Windows Analysis Report
https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc

Overview

General Information

Sample URL:	https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc
Analysis ID:	1525117
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Stores files to the Windows start menu directory

Classification

Signatures

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49831 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /X-Box-Client-Version: 21.315.2X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NFuduc3hyGCd1K&MD=Rnn879Vs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377 HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377 HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NFuduc3hyGCd1K&MD=Rnn879Vs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: app.box.com
Source: global traffic	DNS traffic detected: DNS query: cdn01.boxcdn.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pendo-data-prod.box.com
Source: global traffic	DNS traffic detected: DNS query: cdn.amplitude.com

Source: unknown

HTTP traffic detected: POST /gen204 HTTP/1.1Host: app.box.comConnection: keep-aliveContent-Length: 449sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"X-Box-Client-Version: 21.315.2X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonX-Request-Token: b7873701837fcebd237f6d33b0e58f165068513d46fc9d3f5389dead5edef401Request-Token: b7873701837fcebd237f6d33b0e58f165068513d46fc9d3f5389dead5edef401sec-ch-ua-platform: "Windows"Origin: https://app.box.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not Founddate: Thu, 03 Oct 2024 15:55:27 GMTcontent-type: text/html; charset=utf-8x-robots-tag: noindex, nofollowstrict-transport-security: max-age=31536000expires: Thu, 19 Nov 1981 08:52:00 GMTcache-control: no-store, no-cache, must-revalidatepragma: no-cacheset-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; path=/; domain=.app.box.com; secure; HttpOnlyset-cookie: z=mcp60j0tdv1v6t5ecsav9tq993; Path=/; Domain=.app.box.com; Secure; HttpOnly; SameSite=Noneset-cookie: box_visitor_id=66febe6f9ce810.68343862; expires=Fri, 03-Oct-2025 15:55:27 GMT; Max-Age=31536000; path=/; domain=.box.com; secure; SameSite=Noneset-cookie: bv=DEVECO-10562; expires=Thu, 10-Oct-2024 15:55:27 GMT; Max-Age=604800; path=/; domain=.app.box.com; secureset-cookie: cn=59; expires=Fri, 03-Oct-2025 15:55:27 GMT; Max-Age=31536000; path=/; domain=.app.box.com; secureset-cookie: site_preference=desktop; path=/; domain=.box.com; securevia: 1.1 googleAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: closeTransfer-Encoding: chunked

Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: http://blog.stevenlevithan.com/archives/parseuri
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_181.1.dr, chromecache_164.1.dr, chromecache_223.1.dr	String found in binary or memory: http://www.box.com)
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: https://github.com/derek-watson/jsUri
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: https://support.box.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49831 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/166@18/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,11519740772081467594,12038132482264796469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,11519740772081467594,12038132482264796469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
74.112.186.157	app.box.com	United States	33011	BOXNETUS	false
142.250.184.196	www.google.com	United States	15169	GOOGLEUS	false
18.245.86.101	unknown	United States	16509	AMAZON-02US	false
74.112.186.159	pendo-data-prod.box.com	United States	33011	BOXNETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
18.245.86.69	cdn.amplitude.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.16

Contacted Domains

Name	IP	Active
pendo-data-prod.box.com	74.112.186.159	true
cdn.amplitude.com	18.245.86.69	true
www.google.com	142.250.184.196	true
app.box.com	74.112.186.157	true
cdn01.boxcdn.net	unknown	unknown

Contacted URLs

Name	Malicious	Reputation
https://pendo-data-prod.box.com/data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377	false	unknown
https://app.box.com/app-api/split-proxy/api/mySegments/-1	false	unknown
https://app.box.com/app-api/split-proxy/api/mySegments/2	false	unknown
https://app.box.com/app-api/split-proxy/api/splitChanges?since=-1	false	unknown
https://app.box.com/gen204	false	unknown
https://app.box.com/index.php?rm=box_gen204_batch_record	false	unknown
https://app.box.com/app-api/enduserapp/current-user/features/secondary	false	unknown
https://pendo-data-prod.box.com/data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM	false	unknown
https://pendo-data-prod.box.com/data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod	false	unknown
https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc	false	unknown
https://app.box.com/app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862	false	unknown
https://cdn.amplitude.com/libs/amplitude-4.5.2-min.gz.js	false	unknown

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 14:55:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	0DBED9524E5C17A08B635917AB074F6C	D009BB27CBA6C787C30A8744F18D18C74702EA58	E067D2C523498FFD94F81E05339196A68A14F15625C1DB509470D325D2CA14B1
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 14:55:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	1C58736D374A3654B30D6089781E4542	7B77E778B2F935526A020D62599393CD548BAC06	B44CAA6D9E5FB5FE41F8CB9C8A2055432C9DF1785FC46BB2B12DE1761C30F639
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	157960A8F71EEA7190F33D99BDDA4C8A	EA4EE7E32DFB1A063E015E84AC6F0C7DC7C6EA99	4B7FD9DF6B5243AA714AE7EDAD6A30E9B61D4D8002A3A0E49EE5F3CD37F36E49
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 14:55:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	6F214110391640CB75AA23A5A0536F0E	9AB03A7CFFEF163793D5E2DCB696D94F622F9270	4B78E92E94BB072E303156A2B12A2CDB01C15261BFEAAADA281BEA4A888C27C0
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 14:55:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	E5A05CE3D01F04F3655F4C26FF20A644	D33B91BB1EE226EAFFCBAECA671CF26B067BC415	EB2A6B8D8447A40793549C5348573B799F924B54F10ACB9445B34B6AEC4D80DF
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 3 14:55:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide	AB43C1675FD426A8A0EDB28E116949F5	263854F41676CED70FFEB62348700C1FAC226612	E4C65899A8A768F5CB8CA82DF0BD162E6E67382DFFD007C876E1A52B63175B4B
Chrome Cache Entry: 131	ASCII text, with very long lines (425), with no line terminators	967E82D1F25CFC3ED141A655D7DD8816	B675140D32A06AAD7DE6FD0605DB72FBB1417E61	0EBD0BBDDB570652180D1F697668E4C7D046990FACFFBA28581FF7988B77A5F7
Chrome Cache Entry: 132	ASCII text, with very long lines (41381), with no line terminators	757FD5B50FBC460545401BE6A71397D0	08881B67FFD37AAFEDD2106AE332081AAC1E647C	49B2E32CF22257932D2E3BC23E96CC31994CAB39A1930FBB6990DA4B63960251
Chrome Cache Entry: 133	ASCII text, with very long lines (13383), with no line terminators	6B3BE74E3BC3E49C2F205227AE3A896A	2B5AC1E5797EE4793F39167E0725A390D909717C	9434406889EB02D84052FA5435B0DB2BB89F5810CBB465EBDF14407B17028BD3
Chrome Cache Entry: 134	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	B17B8C3B3D2EF285E825644080717A59	900301257290A919A89EEFCEE0A7321FEBE7764E	0CB9A48421820365CA54FB035DD124B469BD0AEA890D59B2FF82572A40529058
Chrome Cache Entry: 135	ASCII text, with very long lines (65536), with no line terminators	47A0DC74D34FA4054AF4021D24616368	FCB60E079AD347BC8DD2148BDEFC8F123434A9F0	4E9D75BCB8D7810F3C993E59FB73A4C678B8ED4BBF47CE0658D705AD91B78545
Chrome Cache Entry: 136	ASCII text, with very long lines (65536), with no line terminators	6C0A432FE751D59929950CA0FA1883D8	E721AFDF60B1C91D21CDEBC747F010E4BF70F234	ECFBD8023239212E21AE384481BA798DB2B6826BEC1CB6129AC56FCB7DD406C7
Chrome Cache Entry: 137	ASCII text, with very long lines (54210), with no line terminators	31B77E0097714B161263035F1234DDE9	CB9B47D10FED39CFFF6DF20B89EAA31FB28DAC67	BEE73E82FFE126031F2236199DB69A1587E5F86D4AF7CCE62F2837587842567C
Chrome Cache Entry: 138	ASCII text, with very long lines (12138)	8BB984A5B40E25D3FC05005C9CA31665	85B1DFC39A0E941BE0200EC2AD6FE9C6206074A9	851EB6B296BD6F2FE055D13C2C9C7C33A78A410E531FEEDE242E522DF6E6286E
Chrome Cache Entry: 139	Web Open Font Format (Version 2), TrueType, length 77780, version 1.0	75252D315E182371B7FE9E46195A6EE1	05A5DDAE0811259D65638413E2E130C50E6E4CCD	FDE0EC4535FC20B85C3BD2625828662EC59D1CC0806F2AA9628AA79D5A7F5786
Chrome Cache Entry: 140	ASCII text, with very long lines (65536), with no line terminators	B4ACE5DD5B65D31902A79DB3A6D15512	7DD0DBA558C539470B3823655B897E6A1C95F084	A392D7D2410F8D719ED62410FB26088EF50842A7728A8A9F8831E136690C523A
Chrome Cache Entry: 141	ASCII text, with very long lines (65536), with no line terminators	DFDE80F9DF6FBE0E5AB302BBBF8DC2F1	BF0F19C85E4E9E56E631D3A2B530FA1D814C5202	5831AC43253A031BE3856117E971FC6EEF16B41CBD0CC7614C622C97CC9D3FD7
Chrome Cache Entry: 142	ASCII text, with very long lines (14361), with no line terminators	53DE45E7EEF6D4ECC45C77EEEFB2A73C	ABA3AE3929B536C7C5918AF2FF52AFEFBB41109A	F3CF93D4F51277F248ADDF3085B2A0F1AE7B2492A92F213896EC785983295C0C
Chrome Cache Entry: 143	ASCII text, with very long lines (65453)	54741C7811D7956744D4E0AF5969514A	5D09B8A3C365BC869FA7D70C015D760472E881DE	EE85E3416A064E4E7DEDAA448A54E7D7FFCF2441E8C7A3B72C134643BF285B83
Chrome Cache Entry: 144	ASCII text, with very long lines (41381), with no line terminators	757FD5B50FBC460545401BE6A71397D0	08881B67FFD37AAFEDD2106AE332081AAC1E647C	49B2E32CF22257932D2E3BC23E96CC31994CAB39A1930FBB6990DA4B63960251
Chrome Cache Entry: 145	JSON data	387E0912114619851627A688F8133A1A	C188CF7D30C4D4B918C1F19EAC4BD19441B99992	00894697648C0FD8C1DAFA34BB740A2F5345600D6D85FACBE9E5107FDD75A39C
Chrome Cache Entry: 146	ASCII text, with very long lines (44561), with no line terminators	CA5397FB716FA28876CE3CE50177A7EB	5DDE0FA557423A4D7B3FF9E31AFE8F6C9852BF9A	594AF0FA4FCFEEFFCCFE4DE815075FB6488F8D9D7289BF07663C5A2546FE9A3E
Chrome Cache Entry: 147	ASCII text, with very long lines (28193), with no line terminators	6EAC0425BB466FCF61890A9FBD03C17A	C3A40D29301515F55495E38D76C3DADA715A02CB	3245A1E45C7684372BBB93D10C596489F2E56F78A221615B1883350134263474
Chrome Cache Entry: 148	ASCII text, with very long lines (8693), with no line terminators	B5DD5B7510065DF833E5604070A17D39	A9972C491E201FCAEC053A7FF398B7DA30B5BD3D	4BE2B409259E28A8A2878B99F4F25E86190BC8287F011CEB659BF570B4196122
Chrome Cache Entry: 149	ASCII text, with very long lines (65452)	0878CD3A98D734CB0F5644F44DD4DFD3	6FAF509B527C3F6D9CE6F89359501274A548DAD4	3AE7EA4F73C36D46A88C3788C6D8A33AE0C8820364C0B47A1DE37C8EE12A42FA
Chrome Cache Entry: 150	ASCII text, with very long lines (28193), with no line terminators	6EAC0425BB466FCF61890A9FBD03C17A	C3A40D29301515F55495E38D76C3DADA715A02CB	3245A1E45C7684372BBB93D10C596489F2E56F78A221615B1883350134263474
Chrome Cache Entry: 151	ASCII text, with very long lines (12390), with no line terminators	CE9B81289A3ACB7049835E4AD65FCF63	3990F27FD0A5F4AE2CEBF1EEA218B1EE8A0589EE	AC5815BFBFEC522D2572AF3DCBB6512C28DC9561BE34FF491548D96E8AB758DB
Chrome Cache Entry: 152	ASCII text, with very long lines (11193), with no line terminators	647C3BFC02356C532ECAD022550D9758	B95552D1B8DE77AA10B4531CC003BD630C5DFF6B	11EFECA1AD706074C835917D678299B222C5B5CB39F267315A243ABF291C1623
Chrome Cache Entry: 153	ASCII text, with very long lines (65536), with no line terminators	8A675F2A7406C6951B5282E38B4AAD8E	85730D20575CE0DBE226BD48B7E0AB618C056DE0	9B3A2295FB77554B6CDE75840F167170DF9D3E9347C897FA245729FFDCD11DD3
Chrome Cache Entry: 154	ASCII text, with very long lines (65444)	73E56517037B1077958AA99BEE3A066B	BC17FAF05A5F12F139ACBF3EDC16DF550653ACDC	0D8F22B97DC9513BFD3BD8AD6DD9219011FD04099B8479AE16087F22C7F9C532
Chrome Cache Entry: 155	ASCII text, with very long lines (65463)	EA3AF16A454921CCB83C4C9428BF1A19	562C3B0ACBDBB83731546512A6F13CA6CAFADFCB	2DECE9DE05EBA284B2BF361629CA9D367859B4591D4060EDCB76BC0D6A193D64
Chrome Cache Entry: 156	GIF image data, version 89a, 1 x 1	D89746888DA2D9510B64A9F031EAECD5	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
Chrome Cache Entry: 157	ASCII text, with very long lines (8881), with no line terminators	07CA412A30AE4AC23D411F766EE7BB84	55C7F4B93D7AF0C0F4D2EEF201D62BFA0E5F46E4	79957349CD8D1B59690D3C64A894F314703A1746BACFA400B5DCFAA91CB23F7F
Chrome Cache Entry: 158	ASCII text, with very long lines (425), with no line terminators	967E82D1F25CFC3ED141A655D7DD8816	B675140D32A06AAD7DE6FD0605DB72FBB1417E61	0EBD0BBDDB570652180D1F697668E4C7D046990FACFFBA28581FF7988B77A5F7
Chrome Cache Entry: 159	JSON data	1282D079215E4C614112DF6FC53EA926	4C7AA9F41DD8C198A81720B4F95FBEA2354F682C	D0BA0A2BDD509815497C0DF60D043B06E1F5022FD1EFDBFFB5E4F6CF5314B93A
Chrome Cache Entry: 160	ASCII text, with very long lines (23035)	16B23323023FE164FB93F70C04D251DA	2DA43C0B00EA3D8115BB7F9D79CFD09ED7815E2F	3CAE8EC3A0CF988043458273E97F8033D0E63B7A3FEA8565658745A80879484E
Chrome Cache Entry: 161	ASCII text, with very long lines (65536), with no line terminators	8A675F2A7406C6951B5282E38B4AAD8E	85730D20575CE0DBE226BD48B7E0AB618C056DE0	9B3A2295FB77554B6CDE75840F167170DF9D3E9347C897FA245729FFDCD11DD3
Chrome Cache Entry: 162	GIF image data, version 89a, 1 x 1	D89746888DA2D9510B64A9F031EAECD5	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
Chrome Cache Entry: 163	ASCII text, with very long lines (44621), with no line terminators	3ADC9B671DE94C36E5F5BCD26BDE3360	1059277C3B5B2B1851FD1B8CF83B7CE7803A409A	05018AC80464B1FB10C0625B4DE488A8329479EF15C8F57C5A99E8D969B0EFE9
Chrome Cache Entry: 164	ASCII text, with very long lines (64532)	A5BAFB61D9831B32B0379993617C2E47	BB8CFB923CBBD62B119796494AC8439699C68D01	FE9544F3995BDA59A7BBF24A29C7010F1B4E336EC8EEC0C40E7E723D6C6AF8C3
Chrome Cache Entry: 165	ASCII text, with very long lines (12196), with no line terminators	2C98B6AD31D4DCA70FB22CA5DD0CE681	53C3EA6FEF55A339AFFE9F7EA308C3EB54798A86	09BE07A077768AAA085422E92D26091BB0B527441FA564F1BA99F29215D349B1
Chrome Cache Entry: 166	Unicode text, UTF-8 text, with very long lines (38687), with no line terminators	42CE9FF02C696092ABF361C5A018183D	469C01047400F6049267919FC8D33AB84B6920BD	C991F26155E947BD9329EECCE475206D5C471394450770043B123BB24035EE39
Chrome Cache Entry: 167	GIF image data, version 89a, 1 x 1	D89746888DA2D9510B64A9F031EAECD5	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
Chrome Cache Entry: 168	ASCII text, with very long lines (24194)	91A48D32C53FCEAA1CD1E238E6321426	03EBA478CFFD0F4EDE949615B26259425BC9B101	B07256040E9B4AEDDC2C34A05B595F665AD03167DAB5009DCB7DE4E54822C867
Chrome Cache Entry: 169	ASCII text, with very long lines (65536), with no line terminators	6B48C6CDB6353F683E5501BE6112D81D	4967D8381E011569F7DE0E327B01E2384B37A737	39F6DD900ACD4667AF0D1889490A2BA4CEE03B4393B7C5B79BEE10D8CD9E2034
Chrome Cache Entry: 170	GIF image data, version 89a, 1 x 1	D89746888DA2D9510B64A9F031EAECD5	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
Chrome Cache Entry: 171	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	A74D15243280A569CD8F985119271509	AFA4B4F88A0A405F0513407098121FB264CFF660	5D1EBBD7B88D4B0F748CB8DDC964A1D159268F0831AF26F709D692A570168902
Chrome Cache Entry: 172	ASCII text, with very long lines (65452)	0878CD3A98D734CB0F5644F44DD4DFD3	6FAF509B527C3F6D9CE6F89359501274A548DAD4	3AE7EA4F73C36D46A88C3788C6D8A33AE0C8820364C0B47A1DE37C8EE12A42FA
Chrome Cache Entry: 173	ASCII text, with very long lines (24194)	91A48D32C53FCEAA1CD1E238E6321426	03EBA478CFFD0F4EDE949615B26259425BC9B101	B07256040E9B4AEDDC2C34A05B595F665AD03167DAB5009DCB7DE4E54822C867
Chrome Cache Entry: 174	ASCII text, with very long lines (24757), with no line terminators	1F2C167C543AA24007B20E2CA2233C5E	2EEB4DF16B0F09D8C2F0CE934B4D8813C155AE0B	4BA5A94ADC4CD0BF57E20B24F7D64CB89DE7B1EF74DB6E19FEFC925A88423758
Chrome Cache Entry: 175	gzip compressed data, last modified: Sat Nov 10 22:02:29 2018, from Unix, original size modulo 2^32 77542	5E816D32CB1CD1F7BDA71EAD48AC192E	7D2DCF30BD1553DF07C560D69CFF84A83AC0035E	589C84A912A7FC97F1196E5718212802E97A24AB908F56A251963930AA94FE72
Chrome Cache Entry: 176	ASCII text, with very long lines (18818), with no line terminators	3328C83B27CB4ECB6EFBB6C2C1AAC90A	47E04510A869C0BE2033FF863DCF4C00326AE71F	6DB74BEDD1F57C15C9C90E091373DC2DE65D5B5DDCE547CCD8CFA4CBA0171E4F
Chrome Cache Entry: 177	ASCII text, with very long lines (44621), with no line terminators	3ADC9B671DE94C36E5F5BCD26BDE3360	1059277C3B5B2B1851FD1B8CF83B7CE7803A409A	05018AC80464B1FB10C0625B4DE488A8329479EF15C8F57C5A99E8D969B0EFE9
Chrome Cache Entry: 178	ASCII text, with very long lines (21524), with no line terminators	C5995C96F044F4629FF6042EFB9399A3	6378A6E8EBE461A731BC16C9FF27F0E8180AEE95	1EA8D5756A54B581EA56C24E22AC0AC2940C8355B35995BE7E5FB7E549358242
Chrome Cache Entry: 179	ASCII text, with very long lines (65463)	2D69F4B1A6C52D8D86ED8B2FF735109D	A8D66E1C5B49ED9EBA57BA22FE0332D50A2B540A	C77F5BCFD5C71B4798DC8CAF26F118032E658FA51074A6336ADB30025E323698
Chrome Cache Entry: 180	ASCII text, with very long lines (10507), with no line terminators	0831CBFB1310EC7769CD3FC9523A65DD	3EAEFCA88E8D35B234F39C8584FB8C01257EA32F	9CBAF01C2D73C4FF7C7E50AD717AF713C2409E1C05AC7D485E2D01CA8CB401A9
Chrome Cache Entry: 181	Unicode text, UTF-8 text, with very long lines (43226)	DE9D066712973ABEA5AF53C1D18365DB	B470F1A7B95FD8FF4E6F91165E72CCE4D32945B5	B8873EEAA5556CD00B15598363E3158162F518EE000DCCA6C61ADBB559F04A89
Chrome Cache Entry: 182	ASCII text, with very long lines (65463)	EA3AF16A454921CCB83C4C9428BF1A19	562C3B0ACBDBB83731546512A6F13CA6CAFADFCB	2DECE9DE05EBA284B2BF361629CA9D367859B4591D4060EDCB76BC0D6A193D64
Chrome Cache Entry: 183	ASCII text, with very long lines (65536), with no line terminators	46266C19536BA855F97547D302B41C83	D5121C80E28EFA97FF3CCE74651C04B22CFA0913	D450019F3F84751A9959AC16045AF21FBADEB459EC8067051681C8F15A48F993
Chrome Cache Entry: 184	ASCII text, with very long lines (65536), with no line terminators	6B48C6CDB6353F683E5501BE6112D81D	4967D8381E011569F7DE0E327B01E2384B37A737	39F6DD900ACD4667AF0D1889490A2BA4CEE03B4393B7C5B79BEE10D8CD9E2034
Chrome Cache Entry: 185	JSON data	8C814C47925E9B2FF056DFA7D3690CC8	4183EC6DCFA17F9BAA7A00977D01B96AC302D801	2070E9EC5EA66461693A174CF782EFA1090E0CA1988968CC1115D019E7B80A95
Chrome Cache Entry: 186	JSON data	8C814C47925E9B2FF056DFA7D3690CC8	4183EC6DCFA17F9BAA7A00977D01B96AC302D801	2070E9EC5EA66461693A174CF782EFA1090E0CA1988968CC1115D019E7B80A95
Chrome Cache Entry: 187	ASCII text, with very long lines (65536), with no line terminators	6C0A432FE751D59929950CA0FA1883D8	E721AFDF60B1C91D21CDEBC747F010E4BF70F234	ECFBD8023239212E21AE384481BA798DB2B6826BEC1CB6129AC56FCB7DD406C7
Chrome Cache Entry: 188	ASCII text, with very long lines (65463)	4EC0D59948ABC95C18A809EC4F164347	0233FD6F4E847CF99A5725E89D430F91241D6D6F	23C8BB099D555FFC30450B87497B7BA65082A5E4313544A1AAA2781736A9C35F
Chrome Cache Entry: 189	ASCII text, with very long lines (65463)	4EC0D59948ABC95C18A809EC4F164347	0233FD6F4E847CF99A5725E89D430F91241D6D6F	23C8BB099D555FFC30450B87497B7BA65082A5E4313544A1AAA2781736A9C35F
Chrome Cache Entry: 190	Unicode text, UTF-8 text, with very long lines (65534), with no line terminators	185BB377F738A5BC7E36421C0647B55D	D01ABFC4528EB1566FC2F41BA777FDE256FB7793	8730E65F2834CBFF8A5B75BB874FEE8A93FBE63483EAB739601BDA0BA6479AC3
Chrome Cache Entry: 191	ASCII text, with very long lines (12390), with no line terminators	CE9B81289A3ACB7049835E4AD65FCF63	3990F27FD0A5F4AE2CEBF1EEA218B1EE8A0589EE	AC5815BFBFEC522D2572AF3DCBB6512C28DC9561BE34FF491548D96E8AB758DB
Chrome Cache Entry: 192	gzip compressed data, last modified: Sat Nov 10 22:02:29 2018, from Unix, original size modulo 2^32 77542	5E816D32CB1CD1F7BDA71EAD48AC192E	7D2DCF30BD1553DF07C560D69CFF84A83AC0035E	589C84A912A7FC97F1196E5718212802E97A24AB908F56A251963930AA94FE72
Chrome Cache Entry: 193	JSON data	8C814C47925E9B2FF056DFA7D3690CC8	4183EC6DCFA17F9BAA7A00977D01B96AC302D801	2070E9EC5EA66461693A174CF782EFA1090E0CA1988968CC1115D019E7B80A95
Chrome Cache Entry: 194	ASCII text, with very long lines (65453)	54741C7811D7956744D4E0AF5969514A	5D09B8A3C365BC869FA7D70C015D760472E881DE	EE85E3416A064E4E7DEDAA448A54E7D7FFCF2441E8C7A3B72C134643BF285B83
Chrome Cache Entry: 195	ASCII text, with very long lines (65536), with no line terminators	742A225A705BBE221DFC87702DFCED86	EB7D9F89E2807A3D68A0CA071BB2D51B00331010	67D4714C108EC6F5AA6C85054BC5DCDEC66076F12CD10C5F460FE6E19D0CF60C
Chrome Cache Entry: 196	Unicode text, UTF-8 text, with very long lines (16974), with no line terminators	251F23ABF8CB11BD348EA63C6EC6E284	1378350A82BE9BCEC4FB7612BBB5FE7FB9135BE2	69013425B57D6C49E79444AFB2FE1A8251BF6346CA0DD25F5595CEDF769853FD
Chrome Cache Entry: 197	ASCII text, with very long lines (24757), with no line terminators	1F2C167C543AA24007B20E2CA2233C5E	2EEB4DF16B0F09D8C2F0CE934B4D8813C155AE0B	4BA5A94ADC4CD0BF57E20B24F7D64CB89DE7B1EF74DB6E19FEFC925A88423758
Chrome Cache Entry: 198	ASCII text, with very long lines (12138)	8BB984A5B40E25D3FC05005C9CA31665	85B1DFC39A0E941BE0200EC2AD6FE9C6206074A9	851EB6B296BD6F2FE055D13C2C9C7C33A78A410E531FEEDE242E522DF6E6286E
Chrome Cache Entry: 199	JSON data	387E0912114619851627A688F8133A1A	C188CF7D30C4D4B918C1F19EAC4BD19441B99992	00894697648C0FD8C1DAFA34BB740A2F5345600D6D85FACBE9E5107FDD75A39C
Chrome Cache Entry: 200	ASCII text, with very long lines (10507), with no line terminators	0831CBFB1310EC7769CD3FC9523A65DD	3EAEFCA88E8D35B234F39C8584FB8C01257EA32F	9CBAF01C2D73C4FF7C7E50AD717AF713C2409E1C05AC7D485E2D01CA8CB401A9
Chrome Cache Entry: 201	ASCII text, with very long lines (65456)	49E47ABD8CAE3E1D2CB2C144DCF0937A	F4D2FA0B507A695DB6339A5A91F0ACDA39FF96BD	A2825FD5DC679CD508F35DE44ACEB997AFBFE1F5D2FB2D21EFEF56A5D5F91ED6
Chrome Cache Entry: 202	ASCII text, with very long lines (65536), with no line terminators	742A225A705BBE221DFC87702DFCED86	EB7D9F89E2807A3D68A0CA071BB2D51B00331010	67D4714C108EC6F5AA6C85054BC5DCDEC66076F12CD10C5F460FE6E19D0CF60C
Chrome Cache Entry: 203	ASCII text, with very long lines (11729), with no line terminators	82781653A40E440703C46415999BACA5	31DA4D5774CFE8F39A73D52614FDAB4A30C51B47	CEE137BF22E894CB9BE30CBEF25CDB3960F40045B0F902F11B9CA59FA503B78E
Chrome Cache Entry: 204	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced	B17B8C3B3D2EF285E825644080717A59	900301257290A919A89EEFCEE0A7321FEBE7764E	0CB9A48421820365CA54FB035DD124B469BD0AEA890D59B2FF82572A40529058
Chrome Cache Entry: 205	ASCII text, with very long lines (65444)	73E56517037B1077958AA99BEE3A066B	BC17FAF05A5F12F139ACBF3EDC16DF550653ACDC	0D8F22B97DC9513BFD3BD8AD6DD9219011FD04099B8479AE16087F22C7F9C532
Chrome Cache Entry: 206	ASCII text, with very long lines (64147), with no line terminators	2083B1DE0BB66A0A9478ACFE3DE405EF	7F6F30FC922A001E3C5BAE4F48F38E3134417F48	A9B9564D2BF5CDA498089E0DF91535DA4AD420FF1975333DA7982AC3157832C9
Chrome Cache Entry: 207	ASCII text, with very long lines (11729), with no line terminators	82781653A40E440703C46415999BACA5	31DA4D5774CFE8F39A73D52614FDAB4A30C51B47	CEE137BF22E894CB9BE30CBEF25CDB3960F40045B0F902F11B9CA59FA503B78E
Chrome Cache Entry: 208	ASCII text	8A6E9B5D7E991233FBCBB28F1FEBA7E1	9A8D48105863306E390232AC9D05E20810CE7F33	1CE0A7AB4A7204E698F731970D2A898AFFE60A2671126FD4A0D9CB753C15A7F9
Chrome Cache Entry: 209	ASCII text, with very long lines (65463)	2D69F4B1A6C52D8D86ED8B2FF735109D	A8D66E1C5B49ED9EBA57BA22FE0332D50A2B540A	C77F5BCFD5C71B4798DC8CAF26F118032E658FA51074A6336ADB30025E323698
Chrome Cache Entry: 210	ASCII text, with very long lines (23081), with no line terminators	EC7A4BCDE6E87BC69C494A479F1EE5CA	039BB0EAEF970E46E57A4955C102D1DE71B54425	19965A07C68E7B56BBCB0757EAC5AAF896AACEA2694D505B1359CA6B5B41286B
Chrome Cache Entry: 211	ASCII text, with very long lines (54210), with no line terminators	31B77E0097714B161263035F1234DDE9	CB9B47D10FED39CFFF6DF20B89EAA31FB28DAC67	BEE73E82FFE126031F2236199DB69A1587E5F86D4AF7CCE62F2837587842567C
Chrome Cache Entry: 212	ASCII text, with very long lines (10053), with no line terminators	BD701964CBA93F45059A1A28B10C2AD1	9432958E1DF5DE392784DC7A14B5FDB96DCDE563	E35729918E9A07075CA117AACF502C692DB47F3E9D89291750AE6E90C4242743
Chrome Cache Entry: 213	ASCII text, with very long lines (14361), with no line terminators	53DE45E7EEF6D4ECC45C77EEEFB2A73C	ABA3AE3929B536C7C5918AF2FF52AFEFBB41109A	F3CF93D4F51277F248ADDF3085B2A0F1AE7B2492A92F213896EC785983295C0C
Chrome Cache Entry: 214	Web Open Font Format (Version 2), TrueType, length 82120, version 1.0	6425CB90AA5434F38A19C48675F858A7	A3C5136D683CF588D738542BDF5FF4B70EEC0473	485A2C6073C0D11874F61F65568BA5CFEF42B48BD69D628E7468B21D42C31637
Chrome Cache Entry: 215	ASCII text, with very long lines (8693), with no line terminators	B5DD5B7510065DF833E5604070A17D39	A9972C491E201FCAEC053A7FF398B7DA30B5BD3D	4BE2B409259E28A8A2878B99F4F25E86190BC8287F011CEB659BF570B4196122
Chrome Cache Entry: 216	ASCII text, with very long lines (65536), with no line terminators	47A0DC74D34FA4054AF4021D24616368	FCB60E079AD347BC8DD2148BDEFC8F123434A9F0	4E9D75BCB8D7810F3C993E59FB73A4C678B8ED4BBF47CE0658D705AD91B78545
Chrome Cache Entry: 217	ASCII text, with very long lines (59989)	C94E6B7BECEF587CAF56B6B906F6FCBC	785744DDC5B1B377D6F7CD539ABFA95FA6B33DF6	F0E01254564E4223A85043857C551D61F7BAE8F4CE77B2A9E2B58A436391DB01
Chrome Cache Entry: 218	ASCII text, with very long lines (21524), with no line terminators	C5995C96F044F4629FF6042EFB9399A3	6378A6E8EBE461A731BC16C9FF27F0E8180AEE95	1EA8D5756A54B581EA56C24E22AC0AC2940C8355B35995BE7E5FB7E549358242
Chrome Cache Entry: 219	Web Open Font Format (Version 2), TrueType, length 84992, version 2.983	8B1868B7BCE455BF0DA2712EC5D1A6C8	576498905760A76534FEFC8A6A770B643E10AF01	0ABCEFA9EF9546CAD5811B5A32F096F8B9407E43DE385227A78182C32DC3451B
Chrome Cache Entry: 220	ASCII text, with very long lines (13383), with no line terminators	6B3BE74E3BC3E49C2F205227AE3A896A	2B5AC1E5797EE4793F39167E0725A390D909717C	9434406889EB02D84052FA5435B0DB2BB89F5810CBB465EBDF14407B17028BD3
Chrome Cache Entry: 221	ASCII text, with very long lines (23035)	16B23323023FE164FB93F70C04D251DA	2DA43C0B00EA3D8115BB7F9D79CFD09ED7815E2F	3CAE8EC3A0CF988043458273E97F8033D0E63B7A3FEA8565658745A80879484E
Chrome Cache Entry: 222	ASCII text, with very long lines (64147), with no line terminators	2083B1DE0BB66A0A9478ACFE3DE405EF	7F6F30FC922A001E3C5BAE4F48F38E3134417F48	A9B9564D2BF5CDA498089E0DF91535DA4AD420FF1975333DA7982AC3157832C9
Chrome Cache Entry: 223	Unicode text, UTF-8 text, with very long lines (43226)	DE9D066712973ABEA5AF53C1D18365DB	B470F1A7B95FD8FF4E6F91165E72CCE4D32945B5	B8873EEAA5556CD00B15598363E3158162F518EE000DCCA6C61ADBB559F04A89
Chrome Cache Entry: 224	Web Open Font Format (Version 2), TrueType, length 84396, version 2.983	8A54EA1AEB67D07C751BD5F03068317B	CFBEE4F2FD7F359A2A60648BB6797CAC1FD4DA3E	4230A20B841519BDBE4B0C154BAD414E017CF80B3918127D45C4F907EEA07280
Chrome Cache Entry: 225	ASCII text, with very long lines (65456)	49E47ABD8CAE3E1D2CB2C144DCF0937A	F4D2FA0B507A695DB6339A5A91F0ACDA39FF96BD	A2825FD5DC679CD508F35DE44ACEB997AFBFE1F5D2FB2D21EFEF56A5D5F91ED6
Chrome Cache Entry: 226	ASCII text, with very long lines (8881), with no line terminators	07CA412A30AE4AC23D411F766EE7BB84	55C7F4B93D7AF0C0F4D2EEF201D62BFA0E5F46E4	79957349CD8D1B59690D3C64A894F314703A1746BACFA400B5DCFAA91CB23F7F
Chrome Cache Entry: 227	ASCII text, with very long lines (11193), with no line terminators	647C3BFC02356C532ECAD022550D9758	B95552D1B8DE77AA10B4531CC003BD630C5DFF6B	11EFECA1AD706074C835917D678299B222C5B5CB39F267315A243ABF291C1623
Chrome Cache Entry: 228	ASCII text, with very long lines (12196), with no line terminators	2C98B6AD31D4DCA70FB22CA5DD0CE681	53C3EA6FEF55A339AFFE9F7EA308C3EB54798A86	09BE07A077768AAA085422E92D26091BB0B527441FA564F1BA99F29215D349B1
Chrome Cache Entry: 229	ASCII text, with very long lines (59989)	C94E6B7BECEF587CAF56B6B906F6FCBC	785744DDC5B1B377D6F7CD539ABFA95FA6B33DF6	F0E01254564E4223A85043857C551D61F7BAE8F4CE77B2A9E2B58A436391DB01
Chrome Cache Entry: 230	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel	A74D15243280A569CD8F985119271509	AFA4B4F88A0A405F0513407098121FB264CFF660	5D1EBBD7B88D4B0F748CB8DDC964A1D159268F0831AF26F709D692A570168902

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49831 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.28.90.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 4.245.163.56
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108

Source: global traffic	HTTP traffic detected: GET /s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/json, text/plain, /X-Box-Client-Version: 21.315.2X-Box-Client-Name: enduserappsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/enduserapp/current-user/features/secondary HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NFuduc3hyGCd1K&MD=Rnn879Vs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/splitChanges?since=-1 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377 HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://app.box.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?jzb=eJwFwIEIAAAAwDDQd3-N1QABFQC5&ct=1727970933378&v=2.238.2_prod HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/ptm.gif/123e0628-cb29-41d1-466c-c592c7ddcd06?v=2.238.2_prod&ct=1727970933376&jzb=eJy9UV1vmzAU_S9-pmBsZwl5W6upm1pp0z5eNk3IgWtKZ7BlGxYa5b_3uokQ0rTtqXm7nONz7uHcHwcSJgtkS9oa-tCqiSRk58xvD64MbYdMvmbrYk0LzvmKJ2RsfRuMK9saRQxfy6oyQx9OwFWOyOA0jg8hWL_NMmltujP7tDJd5jO3adSbJ9s0NDwUv7R4olbtRQD16EfYjxXKrTPWk-2BGF2Xy3X9oHXygi53ntD_xjqisXT4j1_l7sMsC6cPcisGeqfs99sJ2Kebm49ooJzs4IVsHj_3RlzD3aAsXL_bxIqmAJiR5_SYzBV2EOQ_6xMXre-8Ko5ocC_7ZpBNzAn91bcv-HLOoJdciRyWdc4V1X9U-HbmEKpliELKs5xmjDKBhiM435o-2qeMb1JWYqoaCQ9avTc-AFoGN8DrXKXgi6toI-Pmv19lddGrxDjnECueY9BXKIAJcfz5DPqkPoM HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /data/guide.json/123e0628-cb29-41d1-466c-c592c7ddcd06?id=7&jzb=eJxNjsFOwzAQRP_F5zZ23QiV3LiBxA3BtVqSjRtwvZa9jqKg_Hs3lQjc1jOeN_OjxiEPTOmlU42yaqegbakEvr_3BxFK8nJemGNutIYYq0-aqpauOut0cv3DHJ0zfHn89vVsYj_VjP1XHnEaW4mT7z7-KkLxfqeuyNABg2q2_vUU7isEV8ChNGLYv78JYPhd5v97Z_GWbe2avv-TxaJGSBj4afNEkro1aI76YLQ1thbgiCkPFFZ8ZY-nyp5jok6MjL5_pswoSE4Fl-UGkfBgAA&v=2.238.2_prod&ct=1727970933377 HTTP/1.1Host: pendo-data-prod.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: box_visitor_id=66febe6f9ce810.68343862; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862 HTTP/1.1Host: app.box.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0SplitSDKVersion: javascript-10.23.0Authorization: Bearer 3sd5ltupa3cq5t3ovm1r2kear6i4kvmeb42aUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: application/jsonsec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvcAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://app.box.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/2 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /app-api/split-proxy/api/mySegments/66febe6f9ce810.68343862 HTTP/1.1Host: app.box.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: z=mcp60j0tdv1v6t5ecsav9tq993; box_visitor_id=66febe6f9ce810.68343862; bv=DEVECO-10562; cn=59; site_preference=desktop
Source: global traffic	HTTP traffic detected: GET /libs/amplitude-4.5.2-min.gz.js HTTP/1.1Host: cdn.amplitude.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=2NFuduc3hyGCd1K&MD=Rnn879Vs HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com

Source: global traffic	DNS traffic detected: DNS query: app.box.com
Source: global traffic	DNS traffic detected: DNS query: cdn01.boxcdn.net
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: pendo-data-prod.box.com
Source: global traffic	DNS traffic detected: DNS query: cdn.amplitude.com

Source: unknown

Source: global traffic

Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: http://blog.stevenlevithan.com/archives/parseuri
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: chromecache_181.1.dr, chromecache_164.1.dr, chromecache_223.1.dr	String found in binary or memory: http://www.box.com)
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: https://github.com/derek-watson/jsUri
Source: chromecache_181.1.dr, chromecache_223.1.dr	String found in binary or memory: https://support.box.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823

Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.16:49713 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.245.163.56:443 -> 192.168.2.16:49831 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@17/166@18/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,11519740772081467594,12038132482264796469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1964,i,11519740772081467594,12038132482264796469,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Stores files to the Windows start menu directory

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

ID:	1525117
Product:	CloudBasic
Start time:	17:54:45
Start date:	03.10.2024
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS

Windows Analysis Report
https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance

Networking

System Summary

Boot Survival

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Windows Analysis Report
https://app.box.com/s/r8gf6zpgg0th9kl4z0pfx4tefjsvexvc