Edit tour

Windows Analysis Report
https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1

Overview

General Information

Sample URL:	https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1
Analysis ID:	1335542
Infos:

Detection

Score:	2
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Queries the volume information (name, serial number etc) of a device

Queries disk information (often used to detect virtual machines)

Tries to load missing DLLs

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Process Tree

System is w10x64

chrome.exe (PID: 5004 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5164 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2228,i,12174638880187653489,6315347660481113626,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

svchost.exe (PID: 2256 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 6528 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 01 Nov 2023 16:01:30 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: z=hb08df7kme7h0dmjsilk716u98; path=/; domain=.app.box.com; secure; HttpOnlySet-Cookie: z=hb08df7kme7h0dmjsilk716u98; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=NoneSet-Cookie: box_visitor_id=6542765a59c8f6.29956021; expires=Fri, 01-Nov-2024 16:01:30 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite=NoneSet-Cookie: bv=PARTNERS-22119; expires=Wed, 08-Nov-2023 17:01:30 GMT; Max-Age=608400; path=/; domain=.app.box.com; secureSet-Cookie: cn=50; expires=Fri, 01-Nov-2024 16:01:30 GMT; Max-Age=31622400; path=/; domain=.app.box.com; secureSet-Cookie: site_preference=desktop; path=/; domain=.box.com; secureVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_134.2.dr	String found in binary or memory: http://blog.stevenlevithan.com/archives/parseuri
Source: svchost.exe, 00000001.00000002.2510354232.0000025828484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000001.00000002.2510636920.00000258284FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: svchost.exe, 00000001.00000003.1683489867.000002582C618000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: edb.log.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000001.00000003.1683489867.000002582C618000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: svchost.exe, 00000001.00000003.1683489867.000002582C618000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000001.00000002.2509813171.0000025827702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2510529630.00000258284D6000.00000004.00000020.00020000.00000000.sdmp, edb.log.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/axx2pfbv7uq6qptuqj7vcp4aku_2023.10.12.0/g
Source: svchost.exe, 00000001.00000002.2509813171.0000025827702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.1683489867.000002582C64D000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000001.00000002.2510354232.0000025828484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80
Source: qmgr.db.1.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: chromecache_134.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_134.2.dr, chromecache_152.2.dr	String found in binary or memory: http://www.box.com)
Source: svchost.exe, 00000001.00000003.1683489867.000002582C6C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
Source: edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
Source: edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2
Source: edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: svchost.exe, 00000001.00000003.1683489867.000002582C6C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
Source: chromecache_134.2.dr	String found in binary or memory: https://github.com/derek-watson/jsUri
Source: svchost.exe, 00000001.00000003.1683489867.000002582C6C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
Source: edb.log.1.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
Source: chromecache_134.2.dr	String found in binary or memory: https://support.box.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09

Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.165.165.26:443 -> 192.168.2.4:49814 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

Section loaded: pcwum.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_5004_759584114

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS

Jump to behavior

Source: classification engine

Classification label: clean2.win@17/60@18/8

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2228,i,12174638880187653489,6315347660481113626,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 --field-trial-handle=2228,i,12174638880187653489,6315347660481113626,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 5440

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: svchost.exe, 00000001.00000002.2509406303.0000025826E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2510308637.000002582845E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	21 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://www.box.com)	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	172.253.62.84	true	false	high
cdn.amplitude.com	52.85.150.185	true	false	high
www.google.com	172.253.63.106	true	false	high
clients.l.google.com	142.251.16.139	true	false	high
app.box.com	74.112.186.144	true	false	high
clients2.google.com	unknown	unknown	false	high
cdn01.boxcdn.net	unknown	unknown	false	unknown
cdn10.boxcdn.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1	false	high
https://app.box.com/app-api/split-proxy/api/mySegments/-1	false	high
https://app.box.com/app-api/split-proxy/api/mySegments/2	false	high
https://app.box.com/app-api/split-proxy/api/splitChanges?since=-1	false	high
https://app.box.com/gen204	false	high
https://app.box.com/index.php?rm=box_gen204_batch_record	false	high
https://app.box.com/app-api/enduserapp/current-user/features/secondary	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1	false	high
https://app.box.com/app-api/split-proxy/api/mySegments/6542765a59c8f6.29956021	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high
https://cdn.amplitude.com/libs/amplitude-4.5.2-min.gz.js	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod.C:	edb.log.1.dr, qmgr.db.1.dr	false		high
http://blog.stevenlevithan.com/archives/parseuri	chromecache_134.2.dr	false		high
https://github.com/derek-watson/jsUri	chromecache_134.2.dr	false		high
https://g.live.com/odclientsettings/ProdV2	edb.log.1.dr, qmgr.db.1.dr	false		high
https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96	svchost.exe, 00000001.00000003.1683489867.000002582C6C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr	false		high
https://support.box.com	chromecache_134.2.dr	false		high
http://crl.ver)	svchost.exe, 00000001.00000002.2510354232.0000025828484000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://g.live.com/odclientsettings/ProdV2.C:	edb.log.1.dr, qmgr.db.1.dr	false		high
http://www.box.com)	chromecache_134.2.dr, chromecache_152.2.dr	false	Avira URL Cloud: safe	low
https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6	svchost.exe, 00000001.00000003.1683489867.000002582C6C2000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	false		high
http://jedwatson.github.io/classnames	chromecache_134.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.112.186.144	app.box.com	United States	33011	BOXNETUS	false
172.253.63.106	www.google.com	United States	15169	GOOGLEUS	false
172.253.62.84	accounts.google.com	United States	15169	GOOGLEUS	false
142.251.16.139	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.85.150.185	cdn.amplitude.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.4
127.0.0.1

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1335542
Start date and time:	2023-11-01 17:00:35 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean2.win@17/60@18/8
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.253.122.94, 34.104.35.123, 104.16.145.15, 104.16.144.15, 69.192.108.161, 192.229.211.108, 142.250.31.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, cdn10.boxcdn.net.cdn.cloudflare.net, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, prod.fs.microsoft.com.akadns.net, cdn01.boxcdn.net.cdn.cloudflare.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1

Simulations

Behavior and APIs

Time	Type	Description
17:01:27	API Interceptor	2x Sleep call for process: svchost.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	1.3268181068818297
Encrypted:	false
SSDEEP:	3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrk:KooCEYhgYEL0In
MD5:	0C4FC4CC0DB781FEA82A0B7AC590D9C2
SHA1:	352A62E19389F851FFE42667D7C64E1B2BB0052F
SHA-256:	12475CA8C200018E0762768BA2A4851F3A35A3834A9D4A6542BDADCDA65FD8F0
SHA-512:	DD2862C1C4E0B368F80B30A56A3C764CB5A2161F2A4BCE30837D64DA8EC666447532A0E8E463ED5A08B4D9ABF329EFD1539CAB8A67C9A46605FD8E6D5FD52DFB
Malicious:	false
Reputation:	low
Preview:	z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.21.200
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 52.165.165.26
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 72.21.81.240
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /X-Box-Client-Version: 21.100.0X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/6542765a59c8f6.29956021 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/6542765a59c8f6.29956021 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O5DtSB7vSvvZFcF&MD=nbTbvx6M HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O5DtSB7vSvvZFcF&MD=nbTbvx6M HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (53860), with no line terminators
Category:	downloaded
Size (bytes):	53860
Entropy (8bit):	5.282699935101682
Encrypted:	false
SSDEEP:	1536:7Sxemx6klSfNOOBEUaLRGwWl+7EKB3ipef8QScD83Ce5reIKDX46QbHBTxjj:sM8v8H/
MD5:	8BE280B7ACDE2E751BE29B948D6D907A
SHA1:	12B1C87095F8ECAC06E0792A1270CA9CB66E6667
SHA-256:	8385685ACDA374E5AFEFB36AEA2D124002CFEDF011C6C46AEA314A4D2F794E6D
SHA-512:	0BEE842D395C4088A56CAF82D6B4652450DC7CD11BABD8B5CA6AE22B4B9419388B01697D1028B62BF985D32A790D0271DEF3073B63803113DFC7DF0408507269
Malicious:	false
Reputation:	low
URL:	https://cdn01.boxcdn.net/enduser/6689.636a60e242.js
Preview:	(globalThis.webpackChunkEndUserApp=globalThis.webpackChunkEndUserApp\|\|[]).push([[6689],{6610:(e,t,o)=>{"use strict";function n(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}o.d(t,{Z:()=>n})},10379:(e,t,o)=>{"use strict";o.d(t,{Z:()=>r});var n=o(14665);function r(e,t){if("function"!==typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writable:!0,configurable:!0}}),Object.defineProperty(e,"prototype",{writable:!1}),t&&(0,n.Z)(e,t)}},81253:(e,t,o)=>{"use strict";o.d(t,{Z:()=>r});var n=o(19756);function r(e,t){if(null==e)return{};var o,r,i=(0,n.Z)(e,t);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);for(r=0;r<l.length;r++)o=l[r],t.indexOf(o)>=0\|\|Object.prototype.propertyIsEnumerable.call(e,o)&&(i[o]=e[o])}return i}},46070:(e,t,o)=>{"use strict";o.d(t,{Z:()=>i});var n=o(90484),r=o(63349);function i(e,t){if(t&&("object"===(0,n.Z)

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2023 17:01:27.859652042 CET	63397	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:27.860258102 CET	52250	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:27.861706018 CET	62807	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:27.861948013 CET	56188	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:27.931716919 CET	53	59289	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:27.951931953 CET	53	63397	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:27.952573061 CET	53	52250	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:27.954688072 CET	53	62807	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:27.955158949 CET	53	56188	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:28.550122023 CET	53	61193	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:29.848618031 CET	51351	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:29.848903894 CET	56722	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:29.942179918 CET	53	51351	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:29.942579031 CET	53	56722	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:30.720547915 CET	60503	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:30.720897913 CET	52548	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:30.793189049 CET	53871	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:30.793561935 CET	51499	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:30.886240959 CET	53	51499	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:30.886708021 CET	53	53871	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:34.499161959 CET	52773	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:34.499732018 CET	63668	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:34.592327118 CET	53	63668	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:34.592571974 CET	53	52773	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:35.192217112 CET	61130	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:35.192929029 CET	50713	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:35.737849951 CET	63494	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:35.738168001 CET	64035	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:37.916990042 CET	65038	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:37.917603970 CET	57419	53	192.168.2.4	1.1.1.1
Nov 1, 2023 17:01:38.011889935 CET	53	57419	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:38.014609098 CET	53	65038	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:45.793252945 CET	53	54538	1.1.1.1	192.168.2.4
Nov 1, 2023 17:01:48.186294079 CET	138	138	192.168.2.4	192.168.2.255
Nov 1, 2023 17:02:04.923378944 CET	53	64887	1.1.1.1	192.168.2.4
Nov 1, 2023 17:02:27.375247002 CET	53	64643	1.1.1.1	192.168.2.4
Nov 1, 2023 17:02:28.008805990 CET	53	54141	1.1.1.1	192.168.2.4

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:28 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: NID=511=j8SQUTltnVU5cOAeyzqSxW-qHOakRuBHDQGLTGeceC9Z5rRzk5trMKb4CuZC_CFmc7KFwQcRJL-qGz8MvkkzMZmElvXAFWLO-TPZ9PMqBYA78ZAuaepnXIRHe-TAolVoW6Z7dQnqpgyX0m-TmS72bebAgoqZv5GkpRFUcZIw1Kk; 1P_JAR=2023-10-04-09
2023-11-01 16:01:28 UTC	0	OUT	Data Raw: 20 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:35 UTC	26	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 16:01:35 GMT Content-Type: application/json; charset=utf-8 x-envoy-upstream-service-time: 10 strict-transport-security: max-age=31536000 content-encoding: gzip box-request-id: 0ac6094f782cd70381ad2649dc75fad1b Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2023-11-01 16:01:35 UTC	27	IN	Data Raw: 30 30 30 30 30 30 30 31 0d 0a 1f 0d 0a 30 30 30 30 30 30 30 31 0d 0a 8b 0d 0a 30 30 30 30 30 30 30 31 0d 0a 08 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 31 0d 0a 00 0d 0a 32 33 0d 0a 00 00 00 ff aa 56 ca ad 0c 4e 4d cf 4d cd 2b 29 56 b2 8a 8e ad 05 04 00 00 ff ff a1 34 db 08 11 00 00 00 0d 0a Data Ascii: 000000010000000100000001000000010000000100000123VNMM+)V4
2023-11-01 16:01:35 UTC	27	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:36 UTC	95	IN	HTTP/1.1 401 Unauthorized Date: Wed, 01 Nov 2023 16:01:36 GMT Transfer-Encoding: chunked x-envoy-upstream-service-time: 32 strict-transport-security: max-age=31536000 box-request-id: 04213de57a97776855e097014e5e9712f Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 16:01:36 UTC	95	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:36 UTC	96	OUT	POST /gen204 HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 448 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Box-Client-Version: 21.100.0 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json X-Request-Token: 93ca244c184d8d2418ddfba1022c233f40823bee994fd8024cf0ee35626f8677 Request-Token: 93ca244c184d8d2418ddfba1022c233f40823bee994fd8024cf0ee35626f8677 sec-ch-ua-platform: "Windows" Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop
2023-11-01 16:01:36 UTC	97	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 65 75 61 5f 70 65 72 66 6f 72 6d 61 6e 63 65 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 71 6e 6f 64 66 65 68 6a 67 31 72 79 73 69 31 6d 22 2c 22 62 72 6f 77 73 65 72 5f 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 22 2c 22 62 72 6f 77 73 65 72 5f 76 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 22 2c 22 64 65 76 69 63 65 5f 6e 61 6d 65 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 70 65 72 66 6f 72 6d 61 6e 63 65 5f 69 64 22 3a 22 73 70 6c 69 74 22 2c 22 73 74 61 72 74 5f 73 74 61 74 65 22 3a 22 69 6e 69 74 69 61 6c 22 2c 22 65 Data Ascii: {"data":[{"category":"eua_performance","event_type":"web","country_code":"US","request_id":"qnodfehjg1rysi1m","browser_name":"Chrome","browser_version":"117.0","os_name":"Windows","device_name":"unknown","performance_id":"split","start_state":"initial","e

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:28 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-eVlc5ZSz-s3SqH-Q2CKL2w' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 01 Nov 2023 16:01:28 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6148 X-Daystart: 32488 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-11-01 16:01:28 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 34 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 33 32 34 38 38 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6148" elapsed_seconds="32488"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-11-01 16:01:28 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-11-01 16:01:28 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:38 UTC	103	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 16:01:38 GMT Content-Type: application/json; charset=utf-8 x-envoy-upstream-service-time: 7 strict-transport-security: max-age=31536000 content-encoding: gzip box-request-id: 0a25839a46e93254bf0d3797cc16a5e34 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2023-11-01 16:01:38 UTC	103	IN	Data Raw: 30 30 30 30 30 30 30 31 0d 0a 1f 0d 0a 30 30 30 30 30 30 30 31 0d 0a 8b 0d 0a 30 30 30 30 30 30 30 31 0d 0a 08 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a 00 0d 0a 30 30 30 30 30 30 30 31 0d 0a ff 0d 0a 30 30 30 30 30 30 30 31 0d 0a aa 0d 0a 30 30 30 30 30 30 30 31 0d 0a 56 0d 0a 30 30 30 30 30 30 30 31 0d 0a ca 0d 0a 30 30 30 30 30 30 30 31 0d 0a ad 0d 0a 30 30 30 30 30 30 30 31 0d 0a 0c 0d 0a 30 30 30 30 30 30 30 31 0d 0a 4e 0d 0a 30 30 30 30 30 30 30 31 0d 0a 4d 0d 0a 30 30 30 30 30 30 30 31 0d 0a cf 0d 0a 30 30 30 30 30 30 30 31 0d 0a 4d 0d 0a 30 30 30 30 30 30 30 31 Data Ascii: 000000010000000100000001000000010000000100000001000000010000000100000001000000010000000100000001V00000001000000010000000100000001N00000001M0000000100000001M00000001
2023-11-01 16:01:38 UTC	104	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:38 UTC	105	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 25727 Connection: close Date: Wed, 01 Nov 2023 16:01:39 GMT Last-Modified: Mon, 21 Oct 2019 15:45:34 GMT ETag: "5e816d32cb1cd1f7bda71ead48ac192e" Cache-Control: max-age=31536000 Content-Encoding: gzip x-amz-version-id: zskY2uLkrv0oL4SiNEoxREaWRVRZwrqD Accept-Ranges: bytes Server: AmazonS3 Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 a075746ea1824aa1c02a5e26a9e968e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C3 X-Amz-Cf-Id: Npb2Mk-x9oQC6Kv-XQyPicwzJPRt_pvIt6299vD44DH9yyJtK5RGSw==
2023-11-01 16:01:38 UTC	105	IN	Data Raw: 1f 8b 08 00 75 55 e7 5b 00 03 c4 bd 0b 63 da b8 d2 30 fc 57 88 9f 6e d6 2e 82 60 20 24 40 5d de 34 4d bb d9 6d 93 6e 2e bb dd 25 9c bc 0e 28 c4 0d d8 d4 36 b9 34 e6 f9 ed df 8c 6e 96 2f a4 dd 73 9e e7 fd ce d9 06 59 d7 d1 68 34 9a 19 49 a3 8d eb a5 3f 8e bd c0 37 29 89 ad 27 23 b8 fa 42 c7 b1 e1 38 f1 e3 82 06 d7 15 fa b0 08 c2 38 da dc 34 96 fe 84 5e 7b 3e 9d 18 1b 32 71 1e 4c 96 33 3a e0 3f 75 91 d5 89 4d ab 67 c8 6a d3 9a 78 e9 cd 4d fe 5b 77 e7 93 01 0f 9a b1 d5 c3 ef c5 cc 8b 97 13 8a e5 57 66 7c e3 45 44 c1 06 80 2d 23 5a 89 e2 d0 03 e0 fa 32 be 42 39 d4 21 8d 97 a1 5f 89 9d 27 01 43 ef 69 b5 22 50 31 89 25 54 56 1a 5c a9 e2 31 16 27 be f5 e4 5d 9b 1b 26 7d 15 5b 96 a8 8a be b2 eb db 2f e3 c1 47 37 be a9 5f cf 82 20 34 e9 56 6c 55 8d 8a 51 f5 7b 2c Data Ascii: uU[c0Wn.` $@]4Mmn.%(64n/sYh4I?7)'#B884^{>2qL3:?uMgjxM[wWf\|ED-#Z2B9!_'Ci"P1%TV\1']&}[/G7_ 4VlUQ{,
2023-11-01 16:01:38 UTC	107	IN	Data Raw: b1 ff ea 30 4e 7f a7 48 18 9b b5 dd 4e 9b da 2d 8b 95 a9 36 77 b6 77 3a 8d 5a a3 5b b3 5b eb cb e8 45 6a 38 f2 0d 68 06 ff 7b a6 99 4e d3 ee ee ee 6c 6f 37 e9 36 2f 68 77 3b d0 4a b3 d6 b2 cf 9a ad de 76 17 fe ab 77 bb dd 6c 29 e0 13 a9 50 be 70 36 ec d5 ca 77 16 2b 45 55 9c 50 15 45 cd 80 a2 58 14 a3 bb 22 39 cd 2c a4 11 48 43 7e 3b 33 81 3c 00 94 8d 99 b9 01 ed b0 0a ae 9d 6d c7 01 4a 9b a1 d8 52 77 05 a7 dc dc b4 21 7f 58 77 71 32 41 e9 6b 2e c3 5e 3b 50 f4 67 03 06 ea 67 0d ca 15 cb c0 d3 ed 0d de 8c 6d 3c 9f c1 ae 67 32 c0 ff d4 c7 35 76 da 77 ae 95 c6 80 3c c0 d9 d8 f0 57 b0 6c c0 1a ef d5 b9 6c 63 5a a0 4b 41 4c ac c7 88 85 82 d6 8f d8 12 91 24 9e 08 11 5c 06 4e d9 dc c3 48 1e 22 4b 88 e4 65 31 92 87 c8 18 22 df ba 31 c5 28 fc 85 89 0a 45 1f fd d8 Data Ascii: 0NHN-6ww:Z[[Ej8h{Nlo76/hw;Jvwl)Pp6w+EUPEX"9,HC~;3<mJRw!Xwq2Ak.^;Pggm<g25vw<WllcZKAL$\NH"Ke1"1(E
2023-11-01 16:01:38 UTC	123	IN	Data Raw: 43 32 44 bd 64 92 40 9f ee 5f e2 ca 0b 48 2b 0e ed 33 f9 f5 be a4 03 ca 0b e8 eb cc f0 22 aa 01 9b 53 58 4d 93 92 2b ea 7f 05 32 9d cd 91 e8 6b 56 12 05 fe 23 d0 e4 38 82 40 02 ab 7f 98 b8 d1 32 4a 70 1c 92 9b a5 7b 4f bd 64 4e bd 6f 4b 98 eb b0 18 01 e3 85 f9 3b 7b 8c 41 9e c6 56 2e 6b 9c 9b d6 14 67 04 52 10 92 3d 0c 2f cc 4c ae 34 40 95 56 4d 02 94 8e a1 ec ea d5 95 dd 00 26 92 a6 f3 3e 66 96 45 95 3d 15 58 e3 d0 f5 a3 eb 60 08 4a ed 1c 48 79 f4 d4 06 d5 71 85 d8 aa 26 94 52 e0 35 a0 9c 4c 68 c8 63 7c fa b0 8c 2a 3b 7a 03 7b 00 57 96 1c 00 1b 08 3f b7 71 82 1e b8 88 46 29 65 b1 be b0 2c 30 dd 7b d1 74 51 af ea 89 48 1b 50 e9 29 64 30 58 13 c6 67 d0 c8 3c b7 72 c6 2d a6 7a 43 50 5c d6 c3 ff 1b 27 13 eb 62 f2 d4 5e 21 cf 81 c4 61 6d 36 82 ea 7f a8 7e ae Data Ascii: C2Dd@_H+3"SXM+2kV#8@2Jp{OdNoK;{AV.kgR=/L4@VM&>fE=X`JHyq&R5Lhc\|*;z{W?qF)e,0{tQHP)d0Xg<r-zCP\'b^!am6~

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:39 UTC	131	IN	HTTP/1.1 401 Unauthorized Date: Wed, 01 Nov 2023 16:01:39 GMT Transfer-Encoding: chunked x-envoy-upstream-service-time: 9 strict-transport-security: max-age=31536000 box-request-id: 0122730ee7577925e5441168046a85748 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 16:01:39 UTC	132	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:41 UTC	132	OUT	POST /index.php?rm=box_gen204_batch_record HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 1137 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=hb08df7kme7h0dmjsilk716u98; box_visitor_id=6542765a59c8f6.29956021; bv=PARTNERS-22119; cn=50; site_preference=desktop; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6ImFlYjVlYzdjLTQyZGEtNDRlMy1iYzAxLWNlMzg2MTE3MTUxNVIiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTY5ODg1NDQ5ODgzNCwibGFzdEV2ZW50VGltZSI6MTY5ODg1NDQ5ODgzNCwiZXZlbnRJZCI6MCwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjB9
2023-11-01 16:01:41 UTC	133	OUT	Data Raw: 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 72 65 73 69 6e 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 65 76 65 6e 74 73 22 3a 5b 7b 22 70 61 74 68 22 3a 22 2f 73 2f 76 35 63 6c 6d 36 6d 33 64 6c 6a 31 68 77 34 70 67 70 33 6c 68 66 36 76 34 30 71 66 6c 35 77 30 26 63 3d 45 2c 31 2c 39 47 6b 30 4e 68 62 72 50 46 54 47 42 5a 73 50 75 4f 61 6a 6e 4b 49 36 56 5f 33 46 59 67 35 38 6e 50 58 64 37 56 41 42 33 73 5f 68 6b 65 57 59 4b 37 6f 79 4a 67 64 79 5a 4c 4e 42 57 37 6f 54 6d 73 5a 73 6c 39 6c 31 70 57 38 58 58 54 69 47 52 6e 57 34 66 38 33 6a 71 75 77 73 4d 66 4e 62 4f 77 45 47 77 31 46 51 66 44 58 68 77 68 48 46 64 57 57 33 71 71 6a 43 75 71 64 5f 26 74 79 70 6f 3d 31 22 2c 22 73 65 73 73 69 6f 6e 22 3a 22 66 32 38 64 35 38 39 39 66 64 Data Ascii: [{"category":"resin","event_type":"web","events":[{"path":"/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1","session":"f28d5899fd

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:43 UTC	135	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O5DtSB7vSvvZFcF&MD=nbTbvx6M HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-01 16:01:44 UTC	135	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0e5a928b-a907-4930-9bb0-4002bab9606f MS-RequestId: 4009909b-4e2d-4689-bda9-d6dd291cc5a0 MS-CV: TpRVk6XIa0KEeMhX.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 Nov 2023 16:01:43 GMT Connection: close Content-Length: 24490
2023-11-01 16:01:44 UTC	136	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-11-01 16:01:44 UTC	151	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:02:21 UTC	160	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=O5DtSB7vSvvZFcF&MD=nbTbvx6M HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-01 16:02:21 UTC	160	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: 43f07722-45d3-42ad-8501-dc9f42f73dd9 MS-RequestId: d5db5016-e011-472d-82ed-f16a19a15de1 MS-CV: x6o6iBqxBEadg9dn.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 Nov 2023 16:02:20 GMT Connection: close Content-Length: 25457
2023-11-01 16:02:21 UTC	161	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-11-01 16:02:21 UTC	176	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:30 UTC	5	IN	HTTP/1.1 404 Not Found Date: Wed, 01 Nov 2023 16:01:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: z=hb08df7kme7h0dmjsilk716u98; path=/; domain=.app.box.com; secure; HttpOnly Set-Cookie: z=hb08df7kme7h0dmjsilk716u98; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None Set-Cookie: box_visitor_id=6542765a59c8f6.29956021; expires=Fri, 01-Nov-2024 16:01:30 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite=None Set-Cookie: bv=PARTNERS-22119; expires=Wed, 08-Nov-2023 17:01:30 GMT; Max-Age=608400; path=/; domain=.app.box.com; secure Set-Cookie: cn=50; expires=Fri, 01-Nov-2024 16:01:30 GMT; Max-Age=31622400; path=/; domain=.app.box.com; secure Set-Cookie: site_preference=desktop; path=/; domain=.box.com; secure Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 16:01:30 UTC	6	IN	Data Raw: 32 62 63 38 0d 0a 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 72 65 73 69 6e 2d 63 6c 69 65 6e 74 3d 22 77 65 62 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 Data Ascii: 2bc8 <!DOCTYPE html><html lang="en-US" data-resin-client="web"><head><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-s
2023-11-01 16:01:30 UTC	6	IN	Data Raw: 63 61 6c 65 3d 31 2e 30 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 20 20 3c 74 69 74 6c 65 3e 42 6f 78 3c 2f 74 69 74 6c 65 3e 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 66 6f 6e 74 73 2f 31 2e 30 2e 35 2f 6c 61 74 6f 2f 4c 61 74 6f 2d 77 6f 66 66 2e 63 73 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 61 70 70 2e 32 66 30 64 31 66 63 34 37 64 2e 63 73 73 22 3e 20 20 20 3c 6c Data Ascii: cale=1.0"> <meta name="robots" content="noindex, nofollow"> <title>Box</title> <link rel="stylesheet" href="https://cdn01.boxcdn.net/fonts/1.0.5/lato/Lato-woff.css"> <link rel="stylesheet" href="https://cdn01.boxcdn.net/enduser/app.2f0d1fc47d.css"> <l
2023-11-01 16:01:30 UTC	7	IN	Data Raw: 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 31 35 32 78 31 35 32 2d 72 35 74 57 67 68 2e 70 6e 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 31 38 30 78 31 38 30 2d 74 56 30 30 31 63 2e 70 6e 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 Data Ascii: n.net/_assets/img/favicons/apple-touch-icon-152x152-r5tWgh.png"><link rel="apple-touch-icon" sizes="180x180" href="https://cdn10.boxcdn.net/_assets/img/favicons/apple-touch-icon-180x180-tV001c.png"><link rel="icon" type="image/png" href="https://cdn10.b
2023-11-01 16:01:30 UTC	8	IN	Data Raw: 32 57 34 2e 73 76 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 79 7a 2d 74 6a 2d 2e 69 63 6f 22 20 64 61 74 61 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 69 63 6f 6e 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 66 61 76 69 63 6f 6e 2d 45 48 57 57 79 50 2e 69 63 6f 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 Data Ascii: 2W4.svg"><link rel="shortcut icon" href="https://cdn10.boxcdn.net/_assets/img/favicons/favicon-yz-tj-.ico" data-notification-icon-href="https://cdn10.boxcdn.net/_assets/img/favicons/notification-favicon-EHWWyP.ico"><meta name="msapplication-TileColor" c
2023-11-01 16:01:30 UTC	9	IN	Data Raw: 70 6c 69 63 61 74 69 6f 6e 2d 63 6f 6e 66 69 67 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 62 72 6f 77 73 65 72 63 6f 6e 66 69 67 2d 66 64 42 52 65 4b 2e 78 6d 6c 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 66 66 66 66 66 66 22 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 69 73 2d 6c 6f 61 64 69 6e 67 20 22 20 64 61 74 61 2d 72 65 73 69 6e 2d 61 70 70 6c 69 63 61 74 69 6f 6e 3d 22 66 69 6c 65 73 22 3e 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 73 63 72 69 70 74 2d 77 61 72 6e 69 6e 67 22 3e 20 4a 61 76 Data Ascii: plication-config" content="https://cdn10.boxcdn.net/_assets/img/favicons/browserconfig-fdBReK.xml"><meta name="theme-color" content="#ffffff"></head><body class="is-loading " data-resin-application="files"> <noscript><div class="noscript-warning"> Jav
2023-11-01 16:01:30 UTC	10	IN	Data Raw: 22 68 61 73 55 6e 6c 69 6d 69 74 65 64 53 74 6f 72 61 67 65 22 3a 66 61 6c 73 65 2c 22 74 69 65 72 22 3a 6e 75 6c 6c 2c 22 62 6f 78 54 6f 6f 6c 73 44 6f 77 6e 6c 6f 61 64 55 52 4c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 65 33 2e 62 6f 78 63 64 6e 2e 6e 65 74 5c 2f 62 6f 78 2d 69 6e 73 74 61 6c 6c 65 72 73 5c 2f 62 6f 78 65 64 69 74 5c 2f 77 69 6e 5c 2f 63 75 72 72 65 6e 74 72 65 6c 65 61 73 65 5c 2f 42 6f 78 54 6f 6f 6c 73 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 22 2c 22 61 63 63 6f 75 6e 74 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 63 63 6f 75 6e 74 2e 62 6f 78 2e 63 6f 6d 22 2c 22 61 70 69 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 70 69 2e 62 6f 78 2e 63 6f 6d 5c 2f 22 2c 22 61 6d 70 6c 69 74 75 64 65 41 50 49 4b 65 79 22 3a 22 63 Data Ascii: "hasUnlimitedStorage":false,"tier":null,"boxToolsDownloadURL":"https:\/\/e3.boxcdn.net\/box-installers\/boxedit\/win\/currentrelease\/BoxToolsInstaller.exe","accountHost":"https:\/\/account.box.com","apiHost":"https:\/\/api.box.com\/","amplitudeAPIKey":"c
2023-11-01 16:01:30 UTC	11	IN	Data Raw: 61 73 73 69 66 69 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 63 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 56 32 22 3a 66 61 6c 73 65 2c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 22 3a 66 61 6c 73 65 2c 22 64 65 76 65 6c 6f 70 65 72 43 6f 6e 73 6f 6c 65 22 3a 66 61 6c 73 65 2c 22 64 6f 63 67 65 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 41 63 63 65 73 73 53 74 61 74 73 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 41 6c 6c 6f 77 45 64 69 74 6f 72 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 42 72 61 6e 64 69 6e 67 55 73 65 72 45 6e 61 62 6c 65 6d 65 6e 74 45 6e 61 62 6c 65 Data Ascii: assification":false,"classificationV2":false,"collections":false,"developerConsole":false,"docgenEnabled":false,"feed":false,"feedAccessStats":false,"fileRequestEnabled":false,"fileRequestAllowEditorsEnabled":false,"fileRequestBrandingUserEnablementEnable
2023-11-01 16:01:30 UTC	13	IN	Data Raw: 67 6e 4e 65 77 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 73 69 67 6e 52 65 61 64 79 53 69 67 6e 4c 69 6e 6b 73 22 3a 74 72 75 65 2c 22 73 69 67 6e 43 66 72 31 31 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 53 79 6e 63 50 72 65 66 69 6c 6c 56 61 6c 75 65 73 22 3a 74 72 75 65 2c 22 73 69 67 6e 43 75 73 74 6f 6d 42 72 61 6e 64 22 3a 74 72 75 65 2c 22 73 69 67 6e 4e 65 77 48 65 61 64 65 72 22 3a 74 72 75 65 2c 22 73 69 67 6e 4e 61 76 69 67 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 73 69 67 6e 44 65 66 61 75 6c 74 4f 6e 22 3a 66 61 6c 73 65 2c 22 74 61 72 69 66 66 4d 69 67 72 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 6d 61 6e 75 61 6c 53 74 61 72 74 50 75 62 6c 69 63 41 70 69 56 31 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 4d 75 6c 74 69 64 6f 63 73 22 3a 74 72 75 65 2c Data Ascii: gnNewFields":true,"signReadySignLinks":true,"signCfr11":false,"signSyncPrefillValues":true,"signCustomBrand":true,"signNewHeader":true,"signNavigation":true,"signDefaultOn":false,"tariffMigration":false,"manualStartPublicApiV1":false,"signMultidocs":true,
2023-11-01 16:01:30 UTC	13	IN	Data Raw: 6f 69 6e 74 73 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 54 65 6d 70 6c 61 74 65 4c 6f 63 6b 69 6e 67 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 52 65 76 69 73 65 52 65 71 75 65 73 74 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 52 65 76 69 73 65 52 65 71 75 65 73 74 47 65 61 72 32 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 54 72 69 67 67 65 72 73 22 3a 66 61 6c 73 65 2c 22 66 6f 6c 64 65 72 4d 65 74 61 64 61 74 61 4f 75 74 63 6f 6d 65 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 42 72 61 6e 64 69 6e 67 55 73 65 72 45 6e 61 62 6c 65 6d 65 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 4c 61 62 65 6c 22 3a 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 53 69 67 6e 69 6e 67 4c 6f 67 22 3a 66 61 6c 73 65 2c 22 72 65 6e 61 6d 65 46 69 6c Data Ascii: oints":false,"signTemplateLocking":false,"signReviseRequest":false,"signReviseRequestGear2":false,"signTriggers":false,"folderMetadataOutcome":false,"fileRequestBrandingUserEnablement":false,"classificationLabel":false,"includeSigningLog":false,"renameFil
2023-11-01 16:01:30 UTC	14	IN	Data Raw: 5f 65 6e 68 61 6e 63 65 6d 65 6e 74 73 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 73 68 6f 77 5f 67 72 69 64 5f 76 69 65 77 5f 73 6c 69 64 65 72 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 73 69 67 6e 5f 63 6c 69 65 6e 74 5f 6d 6f 64 75 6c 65 5f 66 65 64 65 72 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 70 72 65 76 69 65 77 5f 65 73 6c 5f 70 6f 73 74 5f 67 61 22 3a 74 72 75 65 7d 2c 22 70 72 65 76 69 65 77 22 3a 7b 22 61 70 69 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 70 69 2e 62 6f 78 2e 63 6f 6d 5c 2f 22 2c 22 61 70 70 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 70 70 2e 62 6f 78 2e 63 6f 6d 5c 2f 22 2c 22 73 74 61 74 69 63 48 6f 73 74 22 3a Data Ascii: _enhancements":true,"eua_experiment_show_grid_view_slider":true,"eua_experiment_sign_client_module_federation":true,"eua_experiment_preview_esl_post_ga":true},"preview":{"apiHost":"https:\/\/api.box.com\/","appHost":"https:\/\/app.box.com\/","staticHost":
2023-11-01 16:01:30 UTC	15	IN	Data Raw: 22 63 75 72 72 65 6e 74 52 6d 22 3a 22 65 6e 64 75 73 65 72 61 70 70 5f 73 68 61 72 65 64 5f 69 74 65 6d 5f 70 61 67 65 22 2c 22 64 61 74 61 63 65 6e 74 65 72 54 61 67 22 3a 22 75 73 2d 77 65 73 74 34 2d 70 72 6f 64 22 2c 22 72 75 6e 74 69 6d 65 4d 65 74 61 64 61 74 61 22 3a 7b 22 61 76 61 69 6c 61 62 69 6c 69 74 79 5a 6f 6e 65 22 3a 22 75 73 2d 77 65 73 74 34 2d 70 72 6f 64 22 2c 22 64 65 70 6c 6f 79 6d 65 6e 74 54 79 70 65 22 3a 22 6b 38 73 22 2c 22 65 6e 76 69 72 6f 6e 6d 65 6e 74 22 3a 22 70 72 6f 64 22 7d 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 71 6e 6f 64 66 65 68 6a 67 31 72 79 73 69 31 6d 22 2c 22 72 65 71 75 65 73 74 54 6f 6b 65 6e 22 3a 22 39 33 63 61 32 34 34 63 31 38 34 64 38 64 32 34 31 38 64 64 66 62 61 31 30 32 32 63 32 33 33 66 34 30 38 Data Ascii: "currentRm":"enduserapp_shared_item_page","datacenterTag":"us-west4-prod","runtimeMetadata":{"availabilityZone":"us-west4-prod","deploymentType":"k8s","environment":"prod"},"requestId":"qnodfehjg1rysi1m","requestToken":"93ca244c184d8d2418ddfba1022c233f408
2023-11-01 16:01:30 UTC	17	IN	Data Raw: 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 6c 61 6e 67 2d 65 6e 2d 55 53 2e 37 33 66 31 31 63 33 62 64 37 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 61 70 70 2e 35 63 61 34 35 66 35 32 61 35 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 20 3c 2f 62 6f Data Ascii: script src="https://cdn01.boxcdn.net/enduser/lang-en-US.73f11c3bd7.js" type="text/javascript" crossorigin="anonymous"></script> <script src="https://cdn01.boxcdn.net/enduser/app.5ca45f52a5.js" type="text/javascript" crossorigin="anonymous"></script> </bo
2023-11-01 16:01:30 UTC	17	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 16:01:34 UTC	18	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 16:01:34 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Strict-Transport-Security: max-age=31536000 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: z=hb08df7kme7h0dmjsilk716u98; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None Set-Cookie: box_visitor_id=6542765a59c8f6.29956021; expires=Fri, 01-Nov-2024 16:01:34 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite=None Set-Cookie: site_preference=desktop; path=/; domain=.box.com; secure X-EndUserApp-CurrentVersion: 21.100.0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 16:01:34 UTC	18	IN	Data Raw: 37 61 0d 0a 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 63 68 61 74 62 6f 74 22 3a 66 61 6c 73 65 2c 22 75 70 67 72 61 64 65 49 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 63 61 6e 41 64 64 53 65 61 74 73 22 3a 66 61 6c 73 65 2c 22 70 65 72 73 69 73 74 65 6e 74 44 72 69 76 65 50 72 6f 6d 6f 74 69 6f 6e 22 3a 66 61 6c 73 65 7d 2c 22 65 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a{"features":{"chatbot":false,"upgradeInline":false,"canAddSeats":false,"persistentDrivePromotion":false},"experiments":[]}0

Target ID:	0
Start time:	17:01:24
Start date:	01/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	17:01:25
Start date:	01/11/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff6eef20000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Chrome Cache Entry: 124

Chrome Cache Entry: 125

Chrome Cache Entry: 126

Chrome Cache Entry: 127

Chrome Cache Entry: 128

Chrome Cache Entry: 129

Chrome Cache Entry: 130

Windows Analysis Report
https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1

Target ID:	3
Start time:	17:01:29
Start date:	01/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/v5clm6m3dlj1hw4pgp3lhf6v40qfl5w0&c=E,1,9Gk0NhbrPFTGBZsPuOajnKI6V_3FYg58nPXd7VAB3s_hkeWYK7oyJgdyZLNBW7oTmsZsl9l1pW8XXTiGRnW4f83jquwsMfNbOwEGw1FQfDXhwhHFdWW3qqjCuqd_&typo=1
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre