Edit tour

Windows Analysis Report
https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32

Overview

General Information

Sample URL:	https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32
Analysis ID:	1590104
Infos:

Detection

HTMLPhisher

Score:	68
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

AI detected phishing page

Yara detected HtmlPhish46

Yara detected HtmlPhish54

AI detected suspicious Javascript

Detected non-DNS traffic on DNS port

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64

chrome.exe (PID: 5640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 5832 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2252,i,14136314091735512277,7748461438341982796,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 7088 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
0.49.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
0.55.id.script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.3.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.4.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_46	Yara detected HtmlPhish_46	Joe Security
3.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_46	Yara detected HtmlPhish_46	Joe Security
3.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

AI detected phishing page

Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'login.hrmails.online' does not match the legitimate domain for Microsoft., The domain 'hrmails.online' is not associated with Microsoft and appears suspicious., The use of a generic domain extension '.online' is often used in phishing attempts., The URL structure does not include any direct reference to Microsoft, which is a red flag. DOM: 3.6.pages.csv
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is well-known and typically associated with the domain 'microsoft.com'., The URL 'login.hrmails.online' does not match the legitimate domain for Microsoft., The domain 'hrmails.online' is not associated with Microsoft and appears suspicious., The use of a generic domain extension '.online' and the presence of 'hrmails' in the domain name are unusual and could indicate phishing., The email domain 'tez.org' in the input fields does not provide any additional legitimacy to the Microsoft brand association. DOM: 3.7.pages.csv

Yara detected HtmlPhish46

Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 0.49.id.script.csv, type: HTML
Source: Yara match	File source: 0.55.id.script.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: 3.4.pages.csv, type: HTML
Source: Yara match	File source: 3.6.pages.csv, type: HTML
Source: Yara match	File source: 3.7.pages.csv, type: HTML

AI detected suspicious Javascript

Source: 0.60.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://login.hrmails.online/common/oauth2/v2.0/au... This script demonstrates several high-risk behaviors, including redirecting the user to an unknown domain and potentially collecting sensitive information (session ID) without transparency. While the script may have a legitimate purpose, such as preventing unauthorized framing, the lack of context and the use of obfuscated code raise significant security concerns.

Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Number of links: 0
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0

HTTP Parser: Base64 decoded: 0042db8e-4fff-4349-909b-69b5e4b5ec6f0d576b8b-08e6-440c-b3fa-37b663ebba85

Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: chrome.exe

Memory has grown: Private usage: 0MB later: 36MB

Source: global traffic

TCP traffic: 192.168.2.5:50046 -> 1.1.1.1:53

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /s/it1hhxczqyf0qxif41bma48tat7sqs32 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /X-Box-Client-Version: 23.25.1X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.28.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?s=1.1&since=-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.28.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.28.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/678526c81f7108.44421725 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.28.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1736779470112&jzb=eJy9UcGOmzAU_BefCdgY1pDbSj206lbVthu1UlUhAyaxBJjYj2xolH_P8yZFSFXb065PZsZvZpj340RgGhRZE12rHnQzkYCU1jw7ZQvQHTJM8Dsh8kRQmqcBOWinwdhC1zgU42tZVWbs4QqsGCKjbfG6AxjcOorkMISlOYaV6SIXaWC73bH6tZ8auj_qJmFlJ5MMJAi3d9wLDtYMjqxPxLR1sbTrx7YNXtCl5xX9b6wzCkuL__gkyw_zGFw_yOOX6fPjRyHY5ttT39ADCjRWduqF_JQn99_fPYtqk48PvOG-ogkUZuSMnoO5wk6B_Gd9d29a383KX1HgQfbbUW59TtWvNl_x5ZyhXXIFcljWLZef_qPC-5lDqJbgBxmPKItiGqcoeFDWadN7-TDmWRgXmKpGwqm2eW8cKJQEO6rX2UrOF1tpjfTOf9-KeNOt-Di3EGma0JDlv08Wp69SR5xm558XE8c9vw HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=678526c81f7108.44421725; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?s=1.1&since=-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/678526c81f7108.44421725 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1736779470112&jzb=eJy9UcGOmzAU_BefCdgY1pDbSj206lbVthu1UlUhAyaxBJjYj2xolH_P8yZFSFXb065PZsZvZpj340RgGhRZE12rHnQzkYCU1jw7ZQvQHTJM8Dsh8kRQmqcBOWinwdhC1zgU42tZVWbs4QqsGCKjbfG6AxjcOorkMISlOYaV6SIXaWC73bH6tZ8auj_qJmFlJ5MMJAi3d9wLDtYMjqxPxLR1sbTrx7YNXtCl5xX9b6wzCkuL__gkyw_zGFw_yOOX6fPjRyHY5ttT39ADCjRWduqF_JQn99_fPYtqk48PvOG-ogkUZuSMnoO5wk6B_Gd9d29a383KX1HgQfbbUW59TtWvNl_x5ZyhXXIFcljWLZef_qPC-5lDqJbgBxmPKItiGqcoeFDWadN7-TDmWRgXmKpGwqm2eW8cKJQEO6rX2UrOF1tpjfTOf9-KeNOt-Di3EGma0JDlv08Wp69SR5xm558XE8c9vw HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=678526c81f7108.44421725; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/end-user-web/sign-settings?typedIDs=f_1748539458374 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /X-Box-Client-Version: 23.25.1X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/elements/tokens HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
Source: global traffic	HTTP traffic detected: GET /api/2.0/files/1748539458374?fields=watermark_info HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Box-Client-Version: 23.25.1X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0Authorization: Bearer 1!9ST5Psku8hjcb_vS4VRBtgYHnnC7-akWDXZlyEp9SDfDVpkVFbYx19AEm9qMP4EXMcOh3-D_eLABOO_8mWNHz6Zyku112Omyk-rRRxrVrFJB0LmWzIPkDeldw2AAzowQv1zr9msA1aRMlRByppAj2txsYOuGNRWq0QzAUSqiV3j1V07WguM6aG3PVX6EZyP0nMfsuN-U8eOkY0C57x0DcWa3OsyIpjrX8zQZWuHw8Ly-Om3SPt3F7SiZqem6lNxg1X0f4bHawQX9WYA-ZBALMVTC3kTarwFcsM6MEjDtMro5z2ZK58Qzq2Pvop3xBhrFEXdbiLmdOMMNZbm5i0ohsBpVN4HL1K3utvT22pcjFN1mbuYy_VCD38tDY3kNtQEGtOthyMafn8XJZ-viX3UnQwwjxZBby7FsuNY1rdRawcoAgkLQ94e6oVq6HhVrAVVoaZHr_k8WUwYBNqlJBaXcZ8ygx3oeblt8Hvb8zw74ePG7i4c_Qt6lW3hSofSwvnDHvqoSoxAAMtD59OhmLfMroAj9RuDLj52CDrtXl-YyN8Y3cWF3QeQ2TdFO7t5sNvr48-iJEZQTzybD0OoStT8Jlok1Vfc11DuVhksvqiO-User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
Source: global traffic	HTTP traffic detected: GET /api/2.0/files/1748539458374/metadata/global/boxSign HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Box-Client-Version: 23.25.1X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0Authorization: Bearer 1!tkKmSz8uCftqGz-Sz4T4tVmQfC9ZyUr4opNS5sxq7g6dcvp78rR4IyQlXk3XCpVS9sdRd_mHFF35ltv0Gc1ECckcZonshZmRIR8l43ViwYUzOM5Dae01CmLI91VCy7nfku9G8X1B-WDJRgvQGQ03OMkjx0gXbaIckBFOZ22FQMhnir9hAEUh5PPCCRj58WlInAQsBJR0ZWse8gs2UvzQ55wFtzJy81KC2aA5bwbUVrxvl9byV3HHl_zbdQvs8HUOX_g9kR7Nhizf8Tqaj4P3pPFu3zC_oumzZ_Wf-3X985XRUEbXuwUEeii8RdDUzK7krFC3pXGxGigoznn52eHM6GEbQsVyTIm6CqxAbcPAUKM7v9b6zHnvFDMMtljExJeo2qDhGyJBlEAa3xwm0akjtzb3_vfBsayH8ImqPwvmmNqDEkZBFAcQqOzG3qIHCfb2IaUChgphSsE2KCV0YanGp_ZU7a4fBnIq7InX-S9CffxmzQeZ3VhxEIGgOI2NWsUjc1-0YNs-mqbaHmWSl7T4Mf0TnJD76hXEVEFCxzHTuz-jDQzbWSd7mIAn93vKZqQSU2CbQRbp-sIhJEQ1hFHugSQ1RFUr3LHL9I4wemN-User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/json, text/plain, /sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/elements/tokens HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
Source: global traffic	HTTP traffic detected: GET /api/2.0/files/1748539458374?fields=watermark_info HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen; csrf-token=fag2EmRuoXgR3F6jxcT3dekpzEMHhJXwg_v2ACjI54C
Source: global traffic	HTTP traffic detected: GET /2.0/files/1748539458374?fields=permissions,shared_link,sha1,file_version,name,size,extension,representations,watermark_info,authenticated_download_url,is_download_available HTTP/1.1Host: api.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Language: en-USX-Box-Client-Name: ContentPreviewsec-ch-ua-mobile: ?0X-Rep-Hints: [3d][pdf][text][mp3][json][jpg?dimensions=1024x1024&paged=false][jpg?dimensions=2048x2048,png?dimensions=2048x2048][dash,mp4][filmstrip]Authorization: Bearer 1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/jsonBoxApi: shared_link=https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32sec-ch-ua-platform: "Windows"Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/elements/tokens HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
Source: global traffic	HTTP traffic detected: GET /api/2.0/internal_files/1748539458374/versions/1925739332568/representations/jpg_1024x1024/content/?access_token=1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6&shared_link=https%3A%2F%2Fapp.box.com%2Fs%2Fit1hhxczqyf0qxif41bma48tat7sqs32&box_client_name=box-content-preview&box_client_version=3.0.0 HTTP/1.1Host: public.boxcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://app.box.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2.0/files/1748539458374?fields=permissions,shared_link,sha1,file_version,name,size,extension,representations,watermark_info,authenticated_download_url,is_download_available HTTP/1.1Host: api.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=678526c81f7108.44421725; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /api/2.0/internal_files/1748539458374/versions/1925739332568/representations/jpg_1024x1024/content/?access_token=1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6&shared_link=https%3A%2F%2Fapp.box.com%2Fs%2Fit1hhxczqyf0qxif41bma48tat7sqs32&box_client_name=box-content-preview&box_client_version=3.0.0 HTTP/1.1Host: public.boxcloud.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /2.0/files/1748539458374?fields=content_created_at,content_modified_at,created_at,created_by,modified_at,modified_by,owned_by,description,metadata.global.boxSkillsCards,expires_at,version_limit,version_number,is_externally_owned,restored_from,uploader_display_name HTTP/1.1Host: api.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept-Language: en-USX-Box-Client-Name: ContentSidebarsec-ch-ua-mobile: ?0X-Rep-Hints: [3d][pdf][text][mp3][json][jpg?dimensions=1024x1024&paged=false][jpg?dimensions=2048x2048,png?dimensions=2048x2048][dash,mp4][filmstrip]Authorization: Bearer 1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: application/jsonBoxApi: shared_link=https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32sec-ch-ua-platform: "Windows"Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, br
Source: global traffic	HTTP traffic detected: GET /2.0/files/1748539458374?fields=content_created_at,content_modified_at,created_at,created_by,modified_at,modified_by,owned_by,description,metadata.global.boxSkillsCards,expires_at,version_limit,version_number,is_externally_owned,restored_from,uploader_display_name HTTP/1.1Host: api.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=678526c81f7108.44421725; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /api/2.0/internal_files/1748539458374/versions/1925739332568/representations/pdf/content/?access_token=1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6&shared_link=https%3A%2F%2Fapp.box.com%2Fs%2Fit1hhxczqyf0qxif41bma48tat7sqs32&box_client_name=box-content-preview&box_client_version=3.0.0 HTTP/1.1Host: public.boxcloud.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://app.box.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /api/2.0/internal_files/1748539458374/versions/1925739332568/representations/pdf/content/?access_token=1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6&shared_link=https%3A%2F%2Fapp.box.com%2Fs%2Fit1hhxczqyf0qxif41bma48tat7sqs32&box_client_name=box-content-preview&box_client_version=3.0.0 HTTP/1.1Host: public.boxcloud.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /verify/bfdocs HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: login.hrmails.onlineConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.hrmails.onlineConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP/1.1Host: login.hrmails.onlineConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; fpc=AolF6eVn-iFHkPxlSDdBW2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEToeyaz1ZboNC9V5pLDapDpuDoQfvOKjtf4tG6DrDMQ4BCEK1mSKXtJ6yXo-C8jcH4SeogayNrUaVGw0rUPiEXDSn8KFZrcdHBHOKStGiW4PLvFr5UD1lG7Aj2NK803llgs-TNNzGyJ35XDuh9XJ06kOTKBGFYSFhNUyDhUdqGoIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268.js HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; fpc=AolF6eVn-iFHkPxlSDdBW2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEToeyaz1ZboNC9V5pLDapDpuDoQfvOKjtf4tG6DrDMQ4BCEK1mSKXtJ6yXo-C8jcH4SeogayNrUaVGw0rUPiEXDSn8KFZrcdHBHOKStGiW4PLvFr5UD1lG7Aj2NK803llgs-TNNzGyJ35XDuh9XJ06kOTKBGFYSFhNUyDhUdqGoIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA
Source: global traffic	HTTP traffic detected: GET /s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268.js HTTP/1.1Host: login.hrmails.onlineConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; fpc=AolF6eVn-iFHkPxlSDdBW2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEToeyaz1ZboNC9V5pLDapDpuDoQfvOKjtf4tG6DrDMQ4BCEK1mSKXtJ6yXo-C8jcH4SeogayNrUaVGw0rUPiEXDSn8KFZrcdHBHOKStGiW4PLvFr5UD1lG7Aj2NK803llgs-TNNzGyJ35XDuh9XJ06kOTKBGFYSFhNUyDhUdqGoIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; fpc=AolF6eVn-iFHkPxlSDdBW2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEToeyaz1ZboNC9V5pLDapDpuDoQfvOKjtf4tG6DrDMQ4BCEK1mSKXtJ6yXo-C8jcH4SeogayNrUaVGw0rUPiEXDSn8KFZrcdHBHOKStGiW4PLvFr5UD1lG7Aj2NK803llgs-TNNzGyJ35XDuh9XJ06kOTKBGFYSFhNUyDhUdqGoIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268 HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; fpc=AolF6eVn-iFHkPxlSDdBW2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEToeyaz1ZboNC9V5pLDapDpuDoQfvOKjtf4tG6DrDMQ4BCEK1mSKXtJ6yXo-C8jcH4SeogayNrUaVGw0rUPiEXDSn8KFZrcdHBHOKStGiW4PLvFr5UD1lG7Aj2NK803llgs-TNNzGyJ35XDuh9XJ06kOTKBGFYSFhNUyDhUdqGoIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; fpc=AolF6eVn-iFHkPxlSDdBW2I; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEToeyaz1ZboNC9V5pLDapDpuDoQfvOKjtf4tG6DrDMQ4BCEK1mSKXtJ6yXo-C8jcH4SeogayNrUaVGw0rUPiEXDSn8KFZrcdHBHOKStGiW4PLvFr5UD1lG7Aj2NK803llgs-TNNzGyJ35XDuh9XJ06kOTKBGFYSFhNUyDhUdqGoIgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268.js HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB4AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEGGjKNP_kOiyFADFkYw_AvKa2OwKJwRNSGXZ5LXMzt8qDGufGd4v5hR9RJw-PdIvmOg8xZX3pOELVYcuuMxWRiwSKbh8t9_kUWQcBDJBiQfwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEJeffWAy9Z35GJvkOdv3A9QtgNjwOQNm08_kQuYa9MxBeoy8vm9yA9vhvC56c7u57ccqL0bIbPno-_vWLkd4jta9U2-pBkb70ql-na91NjcOCQabFj4lqPJvzayyp4E4rjffOguAccxzYe_PzdN3JlvCEh-9fefXXUw1A8qfmWDIgAA; esctx-JfkPigKBUvQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEnRXIPT7-1ew4ZSePPQ0AVdzsMmuAXzxZtOgAbu2x1Lj6my8AD35pVhi0_whfXtPFOrk2agz_1sU_IXpdwmOAKL5FW-VT7LEilFV4jRgpIYlmgyt-ccffFrvp6WPSNGfmyhTOZPcA5c14o4rwpz0pwCAA; fpc=AolF6eVn-iFHkPxlSDdBW2K8Ae7AAQAAAOgdF98OAAAA
Source: global traffic	HTTP traffic detected: GET /s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268.js HTTP/1.1Host: login.hrmails.onlineConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB4AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEGGjKNP_kOiyFADFkYw_AvKa2OwKJwRNSGXZ5LXMzt8qDGufGd4v5hR9RJw-PdIvmOg8xZX3pOELVYcuuMxWRiwSKbh8t9_kUWQcBDJBiQfwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEJeffWAy9Z35GJvkOdv3A9QtgNjwOQNm08_kQuYa9MxBeoy8vm9yA9vhvC56c7u57ccqL0bIbPno-_vWLkd4jta9U2-pBkb70ql-na91NjcOCQabFj4lqPJvzayyp4E4rjffOguAccxzYe_PzdN3JlvCEh-9fefXXUw1A8qfmWDIgAA; esctx-JfkPigKBUvQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEnRXIPT7-1ew4ZSePPQ0AVdzsMmuAXzxZtOgAbu2x1Lj6my8AD35pVhi0_whfXtPFOrk2agz_1sU_IXpdwmOAKL5FW-VT7LEilFV4jRgpIYlmgyt-ccffFrvp6WPSNGfmyhTOZPcA5c14o4rwpz0pwCAA; fpc=AolF6eVn-iFHkPxlSDdBW2K8Ae7AAQAAAOgdF98OAAAA
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.hrmails.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268
Source: global traffic	HTTP traffic detected: GET /s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268 HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB4AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEGGjKNP_kOiyFADFkYw_AvKa2OwKJwRNSGXZ5LXMzt8qDGufGd4v5hR9RJw-PdIvmOg8xZX3pOELVYcuuMxWRiwSKbh8t9_kUWQcBDJBiQfwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEJeffWAy9Z35GJvkOdv3A9QtgNjwOQNm08_kQuYa9MxBeoy8vm9yA9vhvC56c7u57ccqL0bIbPno-_vWLkd4jta9U2-pBkb70ql-na91NjcOCQabFj4lqPJvzayyp4E4rjffOguAccxzYe_PzdN3JlvCEh-9fefXXUw1A8qfmWDIgAA; esctx-JfkPigKBUvQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEnRXIPT7-1ew4ZSePPQ0AVdzsMmuAXzxZtOgAbu2x1Lj6my8AD35pVhi0_whfXtPFOrk2agz_1sU_IXpdwmOAKL5FW-VT7LEilFV4jRgpIYlmgyt-ccffFrvp6WPSNGfmyhTOZPcA5c14o4rwpz0pwCAA; fpc=AolF6eVn-iFHkPxlSDdBW2K8Ae7AAQAAAOgdF98OAAAA
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.hrmails.online/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; uaid=3279301942844ede9634da481c2d482e; MSPRequ=id=N&lt=1736779498&co=1
Source: global traffic	HTTP traffic detected: GET /common/GetCredentialType?mkt=en-US HTTP/1.1Host: login.hrmails.onlineConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB4AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEGGjKNP_kOiyFADFkYw_AvKa2OwKJwRNSGXZ5LXMzt8qDGufGd4v5hR9RJw-PdIvmOg8xZX3pOELVYcuuMxWRiwSKbh8t9_kUWQcBDJBiQfwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEJeffWAy9Z35GJvkOdv3A9QtgNjwOQNm08_kQuYa9MxBeoy8vm9yA9vhvC56c7u57ccqL0bIbPno-_vWLkd4jta9U2-pBkb70ql-na91NjcOCQabFj4lqPJvzayyp4E4rjffOguAccxzYe_PzdN3JlvCEh-9fefXXUw1A8qfmWDIgAA; esctx-JfkPigKBUvQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEnRXIPT7-1ew4ZSePPQ0AVdzsMmuAXzxZtOgAbu2x1Lj6my8AD35pVhi0_whfXtPFOrk2agz_1sU_IXpdwmOAKL5FW-VT7LEilFV4jRgpIYlmgyt-ccffFrvp6WPSNGfmyhTOZPcA5c14o4rwpz0pwCAA; fpc=AolF6eVn-iFHkPxlSDdBW2K8Ae7AAQAAAOgdF98OAAAA; MicrosoftApplicationsTelemetryDeviceId=b18fc65f-08d9-4709-8e31-7d444da9fd74; brcap=0; ai_session=fUyt2XzfjMbIr9dSTQaF9d\|1736779498916\|1736779498916; MSFPC=GUID=a68abac9a1104e87a2158fa19f003145&HASH=a68a&LV=202501&V=4&LU=1736779500270
Source: global traffic	HTTP traffic detected: GET /s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268 HTTP/1.1Host: login.hrmails.onlineConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: 22ac-e4dd=80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; esctx-bKK5owcYuE=AQABCQEAAABVrSpeuWamRam2jAF1XRQEfzKCURlqeAq9c6fDpgwJVA5yTH-5kdKh8YSifixGX0JDo-UDAHuE0Slv2u0gZ4q40pVzFTzgtkgmAPsTajrXy2V_3OZTnHi3evKPu8UwVZnTTFc9wGOFN5ZyPg4300UCthDIlVCAIjUW0v3MuaY1TiAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=1.AXgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAB4AA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEGGjKNP_kOiyFADFkYw_AvKa2OwKJwRNSGXZ5LXMzt8qDGufGd4v5hR9RJw-PdIvmOg8xZX3pOELVYcuuMxWRiwSKbh8t9_kUWQcBDJBiQfwgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEJeffWAy9Z35GJvkOdv3A9QtgNjwOQNm08_kQuYa9MxBeoy8vm9yA9vhvC56c7u57ccqL0bIbPno-_vWLkd4jta9U2-pBkb70ql-na91NjcOCQabFj4lqPJvzayyp4E4rjffOguAccxzYe_PzdN3JlvCEh-9fefXXUw1A8qfmWDIgAA; esctx-JfkPigKBUvQ=AQABCQEAAABVrSpeuWamRam2jAF1XRQEnRXIPT7-1ew4ZSePPQ0AVdzsMmuAXzxZtOgAbu2x1Lj6my8AD35pVhi0_whfXtPFOrk2agz_1sU_IXpdwmOAKL5FW-VT7LEilFV4jRgpIYlmgyt-ccffFrvp6WPSNGfmyhTOZPcA5c14o4rwpz0pwCAA; fpc=AolF6eVn-iFHkPxlSDdBW2K8Ae7AAQAAAOgdF98OAAAA; MicrosoftApplicationsTelemetryDeviceId=b18fc65f-08d9-4709-8e31-7d444da9fd74; brcap=0; ai_session=fUyt2XzfjMbIr9dSTQaF9d\|1736779498916\|1736779498916; MSFPC=GUID=a68abac9a1104e87a2158fa19f003145&HASH=a68a&LV=202501&V=4&LU=1736779500270

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: app.box.com
Source: global traffic	DNS traffic detected: DNS query: cdn01.boxcdn.net
Source: global traffic	DNS traffic detected: DNS query: pendo-data-prod.box.com
Source: global traffic	DNS traffic detected: DNS query: api.box.com
Source: global traffic	DNS traffic detected: DNS query: public.boxcloud.com
Source: global traffic	DNS traffic detected: DNS query: login.hrmails.online
Source: global traffic	DNS traffic detected: DNS query: www.hrmails.online
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: live.hrmails.online

Source: unknown

HTTP traffic detected: POST /gen204 HTTP/1.1Host: app.box.comConnection: keep-aliveContent-Length: 433sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Box-Client-Version: 23.25.1X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518sec-ch-ua-platform: "Windows"Origin: https://app.box.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 13 Jan 2025 14:44:35 GMTcontent-type: application/json; charset=utf-8x-envoy-upstream-service-time: 78x-frame-options: SAMEORIGINx-download-options: noopenstrict-transport-security: max-age=31536000access-control-expose-headers: Server-Timingset-cookie: csrf-token=fag2EmRuoXgR3F6jxcT3dekpzEMHhJXwg_v2ACjI54C; Secure; SameSite=None; Path=/x-xss-protection: 0x-content-type-options: nosniffbox-request-id: 06a6dfab384d3dd860096dc20b7b9742dserver-timing: traceparent;desc="00-57b8c4b57acb2d59a199983de3ef24f0-0836b4892da01b71-00"cache-control: no-cachevia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: closeTransfer-Encoding: chunked
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 13 Jan 2025 14:44:36 GMTcontent-type: text/html; charset=UTF-8strict-transport-security: max-age=31536000via: 1.1 googleContent-Length: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 13 Jan 2025 14:44:36 GMTcontent-type: text/html; charset=UTF-8strict-transport-security: max-age=31536000via: 1.1 googleContent-Length: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Founddate: Mon, 13 Jan 2025 14:44:37 GMTcontent-type: text/html; charset=UTF-8strict-transport-security: max-age=31536000via: 1.1 googleContent-Length: 0Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not Found

Source: chromecache_193.2.dr, chromecache_308.2.dr	String found in binary or memory: http://blog.stevenlevithan.com/archives/parseuri
Source: chromecache_193.2.dr, chromecache_308.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_228.2.dr, chromecache_193.2.dr, chromecache_308.2.dr	String found in binary or memory: http://www.box.com)
Source: chromecache_193.2.dr, chromecache_308.2.dr	String found in binary or memory: https://github.com/derek-watson/jsUri
Source: chromecache_303.2.dr, chromecache_211.2.dr	String found in binary or memory: https://login.hrmails.online/verify/bfdocs)
Source: chromecache_193.2.dr, chromecache_308.2.dr	String found in binary or memory: https://support.box.com
Source: chromecache_275.2.dr	String found in binary or memory: https://www.jsdelivr.com/using-sri-with-dynamic-files

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 50007 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 49866 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50205 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50206 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49934
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50021
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50021 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50039
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50034
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50205
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50206
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49903
Source: unknown	Network traffic detected: HTTP traffic on port 49903 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2252,i,14136314091735512277,7748461438341982796,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=2252,i,14136314091735512277,7748461438341982796,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 303	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 211
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 211	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Extra Window Memory Injection	1 Extra Window Memory Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label
https://login.hrmails.online/s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268	0%	Avira URL Cloud	safe
https://login.hrmails.online/	0%	Avira URL Cloud	safe
https://login.hrmails.online/favicon.ico	0%	Avira URL Cloud	safe
https://live.hrmails.online/Me.htm?v=3	0%	Avira URL Cloud	safe
http://blog.stevenlevithan.com/archives/parseuri	0%	Avira URL Cloud	safe
https://login.hrmails.online/s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268.js	0%	Avira URL Cloud	safe
https://login.hrmails.online/verify/bfdocs	0%	Avira URL Cloud	safe
https://login.hrmails.online/verify/bfdocs)	0%	Avira URL Cloud	safe
https://login.hrmails.online/common/GetCredentialType?mkt=en-US	0%	Avira URL Cloud	safe
http://www.box.com)	0%	Avira URL Cloud	safe
https://www.hrmails.online/login	0%	Avira URL Cloud	safe

Name	IP	Active	Malicious	Reputation
pendo-data-prod.box.com	74.112.186.159	true	false	high
api.box.com	74.112.186.157	true	false	high
public.boxcloud.com	74.112.186.164	true	false	high
www.hrmails.online	157.230.52.149	true	false	unknown
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
sni1gl.wpc.omegacdn.net	152.199.21.175	true	false	high
live.hrmails.online	157.230.52.149	true	false	unknown
www.google.com	172.217.23.100	true	false	high
app.box.com	74.112.186.157	true	false	high
login.hrmails.online	157.230.52.149	true	true	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	high
cdn01.boxcdn.net	unknown	unknown	false	high

Name	Malicious	Antivirus Detection	Reputation
https://app.box.com/app-api/split-proxy/api/mySegments/678526c81f7108.44421725	false		high
https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32	false		high
https://app.box.com/app-api/split-proxy/api/mySegments/-1	false		high
https://app.box.com/app-api/split-proxy/api/mySegments/2	false		high
https://app.box.com/app-api/end-user-web/sign-settings?typedIDs=f_1748539458374	false		high
https://login.hrmails.online/s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268	false	Avira URL Cloud: safe	unknown
https://app.box.com/gen204	false		high
https://login.hrmails.online/	true	Avira URL Cloud: safe	unknown
https://app.box.com/index.php?rm=box_gen204_batch_record	false		high
https://app.box.com/app-api/split-proxy/api/testImpressions/beacon	false		high
https://app.box.com/api/2.0/files/1748539458374?fields=watermark_info	false		high
https://login.hrmails.online/s/80ef0cb0ce1befe6dfb36a04ee9478428359c538d058bcb74e9dd787c3fb8268.js	false	Avira URL Cloud: safe	unknown
https://live.hrmails.online/Me.htm?v=3	false	Avira URL Cloud: safe	unknown
https://api.box.com/2.0/files/1748539458374?fields=permissions,shared_link,sha1,file_version,name,size,extension,representations,watermark_info,authenticated_download_url,is_download_available	false		high
https://login.hrmails.online/favicon.ico	false	Avira URL Cloud: safe	unknown
https://login.hrmails.online/common/GetCredentialType?mkt=en-US	false	Avira URL Cloud: safe	unknown
https://app.box.com/app-api/split-proxy/api/splitChanges?s=1.1&since=-1	false		high
https://app.box.com/app-api/split-proxy/api/testImpressions/count/beacon	false		high
https://app.box.com/app-api/enduserapp/elements/tokens	false		high
https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0	false		unknown
https://app.box.com/app-api/enduserapp/current-user/features/secondary	false		high
https://login.hrmails.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638723762945845626.MDA0MmRiOGUtNGZmZi00MzQ5LTkwOWItNjliNWU0YjVlYzZmMGQ1NzZiOGItMDhlNi00NDBjLWIzZmEtMzdiNjYzZWJiYTg1&ui_locales=en-US&mkt=en-US&client-request-id=8d181987-6413-4d3d-927c-be29ef9b337f&state=5xU1SIKSnToE-rdsR3RTky_MYaItZNbl-NwMphJZd9JCUpOqkt3lNasH9YQ90ZAErtOWnRptvWE2Xn2w428g97HyE7ir4ilHYgqdbL2sYTus3rvgnKZxYdpnc9yDZiagolgXKGZ_b3ho_vaie_xDDWZpK8BUVr1jTAij5hVNsnXENTdQkfKficrFKdOlUewE0f4iLWLGZv4CMkJNKcmNss6H9kZkXKpAMciRi3ZI14IxK51jNDVbZ61UCak-_GrMuSdQH0H3XhJ1qywC9nvCjA&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true	true		unknown
https://app.box.com/api/2.0/files/1748539458374/metadata/global/boxSign	false		high
https://api.box.com/2.0/events	false		high
https://public.boxcloud.com/api/2.0/internal_files/1748539458374/versions/1925739332568/representations/jpg_1024x1024/content/?access_token=1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6&shared_link=https%3A%2F%2Fapp.box.com%2Fs%2Fit1hhxczqyf0qxif41bma48tat7sqs32&box_client_name=box-content-preview&box_client_version=3.0.0	false		high
https://public.boxcloud.com/api/2.0/internal_files/1748539458374/versions/1925739332568/representations/pdf/content/?access_token=1!81GsgeLbvBfdvg_epjR4YXdhC34ifkJ-dEYeL_tDlzy5pPmSdBs4kOXU5NDsuixWfKiUBIX52dXH7xKcZUv9NRzNRgjX_p3EwyI4HetbLFqKAY1IiJqjcz51wxqOBx3qYI2vWaJ193-3hnT4u-BhVV32KbFribDCuvDwtGuZs6Tq--5P0NYeePVL2ca47nq1cNqmOBlI4XA8OArmMAoaKkY6cYoM08a6od562CilqdGPc3owoW28SUH7in447SsgXJNW68i6OfbzD0U6Vt4b27daeCiv34CSyFnWfj8XvC9ynPyAXeENtiO_lG_PaS1PFkAri0JN0DaufR-YHMxXRnoQXIhmxXvoNyI-Ip5XnYF-4w8EHQSMk0UCRNJ2fP5-sxMAEPM7rae5cQWLuR29gLy07jbseH-GT7NXFjjofHspX7LEABe-BgtQ1BEgk1jUb_fyyWzVrbGhNvkVNUgLntyAxCVywL7Apng9AUiSQ7FSi7TwsJZBrIjjk2yO6TBxMefyQbOubJwRJsPRofJZqSGdGzkNVhKeaGok-QK_vN_kUOEpj9hQHAu-8L4RWGIwVVUecPqorXyBJux_kFa1Di_Tu7dv-FWxcBsvxXK6&shared_link=https%3A%2F%2Fapp.box.com%2Fs%2Fit1hhxczqyf0qxif41bma48tat7sqs32&box_client_name=box-content-preview&box_client_version=3.0.0	false		high
https://login.hrmails.online/verify/bfdocs	false	Avira URL Cloud: safe	unknown
https://www.hrmails.online/login	false	Avira URL Cloud: safe	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.jsdelivr.com/using-sri-with-dynamic-files	chromecache_275.2.dr	false		high
http://blog.stevenlevithan.com/archives/parseuri	chromecache_193.2.dr, chromecache_308.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/derek-watson/jsUri	chromecache_193.2.dr, chromecache_308.2.dr	false		high
https://support.box.com	chromecache_193.2.dr, chromecache_308.2.dr	false		high
https://login.hrmails.online/verify/bfdocs)	chromecache_303.2.dr, chromecache_211.2.dr	false	Avira URL Cloud: safe	unknown
http://www.box.com)	chromecache_228.2.dr, chromecache_193.2.dr, chromecache_308.2.dr	false	Avira URL Cloud: safe	unknown
http://jedwatson.github.io/classnames	chromecache_193.2.dr, chromecache_308.2.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
74.112.186.157	api.box.com	United States	33011	BOXNETUS	false
74.112.186.164	public.boxcloud.com	United States	33011	BOXNETUS	false
74.112.186.159	pendo-data-prod.box.com	United States	33011	BOXNETUS	false
157.230.52.149	www.hrmails.online	United States	14061	DIGITALOCEAN-ASNUS	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.217.23.100	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590104
Start date and time:	2025-01-13 15:43:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 26s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.phis.win@17/253@34/7

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Mon Jan 13 13:44:18 2025, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.9766922615246014
Encrypted:	false
SSDEEP:	48:8tdnT//XHMidAKZdA19ehwiZUklqehZy+3:8HTK6y
MD5:	DB35927C00B17C615D8AFFC760884374
SHA1:	1961F068A7C4F92D6CEAA4DF97FE632A1DFF826D
SHA-256:	05FAC8A1CB7805B1BEE7CE7BC0AFCE44A233A9D020178E13DB5E461205800430
SHA-512:	BF8E7FF4A59EAB5B7259FB5E8950E7C58F7022151FCE5731A3A43F27ACD5ADD5A5AF02461D9AE87F4DD52B94C180B310A46B93F6524AD486BB2CF0704A7123B4
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......:..e..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.I-Z.u....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V-Z.u....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V-Z.u....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V-Z.u..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V-Z.u...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............!E.....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 13, 2025 15:44:17.045074940 CET	53	64996	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:17.065318108 CET	53	51646	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:18.076524019 CET	53	63483	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:21.603697062 CET	52983	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:21.603823900 CET	64105	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:21.610589027 CET	53	64105	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:21.610661030 CET	53	52983	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:22.899180889 CET	50401	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:22.899533987 CET	56160	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:23.515258074 CET	53	50401	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:23.523101091 CET	53	56160	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:24.399028063 CET	62822	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:24.399188995 CET	61791	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:25.100384951 CET	62588	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:25.100604057 CET	59720	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:28.653887033 CET	65187	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:28.654114962 CET	56331	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:28.661153078 CET	53	65187	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:28.661705971 CET	53	56331	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:30.557888031 CET	50386	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:30.558005095 CET	53468	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:30.688136101 CET	53	50386	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:30.695725918 CET	53	53468	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:31.421381950 CET	60199	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:31.423333883 CET	49628	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:31.428684950 CET	53	60199	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:31.444000006 CET	53	49628	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:35.212802887 CET	53	49318	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:35.689356089 CET	51257	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:35.689541101 CET	49531	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:35.696521044 CET	53	51257	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:35.696708918 CET	53	49531	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:37.185525894 CET	50700	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:37.185885906 CET	53911	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:37.192393064 CET	53	50700	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:37.193242073 CET	53	53911	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:37.200931072 CET	50120	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:37.201334953 CET	52905	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:37.208158016 CET	53	50120	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:37.221457005 CET	53	52905	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:38.413433075 CET	53076	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:38.413650990 CET	65087	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:38.430639029 CET	53	65087	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:38.433531046 CET	53	53076	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:38.546194077 CET	53	55159	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:52.980675936 CET	62260	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:52.980802059 CET	58237	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:52.988874912 CET	53	62260	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:52.991795063 CET	53	58237	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:53.992767096 CET	60224	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:53.992927074 CET	56294	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:54.004676104 CET	53	60224	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:54.008729935 CET	53	56294	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:54.283819914 CET	53	65023	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:56.375046968 CET	62027	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:56.375046968 CET	56841	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:56.387300968 CET	53	56841	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:56.398825884 CET	53	62027	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:57.302094936 CET	54768	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:57.302216053 CET	59618	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:57.308726072 CET	53	54768	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:57.329273939 CET	51266	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:57.329459906 CET	49324	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:57.335767031 CET	53	51266	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:57.335973024 CET	53	49324	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:58.195045948 CET	51949	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:58.195161104 CET	61016	53	192.168.2.5	1.1.1.1
Jan 13, 2025 15:44:58.203082085 CET	53	61016	1.1.1.1	192.168.2.5
Jan 13, 2025 15:44:58.206219912 CET	53	51949	1.1.1.1	192.168.2.5
Jan 13, 2025 15:45:01.939672947 CET	53	55807	1.1.1.1	192.168.2.5
Jan 13, 2025 15:45:16.814755917 CET	53	65123	1.1.1.1	192.168.2.5
Jan 13, 2025 15:45:17.009248018 CET	53	56768	1.1.1.1	192.168.2.5

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:23 UTC	688	OUT	GET /s/it1hhxczqyf0qxif41bma48tat7sqs32 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-01-13 14:44:24 UTC	1056	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 14:44:24 GMT content-type: text/html; charset=utf-8 x-robots-tag: noindex, nofollow strict-transport-security: max-age=31536000 expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=e0nbhfs05jvfi7hinhshoqas1q; path=/; domain=.app.box.com; secure; HttpOnly set-cookie: z=e0nbhfs05jvfi7hinhshoqas1q; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=678526c81f7108.44421725; expires=Tue, 13 Jan 2026 14:44:24 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: bv=ISF-17076; expires=Mon, 20 Jan 2025 14:44:24 GMT; Max-Age=604800; path=/; domain=.app.box.com; secure set-cookie: cn=88; expires=Tue, 13 Jan 2026 14:44:24 GMT; Max-Age=31536000; path=/; domain=.app.box.com; secure set-cookie: site_preference=desktop; path=/; domain=.box.com; secure via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:24 UTC	334	IN	Data Raw: 31 61 38 36 0d 0a 20 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 20 64 61 74 61 2d 72 65 73 69 6e 2d 63 6c 69 65 6e 74 3d 22 77 65 62 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 20 20 3c 74 69 74 6c 65 3e 42 6f 78 Data Ascii: 1a86 <!DOCTYPE html><html lang="en-US" data-resin-client="web"><head><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0"> <meta name="robots" content="noindex, nofollow"> <title>Box
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 3d 22 73 75 6d 6d 61 72 79 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 77 69 74 74 65 72 3a 73 69 74 65 22 20 63 6f 6e 74 65 6e 74 3d 22 40 42 6f 78 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 69 74 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 4b 4f 20 49 72 65 6c 61 6e 64 20 50 6c 61 6e 6e 69 6e 67 20 26 61 6d 70 3b 20 45 6e 76 69 72 6f 6e 6d 65 6e 74 61 6c 20 43 6f 6e 73 75 6c 74 61 6e 63 79 2e 64 6f 63 78 20 7c 20 50 6f 77 65 72 65 64 20 62 79 20 42 6f 78 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 77 65 62 73 69 74 65 22 3e 3c 6d 65 74 61 20 70 72 6f 70 65 72 74 79 3d 22 6f 67 3a 64 65 73 63 72 69 70 74 69 6f 6e 22 20 63 6f 6e 74 65 6e 74 3d 22 22 3e 3c 6d 65 74 61 20 Data Ascii: ="summary"><meta name="twitter:site" content="@Box"><meta property="og:title" content="MKO Ireland Planning & Environmental Consultancy.docx \| Powered by Box"><meta property="og:type" content="website"><meta property="og:description" content=""><meta
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 76 65 6e 64 6f 72 73 7e 73 68 61 72 65 64 2e 64 62 66 35 35 61 38 30 64 38 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 65 6e 64 75 73 65 72 2f 76 65 6e 64 6f 72 73 7e 6f 62 73 65 72 76 61 62 69 6c 69 74 79 2e 36 65 Data Ascii: ossorigin="anonymous"> <link rel="preload" href="https://cdn01.boxcdn.net/enduser/vendors~shared.dbf55a80d8.js" as="script" type="text/javascript" crossorigin="anonymous"> <link rel="preload" href="https://cdn01.boxcdn.net/enduser/vendors~observability.6e
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 6d 6f 6e 65 79 2d 61 73 73 65 74 73 2f 62 6f 78 5f 6d 6f 6e 65 79 5f 63 6c 69 65 6e 74 5f 72 65 6d 6f 74 65 2e 30 2e 33 2e 38 36 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 3d 22 61 6e 6f 6e 79 6d 6f 75 73 22 3e 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 73 69 67 6e 2d 61 73 73 65 74 73 2f 62 6f 78 5f 73 69 67 6e 5f 63 6c 69 65 6e 74 5f 72 65 6d 6f 74 65 2e 32 2e 32 39 2e 31 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 Data Ascii: ="preload" href="https://cdn01.boxcdn.net/money-assets/box_money_client_remote.0.3.86.js" as="script" type="text/javascript" crossorigin="anonymous"> <link rel="preload" href="https://cdn01.boxcdn.net/sign-assets/box_sign_client_remote.2.29.1.js" as="scri
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 31 31 34 78 31 31 34 2d 62 75 73 71 2d 44 2e 70 6e 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 32 30 78 31 32 30 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 2d 31 32 30 78 31 32 30 2d 4b 2d 75 34 55 35 2e 70 6e 67 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 61 70 70 6c 65 2d 74 6f 75 63 68 2d 69 63 6f 6e 22 20 73 69 7a 65 73 3d 22 31 34 Data Ascii: tps://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-114x114-busq-D.png"><link rel="apple-touch-icon" sizes="120x120" href="https://cdn01.boxcdn.net/_assets/img/favicons/apple-touch-icon-120x120-K-u4U5.png"><link rel="apple-touch-icon" sizes="14
2025-01-13 14:44:24 UTC	904	IN	Data Raw: 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 6e 6f 74 69 66 69 63 61 74 69 6f 6e 2d 66 61 76 69 63 6f 6e 2d 31 36 78 31 36 2d 4f 75 35 4e 38 37 2e 70 6e 67 22 20 73 69 7a 65 73 3d 22 31 36 78 31 36 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 6e 69 66 65 73 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 61 76 69 63 6f 6e 73 2f 6d 61 6e 69 66 65 73 74 2d 72 77 31 41 45 50 2e 6a 73 6f 6e 22 3e 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 6d 61 73 6b 2d 69 63 6f 6e 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 63 64 6e 30 31 2e 62 6f 78 63 64 6e 2e 6e 65 74 2f 5f 61 73 73 65 74 73 2f 69 6d 67 2f 66 Data Ascii: /cdn01.boxcdn.net/_assets/img/favicons/notification-favicon-16x16-Ou5N87.png" sizes="16x16"><link rel="manifest" href="https://cdn01.boxcdn.net/_assets/img/favicons/manifest-rw1AEP.json"><link rel="mask-icon" href="https://cdn01.boxcdn.net/_assets/img/f
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 32 35 30 62 0d 0a 20 3c 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 6e 6f 73 63 72 69 70 74 2d 77 61 72 6e 69 6e 67 22 3e 20 4a 61 76 61 53 63 72 69 70 74 20 69 73 20 63 75 72 72 65 6e 74 6c 79 20 64 69 73 61 62 6c 65 64 20 69 6e 20 79 6f 75 72 20 62 72 6f 77 73 65 72 2e 20 59 6f 75 20 6d 75 73 74 20 68 61 76 65 20 4a 61 76 61 53 63 72 69 70 74 20 65 6e 61 62 6c 65 64 20 74 6f 20 74 61 6b 65 20 66 75 6c 6c 20 61 64 76 61 6e 74 61 67 65 20 6f 66 20 42 6f 78 2e 3c 2f 64 69 76 3e 3c 2f 6e 6f 73 63 72 69 70 74 3e 3c 64 69 76 20 69 64 3d 22 61 70 70 22 20 63 6c 61 73 73 3d 22 72 65 61 63 74 2d 63 6f 6e 74 61 69 6e 65 72 22 3e 3c 2f 64 69 76 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 42 6f 78 20 3d 20 77 69 6e 64 6f 77 2e 42 6f 78 20 7c Data Ascii: 250b <noscript><div class="noscript-warning"> JavaScript is currently disabled in your browser. You must have JavaScript enabled to take full advantage of Box.</div></noscript><div id="app" class="react-container"></div><script>window.Box = window.Box \|
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 49 4b 65 79 22 3a 22 33 73 64 35 6c 74 75 70 61 33 63 71 35 74 33 6f 76 6d 31 72 32 6b 65 61 72 36 69 34 6b 76 6d 65 62 34 32 61 22 2c 22 65 6e 74 65 72 70 72 69 73 65 22 3a 5b 5d 2c 22 74 68 65 6d 65 22 3a 7b 22 69 64 22 3a 31 2c 22 69 73 44 65 66 61 75 6c 74 54 68 65 6d 65 22 3a 74 72 75 65 2c 22 70 72 69 6d 61 72 79 43 6f 6c 6f 72 22 3a 22 23 30 30 36 31 44 35 22 2c 22 6c 6f 67 6f 55 52 4c 73 22 3a 7b 22 73 6d 61 6c 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 72 67 65 22 3a 6e 75 6c 6c 2c 22 70 72 65 76 69 65 77 22 3a 6e 75 6c 6c 2c 22 78 73 6d 61 6c 6c 22 3a 6e 75 6c 6c 2c 22 78 73 6d 61 6c 6c 32 78 22 3a 6e 75 6c 6c 2c 22 78 73 6d 61 6c 6c 33 78 22 3a 6e 75 6c 6c 7d 2c 22 6c 6f 67 6f 32 55 52 4c 73 22 3a 7b 22 73 6d 61 6c 6c 22 3a 6e 75 6c 6c 2c 22 6c 61 72 67 Data Ascii: IKey":"3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42a","enterprise":[],"theme":{"id":1,"isDefaultTheme":true,"primaryColor":"#0061D5","logoURLs":{"small":null,"large":null,"preview":null,"xsmall":null,"xsmall2x":null,"xsmall3x":null},"logo2URLs":{"small":null,"larg
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 61 62 6c 65 64 22 3a 66 61 6c 73 65 2c 22 66 75 6c 6c 56 65 72 73 69 6f 6e 53 68 69 65 6c 64 22 3a 66 61 6c 73 65 2c 22 67 6f 6f 67 6c 65 44 53 53 46 65 61 74 75 72 65 46 6c 69 70 22 3a 66 61 6c 73 65 2c 22 68 75 62 73 22 3a 74 72 75 65 2c 22 68 75 62 73 50 72 6f 76 69 73 69 6f 6e 65 64 22 3a 66 61 6c 73 65 2c 22 68 75 62 73 43 72 65 61 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 68 75 62 73 47 61 6c 6c 65 72 79 22 3a 66 61 6c 73 65 2c 22 6d 65 74 61 64 61 74 61 22 3a 66 61 6c 73 65 2c 22 6e 6f 74 65 73 22 3a 74 72 75 65 2c 22 6f 6e 62 6f 61 72 64 69 6e 67 45 78 70 65 72 69 65 6e 63 65 41 70 69 22 3a 66 61 6c 73 65 2c 22 6f 70 65 6e 57 69 74 68 50 72 6f 67 72 61 6d 22 3a 66 61 6c 73 65 2c 22 6f 77 6e 65 64 42 79 4d 65 22 3a 66 61 6c 73 65 2c 22 70 72 65 76 69 Data Ascii: abled":false,"fullVersionShield":false,"googleDSSFeatureFlip":false,"hubs":true,"hubsProvisioned":false,"hubsCreation":false,"hubsGallery":false,"metadata":false,"notes":true,"onboardingExperienceApi":false,"openWithProgram":false,"ownedByMe":false,"previ
2025-01-13 14:44:24 UTC	1390	IN	Data Raw: 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 73 70 6c 69 74 5f 69 6f 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 73 70 6c 69 74 5f 70 72 6f 78 79 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 72 65 73 70 6f 6e 73 69 76 65 5f 77 65 62 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 6c 69 73 74 5f 76 69 65 77 5f 65 6e 68 61 6e 63 65 6d 65 6e 74 73 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 67 72 69 64 5f 76 69 65 77 5f 65 6e 68 61 6e 63 65 6d 65 6e 74 73 22 3a 74 72 75 65 2c 22 65 75 61 5f 65 78 70 65 72 69 6d 65 6e 74 5f 70 72 65 76 69 65 77 5f 65 73 6c 5f 70 6f 73 74 5f 67 61 22 3a 74 72 75 65 7d 2c 22 70 72 65 76 69 65 77 22 3a 7b 22 61 70 69 48 6f 73 74 22 3a 22 68 Data Ascii: a_experiment_split_io":true,"eua_experiment_split_proxy":true,"eua_experiment_responsive_web":true,"eua_experiment_list_view_enhancements":true,"eua_experiment_grid_view_enhancements":true,"eua_experiment_preview_esl_post_ga":true},"preview":{"apiHost":"h

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:28 UTC	803	OUT	GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / X-Box-Client-Version: 23.25.1 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
2025-01-13 14:44:28 UTC	748	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 14:44:28 GMT content-type: application/json; charset=utf-8 strict-transport-security: max-age=31536000 expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=e0nbhfs05jvfi7hinhshoqas1q; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=678526c81f7108.44421725; expires=Tue, 13 Jan 2026 14:44:28 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure x-enduserapp-currentversion: 23.25.1 via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:28 UTC	293	IN	Data Raw: 31 31 39 0d 0a 7b 22 66 65 61 74 75 72 65 73 22 3a 7b 22 63 61 6e 41 64 64 53 65 61 74 73 22 3a 66 61 6c 73 65 2c 22 63 68 61 74 62 6f 74 22 3a 66 61 6c 73 65 2c 22 70 65 72 73 69 73 74 65 6e 74 44 72 69 76 65 50 72 6f 6d 6f 74 69 6f 6e 22 3a 66 61 6c 73 65 2c 22 75 70 67 72 61 64 65 49 6e 6c 69 6e 65 22 3a 66 61 6c 73 65 2c 22 63 61 6e 55 70 67 72 61 64 65 54 72 69 61 6c 22 3a 66 61 6c 73 65 2c 22 75 6e 75 73 65 64 4d 61 6e 61 67 65 64 55 73 65 72 43 6f 75 6e 74 22 3a 6e 75 6c 6c 2c 22 75 6e 75 73 65 64 4d 61 6e 61 67 65 64 55 73 65 72 50 6c 75 73 4f 76 65 72 61 67 65 41 6c 6c 6f 77 61 6e 63 65 43 6f 75 6e 74 22 3a 6e 75 6c 6c 2c 22 69 73 45 6c 69 67 69 62 6c 65 46 6f 72 49 59 54 41 64 64 55 73 65 72 73 22 3a 66 61 6c 73 65 2c 22 69 73 4d 65 72 67 65 64 Data Ascii: 119{"features":{"canAddSeats":false,"chatbot":false,"persistentDrivePromotion":false,"upgradeInline":false,"canUpgradeTrial":false,"unusedManagedUserCount":null,"unusedManagedUserPlusOverageAllowanceCount":null,"isEligibleForIYTAddUsers":false,"isMerged

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:28 UTC	840	OUT	GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 SplitSDKVersion: javascript-10.28.0 Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42a User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
2025-01-13 14:44:29 UTC	353	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 14:44:29 GMT content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 4 strict-transport-security: max-age=31536000 box-request-id: 0ba6618d2c7905005933402ae01da03b via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:29 UTC	28	IN	Data Raw: 31 31 0d 0a 7b 22 6d 79 53 65 67 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 11{"mySegments":[]}0

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:28 UTC	854	OUT	GET /app-api/split-proxy/api/splitChanges?s=1.1&since=-1 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 SplitSDKVersion: javascript-10.28.0 Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42a User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
2025-01-13 14:44:29 UTC	355	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 14:44:29 GMT content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 26 strict-transport-security: max-age=31536000 box-request-id: 0272508d02a2527b6b267611d398e532b via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:29 UTC	1035	IN	Data Raw: 32 65 63 64 0d 0a 7b 22 74 69 6c 6c 22 3a 31 37 33 36 37 37 38 39 35 32 37 35 32 2c 22 73 69 6e 63 65 22 3a 2d 31 2c 22 73 70 6c 69 74 73 22 3a 5b 7b 22 63 68 61 6e 67 65 4e 75 6d 62 65 72 22 3a 31 36 39 30 34 38 34 34 34 31 34 32 32 2c 22 74 72 61 66 66 69 63 54 79 70 65 4e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 6e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 65 6e 74 65 72 70 72 69 73 65 2d 61 64 6d 69 6e 5f 69 6e 74 65 72 6e 61 6c 5f 61 64 6d 69 6e 5f 64 6f 6d 61 69 6e 5f 76 65 72 69 66 69 63 61 74 69 6f 6e 5f 74 79 70 65 22 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 22 3a 31 30 30 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 53 65 65 64 22 3a 35 37 36 38 33 39 31 31 33 2c 22 73 65 65 64 22 3a Data Ascii: 2ecd{"till":1736778952752,"since":-1,"splits":[{"changeNumber":1690484441422,"trafficTypeName":"enterprise_id","name":"enterprise_enterprise-admin_internal_admin_domain_verification_type","trafficAllocation":100,"trafficAllocationSeed":576839113,"seed":
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 6c 6f 63 61 74 69 6f 6e 53 65 65 64 22 3a 2d 32 30 39 35 32 36 38 34 34 2c 22 73 65 65 64 22 3a 31 30 34 35 37 37 36 39 32 39 2c 22 73 74 61 74 75 73 22 3a 22 41 43 54 49 56 45 22 2c 22 6b 69 6c 6c 65 64 22 3a 66 61 6c 73 65 2c 22 64 65 66 61 75 6c 74 54 72 65 61 74 6d 65 6e 74 22 3a 22 6f 6e 22 2c 22 61 6c 67 6f 22 3a 32 2c 22 63 6f 6e 64 69 74 69 6f 6e 73 22 3a 5b 7b 22 63 6f 6e 64 69 74 69 6f 6e 54 79 70 65 22 3a 22 52 4f 4c 4c 4f 55 54 22 2c 22 6d 61 74 63 68 65 72 47 72 6f 75 70 22 3a 7b 22 63 6f 6d 62 69 6e 65 72 22 3a 22 41 4e 44 22 2c 22 6d 61 74 63 68 65 72 73 22 3a 5b 7b 22 6b 65 79 53 65 6c 65 63 74 6f 72 22 3a 7b 22 74 72 61 66 66 69 63 54 79 70 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 61 74 74 72 69 62 75 74 65 22 3a 6e 75 Data Ascii: locationSeed":-209526844,"seed":1045776929,"status":"ACTIVE","killed":false,"defaultTreatment":"on","algo":2,"conditions":[{"conditionType":"ROLLOUT","matcherGroup":{"combiner":"AND","matchers":[{"keySelector":{"trafficType":"enterprise_id","attribute":nu
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 3a 30 7d 2c 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 66 66 22 2c 22 73 69 7a 65 22 3a 31 30 30 7d 5d 2c 22 6c 61 62 65 6c 22 3a 22 64 65 66 61 75 6c 74 20 72 75 6c 65 22 7d 5d 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 73 22 3a 7b 7d 2c 22 73 65 74 73 22 3a 5b 5d 7d 2c 7b 22 63 68 61 6e 67 65 4e 75 6d 62 65 72 22 3a 31 37 33 36 33 37 30 35 33 36 32 36 37 2c 22 74 72 61 66 66 69 63 54 79 70 65 4e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 6e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 6d 66 61 5f 63 6f 6e 66 69 67 75 72 61 62 6c 65 5f 74 69 6d 65 6f 75 74 5f 63 68 61 6e 67 65 22 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 22 3a 31 30 30 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 53 65 65 64 22 Data Ascii: :0},{"treatment":"off","size":100}],"label":"default rule"}],"configurations":{},"sets":[]},{"changeNumber":1736370536267,"trafficTypeName":"enterprise_id","name":"enterprise_mfa_configurable_timeout_change","trafficAllocation":100,"trafficAllocationSeed"
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 7b 22 73 70 6c 69 74 22 3a 22 67 78 70 5f 66 65 61 74 75 72 65 73 5f 71 32 32 35 22 2c 22 74 72 65 61 74 6d 65 6e 74 73 22 3a 5b 22 6f 66 66 22 5d 7d 2c 22 62 6f 6f 6c 65 61 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 7d 5d 7d 2c 22 70 61 72 74 69 74 69 6f 6e 73 22 3a 5b 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 6e 22 2c 22 73 69 7a 65 22 3a 30 7d 2c 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 66 66 22 2c 22 73 69 7a 65 22 3a 31 30 30 7d 5d 2c 22 6c 61 62 65 6c 22 3a 22 69 6e 20 73 70 6c 69 74 20 67 78 70 5f 66 65 61 74 75 72 65 73 5f 71 32 32 35 20 Data Ascii: tcherData":null,"dependencyMatcherData":{"split":"gxp_features_q225","treatments":["off"]},"booleanMatcherData":null,"stringMatcherData":null}]},"partitions":[{"treatment":"on","size":0},{"treatment":"off","size":100}],"label":"in split gxp_features_q225
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 6c 2c 22 62 65 74 77 65 65 6e 53 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 7b 22 73 70 6c 69 74 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 72 65 70 6f 72 74 73 5f 64 61 74 61 5f 72 65 74 65 6e 74 69 6f 6e 5f 76 32 22 2c 22 74 72 65 61 74 6d 65 6e 74 73 22 3a 5b 22 6f 6e 22 5d 7d 2c 22 62 6f 6f 6c 65 61 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 7d 5d 7d 2c 22 70 61 72 74 69 74 69 6f 6e 73 22 3a 5b 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 6e 22 2c 22 73 69 7a 65 22 3a 31 30 30 7d 2c 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 66 66 22 2c 22 73 69 7a 65 22 3a 30 7d 5d 2c Data Ascii: l,"betweenStringMatcherData":null,"dependencyMatcherData":{"split":"enterprise_reports_data_retention_v2","treatments":["on"]},"booleanMatcherData":null,"stringMatcherData":null}]},"partitions":[{"treatment":"on","size":100},{"treatment":"off","size":0}],
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 61 74 61 22 3a 6e 75 6c 6c 2c 22 77 68 69 74 65 6c 69 73 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 75 6e 61 72 79 4e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 53 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 7b 22 73 70 6c 69 74 22 3a 22 67 78 70 5f 66 65 61 74 75 72 65 73 5f 71 31 32 35 22 2c 22 74 72 65 61 74 6d 65 6e 74 73 22 3a 5b 22 6f 66 66 22 5d 7d 2c 22 62 6f 6f 6c 65 61 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 7d 5d 7d Data Ascii: ata":null,"whitelistMatcherData":null,"unaryNumericMatcherData":null,"betweenMatcherData":null,"betweenStringMatcherData":null,"dependencyMatcherData":{"split":"gxp_features_q125","treatments":["off"]},"booleanMatcherData":null,"stringMatcherData":null}]}
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 69 7a 65 22 3a 31 30 30 7d 2c 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 6f 66 66 22 2c 22 73 69 7a 65 22 3a 30 7d 5d 2c 22 6c 61 62 65 6c 22 3a 22 64 65 66 61 75 6c 74 20 72 75 6c 65 22 7d 5d 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 73 22 3a 7b 7d 2c 22 73 65 74 73 22 3a 5b 5d 7d 2c 7b 22 63 68 61 6e 67 65 4e 75 6d 62 65 72 22 3a 31 36 38 39 30 38 37 36 39 39 37 37 35 2c 22 74 72 61 66 66 69 63 54 79 70 65 4e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 6e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 63 6f 6e 74 65 78 74 75 61 6c 5f 6d 65 73 73 61 67 65 5f 74 6f 70 5f 6c 65 76 65 6c 22 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 22 3a 31 30 30 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 53 65 65 64 Data Ascii: ize":100},{"treatment":"off","size":0}],"label":"default rule"}],"configurations":{},"sets":[]},{"changeNumber":1689087699775,"trafficTypeName":"enterprise_id","name":"enterprise_contextual_message_top_level","trafficAllocation":100,"trafficAllocationSeed
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 22 3a 5b 22 31 30 35 30 34 37 30 34 38 38 22 2c 22 31 30 36 30 37 33 36 30 31 32 22 2c 22 38 33 35 39 38 35 33 36 38 22 2c 22 38 36 38 31 39 36 30 34 35 22 5d 7d 2c 22 75 6e 61 72 79 4e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 53 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 64 65 70 65 6e 64 65 6e 63 79 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 6f 6f 6c 65 61 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 73 74 72 69 6e 67 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 7d 5d 7d 2c 22 70 61 72 74 69 74 69 6f 6e 73 22 3a 5b 7b 22 74 72 65 61 74 6d 65 6e 74 22 3a 22 Data Ascii: ":["1050470488","1060736012","835985368","868196045"]},"unaryNumericMatcherData":null,"betweenMatcherData":null,"betweenStringMatcherData":null,"dependencyMatcherData":null,"booleanMatcherData":null,"stringMatcherData":null}]},"partitions":[{"treatment":"
2025-01-13 14:44:29 UTC	1224	IN	Data Raw: 66 61 75 6c 74 20 72 75 6c 65 22 7d 5d 2c 22 63 6f 6e 66 69 67 75 72 61 74 69 6f 6e 73 22 3a 7b 7d 2c 22 73 65 74 73 22 3a 5b 5d 7d 2c 7b 22 63 68 61 6e 67 65 4e 75 6d 62 65 72 22 3a 31 37 31 33 33 39 31 34 35 30 35 34 39 2c 22 74 72 61 66 66 69 63 54 79 70 65 4e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 6e 61 6d 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 67 65 74 5f 63 69 61 73 5f 66 6f 72 5f 69 74 65 6d 73 5f 66 69 78 5f 73 68 61 72 64 69 6e 67 5f 62 75 67 22 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 22 3a 31 30 30 2c 22 74 72 61 66 66 69 63 41 6c 6c 6f 63 61 74 69 6f 6e 53 65 65 64 22 3a 31 37 33 30 31 34 31 34 34 36 2c 22 73 65 65 64 22 3a 32 39 31 32 39 35 36 36 38 2c 22 73 74 61 74 75 73 22 3a 22 41 43 54 49 Data Ascii: fault rule"}],"configurations":{},"sets":[]},{"changeNumber":1713391450549,"trafficTypeName":"enterprise_id","name":"enterprise_get_cias_for_items_fix_sharding_bug","trafficAllocation":100,"trafficAllocationSeed":1730141446,"seed":291295668,"status":"ACTI
2025-01-13 14:44:29 UTC	1390	IN	Data Raw: 66 66 61 0d 0a 4e 44 22 2c 22 6d 61 74 63 68 65 72 73 22 3a 5b 7b 22 6b 65 79 53 65 6c 65 63 74 6f 72 22 3a 7b 22 74 72 61 66 66 69 63 54 79 70 65 22 3a 22 65 6e 74 65 72 70 72 69 73 65 5f 69 64 22 2c 22 61 74 74 72 69 62 75 74 65 22 3a 6e 75 6c 6c 7d 2c 22 6d 61 74 63 68 65 72 54 79 70 65 22 3a 22 49 4e 5f 53 50 4c 49 54 5f 54 52 45 41 54 4d 45 4e 54 22 2c 22 6e 65 67 61 74 65 22 3a 66 61 6c 73 65 2c 22 75 73 65 72 44 65 66 69 6e 65 64 53 65 67 6d 65 6e 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 77 68 69 74 65 6c 69 73 74 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 75 6e 61 72 79 4e 75 6d 65 72 69 63 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c 6c 2c 22 62 65 74 77 65 65 6e 4d 61 74 63 68 65 72 44 61 74 61 22 3a 6e 75 6c Data Ascii: ffaND","matchers":[{"keySelector":{"trafficType":"enterprise_id","attribute":null},"matcherType":"IN_SPLIT_TREATMENT","negate":false,"userDefinedSegmentMatcherData":null,"whitelistMatcherData":null,"unaryNumericMatcherData":null,"betweenMatcherData":nul

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

LLM Input / Output

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 174

Chrome Cache Entry: 175

Chrome Cache Entry: 176

Chrome Cache Entry: 177

Chrome Cache Entry: 178

Chrome Cache Entry: 179

Chrome Cache Entry: 180

Chrome Cache Entry: 181

Chrome Cache Entry: 182

Chrome Cache Entry: 183

Chrome Cache Entry: 184

Chrome Cache Entry: 185

Chrome Cache Entry: 186

Chrome Cache Entry: 187

Chrome Cache Entry: 188

Chrome Cache Entry: 189

Chrome Cache Entry: 190

Chrome Cache Entry: 191

Chrome Cache Entry: 192

Windows Analysis Report
https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:31 UTC	839	OUT	GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 SplitSDKVersion: javascript-10.28.0 Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42a User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
2025-01-13 14:44:31 UTC	354	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 14:44:31 GMT content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 5 strict-transport-security: max-age=31536000 box-request-id: 014e291a8ef63d2634066a1fc21aab22e via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:31 UTC	28	IN	Data Raw: 31 31 0d 0a 7b 22 6d 79 53 65 67 6d 65 6e 74 73 22 3a 5b 5d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 11{"mySegments":[]}0

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:31 UTC	989	OUT	POST /gen204 HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 433 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Box-Client-Version: 23.25.1 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json X-Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518 Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518 sec-ch-ua-platform: "Windows" Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
2025-01-13 14:44:31 UTC	433	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 65 75 61 5f 70 65 72 66 6f 72 6d 61 6e 63 65 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 72 65 71 75 65 73 74 5f 69 64 22 3a 22 71 70 36 67 65 68 78 6a 69 6c 31 37 6f 74 6f 22 2c 22 62 72 6f 77 73 65 72 5f 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 22 2c 22 62 72 6f 77 73 65 72 5f 76 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 22 2c 22 6f 73 5f 6e 61 6d 65 22 3a 22 57 69 6e 64 6f 77 73 22 2c 22 64 65 76 69 63 65 5f 6e 61 6d 65 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 70 65 72 66 6f 72 6d 61 6e 63 65 5f 69 64 22 3a 22 73 70 6c 69 74 22 2c 22 73 74 61 72 74 5f 73 74 61 74 65 22 3a 22 69 6e 69 74 69 61 6c 22 2c 22 65 6e Data Ascii: {"data":[{"category":"eua_performance","event_type":"web","country_code":"US","request_id":"qp6gehxjil17oto","browser_name":"Chrome","browser_version":"117.0","os_name":"Windows","device_name":"unknown","performance_id":"split","start_state":"initial","en
2025-01-13 14:44:31 UTC	772	IN	HTTP/1.1 204 No Content date: Mon, 13 Jan 2025 14:44:31 GMT content-type: text/html;charset=UTF-8 strict-transport-security: max-age=31536000 access-control-allow-origin: https://app.box.com access-control-allow-credentials: true expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=e0nbhfs05jvfi7hinhshoqas1q; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=678526c81f7108.44421725; expires=Tue, 13 Jan 2026 14:44:31 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:31 UTC	1214	OUT	GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1736779470112&jzb=eJy9UcGOmzAU_BefCdgY1pDbSj206lbVthu1UlUhAyaxBJjYj2xolH_P8yZFSFXb065PZsZvZpj340RgGhRZE12rHnQzkYCU1jw7ZQvQHTJM8Dsh8kRQmqcBOWinwdhC1zgU42tZVWbs4QqsGCKjbfG6AxjcOorkMISlOYaV6SIXaWC73bH6tZ8auj_qJmFlJ5MMJAi3d9wLDtYMjqxPxLR1sbTrx7YNXtCl5xX9b6wzCkuL__gkyw_zGFw_yOOX6fPjRyHY5ttT39ADCjRWduqF_JQn99_fPYtqk48PvOG-ogkUZuSMnoO5wk6B_Gd9d29a383KX1HgQfbbUW59TtWvNl_x5ZyhXXIFcljWLZef_qPC-5lDqJbgBxmPKItiGqcoeFDWadN7-TDmWRgXmKpGwqm2eW8cKJQEO6rX2UrOF1tpjfTOf9-KeNOt-Di3EGma0JDlv08Wp69SR5xm558XE8c9vw HTTP/1.1 Host: pendo-data-prod.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://app.box.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: box_visitor_id=678526c81f7108.44421725; site_preference=desktop
2025-01-13 14:44:31 UTC	556	IN	HTTP/1.1 200 OK access-control-allow-credentials: false access-control-allow-headers: * access-control-allow-methods: GET,POST access-control-allow-origin: * access-control-max-age: 600 cache-control: no-store content-type: image/gif x-content-type-options: nosniff date: Mon, 13 Jan 2025 14:44:31 GMT Content-Length: 42 x-envoy-upstream-service-time: 49 server: istio-envoy via: 1.1 google, 1.1 google strict-transport-security: max-age=63072000 alt-svc: clear Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-01-13 14:44:31 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 00 00 2c 00 00 00 00 01 00 01 00 00 02 01 44 00 3b Data Ascii: GIF89a!,D;

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:31 UTC	495	OUT	GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1 Host: app.box.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
2025-01-13 14:44:32 UTC	308	IN	HTTP/1.1 401 Unauthorized date: Mon, 13 Jan 2025 14:44:31 GMT x-envoy-upstream-service-time: 5 strict-transport-security: max-age=31536000 box-request-id: 0e0ac85f26ce31e8052db439983c1db23 via: 1.1 google Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:31 UTC	791	OUT	POST /index.php?rm=box_gen204_batch_record HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 479 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop
2025-01-13 14:44:31 UTC	479	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 65 75 61 5f 70 65 72 66 6f 72 6d 61 6e 63 65 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 77 65 62 22 2c 22 65 76 65 6e 74 73 22 3a 5b 7b 22 61 76 61 69 6c 61 62 69 6c 69 74 79 5f 7a 6f 6e 65 22 3a 22 75 73 2d 77 65 73 74 34 2d 70 72 6f 64 22 2c 22 62 72 6f 77 73 65 72 5f 6e 61 6d 65 22 3a 22 43 68 72 6f 6d 65 22 2c 22 62 72 6f 77 73 65 72 5f 76 65 72 73 69 6f 6e 22 3a 22 31 31 37 2e 30 22 2c 22 63 6c 69 65 6e 74 5f 76 65 72 73 69 6f 6e 22 3a 22 32 33 2e 32 35 2e 31 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 64 65 70 6c 6f 79 6d 65 6e 74 5f 74 79 70 65 22 3a 22 6b 38 73 22 2c 22 64 65 76 69 63 65 5f 6e 61 6d 65 22 3a 22 75 6e 6b 6e 6f 77 6e 22 2c 22 65 6e 76 69 Data Ascii: {"data":[{"category":"eua_performance","event_type":"web","events":[{"availability_zone":"us-west4-prod","browser_name":"Chrome","browser_version":"117.0","client_version":"23.25.1","country_code":"US","deployment_type":"k8s","device_name":"unknown","envi
2025-01-13 14:44:32 UTC	772	IN	HTTP/1.1 204 No Content date: Mon, 13 Jan 2025 14:44:32 GMT content-type: text/html;charset=UTF-8 strict-transport-security: max-age=31536000 access-control-allow-origin: https://app.box.com access-control-allow-credentials: true expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=e0nbhfs05jvfi7hinhshoqas1q; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=678526c81f7108.44421725; expires=Tue, 13 Jan 2026 14:44:32 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:35 UTC	1102	OUT	POST /app-api/enduserapp/elements/tokens HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 29 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Box-Client-Version: 23.25.1 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 X-Box-EndUser-API: sharedName=it1hhxczqyf0qxif41bma48tat7sqs32 Content-Type: application/json Accept: application/json X-Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518 Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518 sec-ch-ua-platform: "Windows" Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
2025-01-13 14:44:35 UTC	29	OUT	Data Raw: 7b 22 66 69 6c 65 49 44 73 22 3a 5b 22 31 37 34 38 35 33 39 34 35 38 33 37 34 22 5d 7d Data Ascii: {"fileIDs":["1748539458374"]}
2025-01-13 14:44:35 UTC	748	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 14:44:35 GMT content-type: application/json; charset=utf-8 strict-transport-security: max-age=31536000 expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=e0nbhfs05jvfi7hinhshoqas1q; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=678526c81f7108.44421725; expires=Tue, 13 Jan 2026 14:44:35 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure x-enduserapp-currentversion: 23.25.1 via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:35 UTC	642	IN	Data Raw: 32 38 37 0d 0a 7b 22 31 37 34 38 35 33 39 34 35 38 33 37 34 22 3a 7b 22 72 65 61 64 22 3a 22 31 21 39 53 54 35 50 73 6b 75 38 68 6a 63 62 5f 76 53 34 56 52 42 74 67 59 48 6e 6e 43 37 2d 61 6b 57 44 58 5a 6c 79 45 70 39 53 44 66 44 56 70 6b 56 46 62 59 78 31 39 41 45 6d 39 71 4d 50 34 45 58 4d 63 4f 68 33 2d 44 5f 65 4c 41 42 4f 4f 5f 38 6d 57 4e 48 7a 36 5a 79 6b 75 31 31 32 4f 6d 79 6b 2d 72 52 52 78 72 56 72 46 4a 42 30 4c 6d 57 7a 49 50 6b 44 65 6c 64 77 32 41 41 7a 6f 77 51 76 31 7a 72 39 6d 73 41 31 61 52 4d 6c 52 42 79 70 70 41 6a 32 74 78 73 59 4f 75 47 4e 52 57 71 30 51 7a 41 55 53 71 69 56 33 6a 31 56 30 37 57 67 75 4d 36 61 47 33 50 56 58 36 45 5a 79 50 30 6e 4d 66 73 75 4e 2d 55 38 65 4f 6b 59 30 43 35 37 78 30 44 63 57 61 33 4f 73 79 49 70 6a Data Ascii: 287{"1748539458374":{"read":"1!9ST5Psku8hjcb_vS4VRBtgYHnnC7-akWDXZlyEp9SDfDVpkVFbYx19AEm9qMP4EXMcOh3-D_eLABOO_8mWNHz6Zyku112Omyk-rRRxrVrFJB0LmWzIPkDeldw2AAzowQv1zr9msA1aRMlRByppAj2txsYOuGNRWq0QzAUSqiV3j1V07WguM6aG3PVX6EZyP0nMfsuN-U8eOkY0C57x0DcWa3OsyIpj
2025-01-13 14:44:35 UTC	17	IN	Data Raw: 6b 73 76 71 69 4f 2d 22 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: ksvqiO-"}}0

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:35 UTC	1012	OUT	POST /gen204 HTTP/1.1 Host: app.box.com Connection: keep-alive Content-Length: 1004 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Box-Client-Version: 23.25.1 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json Accept: application/json X-Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518 Request-Token: 308ea14a8c7f41ad3c80a6de28ec4648c6a91ebe030a7ee1845003d2e7612518 sec-ch-ua-platform: "Windows" Origin: https://app.box.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
2025-01-13 14:44:35 UTC	1004	OUT	Data Raw: 7b 22 64 61 74 61 22 3a 5b 7b 22 63 61 74 65 67 6f 72 79 22 3a 22 62 6f 6f 6d 65 72 61 6e 67 22 2c 22 65 76 65 6e 74 5f 74 79 70 65 22 3a 22 62 65 61 63 6f 6e 22 2c 22 61 76 61 69 6c 61 62 69 6c 69 74 79 5f 7a 6f 6e 65 22 3a 22 75 73 2d 77 65 73 74 34 2d 70 72 6f 64 22 2c 22 63 6c 69 65 6e 74 5f 6e 61 6d 65 22 3a 22 65 6e 64 75 73 65 72 61 70 70 22 2c 22 63 6c 69 65 6e 74 5f 76 65 72 73 69 6f 6e 22 3a 22 32 33 2e 32 35 2e 31 22 2c 22 63 75 72 72 65 6e 74 5f 72 6d 22 3a 22 65 6e 64 75 73 65 72 61 70 70 5f 73 68 61 72 65 64 5f 69 74 65 6d 5f 70 61 67 65 22 2c 22 64 61 74 61 63 65 6e 74 65 72 54 61 67 22 3a 22 75 73 2d 77 65 73 74 34 2d 70 72 6f 64 22 2c 22 64 65 70 6c 6f 79 6d 65 6e 74 5f 74 79 70 65 22 3a 22 6b 38 73 22 2c 22 65 6e 76 69 72 6f 6e 6d 65 6e Data Ascii: {"data":[{"category":"boomerang","event_type":"beacon","availability_zone":"us-west4-prod","client_name":"enduserapp","client_version":"23.25.1","current_rm":"enduserapp_shared_item_page","datacenterTag":"us-west4-prod","deployment_type":"k8s","environmen
2025-01-13 14:44:35 UTC	772	IN	HTTP/1.1 204 No Content date: Mon, 13 Jan 2025 14:44:35 GMT content-type: text/html;charset=UTF-8 strict-transport-security: max-age=31536000 access-control-allow-origin: https://app.box.com access-control-allow-credentials: true expires: Thu, 19 Nov 1981 08:52:00 GMT cache-control: no-store, no-cache, must-revalidate pragma: no-cache set-cookie: z=e0nbhfs05jvfi7hinhshoqas1q; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=None set-cookie: box_visitor_id=678526c81f7108.44421725; expires=Tue, 13 Jan 2026 14:44:35 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=None set-cookie: site_preference=desktop; path=/; domain=.box.com; secure via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:35 UTC	834	OUT	GET /app-api/end-user-web/sign-settings?typedIDs=f_1748539458374 HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Accept: application/json, text/plain, / X-Box-Client-Version: 23.25.1 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
2025-01-13 14:44:35 UTC	734	IN	HTTP/1.1 404 Not Found date: Mon, 13 Jan 2025 14:44:35 GMT content-type: application/json; charset=utf-8 x-envoy-upstream-service-time: 78 x-frame-options: SAMEORIGIN x-download-options: noopen strict-transport-security: max-age=31536000 access-control-expose-headers: Server-Timing set-cookie: csrf-token=fag2EmRuoXgR3F6jxcT3dekpzEMHhJXwg_v2ACjI54C; Secure; SameSite=None; Path=/ x-xss-protection: 0 x-content-type-options: nosniff box-request-id: 06a6dfab384d3dd860096dc20b7b9742d server-timing: traceparent;desc="00-57b8c4b57acb2d59a199983de3ef24f0-0836b4892da01b71-00" cache-control: no-cache via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:35 UTC	106	IN	Data Raw: 35 66 0d 0a 7b 22 73 74 61 74 75 73 43 6f 64 65 22 3a 34 30 34 2c 22 65 72 72 6f 72 22 3a 22 4e 6f 74 20 46 6f 75 6e 64 22 2c 22 6d 65 73 73 61 67 65 22 3a 22 43 6f 75 6c 64 20 6e 6f 74 20 73 69 67 6e 20 73 65 74 74 69 6e 67 73 20 66 6f 72 3a 20 66 5f 31 37 34 38 35 33 39 34 35 38 33 37 34 22 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 5f{"statusCode":404,"error":"Not Found","message":"Could not sign settings for: f_1748539458374"}0

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:36 UTC	515	OUT	GET /app-api/enduserapp/elements/tokens HTTP/1.1 Host: app.box.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
2025-01-13 14:44:36 UTC	260	IN	HTTP/1.1 404 Not Found date: Mon, 13 Jan 2025 14:44:36 GMT content-type: text/html; charset=UTF-8 strict-transport-security: max-age=31536000 via: 1.1 google Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Timestamp	Bytes transferred	Direction	Data
2025-01-13 14:44:36 UTC	1466	OUT	GET /api/2.0/files/1748539458374?fields=watermark_info HTTP/1.1 Host: app.box.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" X-Box-Client-Version: 23.25.1 X-Box-Client-Name: enduserapp sec-ch-ua-mobile: ?0 Authorization: Bearer 1!9ST5Psku8hjcb_vS4VRBtgYHnnC7-akWDXZlyEp9SDfDVpkVFbYx19AEm9qMP4EXMcOh3-D_eLABOO_8mWNHz6Zyku112Omyk-rRRxrVrFJB0LmWzIPkDeldw2AAzowQv1zr9msA1aRMlRByppAj2txsYOuGNRWq0QzAUSqiV3j1V07WguM6aG3PVX6EZyP0nMfsuN-U8eOkY0C57x0DcWa3OsyIpjrX8zQZWuHw8Ly-Om3SPt3F7SiZqem6lNxg1X0f4bHawQX9WYA-ZBALMVTC3kTarwFcsM6MEjDtMro5z2ZK58Qzq2Pvop3xBhrFEXdbiLmdOMMNZbm5i0ohsBpVN4HL1K3utvT22pcjFN1mbuYy_VCD38tDY3kNtQEGtOthyMafn8XJZ-viX3UnQwwjxZBby7FsuNY1rdRawcoAgkLQ94e6oVq6HhVrAVVoaZHr_k8WUwYBNqlJBaXcZ8ygx3oeblt8Hvb8zw74ePG7i4c_Qt6lW3hSofSwvnDHvqoSoxAAMtD59OhmLfMroAj9RuDLj52CDrtXl-YyN8Y3cWF3QeQ2TdFO7t5sNvr48-iJEZQTzybD0OoStT8Jlok1Vfc11DuVhksvqiO- User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: application/json, text/plain, / sec-ch-ua-platform: "Windows" Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://app.box.com/s/it1hhxczqyf0qxif41bma48tat7sqs32 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: z=e0nbhfs05jvfi7hinhshoqas1q; box_visitor_id=678526c81f7108.44421725; bv=ISF-17076; cn=88; site_preference=desktop; anonymousbanner=seen
2025-01-13 14:44:36 UTC	300	IN	HTTP/1.1 200 OK date: Mon, 13 Jan 2025 14:44:36 GMT content-type: application/json strict-transport-security: max-age=31536000 cache-control: no-cache, no-store etag: "6" via: 1.1 google Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close Transfer-Encoding: chunked
2025-01-13 14:44:36 UTC	100	IN	Data Raw: 35 39 0d 0a 7b 22 74 79 70 65 22 3a 22 66 69 6c 65 22 2c 22 69 64 22 3a 22 31 37 34 38 35 33 39 34 35 38 33 37 34 22 2c 22 65 74 61 67 22 3a 22 36 22 2c 22 77 61 74 65 72 6d 61 72 6b 5f 69 6e 66 6f 22 3a 7b 22 69 73 5f 77 61 74 65 72 6d 61 72 6b 65 64 22 3a 66 61 6c 73 65 7d 7d 0d 0a 30 0d 0a 0d 0a Data Ascii: 59{"type":"file","id":"1748539458374","etag":"6","watermark_info":{"is_watermarked":false}}0