Edit tour

Windows Analysis Report
https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1

Overview

General Information

Sample URL:	https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1
Analysis ID:	1335687
Infos:

Detection

Score:	3
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Queries the volume information (name, serial number etc) of a device

Queries disk information (often used to detect virtual machines)

Tries to load missing DLLs

May sleep (evasive loops) to hinder dynamic analysis

Creates files inside the system directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

Process Tree

System is w10x64

chrome.exe (PID: 2612 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 5560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1856,i,774930519848139389,9542806436953245555,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

svchost.exe (PID: 2436 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

chrome.exe (PID: 4560 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

cleanup

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 01 Nov 2023 19:49:23 GMTContent-Type: text/html; charset=utf-8Transfer-Encoding: chunkedX-Robots-Tag: noindex, nofollowStrict-Transport-Security: max-age=31536000Expires: Thu, 19 Nov 1981 08:52:00 GMTCache-Control: no-store, no-cache, must-revalidatePragma: no-cacheSet-Cookie: z=vpgrar85uoliacunnfc47msojr; path=/; domain=.app.box.com; secure; HttpOnlySet-Cookie: z=vpgrar85uoliacunnfc47msojr; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=NoneSet-Cookie: box_visitor_id=6542abc318eb73.99554465; expires=Fri, 01-Nov-2024 19:49:23 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite=NoneSet-Cookie: bv=PARTNERS-22010; expires=Wed, 08-Nov-2023 20:49:23 GMT; Max-Age=608400; path=/; domain=.app.box.com; secureSet-Cookie: cn=54; expires=Fri, 01-Nov-2024 19:49:23 GMT; Max-Age=31622400; path=/; domain=.app.box.com; secureSet-Cookie: site_preference=desktop; path=/; domain=.box.com; secureVia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: chromecache_127.2.dr	String found in binary or memory: http://blog.stevenlevithan.com/archives/parseuri
Source: svchost.exe, 00000001.00000002.2971288313.000001F887400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: svchost.exe, 00000001.00000002.2971389367.000001F887494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com/
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acocfkfsx7alydpzevdxln7drwdq_117.0.5938.134/117.0.5
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: svchost.exe, 00000001.00000002.2970856093.000001F882702000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2970536846.000001F881E2B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2971288313.000001F887400000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000003.2736774487.000001F8872A1000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: svchost.exe, 00000001.00000002.2970856093.000001F882702000.00000004.00000020.00020000.00000000.sdmp, qmgr.db.1.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: svchost.exe, 00000001.00000002.2971389367.000001F887494000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://edgedl.me.gvt1.com:80IO:ID:
Source: qmgr.db.1.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: chromecache_127.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_144.2.dr, chromecache_127.2.dr	String found in binary or memory: http://www.box.com)
Source: qmgr.db.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod1C:
Source: svchost.exe, 00000001.00000003.2112931409.000001F8872A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV21C:
Source: chromecache_127.2.dr	String found in binary or memory: https://github.com/derek-watson/jsUri
Source: chromecache_127.2.dr	String found in binary or memory: https://support.box.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 1P_JAR=2023-10-05-06; NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg

Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.6:49793 version: TLS 1.2

Source: C:\Windows\System32\svchost.exe

Section loaded: pcwum.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_2612_62588830

Jump to behavior

Source: C:\Windows\System32\svchost.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS

Jump to behavior

Source: classification engine

Classification label: clean3.win@17/60@18/9

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1856,i,774930519848139389,9542806436953245555,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1856,i,774930519848139389,9542806436953245555,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\svchost.exe TID: 4140

Thread sleep time: -30000s >= -30000s

Jump to behavior

Source: svchost.exe, 00000001.00000002.2970536846.000001F881E2F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: svchost.exe, 00000001.00000002.2970521106.000001F881E13000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000001.00000002.2971359746.000001F887459000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	1 Masquerading	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Virtualization/Sandbox Evasion	LSASS Memory	2 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	4 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Process Injection	Security Account Manager	21 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	5 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	3 Ingress Tool Transfer	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
http://jedwatson.github.io/classnames	0%	URL Reputation	safe
http://crl.ver)	0%	Avira URL Cloud	safe
http://www.box.com)	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	172.253.62.84	true	false	high
cdn.amplitude.com	52.85.150.185	true	false	high
www.google.com	172.253.62.147	true	false	high
clients.l.google.com	142.251.16.101	true	false	high
app.box.com	74.112.186.144	true	false	high
clients2.google.com	unknown	unknown	false	high
cdn01.boxcdn.net	unknown	unknown	false	unknown
cdn10.boxcdn.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Reputation
https://app.box.com/app-api/split-proxy/api/mySegments/-1	false	high
https://app.box.com/app-api/split-proxy/api/mySegments/2	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high
https://app.box.com/app-api/split-proxy/api/splitChanges?since=-1	false	high
https://app.box.com/gen204	false	high
https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1	false	high
https://app.box.com/index.php?rm=box_gen204_batch_record	false	high
https://app.box.com/app-api/enduserapp/current-user/features/secondary	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1	false	high
https://cdn.amplitude.com/libs/amplitude-4.5.2-min.gz.js	false	high
https://app.box.com/app-api/split-proxy/api/mySegments/6542abc318eb73.99554465	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://blog.stevenlevithan.com/archives/parseuri	chromecache_127.2.dr	false		high
https://g.live.com/odclientsettings/Prod1C:	qmgr.db.1.dr	false		high
https://github.com/derek-watson/jsUri	chromecache_127.2.dr	false		high
https://support.box.com	chromecache_127.2.dr	false		high
https://g.live.com/odclientsettings/ProdV21C:	svchost.exe, 00000001.00000003.2112931409.000001F8872A0000.00000004.00000800.00020000.00000000.sdmp, edb.log.1.dr	false		high
http://crl.ver)	svchost.exe, 00000001.00000002.2971288313.000001F887400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.box.com)	chromecache_144.2.dr, chromecache_127.2.dr	false	Avira URL Cloud: safe	low
http://jedwatson.github.io/classnames	chromecache_127.2.dr	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.112.186.144	app.box.com	United States	33011	BOXNETUS	false
142.251.16.101	clients.l.google.com	United States	15169	GOOGLEUS	false
172.253.62.84	accounts.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
52.85.150.185	cdn.amplitude.com	United States	16509	AMAZON-02US	false
172.253.62.147	www.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
192.168.2.6
127.0.0.1

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1335687
Start date and time:	2023-11-01 20:48:29 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 19s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean3.win@17/60@18/9
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 142.251.167.94, 34.104.35.123, 104.16.144.15, 104.16.145.15, 23.77.240.155, 192.229.211.108, 8.253.45.239, 142.250.31.94
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, cdn10.boxcdn.net.cdn.cloudflare.net, ctldl.windowsupdate.com, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, edgedl.me.gvt1.com, e16604.g.akamaiedge.net, update.googleapis.com, prod.fs.microsoft.com.akadns.net, cdn01.boxcdn.net.cdn.cloudflare.net
Not all processes where analyzed, report is missing behavior information
VT rate limit hit for: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1

Simulations

Behavior and APIs

Time	Type	Description
20:49:18	API Interceptor	2x Sleep call for process: svchost.exe modified

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7484331928780432
Encrypted:	false
SSDEEP:	1536:9J8s6YR3pnhWKInznxTgScwXhCeEcrKYSZNmTHk4UQJ32aqGT46yAwFM5hA7yH0z:9JZj5MiKNnNhoxuW
MD5:	0E9427D43D6D894B0DF6DFB3FB384BB3
SHA1:	607DC8CD7B2C3F528CC5CB2E14BC467FFF61970C
SHA-256:	F9CDFB8700AFBDD54D0EAED8BFB0E6C47FBA583BAA658C5539283D6A5989F8A2
SHA-512:	FDC24F9BC1DC172F0193ED3054050A9837B74C14D682A58D3C9AF01B9EFDB758F9AE6BF497D9ECBB2BAA3F4D7C5468133263380977692BC9A48363B7D6C3E9EB
Malicious:	false
Reputation:	low
Preview:	...........@..@9....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................Fajaj.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 104.66.243.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.42.68
Source: unknown	TCP traffic detected without corresponding DNS query: 104.66.243.145
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.42.68
Source: unknown	TCP traffic detected without corresponding DNS query: 23.217.42.68
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 13.107.21.200
Source: unknown	TCP traffic detected without corresponding DNS query: 209.197.3.8
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.134&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.134Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /X-Box-Client-Version: 21.102.0X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/6542abc318eb73.99554465 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.17.3Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/6542abc318eb73.99554465 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WDzwKAdt2csOOs3&MD=AdOGHopC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WDzwKAdt2csOOs3&MD=AdOGHopC HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (53860), with no line terminators
Category:	downloaded
Size (bytes):	53860
Entropy (8bit):	5.282699935101682
Encrypted:	false
SSDEEP:	1536:7Sxemx6klSfNOOBEUaLRGwWl+7EKB3ipef8QScD83Ce5reIKDX46QbHBTxjj:sM8v8H/
MD5:	8BE280B7ACDE2E751BE29B948D6D907A
SHA1:	12B1C87095F8ECAC06E0792A1270CA9CB66E6667
SHA-256:	8385685ACDA374E5AFEFB36AEA2D124002CFEDF011C6C46AEA314A4D2F794E6D
SHA-512:	0BEE842D395C4088A56CAF82D6B4652450DC7CD11BABD8B5CA6AE22B4B9419388B01697D1028B62BF985D32A790D0271DEF3073B63803113DFC7DF0408507269
Malicious:	false
Reputation:	low
URL:	https://cdn01.boxcdn.net/enduser/6689.636a60e242.js
Preview:	(globalThis.webpackChunkEndUserApp=globalThis.webpackChunkEndUserApp\|\|[]).push([[6689],{6610:(e,t,o)=>{"use strict";function n(e,t){if(!(e instanceof t))throw new TypeError("Cannot call a class as a function")}o.d(t,{Z:()=>n})},10379:(e,t,o)=>{"use strict";o.d(t,{Z:()=>r});var n=o(14665);function r(e,t){if("function"!==typeof t&&null!==t)throw new TypeError("Super expression must either be null or a function");e.prototype=Object.create(t&&t.prototype,{constructor:{value:e,writable:!0,configurable:!0}}),Object.defineProperty(e,"prototype",{writable:!1}),t&&(0,n.Z)(e,t)}},81253:(e,t,o)=>{"use strict";o.d(t,{Z:()=>r});var n=o(19756);function r(e,t){if(null==e)return{};var o,r,i=(0,n.Z)(e,t);if(Object.getOwnPropertySymbols){var l=Object.getOwnPropertySymbols(e);for(r=0;r<l.length;r++)o=l[r],t.indexOf(o)>=0\|\|Object.prototype.propertyIsEnumerable.call(e,o)&&(i[o]=e[o])}return i}},46070:(e,t,o)=>{"use strict";o.d(t,{Z:()=>i});var n=o(90484),r=o(63349);function i(e,t){if(t&&("object"===(0,n.Z)

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2023 20:49:19.494055033 CET	53	49640	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:19.578584909 CET	50971	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:19.578883886 CET	59565	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:19.579449892 CET	53592	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:19.579741955 CET	52621	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:19.671327114 CET	53	50971	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:19.672529936 CET	53	53592	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:19.672559977 CET	53	59565	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:19.672966003 CET	53	52621	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:20.246228933 CET	53	63938	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:22.571934938 CET	62889	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:22.575393915 CET	56370	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:22.665111065 CET	53	62889	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:22.669133902 CET	53	56370	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:23.416333914 CET	64736	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:23.417156935 CET	61050	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:24.074037075 CET	59800	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:24.074438095 CET	60585	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:24.169858932 CET	53	59800	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:24.170115948 CET	53	60585	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:26.692819118 CET	65227	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:26.693344116 CET	64020	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:26.785486937 CET	53	65227	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:26.786575079 CET	53	64020	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:27.008596897 CET	58485	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:27.008886099 CET	58674	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:29.380398989 CET	62973	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:29.380713940 CET	55146	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:30.671751976 CET	49543	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:30.672071934 CET	59409	53	192.168.2.6	1.1.1.1
Nov 1, 2023 20:49:30.764652014 CET	53	59409	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:30.764902115 CET	53	49543	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:37.311753988 CET	53	56619	1.1.1.1	192.168.2.6
Nov 1, 2023 20:49:56.077737093 CET	53	57771	1.1.1.1	192.168.2.6
Nov 1, 2023 20:50:18.575859070 CET	53	65481	1.1.1.1	192.168.2.6
Nov 1, 2023 20:50:19.486486912 CET	53	57951	1.1.1.1	192.168.2.6

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:19 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: 1P_JAR=2023-10-05-06; NID=511=UBeNCkZ3L8yXcx8qh4JFUXkwkNC9IrdiRdbjSTjqSiFh8WrRcbKr_rOJbgHY6TA4RT-6ps0bhemfwCPBsLMgPT7-gTcWqHvZvZbafOpkqRy0dLyYG9AjP2vbUBomarnc9pcZVlhHkUeUaWMurD0GGXyW05_B_1IyUNYEELmyqRg
2023-11-01 19:49:19 UTC	1	OUT	Data Raw: 20 Data Ascii:

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:27 UTC	21	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 19:49:27 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Strict-Transport-Security: max-age=31536000 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: z=vpgrar85uoliacunnfc47msojr; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None Set-Cookie: box_visitor_id=6542abc318eb73.99554465; expires=Fri, 01-Nov-2024 19:49:27 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite=None Set-Cookie: site_preference=desktop; path=/; domain=.box.com; secure X-EndUserApp-CurrentVersion: 21.102.0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 19:49:27 UTC	22	IN	Data Raw: 37 61 0d 0a 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 63 68 61 74 62 6f 74 22 3a 66 61 6c 73 65 2c 22 75 70 67 72 61 64 65 49 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 63 61 6e 41 64 64 53 65 61 74 73 22 3a 66 61 6c 73 65 2c 22 70 65 72 73 69 73 74 65 6e 74 44 72 69 76 65 50 72 6f 6d 6f 74 69 6f 6e 22 3a 66 61 6c 73 65 7d 2c 22 65 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a{"features":{"chatbot":false,"upgradeInline":false,"canAddSeats":false,"persistentDrivePromotion":false},"experiments":[]}0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:28 UTC	95	OUT	POST /gen204 HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 448 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Box-Client-Version: 21.102.0 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json X-Request-Token: 9a65e91da9fd9ffc90cd219c0bb61fb7f76a8b8289fd09d760d91817e2db32ec Request-Token: 9a65e91da9fd9ffc90cd219c0bb61fb7f76a8b8289fd09d760d91817e2db32ec sec-ch-ua-platform: "Windows" Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop
2023-11-01 19:49:28 UTC	96	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 65 75 61 5f 70 65 72 66 6f 72 6d 61 6e 63 65 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 39 37 34 61 37 71 68 6a 67 38 64 32 6d 39 73 70 22 2c 22 62 72 6f 77 73 65 72 5f 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 22 2c 22 62 72 6f 77 73 65 72 5f 76 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 22 2c 22 64 65 76 69 63 65 5f 6e 61 6d 65 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 70 65 72 66 6f 72 6d 61 6e 63 65 5f 69 64 22 3a 22 73 70 6c 69 74 22 2c 22 73 74 61 72 74 5f 73 74 61 74 65 22 3a 22 69 6e 69 74 69 61 6c 22 2c 22 65 Data Ascii: {"data":[{"category":"eua_performance","event_type":"web","country_code":"US","request_id":"974a7qhjg8d2m9sp","browser_name":"Chrome","browser_version":"117.0","os_name":"Windows","device_name":"unknown","performance_id":"split","start_state":"initial","e

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:20 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-yybDFh_c5GbYim22QZrSwA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Wed, 01 Nov 2023 19:49:20 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 6148 X-Daystart: 46160 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-11-01 19:49:20 UTC	2	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 36 31 34 38 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 34 36 31 36 30 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="6148" elapsed_seconds="46160"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-11-01 19:49:20 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-11-01 19:49:20 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:31 UTC	103	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 19:49:31 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked x-envoy-upstream-service-time: 12 strict-transport-security: max-age=31536000 box-request-id: 03a566ade2d352ce74d898077df20ab2 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 19:49:31 UTC	103	IN	Data Raw: 31 31 0d 0a 7b 22 6d 79 53 65 67 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 11{"mySegments":[]}0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:31 UTC	104	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-Length: 25727 Connection: close Date: Wed, 01 Nov 2023 19:49:32 GMT Last-Modified: Mon, 21 Oct 2019 15:45:34 GMT ETag: "5e816d32cb1cd1f7bda71ead48ac192e" Cache-Control: max-age=31536000 Content-Encoding: gzip x-amz-version-id: zskY2uLkrv0oL4SiNEoxREaWRVRZwrqD Accept-Ranges: bytes Server: AmazonS3 Access-Control-Allow-Origin: * X-Cache: Miss from cloudfront Via: 1.1 a075746ea1824aa1c02a5e26a9e968e4.cloudfront.net (CloudFront) X-Amz-Cf-Pop: IAD89-C3 X-Amz-Cf-Id: V7x6iKjU64jvQe_ByhpC0QwH_QaYtCPuDFg23PtXNUVcgBAOGsPZMg==
2023-11-01 19:49:31 UTC	105	IN	Data Raw: 1f 8b 08 00 75 55 e7 5b 00 03 c4 bd 0b 63 da b8 d2 30 fc 57 88 9f 6e d6 2e 82 60 20 24 40 5d de 34 4d bb d9 6d 93 6e 2e bb dd 25 9c bc 0e 28 c4 0d d8 d4 36 b9 34 e6 f9 ed df 8c 6e 96 2f a4 dd 73 9e e7 fd ce d9 06 59 d7 d1 68 34 9a 19 49 a3 8d eb a5 3f 8e bd c0 37 29 89 ad 27 23 b8 fa 42 c7 b1 e1 38 f1 e3 82 06 d7 15 fa b0 08 c2 38 da dc 34 96 fe 84 5e 7b 3e 9d 18 1b 32 71 1e 4c 96 33 3a e0 3f 75 91 d5 89 4d ab 67 c8 6a d3 9a 78 e9 cd 4d fe 5b 77 e7 93 01 0f 9a b1 d5 c3 ef c5 cc 8b 97 13 8a e5 57 66 7c e3 45 44 c1 06 80 2d 23 5a 89 e2 d0 03 e0 fa 32 be 42 39 d4 21 8d 97 a1 5f 89 9d 27 01 43 ef 69 b5 22 50 31 89 25 54 56 1a 5c a9 e2 31 16 27 be f5 e4 5d 9b 1b 26 7d 15 5b 96 a8 8a be b2 eb db 2f e3 c1 47 37 be a9 5f cf 82 20 34 e9 56 6c 55 8d 8a 51 f5 7b 2c Data Ascii: uU[c0Wn.` $@]4Mmn.%(64n/sYh4I?7)'#B884^{>2qL3:?uMgjxM[wWf\|ED-#Z2B9!_'Ci"P1%TV\1']&}[/G7_ 4VlUQ{,
2023-11-01 19:49:31 UTC	120	IN	Data Raw: c1 48 cf 90 2b a4 d1 60 ae a8 fc 3d fb eb 93 aa 41 cb 8d 47 10 18 5f ff ad 68 f6 4c ef b7 6b a6 3a 63 0e ab c7 cc 00 81 d3 40 d7 2f 06 48 99 46 cc d6 1c d7 31 a0 da 49 10 e2 db e8 10 0c d1 af 29 3e 70 0f 45 ae bc 19 e4 58 40 56 d4 2b 62 03 94 f4 27 58 cb 20 7b ee 96 c6 3a 8f 9c e8 65 14 84 29 f8 2b 84 d7 9f 9a 8e d3 18 a0 5c e9 b0 58 71 59 84 f9 c4 64 e7 f1 1d 0c 6a 26 0d 10 d1 4a 6f 84 14 9f 36 dc dc 64 9e b5 f3 2f 2b a5 8f a3 67 9f 0f 46 5f b7 f0 e5 7d a3 65 5b 7a b9 dc 2b 32 77 bf e4 7c e3 af 83 63 a0 3f 82 01 d2 77 ea 50 e8 da 79 0a a7 0f ba 5f 22 cd 73 57 e6 a1 fa 06 9a da a4 5a d4 77 5f 2d d5 73 19 1b 9e 90 ce c7 ce 12 6d a7 0b fc a9 da cc a8 95 1e b2 46 a7 bb 62 34 d8 48 2c ac 45 a9 33 d8 fc 6e ac 19 38 0b 1c 8a 01 1d 06 00 ba 3c ac de a3 a8 06 8b Data Ascii: H+`=AG_hLk:c@/HF1I)>pEX@V+b'X {:e)+\XqYdj&Jo6d/+gF_}e[z+2w\|c?wPy_"sWZw_-smFb4H,E3n8<
2023-11-01 19:49:31 UTC	122	IN	Data Raw: ed 4a ee 83 7b f4 d7 6a 61 4c ff c2 1a f1 31 37 dc 10 46 2e 06 e1 1c 9f ab 24 06 94 ee b4 f9 f4 31 3d b7 d5 34 07 4e df b2 4a f3 ce ea 52 cd 1d c9 15 c2 1b b6 da 9d 51 f2 60 ed 76 9e 6b 04 2b e6 6d 08 91 11 66 f4 18 44 08 36 d9 ac fe 45 b4 58 8c fb 6b e0 0b e7 86 6a 0e b2 25 0b 84 61 31 46 69 01 7a 36 c0 5f 90 c6 dc 71 d2 4f 2e d6 00 be 85 45 b6 f0 c6 45 be 0b d1 d2 6f 5f dc 3f 07 7a b4 80 88 14 02 f7 2e 6c 35 13 cf ed b4 39 a2 92 ce ee 2d de a7 84 10 40 ca 60 4a e0 fb 0e 68 0d 53 21 e8 c6 40 d0 17 91 05 25 13 c4 58 e8 3d c0 ec 58 44 09 ab 59 76 83 d5 96 2c dc 1a 90 e0 f8 fb e8 1f 49 f1 1f 68 00 08 cf 5b b8 30 33 66 ee 23 32 5f ab 8f f4 12 5d 58 7d 98 1b 66 08 e2 15 7b 0a 9a 57 1a 10 97 0c 23 b2 e0 2b 04 c6 e3 7d e0 39 9d 78 ae 62 71 15 51 a3 b5 c5 0a 0c Data Ascii: J{jaL17F.$1=4NJRQ`vk+mfD6EXkj%a1Fiz6_qO.EEo_?z.l59-@`JhS!@%X=XDYv,Ih[03f#2_]X}f{W#+}9xbqQ

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:31 UTC	131	IN	HTTP/1.1 401 Unauthorized Date: Wed, 01 Nov 2023 19:49:31 GMT Transfer-Encoding: chunked x-envoy-upstream-service-time: 11 strict-transport-security: max-age=31536000 box-request-id: 03211b2a9c5430a711df7222c0b0e2edf Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 19:49:31 UTC	131	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:32 UTC	131	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WDzwKAdt2csOOs3&MD=AdOGHopC HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-01 19:49:32 UTC	132	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0404a583-d803-4d2e-a823-f6132169c793 MS-RequestId: 732e20c9-eb3c-4eb8-aad4-ba9d8c98769f MS-CV: xrrcdVt4mU+wlKQ5.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 Nov 2023 19:49:32 GMT Connection: close Content-Length: 24490
2023-11-01 19:49:32 UTC	132	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2023-11-01 19:49:32 UTC	148	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:33 UTC	156	OUT	POST /index.php?rm=box_gen204_batch_record HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 1112 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=vpgrar85uoliacunnfc47msojr; box_visitor_id=6542abc318eb73.99554465; bv=PARTNERS-22010; cn=54; site_preference=desktop; amplitude_id_c6eb3d709c5c30ca80c0381080bcc254box.com=eyJkZXZpY2VJZCI6ImFhNmE4YjJlLTNkNzYtNDIwMy1iZTczLWY2ZjE2MGFlNGQ3N1IiLCJ1c2VySWQiOm51bGwsIm9wdE91dCI6ZmFsc2UsInNlc3Npb25JZCI6MTY5ODg2ODE3MDUxNSwibGFzdEV2ZW50VGltZSI6MTY5ODg2ODE3MDUxNSwiZXZlbnRJZCI6MCwiaWRlbnRpZnlJZCI6MCwic2VxdWVuY2VOdW1iZXIiOjB9
2023-11-01 19:49:33 UTC	157	OUT	Data Raw: 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 72 65 73 69 6e 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 65 76 65 6e 74 73 22 3a 5b 7b 22 70 61 74 68 22 3a 22 2f 73 2f 64 69 7a 6d 75 73 79 64 74 74 6d 74 38 66 77 6a 39 73 79 76 6e 34 37 76 69 37 73 78 72 6d 31 66 26 63 3d 45 2c 31 2c 42 7a 41 77 36 68 76 33 72 5f 5a 72 38 48 78 55 4e 71 36 6f 42 4d 64 43 57 69 38 65 32 53 31 7a 77 61 7a 53 74 7a 47 54 73 4b 6d 32 57 37 73 6e 66 6e 55 59 54 67 6b 4c 4b 4e 61 71 32 50 4e 52 63 70 56 2d 43 30 32 57 59 4f 4f 79 34 55 67 41 39 43 77 63 55 38 4f 4f 6e 62 52 6c 6f 76 4d 72 55 74 79 50 67 64 5f 37 77 66 75 59 68 42 4d 2c 26 74 79 70 6f 3d 31 22 2c 22 73 65 73 73 69 6f 6e 22 3a 22 37 62 31 32 39 66 35 34 62 66 66 63 31 34 31 62 66 38 34 35 65 31 Data Ascii: [{"category":"resin","event_type":"web","events":[{"path":"/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1","session":"7b129f54bffc141bf845e1

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:50:10 UTC	159	OUT	GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=WDzwKAdt2csOOs3&MD=AdOGHopC HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2023-11-01 19:50:11 UTC	159	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "Mx1RoJH/qEwpWfKllx7sbsl28AuERz5IYdcsvtTJcgM=_2160" MS-CorrelationId: f2726178-2075-4a57-b271-472aff5a37c1 MS-RequestId: 8b056eab-77ee-4592-a57a-47bc4de31ff8 MS-CV: SUEKB72zeky09mTF.0 X-Microsoft-SLSClientCache: 2160 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Wed, 01 Nov 2023 19:50:10 GMT Connection: close Content-Length: 25457
2023-11-01 19:50:11 UTC	160	IN	Data Raw: 4d 53 43 46 00 00 00 00 51 22 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 db 8e 00 00 14 00 00 00 00 00 10 00 51 22 00 00 20 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 f3 43 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 0d 92 6f db e5 21 f3 43 43 4b ed 5a 09 38 55 5b df 3f 93 99 90 29 99 e7 29 ec 73 cc 4a 66 32 cf 84 32 64 c8 31 c7 11 52 38 87 90 42 66 09 99 87 32 0f 19 0a 09 51 a6 a8 08 29 53 86 4a 52 84 50 df 46 83 ba dd 7b df fb 7e ef 7d ee 7d bf ef 9e e7 d9 67 ef 35 ee b5 fe eb 3f ff b6 96 81 a2 0a 04 fc 31 40 21 5b 3f a5 ed 1b 04 0e 85 42 a0 10 04 64 12 6c a5 de aa a1 d8 ea f3 58 01 f2 f5 67 0b 5e 9b bd e8 a0 90 1d bf 40 88 9d eb 49 b4 87 9b ab 8b 9d 2b 46 c8 c7 c5 19 92 Data Ascii: MSCFQ"DQ" AdCenvironment.cabo!CCKZ8U[?))sJf22d1R8Bf2Q)SJRPF{~}}g5?1@![?BdlXg^@I+F
2023-11-01 19:50:11 UTC	175	IN	Data Raw: 21 6f b3 eb a6 cc f5 31 be cf 05 e2 a9 fe fa 57 6d 19 30 b3 c2 c5 66 c9 6a df f5 e7 f0 78 bd c7 a8 9e 25 e3 f9 bc ed 6b 54 57 08 2b 51 82 44 12 fb b9 53 8c cc f4 60 12 8a 76 cc 40 40 41 9b dc 5c 17 ff 5c f9 5e 17 35 98 24 56 4b 74 ef 42 10 c8 af bf 7f c6 7f f2 37 7d 5a 3f 1c f2 99 79 4a 91 52 00 af 38 0f 17 f5 2f 79 81 65 d9 a9 b5 6b e4 c7 ce f6 ca 7a 00 6f 4b 30 44 24 22 3c cf ed 03 a5 96 8f 59 29 bc b6 fd 04 e1 70 9f 32 4a 27 fd 55 af 2f fe b6 e5 8e 33 bb 62 5f 9a db 57 40 e9 f1 ce 99 66 90 8c ff 6a 62 7f dd c5 4a 0b 91 26 e2 39 ec 19 4a 71 63 9d 7b 21 6d c3 9c a3 a2 3c fa 7f 7d 96 6a 90 78 a6 6d d2 e1 9c f9 1d fc 38 d8 94 f4 c6 a5 0a 96 86 a4 bd 9e 1a ae 04 42 83 b8 b5 80 9b 22 38 20 b5 25 e5 64 ec f7 f4 bf 7e 63 59 25 0f 7a 2e 39 57 76 a2 71 aa 06 8a Data Ascii: !o1Wm0fjx%kTW+QDS`v@@A\\^5$VKtB7}Z?yJR8/yekzoK0D$"<Y)p2J'U/3b_W@fjbJ&9Jqc{!m<}jxm8B"8 %d~cY%z.9Wvq

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:23 UTC	5	IN	HTTP/1.1 404 Not Found Date: Wed, 01 Nov 2023 19:49:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked X-Robots-Tag: noindex, nofollow Strict-Transport-Security: max-age=31536000 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: z=vpgrar85uoliacunnfc47msojr; path=/; domain=.app.box.com; secure; HttpOnly Set-Cookie: z=vpgrar85uoliacunnfc47msojr; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None Set-Cookie: box_visitor_id=6542abc318eb73.99554465; expires=Fri, 01-Nov-2024 19:49:23 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite=None Set-Cookie: bv=PARTNERS-22010; expires=Wed, 08-Nov-2023 20:49:23 GMT; Max-Age=608400; path=/; domain=.app.box.com; secure Set-Cookie: cn=54; expires=Fri, 01-Nov-2024 19:49:23 GMT; Max-Age=31622400; path=/; domain=.app.box.com; secure Set-Cookie: site_preference=desktop; path=/; domain=.box.com; secure Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 19:49:23 UTC	6	IN	Data Raw: 32 62 63 38 0d 0a 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 72 65 73 69 6e 2d 63 6c 69 65 6e 74 3d 22 77 65 62 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 Data Ascii: 2bc8 <!DOCTYPE html><html lang="en-US" data-resin-client="web"><head><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-s
2023-11-01 19:49:23 UTC	6	IN	Data Raw: 63 61 6c 65 3d 31 2e 30 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 20 20 3c 74 69 74 6c 65 3e 42 6f 78 3c 2f 74 69 74 6c 65 3e 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 66 6f 6e 74 73 2f 31 2e 30 2e 35 2f 6c 61 74 6f 2f 4c 61 74 6f 2d 77 6f 66 66 2e 63 73 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 61 70 70 2e 32 66 30 64 31 66 63 34 37 64 2e 63 73 73 22 3e 20 20 20 3c 6c Data Ascii: cale=1.0"> <meta name="robots" content="noindex, nofollow"> <title>Box</title> <link rel="stylesheet" href="https://cdn01.boxcdn.net/fonts/1.0.5/lato/Lato-woff.css"> <link rel="stylesheet" href="https://cdn01.boxcdn.net/enduser/app.2f0d1fc47d.css"> <l
2023-11-01 19:49:23 UTC	7	IN	Data Raw: 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 31 35 32 78 31 35 32 2d 72 35 74 57 67 68 2e 70 6e 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 38 30 78 31 38 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 31 38 30 78 31 38 30 2d 74 56 30 30 31 63 2e 70 6e 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 69 63 6f 6e 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 70 6e 67 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 Data Ascii: n.net/_assets/img/favicons/apple-touch-icon-152x152-r5tWgh.png"><link rel="apple-touch-icon" sizes="180x180" href="https://cdn10.boxcdn.net/_assets/img/favicons/apple-touch-icon-180x180-tV001c.png"><link rel="icon" type="image/png" href="https://cdn10.b
2023-11-01 19:49:23 UTC	8	IN	Data Raw: 32 57 34 2e 73 76 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 66 61 76 69 63 6f 6e 2d 79 7a 2d 74 6a 2d 2e 69 63 6f 22 20 64 61 74 61 2d 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 69 63 6f 6e 2d 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 66 61 76 69 63 6f 6e 2d 45 48 57 57 79 50 2e 69 63 6f 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 6d 73 61 70 70 6c 69 63 61 74 69 6f 6e 2d 54 69 6c 65 43 6f 6c 6f 72 22 20 63 Data Ascii: 2W4.svg"><link rel="shortcut icon" href="https://cdn10.boxcdn.net/_assets/img/favicons/favicon-yz-tj-.ico" data-notification-icon-href="https://cdn10.boxcdn.net/_assets/img/favicons/notification-favicon-EHWWyP.ico"><meta name="msapplication-TileColor" c
2023-11-01 19:49:23 UTC	9	IN	Data Raw: 70 6c 69 63 61 74 69 6f 6e 2d 63 6f 6e 66 69 67 22 20 63 6f 6e 74 65 6e 74 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 31 30 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 62 72 6f 77 73 65 72 63 6f 6e 66 69 67 2d 66 64 42 52 65 4b 2e 78 6d 6c 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 66 66 66 66 66 66 22 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 20 63 6c 61 73 73 3d 22 69 73 2d 6c 6f 61 64 69 6e 67 20 22 20 64 61 74 61 2d 72 65 73 69 6e 2d 61 70 70 6c 69 63 61 74 69 6f 6e 3d 22 66 69 6c 65 73 22 3e 20 20 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 73 63 72 69 70 74 2d 77 61 72 6e 69 6e 67 22 3e 20 4a 61 76 Data Ascii: plication-config" content="https://cdn10.boxcdn.net/_assets/img/favicons/browserconfig-fdBReK.xml"><meta name="theme-color" content="#ffffff"></head><body class="is-loading " data-resin-application="files"> <noscript><div class="noscript-warning"> Jav
2023-11-01 19:49:23 UTC	10	IN	Data Raw: 22 68 61 73 55 6e 6c 69 6d 69 74 65 64 53 74 6f 72 61 67 65 22 3a 66 61 6c 73 65 2c 22 74 69 65 72 22 3a 6e 75 6c 6c 2c 22 62 6f 78 54 6f 6f 6c 73 44 6f 77 6e 6c 6f 61 64 55 52 4c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 65 33 2e 62 6f 78 63 64 6e 2e 6e 65 74 5c 2f 62 6f 78 2d 69 6e 73 74 61 6c 6c 65 72 73 5c 2f 62 6f 78 65 64 69 74 5c 2f 77 69 6e 5c 2f 63 75 72 72 65 6e 74 72 65 6c 65 61 73 65 5c 2f 42 6f 78 54 6f 6f 6c 73 49 6e 73 74 61 6c 6c 65 72 2e 65 78 65 22 2c 22 61 63 63 6f 75 6e 74 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 63 63 6f 75 6e 74 2e 62 6f 78 2e 63 6f 6d 22 2c 22 61 70 69 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 70 69 2e 62 6f 78 2e 63 6f 6d 5c 2f 22 2c 22 61 6d 70 6c 69 74 75 64 65 41 50 49 4b 65 79 22 3a 22 63 Data Ascii: "hasUnlimitedStorage":false,"tier":null,"boxToolsDownloadURL":"https:\/\/e3.boxcdn.net\/box-installers\/boxedit\/win\/currentrelease\/BoxToolsInstaller.exe","accountHost":"https:\/\/account.box.com","apiHost":"https:\/\/api.box.com\/","amplitudeAPIKey":"c
2023-11-01 19:49:23 UTC	11	IN	Data Raw: 61 73 73 69 66 69 63 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 63 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 56 32 22 3a 66 61 6c 73 65 2c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 22 3a 66 61 6c 73 65 2c 22 64 65 76 65 6c 6f 70 65 72 43 6f 6e 73 6f 6c 65 22 3a 66 61 6c 73 65 2c 22 64 6f 63 67 65 6e 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 22 3a 66 61 6c 73 65 2c 22 66 65 65 64 41 63 63 65 73 73 53 74 61 74 73 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 41 6c 6c 6f 77 45 64 69 74 6f 72 73 45 6e 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 42 72 61 6e 64 69 6e 67 55 73 65 72 45 6e 61 62 6c 65 6d 65 6e 74 45 6e 61 62 6c 65 Data Ascii: assification":false,"classificationV2":false,"collections":false,"developerConsole":false,"docgenEnabled":false,"feed":false,"feedAccessStats":false,"fileRequestEnabled":false,"fileRequestAllowEditorsEnabled":false,"fileRequestBrandingUserEnablementEnable
2023-11-01 19:49:23 UTC	12	IN	Data Raw: 67 6e 4e 65 77 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 73 69 67 6e 52 65 61 64 79 53 69 67 6e 4c 69 6e 6b 73 22 3a 74 72 75 65 2c 22 73 69 67 6e 43 66 72 31 31 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 53 79 6e 63 50 72 65 66 69 6c 6c 56 61 6c 75 65 73 22 3a 74 72 75 65 2c 22 73 69 67 6e 43 75 73 74 6f 6d 42 72 61 6e 64 22 3a 74 72 75 65 2c 22 73 69 67 6e 4e 65 77 48 65 61 64 65 72 22 3a 74 72 75 65 2c 22 73 69 67 6e 4e 61 76 69 67 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 73 69 67 6e 44 65 66 61 75 6c 74 4f 6e 22 3a 66 61 6c 73 65 2c 22 74 61 72 69 66 66 4d 69 67 72 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 6d 61 6e 75 61 6c 53 74 61 72 74 50 75 62 6c 69 63 41 70 69 56 31 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 4d 75 6c 74 69 64 6f 63 73 22 3a 74 72 75 65 2c Data Ascii: gnNewFields":true,"signReadySignLinks":true,"signCfr11":false,"signSyncPrefillValues":true,"signCustomBrand":true,"signNewHeader":true,"signNavigation":true,"signDefaultOn":false,"tariffMigration":false,"manualStartPublicApiV1":false,"signMultidocs":true,
2023-11-01 19:49:23 UTC	13	IN	Data Raw: 6f 69 6e 74 73 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 54 65 6d 70 6c 61 74 65 4c 6f 63 6b 69 6e 67 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 52 65 76 69 73 65 52 65 71 75 65 73 74 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 52 65 76 69 73 65 52 65 71 75 65 73 74 47 65 61 72 32 22 3a 66 61 6c 73 65 2c 22 73 69 67 6e 54 72 69 67 67 65 72 73 22 3a 66 61 6c 73 65 2c 22 66 6f 6c 64 65 72 4d 65 74 61 64 61 74 61 4f 75 74 63 6f 6d 65 22 3a 66 61 6c 73 65 2c 22 66 69 6c 65 52 65 71 75 65 73 74 42 72 61 6e 64 69 6e 67 55 73 65 72 45 6e 61 62 6c 65 6d 65 6e 74 22 3a 66 61 6c 73 65 2c 22 63 6c 61 73 73 69 66 69 63 61 74 69 6f 6e 4c 61 62 65 6c 22 3a 66 61 6c 73 65 2c 22 69 6e 63 6c 75 64 65 53 69 67 6e 69 6e 67 4c 6f 67 22 3a 66 61 6c 73 65 2c 22 72 65 6e 61 6d 65 46 69 6c Data Ascii: oints":false,"signTemplateLocking":false,"signReviseRequest":false,"signReviseRequestGear2":false,"signTriggers":false,"folderMetadataOutcome":false,"fileRequestBrandingUserEnablement":false,"classificationLabel":false,"includeSigningLog":false,"renameFil
2023-11-01 19:49:23 UTC	14	IN	Data Raw: 5f 65 6e 68 61 6e 63 65 6d 65 6e 74 73 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 73 68 6f 77 5f 67 72 69 64 5f 76 69 65 77 5f 73 6c 69 64 65 72 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 73 69 67 6e 5f 63 6c 69 65 6e 74 5f 6d 6f 64 75 6c 65 5f 66 65 64 65 72 61 74 69 6f 6e 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 70 72 65 76 69 65 77 5f 65 73 6c 5f 70 6f 73 74 5f 67 61 22 3a 74 72 75 65 7d 2c 22 70 72 65 76 69 65 77 22 3a 7b 22 61 70 69 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 70 69 2e 62 6f 78 2e 63 6f 6d 5c 2f 22 2c 22 61 70 70 48 6f 73 74 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 70 70 2e 62 6f 78 2e 63 6f 6d 5c 2f 22 2c 22 73 74 61 74 69 63 48 6f 73 74 22 3a Data Ascii: _enhancements":true,"eua_experiment_show_grid_view_slider":true,"eua_experiment_sign_client_module_federation":true,"eua_experiment_preview_esl_post_ga":true},"preview":{"apiHost":"https:\/\/api.box.com\/","appHost":"https:\/\/app.box.com\/","staticHost":
2023-11-01 19:49:23 UTC	15	IN	Data Raw: 22 63 75 72 72 65 6e 74 52 6d 22 3a 22 65 6e 64 75 73 65 72 61 70 70 5f 73 68 61 72 65 64 5f 69 74 65 6d 5f 70 61 67 65 22 2c 22 64 61 74 61 63 65 6e 74 65 72 54 61 67 22 3a 22 75 73 2d 77 65 73 74 34 2d 70 72 6f 64 22 2c 22 72 75 6e 74 69 6d 65 4d 65 74 61 64 61 74 61 22 3a 7b 22 61 76 61 69 6c 61 62 69 6c 69 74 79 5a 6f 6e 65 22 3a 22 75 73 2d 77 65 73 74 34 2d 70 72 6f 64 22 2c 22 64 65 70 6c 6f 79 6d 65 6e 74 54 79 70 65 22 3a 22 6b 38 73 22 2c 22 65 6e 76 69 72 6f 6e 6d 65 6e 74 22 3a 22 70 72 6f 64 22 7d 2c 22 72 65 71 75 65 73 74 49 64 22 3a 22 39 37 34 61 37 71 68 6a 67 38 64 32 6d 39 73 70 22 2c 22 72 65 71 75 65 73 74 54 6f 6b 65 6e 22 3a 22 39 61 36 35 65 39 31 64 61 39 66 64 39 66 66 63 39 30 63 64 32 31 39 63 30 62 62 36 31 66 62 37 66 37 36 Data Ascii: "currentRm":"enduserapp_shared_item_page","datacenterTag":"us-west4-prod","runtimeMetadata":{"availabilityZone":"us-west4-prod","deploymentType":"k8s","environment":"prod"},"requestId":"974a7qhjg8d2m9sp","requestToken":"9a65e91da9fd9ffc90cd219c0bb61fb7f76
2023-11-01 19:49:23 UTC	16	IN	Data Raw: 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 6c 61 6e 67 2d 65 6e 2d 55 53 2e 65 64 65 30 36 36 34 66 31 63 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 3c 73 63 72 69 70 74 20 73 72 63 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 61 70 70 2e 33 64 38 34 30 34 62 63 64 62 2e 6a 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 3c 2f 73 63 72 69 70 74 3e 20 20 3c 2f 62 6f Data Ascii: script src="https://cdn01.boxcdn.net/enduser/lang-en-US.ede0664f1c.js" type="text/javascript" crossorigin="anonymous"></script> <script src="https://cdn01.boxcdn.net/enduser/app.3d8404bcdb.js" type="text/javascript" crossorigin="anonymous"></script> </bo

Timestamp	kBytes transferred	Direction	Data
2023-11-01 19:49:26 UTC	18	IN	HTTP/1.1 200 OK Date: Wed, 01 Nov 2023 19:49:26 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Strict-Transport-Security: max-age=31536000 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Set-Cookie: z=vpgrar85uoliacunnfc47msojr; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None Set-Cookie: box_visitor_id=6542abc318eb73.99554465; expires=Fri, 01-Nov-2024 19:49:26 GMT; Max-Age=31622400; path=/; domain=.box.com; secure; SameSite=None Set-Cookie: site_preference=desktop; path=/; domain=.box.com; secure X-EndUserApp-CurrentVersion: 21.102.0 Via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-11-01 19:49:26 UTC	18	IN	Data Raw: 37 61 0d 0a 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 63 68 61 74 62 6f 74 22 3a 66 61 6c 73 65 2c 22 75 70 67 72 61 64 65 49 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 63 61 6e 41 64 64 53 65 61 74 73 22 3a 66 61 6c 73 65 2c 22 70 65 72 73 69 73 74 65 6e 74 44 72 69 76 65 50 72 6f 6d 6f 74 69 6f 6e 22 3a 66 61 6c 73 65 7d 2c 22 65 78 70 65 72 69 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 7a{"features":{"chatbot":false,"upgradeInline":false,"canAddSeats":false,"persistentDrivePromotion":false},"experiments":[]}0

Target ID:	0
Start time:	20:49:12
Start date:	01/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	1
Start time:	20:49:17
Start date:	01/11/2023
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7403e0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	20:49:21
Start date:	01/11/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Chrome Cache Entry: 101

Chrome Cache Entry: 102

Chrome Cache Entry: 103

Chrome Cache Entry: 104

Chrome Cache Entry: 105

Chrome Cache Entry: 106

Chrome Cache Entry: 107

Chrome Cache Entry: 108

Chrome Cache Entry: 109

Chrome Cache Entry: 110

Chrome Cache Entry: 111

Chrome Cache Entry: 112

Chrome Cache Entry: 113

Chrome Cache Entry: 114

Chrome Cache Entry: 115

Chrome Cache Entry: 116

Chrome Cache Entry: 117

Chrome Cache Entry: 118

Chrome Cache Entry: 119

Chrome Cache Entry: 120

Chrome Cache Entry: 121

Chrome Cache Entry: 122

Chrome Cache Entry: 123

Windows Analysis Report
https://app.box.com/s/dizmusydttmt8fwj9syvn47vi7sxrm1f&c=E,1,BzAw6hv3r_Zr8HxUNq6oBMdCWi8e2S1zwazStzGTsKm2W7snfnUYTgkLKNaq2PNRcpV-C02WYOOy4UgA9CwcU8OOnbRlovMrUtyPgd_7wfuYhBM,&typo=1

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre