_687.4.dr, chromecache_566.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/8177_c8d730b698a776202ae9.js.map
Source: chromecache_520.4.dr, chromecache_454.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/8350_00e678f4b6db810dcaa2.js.map
Source: chromecache_449.4.dr, chromecache_359.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/9105_980f2fc96317178fbd6b.js.map
Source: chromecache_384.4.dr, chromecache_346.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/912_44ab21ba33c801fe433b.js.map
Source: chromecache_450.4.dr, chromecache_544.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/9424_9c392ed87b3ed8c42da0.js.map
Source: chromecache_598.4.dr, chromecache_506.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/9595_6fd977f54ee4117b463d.js.map
Source: chromecache_473.4.dr, chromecache_594.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/9935_551959426c9fa0150891.js.map
Source: chromecache_742.4.dr, chromecache_499.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/a_u_8a29ce37c8890a9912f7.js.map
Source: chromecache_665.4.dr, chromecache_706.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/bgn_verification_d364cd95103953510a62.js.map
Source: chromecache_444.4.dr, chromecache_529.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/biz_layout_activity_coupon_popup_1d87692495e97f193a0b.js.m
Source: chromecache_753.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/biz_layout_activity_coupon_popup_412f8a869f7cefc8a0f1.js.m
Source: chromecache_363.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/biz_layout_activity_coupon_popup_6cf8e885ee86a7173c46.js.m
Source: chromecache_567.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/biz_layout_activity_download_dialog_25dc69d0698437e29b27.j
Source: chromecache_655.4.dr	String found in binary or memory: http://temudebug.com/sourcemaps/assets/js/biz_layout_activity_download_dialog_b4ed9fbcd678b5b278a8.j

Name	Source	Malicious	Reputation
http://temudebug.com/sourcemaps/assets/js/react_webpack_runtime_1cf2ad1779850a658f8d.js.map	chromecache_639.4.dr, chromecache_418.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/biz_vendors_d375db9e6f8312139837.js.map	chromecache_588.4.dr, chromecache_698.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/8177_c8d730b698a776202ae9.js.map	chromecache_687.4.dr, chromecache_566.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/912_44ab21ba33c801fe433b.js.map	chromecache_384.4.dr, chromecache_346.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/biz_vendors_ffe7393e014b653d1144.js.map	chromecache_409.4.dr, chromecache_462.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/biz_layout_sc_sidebar_881cca81e9d7a53cd8fc.js.map	chromecache_707.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/2541_ccec17becda741021c4d.js.map	chromecache_627.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/a_u_8a29ce37c8890a9912f7.js.map	chromecache_742.4.dr, chromecache_499.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/channel/local-warehouse_2aa6194820e1f369a8be.js.map	chromecache_550.4.dr, chromecache_360.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/9935_551959426c9fa0150891.js.map	chromecache_473.4.dr, chromecache_594.4.dr	false	unknown
https://aimg.kwcdn.com/upload_aimg/temu/7be318de-3f5d-4bfd-96c6-8cd397904388.png	chromecache_483.4.dr, chromecache_407.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/6905_6aa22b1da20aa5c1b187.js.map	chromecache_595.4.dr, chromecache_551.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/home-other-popup_8fb884adfed45c976094.js.map	chromecache_557.4.dr, chromecache_443.4.dr	false	unknown
https://static.kwcdn.com/m-assets/assets/js/912_44ab21ba33c801fe433b.js	chromecache_611.4.dr, chromecache_582.4.dr	false	unknown
https://aimg.kwcdn.com/upload_aimg/message/fa409a8f-6eda-455c-b4a2-e43ef39e8a79.png.slim.png	chromecache_584.4.dr, chromecache_611.4.dr, chromecache_657.4.dr, chromecache_732.4.dr, chromecache_672.4.dr, chromecache_693.4.dr	false	unknown
https://static.kwcdn.com/m-assets/assets/js/w/commitments_fed_temp_3ad3f47206974e178542.js	chromecache_672.4.dr	false	unknown
https://static.kwcdn.com/dll/assets/js/funWebWidgets/2.4.15.js	chromecache_611.4.dr, chromecache_582.4.dr, chromecache_672.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/biz_ui_notification_9a610f7148419e5ef6ef.js.map	chromecache_726.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/3820_ddcdbb04a3ac0dae01a1.js.map	chromecache_646.4.dr, chromecache_715.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/2432_dc8dd87df7393b7ee1db.js.map	chromecache_371.4.dr, chromecache_524.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/73_81d4843eb041e335753b.js.map	chromecache_748.4.dr, chromecache_479.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/biz_layout_activity_download_dialog_b4ed9fbcd678b5b278a8.j	chromecache_655.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/8350_00e678f4b6db810dcaa2.js.map	chromecache_520.4.dr, chromecache_454.4.dr	false	unknown
https://static.kwcdn.com/m-assets/assets/js/vendors_02915fcc19584eae82f8.js	chromecache_584.4.dr, chromecache_657.4.dr, chromecache_732.4.dr, chromecache_693.4.dr	false	unknown
https://static.kwcdn.com/m-assets/assets/js/w/index_e65a18a742cb7dfb.js	chromecache_582.4.dr	false	unknown
https://aimg.kwcdn.com/upload_aimg/temu/c3e5eb19-1b60-4c2b-87e1-4528fb390cbf.png.slim.png	chromecache_483.4.dr, chromecache_407.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/home-unified-popup_70ffff5fe24d1188d82c.js.map	chromecache_482.4.dr, chromecache_341.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/vendors_318404d9d3c244d8f50e.js.map	chromecache_320.4.dr, chromecache_737.4.dr	false	unknown
https://aimg.kwcdn.com/upload_aimg/temu/65e96f45-9ff5-435a-afbf-0785934809ef.png.slim.png	chromecache_407.4.dr	false	unknown
https://static.kwcdn.com/m-assets/assets/js/biz_vendors_d375db9e6f8312139837.js	chromecache_584.4.dr, chromecache_657.4.dr, chromecache_732.4.dr, chromecache_693.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/20_81a566316b9785b3f7f7.js.map	chromecache_399.4.dr, chromecache_573.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/2634_fcd15f32348b8218fa41.js.map	chromecache_558.4.dr, chromecache_751.4.dr, chromecache_593.4.dr, chromecache_662.4.dr	false	unknown
https://static.kwcdn.com/m-assets/assets/js/3820_ddcdbb04a3ac0dae01a1.js	chromecache_672.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/vendors_affc6e77fe8721cd.js.map	chromecache_328.4.dr, chromecache_453.4.dr	false	unknown
https://aimg.kwcdn.com/upload_aimg/temu/d9faa4c2-17e6-4012-bc43-179d7252c184.png.slim.png	chromecache_483.4.dr, chromecache_407.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/react_webpack_runtime_d40da5e837c34c0e19aa.js.map	chromecache_720.4.dr, chromecache_572.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/biz_vendors_5bfc1b3bc826330c7916.js.map	chromecache_606.4.dr, chromecache_518.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/503_3942d836d7336413da47.js.map	chromecache_342.4.dr, chromecache_571.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/vendors_111051a0d0a17fc1c9d7.js.map	chromecache_430.4.dr, chromecache_543.4.dr	false	unknown
http://temudebug.com/sourcemaps/assets/js/biz_layout_activity_coupon_popup_412f8a869f7cefc8a0f1.js.m	chromecache_753.4.dr	false	unknown

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
152.199.19.158	cs396.wpc.thetacdn.net	United States	15133	EDGECASTUS	false
20.33.59.10	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
4.157.73.169	thtk-us.temu.com	United States	3356	LEVEL3US	false
20.157.217.118	gw-c-eu-isp.temu.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.149.234.104	pftk-us.temu.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.186.110	google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1526250
Start date and time:	2024-10-05 00:34:31 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@26/687@48/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Browse: https://www.temu.com/channel/lightning-deals.html Browse: https://www.temu.com/channel/local-warehouse.html Browse: https://www.temu.com/search_result.html?search_key=womens%20tops&search_method=shade&refer_page_el_sn=200010 Browse: https://www.temu.com/attendance/us-temufest-20278-1-a-psurl.html Browse: https://www.temu.com/channel/full-star.html Browse: https://www.temu.com/channel/best-sellers.html Browse: https://www.temu.com/attendance/price-drop-new-15730-2-a-psurl.html

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.210.172	true	false	unknown
google.com	142.250.186.110	true	false	unknown
pftk-us.temu.com	52.149.234.104	true	false	unknown
gw-c-eu-isp.temu.com	20.157.217.118	true	false	unknown
thtk-us.temu.com	4.157.73.169	true	false	unknown
www.google.com	142.250.184.196	true	false	unknown
cs396.wpc.thetacdn.net	152.199.19.158	true	false	unknown
aimg.kwcdn.com	unknown	unknown	false	unknown
www.temu.com	unknown	unknown	false	unknown
dl.kwcdn.com	unknown	unknown	false	unknown
img.kwcdn.com	unknown	unknown	false	unknown
static.kwcdn.com	unknown	unknown	false	unknown
us.pftk.temu.com	unknown	unknown	false	unknown
commimg-us.kwcdn.com	unknown	unknown	false	unknown
static-2.kwcdn.com	unknown	unknown	false	unknown
us.thtk.temu.com	unknown	unknown	false	unknown
rewimg-us.kwcdn.com	unknown	unknown	false	unknown

Name	Malicious	Reputation
https://img.kwcdn.com/product/fancy/2f420aa5-6825-4ae8-95b7-b74899d07572.jpg?imageView2/2/w/500/q/70/format/webp	false	unknown
https://www.temu.com/channel/local-warehouse.html	false	unknown
https://www.temu.com/api/bg/buffon/fuji/region/pay/icon	false	unknown
https://www.temu.com/api/poppy/v1/title_bar_recommend?scene=local_warehouse_rec	false	unknown
https://www.temu.com/channel/lightning-deals.html?is_back=1	false	unknown
https://www.temu.com/api/poppy/v1/shade_words?scene=shade_words	false	unknown
https://www.temu.com/bgn_verification.html?VerifyAuthToken=IAUIXK27Pd0VqSBkCGLswwb91d4c706fc35bd19&from=https%3A%2F%2Fwww.temu.com%2Fsearch_result.html%3Fsearch_key%3Dwomens%2520tops%26search_method%3Dshade%26refer_page_el_sn%3D200010&refer_page_name=search_result&refer_page_id=10009_1728081373678_r3lsq5mhhx&refer_page_sn=10009&_x_sessn_id=2gf1ozf0ya	false	unknown
https://img.kwcdn.com/product/fancy/2819aa35-0767-4284-b861-b3bdd9837a89.jpg?imageView2/2/w/250/q/10/format/webp	false	unknown
https://img.kwcdn.com/product/fancy/3bd33bd5-7063-4f7a-8df1-ee0f63031ea9.jpg?imageView2/2/w/500/q/70/format/webp	false	unknown
https://img.kwcdn.com/product/Fancyalgo/VirtualModelMatting/b750e755ee31edda9795f1fa51f2d44d.jpg?imageView2/2/w/500/q/70/format/webp	false	unknown
https://www.temu.com/api/passport/token/touch	false	unknown
https://www.temu.com/api/bg/bg-uranus-api/uranus_cart/user_cart_num?is_back=1	false	unknown
https://img.kwcdn.com/product/fancy/1d5bcf07-d2e6-44ac-9c9a-ae159aa44c1a.jpg?imageView2/2/w/500/q/70/format/webp	false	unknown
https://www.temu.com/?ws-titan-request-sign=dee0ea73	false	unknown
https://www.temu.com/api/passport/token/touch?is_back=1	false	unknown
https://img.kwcdn.com/product/fancy/2819aa35-0767-4284-b861-b3bdd9837a89.jpg?imageView2/2/w/500/q/70/format/webp	false	unknown
https://www.temu.com/api/phantom/vc_pre_ck	false	unknown
https://www.temu.com/api/phantom/dm/wl/cg	false	unknown
https://www.temu.com/api/server/_stm?t=1728081375143	false	unknown
https://img.kwcdn.com/product/fancy/20a7fded-cbc7-4da0-8e59-b9e3b621690e.jpg?imageView2/2/w/500/q/70/format/webp	false	unknown
https://www.temu.com/bgn_verification.html?VerifyAuthToken=L52SVeOL1wIbqofOXS37yQ78771f2af9ea3ff47&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Ffull-star.html&refer_page_name=5-Star%20Rated&refer_page_id=10443_1728081389402_63lmfjljk2&refer_page_sn=10443&_x_sessn_id=yrxdjw3dsy	false	unknown
https://www.temu.com/api/phantom/xg/pfb/b	false	unknown
https://img.kwcdn.com/product/fancy/2f420aa5-6825-4ae8-95b7-b74899d07572.jpg?imageView2/2/w/250/q/10/format/webp	false	unknown
https://www.temu.com/api/poppy/v1/search?scene=search	false	unknown
https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail	false	unknown
https://www.temu.com/api/bg/huygens/region/list	false	unknown
https://www.temu.com/api/bg/gentian/flash_sale	false	unknown
https://img.kwcdn.com/product/fancy/1d5bcf07-d2e6-44ac-9c9a-ae159aa44c1a.jpg?imageView2/2/w/250/q/10/format/webp	false	unknown
https://www.temu.com/bgn_verification.html?VerifyAuthToken=1p-_linba1ArKZFFSeGwmQdb5678e905587ffe1&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Flightning-deals.html&refer_page_name=lightning-deals&refer_page_id=10132_1728081362004_3pocx1fmym&refer_page_sn=10132&_x_sessn_id=7kk2edgwwz	false	unknown
https://www.temu.com/bgn_verification.html?VerifyAuthToken=-WrNbBA0U_R9RCsi4EyLaQ6bc8a4895cb6c3c66&from=https%3A%2F%2Fwww.temu.com%2Fcommitments.html%3Frefer_page_name%3Dhome%26refer_page_id%3D10005_1728081339569_rsx7nr56pk%26refer_page_sn%3D10005&_x_msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_x_src=mail&_x_sessn_id=uou09mbt6g&refer_page_name=commitments&refer_page_id=10210_1728081345005_woj7jbqmm2&refer_page_sn=10210	false	unknown
https://static-2.kwcdn.com/m-assets/assets/css/biz_vendors-0c7709ba7c6e8781bbc4.css	false	unknown
https://static-2.kwcdn.com/m-assets/assets/js/1962_a59cf0a0432d44f0d28e.js	false	unknown
https://us.pftk.temu.com/pmm/api/pmm/front_err	false	unknown
https://img.kwcdn.com/product/fancy/194fb110-4d63-4840-be1b-6f19f9494ee6.jpg?imageView2/2/w/500/q/70/format/webp	false	unknown
https://us.pftk.temu.com/pmm/api/pmm/api	false	unknown
https://www.temu.com/api/server/_stm?t=1728081362061	false	unknown
https://www.temu.com/api/tmod/lizard/sensitive/recognize	false	unknown

Input	Output
URL: https://www.temu.com/channel/best-sellers.html Model: jbxai	{ "brand":[], "contains_trigger_text":true, "trigger_text":"Slide to complete the puzzle", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.temu.com/bgn_verification.html?VerifyAuthToken=RmFX-ruaF4cvWJ-jFm9jvg2911d5b29aff70265&from=https%3A%2F%2Fwww.temu.com%2Fchannel%2Fbest-sellers.html&refer_page_name=best_sellers&refer_page_id=10125_1728081399657_omro80u6tq&refer_page_sn=10125& Model: jbxai	{ "brand":[], "contains_trigger_text":true, "trigger_text":"Slide to complete the puzzle", "prominent_button_name":"unknown", "text_input_field_labels":"unknown", "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

URL: https://www.temu.com/commitments.html?_x_msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_x_src=mail&refer_page_name=home&refer_page_id=10005_1728081339569_rsx7nr56pk&refer_page_sn=10005&_x_sessn_id=uou09mbt6g Model: jbxai	{ "brand":["Temu"], "contains_trigger_text":true, "trigger_text":"Security & Privacy", "prominent_button_name":"Security & Privacy", "text_input_field_labels":["Card information is secure and uncompromised", "Temu follows the Payment Card Industry Data Security Standard (PCI DSS) and other security standards when handling card data", "All data is encrypted"], "pdf_icon_visible":false, "has_visible_captcha":false, "has_urgent_text":false, "has_visible_qrcode":false}

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 4 21:35:30 2024, atime=Mon Oct 2 20:46:57 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.976618934651232
Encrypted:	false
SSDEEP:	48:8ZpbdRTUeHUidAKZdA1uehwiZUklqehHy+3:8ZpYaoy
MD5:	BBB9D17DD1AB6F41D1204AF6D5B1F497
SHA1:	B65BBF3F4363E074B783165A4798C22E8658130B
SHA-256:	6EFDF5CFA1331E8983B790748004C8119A70540A64605012E19871F8F8CEC522
SHA-512:	A7F50F49F02FB3152BA2CD10BEAEBDA79C5E82730BD748ADF432076A8C9F6443295ED4EB7600A94D25EF642A2FC7CC6750F7C4324831B4549E91D30940126387
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....r.........y... w......................1....P.O. .:i.....+00.../C:\.....................1.....EW$O..PROGRA~1..t......O.IDYm.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VDYm.....L.....................p+j.G.o.o.g.l.e.....T.1.....EW.L..Chrome..>......CW.VDYm.....M......................k..C.h.r.o.m.e.....`.1.....EW.L..APPLIC~1..H......CW.VDYm............................k..A.p.p.l.i.c.a.t.i.o.n.....n.2. w..BW. .CHROME~1.EXE..R......CW.VDYo.....N.......................3.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............0......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 5, 2024 00:35:30.208950996 CEST	192.168.2.10	1.1.1.1	0xa336	Standard query (0)	www.temu.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:30.211714983 CEST	192.168.2.10	1.1.1.1	0xf244	Standard query (0)	www.temu.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:31.434653044 CEST	192.168.2.10	1.1.1.1	0x47b3	Standard query (0)	img.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.434847116 CEST	192.168.2.10	1.1.1.1	0x12ea	Standard query (0)	img.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:31.441909075 CEST	192.168.2.10	1.1.1.1	0xdce8	Standard query (0)	aimg.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.442905903 CEST	192.168.2.10	1.1.1.1	0xe8f1	Standard query (0)	aimg.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:31.444345951 CEST	192.168.2.10	1.1.1.1	0x471e	Standard query (0)	static.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.446980953 CEST	192.168.2.10	1.1.1.1	0x707c	Standard query (0)	static.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:31.478987932 CEST	192.168.2.10	1.1.1.1	0x380a	Standard query (0)	dl.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.479263067 CEST	192.168.2.10	1.1.1.1	0xc38a	Standard query (0)	dl.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:31.488948107 CEST	192.168.2.10	1.1.1.1	0x4a7c	Standard query (0)	us.pftk.temu.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.489095926 CEST	192.168.2.10	1.1.1.1	0xf204	Standard query (0)	us.pftk.temu.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:32.690185070 CEST	192.168.2.10	1.1.1.1	0xe2e5	Standard query (0)	commimg-us.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:32.690995932 CEST	192.168.2.10	1.1.1.1	0xc33f	Standard query (0)	commimg-us.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:33.632081985 CEST	192.168.2.10	1.1.1.1	0xeb76	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:33.633048058 CEST	192.168.2.10	1.1.1.1	0x30d8	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:33.722845078 CEST	192.168.2.10	1.1.1.1	0x4e1b	Standard query (0)	static-2.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:33.723005056 CEST	192.168.2.10	1.1.1.1	0xc0b1	Standard query (0)	static-2.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:36.510977030 CEST	192.168.2.10	1.1.1.1	0x185f	Standard query (0)	aimg.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.511269093 CEST	192.168.2.10	1.1.1.1	0x40c7	Standard query (0)	aimg.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:36.511969090 CEST	192.168.2.10	1.1.1.1	0xf8e	Standard query (0)	us.pftk.temu.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.512233019 CEST	192.168.2.10	1.1.1.1	0xf7fa	Standard query (0)	us.pftk.temu.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:36.513868093 CEST	192.168.2.10	1.1.1.1	0x9475	Standard query (0)	img.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.514482975 CEST	192.168.2.10	1.1.1.1	0x3e3c	Standard query (0)	img.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:38.288487911 CEST	192.168.2.10	1.1.1.1	0x9988	Standard query (0)	commimg-us.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:38.288710117 CEST	192.168.2.10	1.1.1.1	0x2cab	Standard query (0)	commimg-us.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:38.292202950 CEST	192.168.2.10	1.1.1.1	0xa2f0	Standard query (0)	static.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:38.292375088 CEST	192.168.2.10	1.1.1.1	0xb514	Standard query (0)	static.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:41.133349895 CEST	192.168.2.10	1.1.1.1	0x1034	Standard query (0)	us.thtk.temu.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:41.133564949 CEST	192.168.2.10	1.1.1.1	0x988c	Standard query (0)	us.thtk.temu.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:42.941137075 CEST	192.168.2.10	1.1.1.1	0xe8a6	Standard query (0)	www.temu.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:42.941287994 CEST	192.168.2.10	1.1.1.1	0x2961	Standard query (0)	www.temu.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:43.179352999 CEST	192.168.2.10	1.1.1.1	0xa6f5	Standard query (0)	static-2.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:43.179653883 CEST	192.168.2.10	1.1.1.1	0xaef2	Standard query (0)	static-2.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:44.421113968 CEST	192.168.2.10	1.1.1.1	0xfc9c	Standard query (0)	rewimg-us.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:44.421113968 CEST	192.168.2.10	1.1.1.1	0x8c39	Standard query (0)	rewimg-us.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:47.599476099 CEST	192.168.2.10	1.1.1.1	0x78fc	Standard query (0)	rewimg-us.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:47.599632978 CEST	192.168.2.10	1.1.1.1	0x8a4f	Standard query (0)	rewimg-us.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:49.605201960 CEST	192.168.2.10	1.1.1.1	0x2758	Standard query (0)	google.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:49.605458975 CEST	192.168.2.10	1.1.1.1	0xdbf9	Standard query (0)	google.com	65	IN (0x0001)	false
Oct 5, 2024 00:35:50.615809917 CEST	192.168.2.10	1.1.1.1	0xe3c8	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:50.616074085 CEST	192.168.2.10	1.1.1.1	0xe8da	Standard query (0)	www.google.com	65	IN (0x0001)	false
Oct 5, 2024 00:36:31.548151016 CEST	192.168.2.10	1.1.1.1	0x38e5	Standard query (0)	us.pftk.temu.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:31.548151016 CEST	192.168.2.10	1.1.1.1	0x72e2	Standard query (0)	us.pftk.temu.com	65	IN (0x0001)	false
Oct 5, 2024 00:36:42.295964003 CEST	192.168.2.10	1.1.1.1	0x559c	Standard query (0)	aimg.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:42.295964003 CEST	192.168.2.10	1.1.1.1	0x42ef	Standard query (0)	aimg.kwcdn.com	65	IN (0x0001)	false
Oct 5, 2024 00:36:47.535721064 CEST	192.168.2.10	1.1.1.1	0xa2b7	Standard query (0)	static.kwcdn.com	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:47.536031008 CEST	192.168.2.10	1.1.1.1	0xb0e5	Standard query (0)	static.kwcdn.com	65	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 5, 2024 00:35:30.217531919 CEST	1.1.1.1	192.168.2.10	0xa336	No error (0)	www.temu.com	temu-gtm.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:30.217531919 CEST	1.1.1.1	192.168.2.10	0xa336	No error (0)	gw-c-eu-isp.temu.com		20.157.217.118	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:30.217531919 CEST	1.1.1.1	192.168.2.10	0xa336	No error (0)	gw-c-eu-isp.temu.com		20.157.119.2	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:30.217531919 CEST	1.1.1.1	192.168.2.10	0xa336	No error (0)	gw-c-eu-isp.temu.com		20.47.117.32	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:30.217531919 CEST	1.1.1.1	192.168.2.10	0xa336	No error (0)	gw-c-eu-isp.temu.com		20.157.217.65	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:30.220619917 CEST	1.1.1.1	192.168.2.10	0xf244	No error (0)	www.temu.com	temu-gtm.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.443178892 CEST	1.1.1.1	192.168.2.10	0x47b3	No error (0)	img.kwcdn.com	img-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.443178892 CEST	1.1.1.1	192.168.2.10	0x47b3	No error (0)	cs396.wpc.thetacdn.net		152.199.19.158	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.445072889 CEST	1.1.1.1	192.168.2.10	0x12ea	No error (0)	img.kwcdn.com	img-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.450629950 CEST	1.1.1.1	192.168.2.10	0xdce8	No error (0)	aimg.kwcdn.com	aimg-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.451406956 CEST	1.1.1.1	192.168.2.10	0xe8f1	No error (0)	aimg.kwcdn.com	aimg-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.454665899 CEST	1.1.1.1	192.168.2.10	0x471e	No error (0)	static.kwcdn.com	static-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.456121922 CEST	1.1.1.1	192.168.2.10	0x707c	No error (0)	static.kwcdn.com	static-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.499699116 CEST	1.1.1.1	192.168.2.10	0xc38a	No error (0)	dl.kwcdn.com	dl.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.499799967 CEST	1.1.1.1	192.168.2.10	0x380a	No error (0)	dl.kwcdn.com	dl.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.502516985 CEST	1.1.1.1	192.168.2.10	0x4a7c	No error (0)	us.pftk.temu.com	pftk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:31.502516985 CEST	1.1.1.1	192.168.2.10	0x4a7c	No error (0)	pftk-us.temu.com		52.149.234.104	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.502516985 CEST	1.1.1.1	192.168.2.10	0x4a7c	No error (0)	pftk-us.temu.com		20.33.59.10	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.502516985 CEST	1.1.1.1	192.168.2.10	0x4a7c	No error (0)	pftk-us.temu.com		20.185.74.90	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.502516985 CEST	1.1.1.1	192.168.2.10	0x4a7c	No error (0)	pftk-us.temu.com		20.33.55.27	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:31.507033110 CEST	1.1.1.1	192.168.2.10	0xf204	No error (0)	us.pftk.temu.com	pftk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:32.697942972 CEST	1.1.1.1	192.168.2.10	0xe2e5	No error (0)	commimg-us.kwcdn.com	commimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:32.697957993 CEST	1.1.1.1	192.168.2.10	0xc33f	No error (0)	commimg-us.kwcdn.com	commimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:33.638825893 CEST	1.1.1.1	192.168.2.10	0xeb76	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:33.639734983 CEST	1.1.1.1	192.168.2.10	0x30d8	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 5, 2024 00:35:33.730937004 CEST	1.1.1.1	192.168.2.10	0x4e1b	No error (0)	static-2.kwcdn.com	static-2-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:33.730937004 CEST	1.1.1.1	192.168.2.10	0x4e1b	No error (0)	cs396.wpc.thetacdn.net		152.199.19.158	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:33.731138945 CEST	1.1.1.1	192.168.2.10	0xc0b1	No error (0)	static-2.kwcdn.com	static-2-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:36.520325899 CEST	1.1.1.1	192.168.2.10	0x40c7	No error (0)	aimg.kwcdn.com	aimg-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:36.520473957 CEST	1.1.1.1	192.168.2.10	0x185f	No error (0)	aimg.kwcdn.com	aimg-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:36.521965027 CEST	1.1.1.1	192.168.2.10	0x9475	No error (0)	img.kwcdn.com	img-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:36.521965027 CEST	1.1.1.1	192.168.2.10	0x9475	No error (0)	cs396.wpc.thetacdn.net		152.199.19.158	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.522979021 CEST	1.1.1.1	192.168.2.10	0x3e3c	No error (0)	img.kwcdn.com	img-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:36.543277025 CEST	1.1.1.1	192.168.2.10	0xf8e	No error (0)	us.pftk.temu.com	pftk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:36.543277025 CEST	1.1.1.1	192.168.2.10	0xf8e	No error (0)	pftk-us.temu.com		52.149.234.104	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.543277025 CEST	1.1.1.1	192.168.2.10	0xf8e	No error (0)	pftk-us.temu.com		20.185.74.90	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.543277025 CEST	1.1.1.1	192.168.2.10	0xf8e	No error (0)	pftk-us.temu.com		20.33.55.27	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.543277025 CEST	1.1.1.1	192.168.2.10	0xf8e	No error (0)	pftk-us.temu.com		20.33.59.10	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:36.544781923 CEST	1.1.1.1	192.168.2.10	0xf7fa	No error (0)	us.pftk.temu.com	pftk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:38.295562029 CEST	1.1.1.1	192.168.2.10	0x9988	No error (0)	commimg-us.kwcdn.com	commimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:38.296273947 CEST	1.1.1.1	192.168.2.10	0x2cab	No error (0)	commimg-us.kwcdn.com	commimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:38.299221039 CEST	1.1.1.1	192.168.2.10	0xa2f0	No error (0)	static.kwcdn.com	static-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:38.299294949 CEST	1.1.1.1	192.168.2.10	0xb514	No error (0)	static.kwcdn.com	static-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:41.142316103 CEST	1.1.1.1	192.168.2.10	0x1034	No error (0)	us.thtk.temu.com	thtk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:41.142316103 CEST	1.1.1.1	192.168.2.10	0x1034	No error (0)	thtk-us.temu.com		4.157.73.169	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:41.142316103 CEST	1.1.1.1	192.168.2.10	0x1034	No error (0)	thtk-us.temu.com		20.237.106.215	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:41.142316103 CEST	1.1.1.1	192.168.2.10	0x1034	No error (0)	thtk-us.temu.com		20.33.55.169	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:41.142316103 CEST	1.1.1.1	192.168.2.10	0x1034	No error (0)	thtk-us.temu.com		20.33.53.24	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:41.142316103 CEST	1.1.1.1	192.168.2.10	0x1034	No error (0)	thtk-us.temu.com		20.33.41.22	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:41.142316103 CEST	1.1.1.1	192.168.2.10	0x1034	No error (0)	thtk-us.temu.com		52.147.223.216	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:41.155960083 CEST	1.1.1.1	192.168.2.10	0x988c	No error (0)	us.thtk.temu.com	thtk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:42.947700024 CEST	1.1.1.1	192.168.2.10	0xe8a6	No error (0)	www.temu.com	temu-gtm.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:42.947700024 CEST	1.1.1.1	192.168.2.10	0xe8a6	No error (0)	gw-c-eu-isp.temu.com		20.157.217.118	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:42.947700024 CEST	1.1.1.1	192.168.2.10	0xe8a6	No error (0)	gw-c-eu-isp.temu.com		20.47.117.32	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:42.947700024 CEST	1.1.1.1	192.168.2.10	0xe8a6	No error (0)	gw-c-eu-isp.temu.com		20.157.119.2	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:42.947700024 CEST	1.1.1.1	192.168.2.10	0xe8a6	No error (0)	gw-c-eu-isp.temu.com		20.157.217.65	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:42.948507071 CEST	1.1.1.1	192.168.2.10	0x2961	No error (0)	www.temu.com	temu-gtm.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:43.186449051 CEST	1.1.1.1	192.168.2.10	0xa6f5	No error (0)	static-2.kwcdn.com	static-2-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:43.186449051 CEST	1.1.1.1	192.168.2.10	0xa6f5	No error (0)	cs396.wpc.thetacdn.net		152.199.19.158	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:43.213757992 CEST	1.1.1.1	192.168.2.10	0xaef2	No error (0)	static-2.kwcdn.com	static-2-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:44.441427946 CEST	1.1.1.1	192.168.2.10	0x8c39	No error (0)	rewimg-us.kwcdn.com	rewimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:44.442043066 CEST	1.1.1.1	192.168.2.10	0xfc9c	No error (0)	rewimg-us.kwcdn.com	rewimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:45.081206083 CEST	1.1.1.1	192.168.2.10	0x9e99	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:45.081206083 CEST	1.1.1.1	192.168.2.10	0x9e99	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:47.619688034 CEST	1.1.1.1	192.168.2.10	0x78fc	No error (0)	rewimg-us.kwcdn.com	rewimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:47.620697021 CEST	1.1.1.1	192.168.2.10	0x8a4f	No error (0)	rewimg-us.kwcdn.com	rewimg-us.kwcdn.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:35:49.614509106 CEST	1.1.1.1	192.168.2.10	0x2758	No error (0)	google.com		142.250.186.110	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:35:49.614620924 CEST	1.1.1.1	192.168.2.10	0xdbf9	No error (0)	google.com			65	IN (0x0001)	false
Oct 5, 2024 00:35:50.624684095 CEST	1.1.1.1	192.168.2.10	0xe8da	No error (0)	www.google.com			65	IN (0x0001)	false
Oct 5, 2024 00:35:50.625572920 CEST	1.1.1.1	192.168.2.10	0xe3c8	No error (0)	www.google.com		142.250.184.196	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:31.556106091 CEST	1.1.1.1	192.168.2.10	0x38e5	No error (0)	us.pftk.temu.com	pftk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:36:31.556106091 CEST	1.1.1.1	192.168.2.10	0x38e5	No error (0)	pftk-us.temu.com		20.33.59.10	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:31.556106091 CEST	1.1.1.1	192.168.2.10	0x38e5	No error (0)	pftk-us.temu.com		52.149.234.104	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:31.556106091 CEST	1.1.1.1	192.168.2.10	0x38e5	No error (0)	pftk-us.temu.com		20.33.55.27	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:31.556106091 CEST	1.1.1.1	192.168.2.10	0x38e5	No error (0)	pftk-us.temu.com		20.185.74.90	A (IP address)	IN (0x0001)	false
Oct 5, 2024 00:36:31.556122065 CEST	1.1.1.1	192.168.2.10	0x72e2	No error (0)	us.pftk.temu.com	pftk-us.temu.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:36:42.303062916 CEST	1.1.1.1	192.168.2.10	0x42ef	No error (0)	aimg.kwcdn.com	aimg-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:36:42.303462029 CEST	1.1.1.1	192.168.2.10	0x559c	No error (0)	aimg.kwcdn.com	aimg-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:36:47.544579983 CEST	1.1.1.1	192.168.2.10	0xb0e5	No error (0)	static.kwcdn.com	static-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 5, 2024 00:36:47.547075987 CEST	1.1.1.1	192.168.2.10	0xa2b7	No error (0)	static.kwcdn.com	static-kwcdn-com.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:28 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:28 UTC	540	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:28 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 30 Sep 2024 13:16:38 GMT ETag: "0x8DCE1521DF74B57" x-ms-request-id: 90766f9b-701e-006f-578c-15afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223528Z-15767c5fc554wklc0x4mc5pq0w0000000dg000000000azwt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:28 UTC	15844	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e Data Ascii: "0" /> </L> <R> <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" />
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 20 20 3c 53 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 53 54 3e 0d 0a 3c 2f 52 3e 0d 0a 3c 24 21 23 3e 31 30 38 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 Data Ascii: <ST> <S T="1" /> </ST></R><$!#>10820v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-781
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 20 54 3d 22 55 36 34 22 20 49 3d 22 38 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 45 76 65 6e 74 73 5f 41 76 67 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 Data Ascii: T="U64" I="8" O="false" N="Events_Avg"> <S T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32"
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f Data Ascii: "0" O="false" N="Count_CreateCard_ValidPersona_False"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Co
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 20 20 20 20 3c 53 20 54 3d 22 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a Data Ascii: <S T="31" /> </C> </C> <C T="U32" I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C>
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 Data Ascii: <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMillisec
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e Data Ascii: R> <V V="0" T="I32" /> </R> </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIn
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 Data Ascii: R> </O> </F> <F T="6"> <O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L>
2024-10-04 22:35:28 UTC	16384	IN	Data Raw: 54 3d 22 36 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c Data Ascii: T="6"> <O T="EQ"> <L> <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:29 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 4b0a31e7-c01e-00ad-448c-15a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223529Z-15767c5fc55lghvzbxktxfqntw0000000cw000000000a8g4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:29 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:29 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:29 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:29 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: b9d87bc4-001e-008d-138c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223529Z-15767c5fc55n4msds84xh4z67w00000006ug00000000f4vm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:29 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:29 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:29 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:29 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b9d87bc3-001e-008d-128c-15d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223529Z-15767c5fc55xsgnlxyxy40f4m00000000d0000000000krb3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:29 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 310

Chrome Cache Entry: 311

Chrome Cache Entry: 312

Chrome Cache Entry: 313

Chrome Cache Entry: 314

Chrome Cache Entry: 315

Chrome Cache Entry: 316

Chrome Cache Entry: 317

Chrome Cache Entry: 318

Chrome Cache Entry: 319

Chrome Cache Entry: 320

Chrome Cache Entry: 321

Chrome Cache Entry: 322

Chrome Cache Entry: 323

Chrome Cache Entry: 324

Chrome Cache Entry: 325

Chrome Cache Entry: 326

Chrome Cache Entry: 327

Chrome Cache Entry: 328

Chrome Cache Entry: 329

Chrome Cache Entry: 330

Windows Analysis Report
https://www.temu.com/?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:29 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:29 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:29 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 39d43082-801e-00ac-658c-15fd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223529Z-15767c5fc55xsgnlxyxy40f4m00000000d2g00000000a93b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:29 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:29 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:29 UTC	563	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:29 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 1cc2ff82-e01e-0071-478c-1508e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223529Z-15767c5fc55852fxfeh7csa2dn0000000cz000000000stzh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:29 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:30 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:30 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: aa8826a4-b01e-0053-608c-15cdf8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223530Z-15767c5fc55jdxmppy6cmd24bn00000005eg0000000051f2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:30 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:30 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:30 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 757ce4f4-401e-000a-128c-154a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223530Z-15767c5fc5546rn6ch9zv310e0000000063g00000000e2xe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:30 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:30 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:30 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 24b39cfc-301e-0096-2a8c-15e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223530Z-15767c5fc55w69c2zvnrz0gmgw0000000db000000000m0aq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:30 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:30 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:30 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: b2393cc3-501e-005b-768c-15d7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223530Z-15767c5fc55gs96cphvgp5f5vc0000000d2g00000000bq1y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:30 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:30 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:30 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:30 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 3a0dc1eb-601e-0032-608c-15eebb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223530Z-15767c5fc55852fxfeh7csa2dn0000000d3000000000958z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:30 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:30 UTC	736	OUT	GET /?msgid=100-20241001-15-B-783234786743422976-427-orGMX05z&_p_landing=1&_x_src=mail HTTP/1.1 Host: www.temu.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-10-04 22:35:31 UTC	3429	IN	HTTP/1.1 200 OK Server: nginx Date: Fri, 04 Oct 2024 22:35:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Vary: Accept-Encoding Content-Language: en Surrogate-Control: no-store Cache-Control: no-cache, must-revalidate, proxy-revalidate, max-age=0 Pragma: no-cache Expires: 0 X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff Reporting-Endpoints: default="https://www.temu.com/api/temu-fe-performance/reporting-api" X-Accel-Buffering: no x-yak-request-id: 1728081331033-cf4583074218021cdc80748ba1598f7d strict-transport-security: max-age=31536000 Content-Security-Policy-Report-Only: default-src temu: .temu.com .kwcdn.com wss://.temu.com .paypal.com .googleapis.com .gstatic.com .googletagmanager.com .google-analytics.com .analytics.google.com .doubleclick.net .google.com .googlesyndication.com .googleusercontent.com www.googleadservices.com www.google.cn www.google.com.hk www.google.co.uk www.google.ca www.google.com.au www.google.co.nz google.com connect.facebook.net www.facebook.com appleid.cdn-apple.com socialplugin.facebook.net .cash.app .forter.com www.paypalobjects.com .braintree-api.com .braintreegateway.com cash-f.squarecdn.com api.squareup.com api.lab.amplitude.com .paidy.com .cardinalcommerce.com .stripe.com d3nocrch4qti4v.cloudfront.net duuytoqss3gu4.cloudfront.net df45ay5pw60dy.cloudfront.net d2o5idwacg3gyw.cloudfront.net d3lqotgbn3npr.cloudfront.net d6rak4b14t5gp.cloudfront.net dlthst9q2beh8.cloudfront.net o160250.ingest.sentry.io .pagoefectivo.pe wauth.teledit.com blob: data: 'unsafe-eval' 'unsafe-inline' 'wasm-unsafe [TRUNCATED] Content-Security-Policy: default-src temu: .temu.com .kwcdn.com wss://.temu.com .paypal.com .googleapis.com .gstatic.com .googletagmanager.com .google-analytics.com .analytics.google.com .doubleclick.net .google.com .googlesyndication.com .googleusercontent.com www.googleadservices.com www.google.cn www.google.com.hk www.google.co.uk www.google.ca www.google.com.au www.google.co.nz google.com connect.facebook.net www.facebook.com appleid.cdn-apple.com socialplugin.facebook.net .cash.app .forter.com www.paypalobjects.com .braintree-api.com .braintreegateway.com cash-f.squarecdn.com api.squareup.com api.lab.amplitude.com .paidy.com .cardinalcommerce.com .stripe.com d3nocrch4qti4v.cloudfront.net duuytoqss3gu4.cloudfront.net df45ay5pw60dy.cloudfront.net d2o5idwacg3gyw.cloudfront.net d3lqotgbn3npr.cloudfront.net d6rak4b14t5gp.cloudfront.net dlthst9q2beh8.cloudfront.net o160250.ingest.sentry.io .pagoefectivo.pe wauth.teledit.com blob: data: 'unsafe-eval' 'unsafe-inline' 'wasm-unsafe-eval'; repo [TRUNCATED] vary: User-Agent Referrer-Policy: strict-origin-when-cross-origin x-frame-options: SAMEORIGIN Set-Cookie: api_uid=Cmy4GmcAbbNilQBc5yPeAg==; expires=Sat, 04-Oct-25 22:35:31 GMT; domain=.temu.com; path=/; secure cip: 8.46.123.33 Alt-Svc: h3=":443"; ma=604800 Set-Cookie: region=211; Expires=Wed, 02-Apr-25 22:35:31 GMT; Path=/; Secure Set-Cookie: language=en; Expires=Wed, 02-Apr-25 22:35:31 GMT; Path=/; Secure Set-Cookie: currency=USD; Expires=Wed, 02-Apr-25 22:35:31 GMT; Path=/; Secure vary: User-Agent
2024-10-04 22:35:31 UTC	6992	IN	Data Raw: 31 62 34 38 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 5f 5f 50 61 67 65 43 6f 6e 74 65 78 74 5f 5f 20 3d 20 7b 22 70 61 67 65 50 61 74 68 22 3a 22 77 2f 69 6e 64 65 78 22 2c 22 62 75 69 6c 64 49 64 22 3a 22 4e 57 48 44 42 5f 31 37 32 37 36 37 38 38 33 38 38 38 31 22 2c 22 6d 6f 64 65 72 6e 22 3a 66 61 6c 73 65 7d 0a 20 20 20 20 20 20 3c 2f 73 63 72 69 70 74 3e 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 77 69 6e 64 6f 77 2e 5f 5f 43 44 4e 5f 49 4d 47 5f 5f 20 3d 20 7b 22 72 65 74 72 79 4c 69 6d 69 74 22 3a 33 2c 22 62 61 63 6b 75 70 44 6f 6d 61 69 6e 43 6f 6e 66 69 67 4d 61 70 22 3a 7b 22 69 Data Ascii: 1b48<!DOCTYPE html><html lang="en"><head><script> window.__PageContext__ = {"pagePath":"w/index","buildId":"NWHDB_1727678838881","modern":false} </script><script> window.__CDN_IMG__ = {"retryLimit":3,"backupDomainConfigMap":{"i
2024-10-04 22:35:31 UTC	16384	IN	Data Raw: 65 33 36 37 0d 0a 69 6c 5f 73 68 6f 77 5f 66 72 6f 6d 5f 6f 72 64 65 72 73 22 2c 22 72 65 74 75 72 6e 5f 68 69 73 74 6f 72 79 5f 74 6f 6b 65 6e 22 2c 22 63 68 61 72 67 65 5f 64 65 74 61 69 6c 5f 74 6f 6b 65 6e 22 2c 22 61 66 74 65 72 73 61 6c 65 5f 6c 69 73 74 5f 74 6f 6b 65 6e 22 2c 22 6f 72 64 65 72 5f 72 65 63 65 69 70 74 5f 74 6f 6b 65 6e 22 2c 22 72 65 66 75 6e 64 5f 64 65 74 61 69 6c 5f 74 6f 6b 65 6e 22 2c 22 62 67 5f 6d 61 69 6c 5f 74 6f 6b 65 6e 22 2c 22 70 61 79 6d 65 6e 74 5f 64 65 74 61 69 6c 5f 74 6f 6b 65 6e 22 2c 22 65 6d 61 69 6c 43 68 65 63 6b 46 6f 72 62 69 64 64 65 6e 5f 6f 70 22 2c 22 65 78 70 72 65 73 73 5f 6c 69 73 74 5f 74 6f 6b 65 6e 22 2c 22 65 78 70 72 65 73 73 5f 74 6f 6b 65 6e 22 2c 22 65 78 70 72 65 73 73 5f 73 6c 6f 77 5f 74 Data Ascii: e367il_show_from_orders","return_history_token","charge_detail_token","aftersale_list_token","order_receipt_token","refund_detail_token","bg_mail_token","payment_detail_token","emailCheckForbidden_op","express_list_token","express_token","express_slow_t
2024-10-04 22:35:31 UTC	16384	IN	Data Raw: 72 52 65 73 6f 75 72 63 65 73 4c 6f 61 64 65 72 5f 5f 22 2c 77 69 6e 64 6f 77 5b 65 5d 7c 7c 28 72 3d 2f 5c 73 28 74 65 6d 75 7c 5b 61 2d 7a 5d 68 7b 32 7d 29 5f 69 6f 73 5f 76 65 72 73 69 6f 6e 5c 2f 2f 69 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 74 3d 2f 5c 73 28 74 65 6d 75 7c 5b 61 2d 7a 5d 68 7b 32 7d 29 5f 61 6e 64 72 6f 69 64 5f 76 65 72 73 69 6f 6e 5c 2f 2f 69 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 6e 3d 72 7c 7c 74 2c 6f 3d 2f 69 70 68 6f 6e 65 7c 69 70 61 64 7c 69 70 6f 64 2f 69 2e 74 65 73 74 28 6e 61 76 69 67 61 74 6f 72 2e 75 73 65 72 41 67 65 6e 74 29 2c 75 3d 7b 6a 73 3a 7b 65 72 72 6f 72 3a 5b 37 30 30 31 33 2c 37 30 30 31 34 2c 37 30 30 31 35 5d 2c 74 69 6d Data Ascii: rResourcesLoader__",window[e]\|\|(r=/\s(temu\|[a-z]h{2})_ios_version\//i.test(navigator.userAgent),t=/\s(temu\|[a-z]h{2})_android_version\//i.test(navigator.userAgent),n=r\|\|t,o=/iphone\|ipad\|ipod/i.test(navigator.userAgent),u={js:{error:[70013,70014,70015],tim
2024-10-04 22:35:31 UTC	16384	IN	Data Raw: 63 6f 6d 2f 75 61 2d 65 6e 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 55 41 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 6d 75 2e 63 6f 6d 2f 69 73 2d 65 6e 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 49 53 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 6d 75 2e 63 6f 6d 2f 6b 7a 2d 65 6e 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 4b 5a 22 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 6c 74 65 72 6e 61 74 65 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 77 77 77 2e 74 65 6d 75 2e 63 6f 6d 2f 6d 61 2d 65 6e 22 20 68 72 65 66 6c 61 6e 67 3d 22 65 6e 2d 4d 41 22 2f 3e 3c 6c 69 6e Data Ascii: com/ua-en" hreflang="en-UA"/><link rel="alternate" href="https://www.temu.com/is-en" hreflang="en-IS"/><link rel="alternate" href="https://www.temu.com/kz-en" hreflang="en-KZ"/><link rel="alternate" href="https://www.temu.com/ma-en" hreflang="en-MA"/><lin
2024-10-04 22:35:31 UTC	9071	IN	Data Raw: 4f 77 6e 50 72 6f 70 65 72 74 79 44 65 73 63 72 69 70 74 6f 72 28 6f 2c 72 29 29 7d 29 29 7d 72 65 74 75 72 6e 20 65 7d 66 75 6e 63 74 69 6f 6e 20 6f 28 65 2c 72 29 7b 69 66 28 6e 75 6c 6c 3d 3d 65 29 72 65 74 75 72 6e 7b 7d 3b 76 61 72 20 6e 2c 74 2c 6f 3d 66 75 6e 63 74 69 6f 6e 28 65 2c 72 29 7b 69 66 28 6e 75 6c 6c 3d 3d 65 29 72 65 74 75 72 6e 7b 7d 3b 76 61 72 20 6e 3d 7b 7d 3b 66 6f 72 28 76 61 72 20 74 20 69 6e 20 65 29 69 66 28 7b 7d 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 65 2c 74 29 29 7b 69 66 28 72 2e 69 6e 63 6c 75 64 65 73 28 74 29 29 63 6f 6e 74 69 6e 75 65 3b 6e 5b 74 5d 3d 65 5b 74 5d 7d 72 65 74 75 72 6e 20 6e 7d 28 65 2c 72 29 3b 69 66 28 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 Data Ascii: OwnPropertyDescriptor(o,r))}))}return e}function o(e,r){if(null==e)return{};var n,t,o=function(e,r){if(null==e)return{};var n={};for(var t in e)if({}.hasOwnProperty.call(e,t)){if(r.includes(t))continue;n[t]=e[t]}return n}(e,r);if(Object.getOwnPropertySymb
2024-10-04 22:35:31 UTC	11176	IN	Data Raw: 32 62 61 30 0d 0a 30 31 2c 43 55 53 54 4f 4d 5f 45 52 52 4f 52 3a 35 30 32 2c 4e 4f 52 4d 41 4c 5f 4c 4f 47 3a 36 30 30 7d 2c 65 65 3d 7b 7d 2c 72 65 3d 7b 7d 3b 66 75 6e 63 74 69 6f 6e 20 6e 65 28 65 29 7b 72 65 74 75 72 6e 28 72 3d 51 2c 4f 62 6a 65 63 74 2e 6b 65 79 73 28 72 29 2e 6d 61 70 28 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 72 5b 65 5d 7d 29 29 29 2e 69 6e 64 65 78 4f 66 28 65 29 3e 2d 31 3f 65 3a 51 2e 43 55 53 54 4f 4d 5f 45 52 52 4f 52 3b 76 61 72 20 72 7d 76 61 72 20 74 65 3d 22 75 6e 64 65 66 69 6e 65 64 22 21 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 2e 69 6e 63 6c 75 64 65 73 28 6a 29 2c 6f 65 3d 66 75 6e 63 74 69 6f 6e 28 65 29 7b 76 61 72 20 72 3b 72 Data Ascii: 2ba001,CUSTOM_ERROR:502,NORMAL_LOG:600},ee={},re={};function ne(e){return(r=Q,Object.keys(r).map((function(e){return r[e]}))).indexOf(e)>-1?e:Q.CUSTOM_ERROR;var r}var te="undefined"!=typeof window&&window.location.href.includes(j),oe=function(e){var r;r
2024-10-04 22:35:31 UTC	3851	IN	Data Raw: 66 30 34 0d 0a 74 28 22 73 63 72 69 70 74 22 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 2e 73 72 63 20 3d 20 6e 5b 74 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 2e 63 72 6f 73 73 4f 72 69 67 69 6e 20 3d 20 22 61 6e 6f 6e 79 6d 6f 75 73 22 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 69 66 20 28 6d 5b 74 5d 29 20 7b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 2e 69 6e 74 65 67 72 69 74 79 20 3d 20 6d 5b 74 5d 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 6f 2e 61 73 79 6e 63 20 3d 20 21 31 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 65 2e 61 70 70 65 6e 64 43 68 69 6c 64 28 6f 29 3b 0a 20 20 20 20 20 20 20 20 20 20 20 20 7d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 6f Data Ascii: f04t("script"); o.src = n[t]; o.crossOrigin = "anonymous"; if (m[t]) { o.integrity = m[t]; } o.async = !1; e.appendChild(o); } do
2024-10-04 22:35:31 UTC	6889	IN	Data Raw: 31 61 65 31 0d 0a 0a 3c 73 63 72 69 70 74 3e 0a 20 20 20 20 77 69 6e 64 6f 77 2e 5f 5f 53 53 52 5f 49 4d 41 47 45 53 5f 5f 3d 5b 22 68 74 74 70 73 3a 5c 75 30 30 32 46 5c 75 30 30 32 46 61 69 6d 67 2e 6b 77 63 64 6e 2e 63 6f 6d 5c 75 30 30 32 46 6d 61 74 65 72 69 61 6c 2d 70 75 74 5c 75 30 30 32 46 31 66 31 34 66 35 30 30 65 38 38 5c 75 30 30 32 46 37 63 37 66 35 35 63 37 2d 36 39 30 36 2d 34 31 38 66 2d 62 34 33 35 2d 35 34 37 61 61 34 36 64 63 38 33 62 2e 70 6e 67 3f 69 6d 61 67 65 56 69 65 77 32 5c 75 30 30 32 46 32 5c 75 30 30 32 46 77 5c 75 30 30 32 46 33 30 30 5c 75 30 30 32 46 71 5c 75 30 30 32 46 37 30 5c 75 30 30 32 46 66 6f 72 6d 61 74 5c 75 30 30 32 46 77 65 62 70 22 2c 22 68 74 74 70 73 3a 5c 75 30 30 32 46 5c 75 30 30 32 46 61 69 6d 67 2e 6b Data Ascii: 1ae1<script> window.__SSR_IMAGES__=["https:\u002F\u002Faimg.kwcdn.com\u002Fmaterial-put\u002F1f14f500e88\u002F7c7f55c7-6906-418f-b435-547aa46dc83b.png?imageView2\u002F2\u002Fw\u002F300\u002Fq\u002F70\u002Fformat\u002Fwebp","https:\u002F\u002Faimg.k
2024-10-04 22:35:31 UTC	4196	IN	Data Raw: 31 30 35 63 0d 0a 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 39 35 31 33 32 39 30 38 35 31 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 2e 39 35 31 33 32 39 30 38 35 31 29 3b 6f 70 61 63 69 74 79 3a 2e 39 39 7d 35 30 2e 30 30 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 30 30 35 37 39 35 39 35 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 30 30 35 37 39 35 39 35 29 3b 6f 70 61 63 69 74 79 3a 31 7d 35 38 2e 33 33 25 7b 2d 77 65 62 6b 69 74 2d 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 30 33 31 33 30 33 30 33 35 38 29 3b 74 72 61 6e 73 66 6f 72 6d 3a 73 63 61 6c 65 28 31 2e 30 33 31 33 30 33 30 33 35 38 29 3b 6f 70 61 63 69 74 79 3a 31 7d 36 36 2e 36 37 25 Data Ascii: 105cwebkit-transform:scale(.9513290851);transform:scale(.9513290851);opacity:.99}50.00%{-webkit-transform:scale(1.00579595);transform:scale(1.00579595);opacity:1}58.33%{-webkit-transform:scale(1.0313030358);transform:scale(1.0313030358);opacity:1}66.67%
2024-10-04 22:35:31 UTC	16384	IN	Data Raw: 35 34 62 34 0d 0a 6d 70 6f 72 74 61 6e 74 3b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 64 69 76 2e 5f 31 58 36 4c 69 74 32 49 20 2e 5f 31 38 55 31 77 52 49 54 7b 63 6f 6c 6f 72 3a 23 66 66 66 21 69 6d 70 6f 72 74 61 6e 74 7d 64 69 76 2e 5f 31 58 36 4c 69 74 32 49 20 2e 5f 31 44 5a 50 7a 64 6a 4a 7b 63 6f 6c 6f 72 3a 23 66 66 66 7d 64 69 76 2e 5f 31 58 36 4c 69 74 32 49 20 64 69 76 2e 5f 31 4e 38 6d 79 49 73 58 20 2e 5f 33 50 48 54 6a 6f 32 50 7b 62 6f 72 64 65 72 3a 6e 6f 6e 65 7d 64 69 76 2e 5f 31 58 36 4c 69 74 32 49 20 64 69 76 2e 5f 31 4e 38 6d 79 49 73 58 20 2e 5f 32 5a 75 79 6d 36 78 38 2c 64 69 76 2e 5f 31 58 36 4c 69 74 32 49 20 64 69 76 2e 5f 31 4e 38 6d 79 49 73 58 20 2e 5f 33 50 48 54 6a 6f 32 50 7b 70 61 64 64 69 6e 67 2d Data Ascii: 54b4mportant;color:#fff!important}div._1X6Lit2I ._18U1wRIT{color:#fff!important}div._1X6Lit2I ._1DZPzdjJ{color:#fff}div._1X6Lit2I div._1N8myIsX ._3PHTjo2P{border:none}div._1X6Lit2I div._1N8myIsX ._2Zuym6x8,div._1X6Lit2I div._1N8myIsX ._3PHTjo2P{padding-

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:31 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 023e3708-a01e-003d-568c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223531Z-15767c5fc55852fxfeh7csa2dn0000000cyg00000000vg45 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Timestamp	Bytes transferred	Direction	Data
2024-10-04 22:35:31 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-10-04 22:35:31 UTC	470	IN	HTTP/1.1 200 OK Date: Fri, 04 Oct 2024 22:35:31 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 023e3944-a01e-003d-708c-1598d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241004T223531Z-15767c5fc55qkvj6n60pxm9mbw000000028g00000000kus3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-10-04 22:35:31 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">